Malware Analysis Report

2024-10-16 03:28

Sample ID 240531-rx54xacb39
Target d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4
SHA256 d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4
Tags
avoslocker execution ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4

Threat Level: Known bad

The file d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4 was found to be: Known bad.

Malicious Activity Summary

avoslocker execution ransomware

Avoslocker Ransomware

Renames multiple (10403) files with added filename extension

Renames multiple (8682) files with added filename extension

Drops desktop.ini file(s)

Sets desktop wallpaper using registry

Drops file in Program Files directory

Unsigned PE

Command and Scripting Interpreter: PowerShell

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-31 14:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-31 14:35

Reported

2024-05-31 14:37

Platform

win7-20240508-en

Max time kernel

120s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe"

Signatures

Avoslocker Ransomware

ransomware avoslocker

Renames multiple (10403) files with added filename extension

ransomware

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1859274057.png" C:\Windows\SysWOW64\reg.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR31F.GIF C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider.png C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\meta-index C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Windows Media Player\en-US\WMPDMCCore.dll.mui C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\clock.html C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB5A.BDR C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Pago_Pago C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02793_.WMF C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01246_.GIF C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\RMNSQUE.ELM C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\CLICK.WAV C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GROOVE_COL.HXT C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115842.GIF C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Windows Mail\de-DE\WinMail.exe.mui C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD_F_COL.HXK C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107488.WMF C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Anchorage C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCOUPON.DPV C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Newsprint.dotx C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\gadget.xml C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\gadget.xml C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_rest.png C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\en-US\setup_wm.exe.mui C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099145.JPG C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099184.WMF C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_s.png C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\precomplete C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Australia\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR45B.GIF C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\TAB_ON.GIF C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143758.GIF C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00686_.WMF C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files\Windows NT\TableTextService\en-US\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\avtransport.xml C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert.css C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\ACWZTOOL.ACCDE C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\41.png C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssLogo.gif C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VeriSign_Class_3_Public_Primary_CA.cer C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\PREVIEW.GIF C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\library.js C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01179_.WMF C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200279.WMF C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Luis C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2100 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2100 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2100 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2100 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 856 wrote to memory of 848 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 856 wrote to memory of 848 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 856 wrote to memory of 848 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 856 wrote to memory of 848 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 856 wrote to memory of 3400 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\rundll32.exe
PID 856 wrote to memory of 3400 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\rundll32.exe
PID 856 wrote to memory of 3400 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\rundll32.exe
PID 856 wrote to memory of 3400 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\rundll32.exe
PID 856 wrote to memory of 3400 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\rundll32.exe
PID 856 wrote to memory of 3400 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\rundll32.exe
PID 856 wrote to memory of 3400 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe

"C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "$a = [System.IO.File]::ReadAllText(\"F:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\1859274057.png /f

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters 0 False

Network

N/A

Files

memory/2100-0-0x0000000000400000-0x00000000004E4000-memory.dmp

memory/2100-5-0x0000000000401000-0x000000000049D000-memory.dmp

memory/2100-8-0x0000000000400000-0x00000000004E4000-memory.dmp

memory/2100-9-0x0000000000400000-0x00000000004E4000-memory.dmp

memory/2100-7-0x00000000004F0000-0x00000000004F1000-memory.dmp

memory/2100-4-0x0000000000400000-0x00000000004E4000-memory.dmp

memory/2100-3-0x0000000000400000-0x00000000004E4000-memory.dmp

memory/2100-2-0x0000000000400000-0x00000000004E4000-memory.dmp

memory/2100-1-0x00000000003B0000-0x00000000003F3000-memory.dmp

memory/2100-6-0x0000000000400000-0x00000000004E4000-memory.dmp

F:\$RECYCLE.BIN\GET_YOUR_FILES_BACK.txt

MD5 dc0c59133c813e685e54ddf9bcb3601d
SHA1 d1d50426e562cc9a103a9f0bb63ae6faea6f410c
SHA256 a3f03323980be92cfc02204ecb15d4f282d5190949526dd4c7ff8a5ff0dd1223
SHA512 e457096e752303e5695e22bbc989143436f9939d945cff1fbe1d349ea91f2d78a8d46666dbd7ece1d01898b189342889265047515e0890914b81f3e7c823e7c4

memory/2100-13181-0x0000000000400000-0x00000000004E4000-memory.dmp

memory/2100-15742-0x00000000003B0000-0x00000000003F3000-memory.dmp

memory/2100-17774-0x0000000000401000-0x000000000049D000-memory.dmp

memory/2100-20255-0x0000000000400000-0x00000000004E4000-memory.dmp

memory/2100-22723-0x0000000000400000-0x00000000004E4000-memory.dmp

memory/2100-22722-0x0000000000400000-0x00000000004E4000-memory.dmp

memory/2100-24294-0x0000000000400000-0x00000000004E4000-memory.dmp

memory/2100-24295-0x00000000003B0000-0x00000000003F3000-memory.dmp

memory/2100-24296-0x0000000000401000-0x000000000049D000-memory.dmp

memory/856-24299-0x0000000074371000-0x0000000074372000-memory.dmp

memory/856-24300-0x0000000074370000-0x000000007491B000-memory.dmp

memory/856-24301-0x0000000074370000-0x000000007491B000-memory.dmp

memory/856-24302-0x0000000074370000-0x000000007491B000-memory.dmp

memory/856-24305-0x0000000074370000-0x000000007491B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-31 14:35

Reported

2024-05-31 14:37

Platform

win10v2004-20240508-en

Max time kernel

138s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe"

Signatures

Avoslocker Ransomware

ransomware avoslocker

Renames multiple (8682) files with added filename extension

ransomware

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1835271293.png" C:\Windows\SysWOW64\reg.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-si\ui-strings.js C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\RedAndBlackReport.dotx C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690Nmerical.XSL C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_checkbox_selected_18.svg C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pl-pl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag.png C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\glib.md C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\ui-strings.js C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\eu-es\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\SpreadsheetCompare_k_col.hxk C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\ui-strings.js C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\PSGet.Resource.psd1 C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-24_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymt.ttf C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\hijrah-config-umalqura.properties C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\el.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\es-es\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-96_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\ui-strings.js C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailSmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable.png C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\main-selector.css C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\hi.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Trust Protection Lists\Sigma\Cryptomining C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_share_18.svg C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\vscroll-thumb.png C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\PREVIEW.GIF C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nb-no\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\he-il\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\it-it\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\ui-strings.js C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ro-ro\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Trust Protection Lists\Sigma\Content C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ta.pak C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Fonts\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-24_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_xml.luac C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\System\ole db\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSUIGHUR.TTF C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe

"C:\Users\Admin\AppData\Local\Temp\d17ff05fe3ecccb7d80327f6907c260d336816ec7fb6d3ae54e58de86e2caee4.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3240,i,16488180140590516186,11762960689811837350,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:8

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "$a = [System.IO.File]::ReadAllText(\"C:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\1835271293.png /f

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters 0 False

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 160.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 104.208.16.94:443 nw-umwatson.events.data.microsoft.com tcp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 94.16.208.104.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/4516-0-0x0000000000400000-0x00000000004E4000-memory.dmp

memory/4516-7-0x0000000000650000-0x0000000000651000-memory.dmp

memory/4516-6-0x0000000000400000-0x00000000004E4000-memory.dmp

memory/4516-8-0x0000000000400000-0x00000000004E4000-memory.dmp

memory/4516-5-0x00000000004BE000-0x00000000004C6000-memory.dmp

memory/4516-9-0x0000000000400000-0x00000000004E4000-memory.dmp

memory/4516-4-0x0000000000770000-0x00000000007B3000-memory.dmp

memory/4516-3-0x0000000000400000-0x00000000004E4000-memory.dmp

memory/4516-2-0x0000000000400000-0x00000000004E4000-memory.dmp

memory/4516-1-0x0000000000400000-0x00000000004E4000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\es-419.pak.DATA

MD5 e29d0d3e9a6c07c24494b832144fe227
SHA1 030c028d3f8623ce2e21c777ace68e90725e3f34
SHA256 54dd5af67da3cc602c8e7ef069485d90aa99751918d358cb64e34ba419810a29
SHA512 160c549c37572fd2dd5b2776a88fa5bd8b29ac57f05a4ddc6d957a40a1420fe3acda993b39a2f502cb0ee71185487684e995d416f823a8f0daf8b80a4df19034

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\fr-CA.pak.DATA.avos2

MD5 011113cb72b1ca203716887318660232
SHA1 7e42875df44f100398319794779f88af154a1326
SHA256 6b472b60679ed7b70c9caa1ad10e0a5e298dbd4f54a203805991d20625d51a83
SHA512 8e604653da5675f0916074b0f837fd9164df83b10b685e851b621ef499c20908988c837e386c2ae77691cd50f1160a548df440900d922bb640b20436c43e1213

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Trust Protection Lists\Mu\LICENSE

MD5 c5dbd8805ffd25caffb3227f8289c90b
SHA1 a33dc8a9c912f4beb31d99dc42278a2510a2e60c
SHA256 4ef7d6226e3c2dad1e2b8e14a607ba652fcfb3ddf6a07101a9869ae1b947e92f
SHA512 dc6bdcb3a80c989b03c2c668aa2f4958b0ab4563a28abb3ebe63b72007aa239c931b48a3bb7753bc821da00fd9be8260478f22e64c7a8676c373c23f05d0ab85

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_proxy\internal.identity_helper.exe.manifest.avos2

MD5 55a358d61a6e89ef46152337ddaf1f89
SHA1 ea7ba0d283fc64188d699f5b12a9ea5379c1f414
SHA256 8dc8dda6c17b83f083b979793aba9a7c5db2581bcb97825d88d6242678cd7840
SHA512 a179170d65c9cc89a27e1d96a820f4209dd5a15bbc5fe0bc24c10874d3ff2f8f9fc304233330fdec2a84b6461c40c6b2a4b0bc6bcd725cd995715b87f3f73203

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_proxy\canary.identity_helper.exe.manifest.avos2

MD5 5eaeeebbee63741c2e980c46f96d95a1
SHA1 9f700cbe3f8d588dc8e14777aee6df2cf754fe40
SHA256 2608979ed841ee7c482dec54da7b4583fdae4ae63f0358873c056b2153850643
SHA512 68708bc6a8f52e29a0677d8131ba894d267e80be3a0739b8c806f0c2299f7c4690b496a3702d2ea6da099f41a733cb33095eed43af71423b6a8ee27c3a69a650

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\edge_feedback\camera_mf_trace.wprp.DATA.avos2

MD5 3dc8b78eafaa049dc61ca8e0bdfbb2ba
SHA1 f2d3be2bc0e2a4181fdb81a49deff8599a66ac8a
SHA256 c709ea7a099efa9e68c5a6f011a19acd17a9a7f7e7d38d857529d42d4b28a582
SHA512 e94090694d1c58626eb191dd45710e9ee46649d81c2622ae7deea6fcc8f8b33337c541f5164e63db7b412fc11166940ce0f6ad61525bd6d3958a704408045845

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Extensions\external_extensions.json.DATA.avos2

MD5 cd237350941c333ae93075a5d83cbd00
SHA1 20cf4e8db83e377b4753d3dc12c1a13c150f462f
SHA256 ee27e22fb40dd63171a268ac78b337e21eac2c6ebdbca3a051e76980959ccfd7
SHA512 402ca902be2b35ef97b39ba0d1f8abe7b49c6154c8d58c0f3eb89eb67d1742b7f85c420a236dbc10187dc90016036954c67eb5de1975fa13c74c231a5f5312f7

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Internal.msix.DATA.avos2

MD5 35a662a159bb017742c85fddf3ecab12
SHA1 73f4e359c93c7e16f0ddd7c83c361d3aff25803d
SHA256 9d1c4f0e063e474de9f0b76ace162e1a04c468ba043abea3a534b5f03c35d92e
SHA512 a32267950388e03f9ab8b7818a431966ad9f2460362bf3971a227832d6746e97f959fa8d59b240a1192e782d473cac93e5570df84ca39ad5698d777dcb1c6971

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\sr-Latn-RS.pak.DATA.avos2

MD5 fd815a0e42f9b246fe8c85cd97876d8a
SHA1 89faceb3c639f321092f0ab81f0134b0dc4fcfb4
SHA256 ca2e384e45872af5a6dbe9b0f260dad0dfc6f966235dfd8153668577a3dc37c0
SHA512 0aff478c5df82eb5e0ef591fe8dade3e1b91c6b4a1827da84c26e00952d0e984628e9c23a4a249d36386ba5aa3a9b814d1d362cb6b6a17226b22367f4656f7a8

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\te.pak.DATA.avos2

MD5 16f4c88ae2fbf073639065bda2ffb9c6
SHA1 82a49cf9407b0fa9f24f84d928f26a06bab1a4aa
SHA256 846e66c488fe6713b424dc51eb852960f4ab893d8b43a390ab67ec67a41997f4
SHA512 3df04433aaf74725bd764bb023455742f144f57c02f774926a26c8dfc0ca5ca3b620078b4fe142eab192c0f9064d6cbd599bb42ff10f4167b9390532e6ad2e8d

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\vi.pak.DATA.avos2

MD5 7df21f2b822e6ef1f2003c94e15174ea
SHA1 aeae9a8ea05e3a8493ef9052d796293a07eba408
SHA256 83e3df3549dc3edc06946df628cbcd2500722616384cd7f8c8aa7cb692d60c5f
SHA512 431db9db8b4ef1bd5549057e5da4bfe7c7d6c1a4c279a501f308e3840c979c154bb37c9e442499e92366d2338d8609d7ba4a63920f4884cb501e0314872f6bcd

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Trust Protection Lists\Sigma\LICENSE

MD5 7d3f850e27f0cc70c74dc3b8fbbe8c21
SHA1 5ea5f4e64327ef6d325035072043f0ab905a2057
SHA256 4f54845b2ac4d27fdd14d20f3ff1310bd6c369661cd25d2ca4e88c69236934ba
SHA512 34f6d1e083ad0aaa05b2bfeb52828f8dea0da67ef330ff471409a70b2ec5292068f98c6203d4d279d5a125f058b6fc5a2e4aa50aa703bc563e11d71370a42783

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Installer\msedge_7z.data.avos2

MD5 cf4e814e8aa78f61b9fe469afc7c585c
SHA1 2d9b29d0ceefb1a9a1b048f70a3a3a33b07d7904
SHA256 72c2ab99d89b57eaa68a3afba9989359756725ed48847c0409a3467e9a993ce5
SHA512 0511ad47fc02e70b4598c992819cb2c211e90bb259000a75fd1e7f04a8d039e24476c00bd590c60b11b3b854ee72ac3f06673a34b2e6f307af436f41694dc7d3

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_proxy\dev.identity_helper.exe.manifest.avos2

MD5 9d2fe192405dc602d45525972f68d220
SHA1 b94f31c6cf5977aed39315b9ed2466f276bcc89e
SHA256 2852b1f08d7f6ae8534aa96b0c373006074ddbc8f13d080172a617eb9654a0d1
SHA512 41eac5cae1d53b61c9307c0161eaa1975031be9761f4ad3adfdbf88966f01fbc49556806c6477c0428fd4ae9d717b948d7117886afefa02d1b33cc1d4f51530d

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_proxy\beta.identity_helper.exe.manifest.avos2

MD5 0dc1e0b0875d598ecdf5fbc4f70316f2
SHA1 c8383d77e12cc8734d5b5cc7512c1a1bad46ddb8
SHA256 f2894117ece5448ebd92ed6c04b88db450bcee4c16cfd877f8f60dcb2541311b
SHA512 8e7d55b1af76ab886b415e06c50a02fa3b6d48629d2b1c8e8f030f4c93e7f61dae5fd4565243948b26448fcf5d931b0e104ef38875a196ef75d71dd377352302

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\edge_feedback\mf_trace.wprp.DATA.avos2

MD5 aab772b6151ba16b314efdd1f1cf0910
SHA1 37093dcb38a1bbeeb59483d6836a1aa538eb40fb
SHA256 a02650910fd7765705f66b45fbcf3768a3d4c7711b60624544036828ff6a4524
SHA512 97cebb75443005b0592f6d697cb088d90c86f9a8817f88122030a2b018963969a2fe140203776ff7551b7e3a2766d2d98d6bda81759eaf64301f65aa6ad0d464

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\copilot_provider_msix\package_metadata.DATA.avos2

MD5 d2830b5aacf8094e751e45b8933d884e
SHA1 074e942cbd11370edf9579d4057a065bb38b709d
SHA256 15d9e50b63a476137b96168affb6e3bf366aac520a3c41ca96cfe3a40d1b0747
SHA512 b3305cb080d00ee4bc0e3fb7dfeb3823ca589a4e4acc1fc998879a6877d0b867730512f5de4a6beb62fee3a826b9e534083d970c9b67d18bf48388a2b122d3c2

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\copilot_provider_msix\copilot_provider_neutral.msix.DATA.avos2

MD5 8a9bba1a1ae1acc74148c1596bce37c6
SHA1 bfa7b7047133ae07b11179642636fa9488d0008c
SHA256 dca94740a75819b5ed4df91b9ab641319af58fdcb2bcb37b64a35119117dc86a
SHA512 689976fcdddd8aa8af0291deefd8107cf6b140847e50fd25b4b7cf46b0d18d0d0d7dc0bf908cdf22dbfb3505cd7ed0cfde71ebe8922c9b4e1e58b04f25d28406

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Stable.msix.DATA.avos2

MD5 d5debb50cd6761494a0fe9666d1c7162
SHA1 a58f578ba99b427e40c5a8d3b5da5846c43a5f4f
SHA256 003ab7c07615aaf93539cbc6fb558bf2fa3a50de4d8cef52ce52fc02a62ce26d
SHA512 5cb1a529b09afaa76a079fc2afbc15dca632aea1998f6f3450470f8afb94666c61e33c42917a9676a13ae9c46da02314e81ea4cfcb244ff5196d9d1ccb728b52

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Dev.msix.DATA.avos2

MD5 12d21089a5739d64440d946fceaaebb7
SHA1 d827ffac87d9f7ff429298e8e4cd7503d78c0ce2
SHA256 2f0c114fcba5774de7ef97a8d1a764d4aee20793ca0e4e066d53abcd1e9c9309
SHA512 26cca3aee26a83ec60f2f6526aee44be7ac29b38de5451a59004b5972c45151746f6429d2e993f3e9170d5907153ef5b07509968320cec8348299b0a6b31b678

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Canary.msix.DATA.avos2

MD5 12faca54de5820b99bb0d442da813bae
SHA1 f49492f995f74e7a9f808fbb36b96174dfc1dc86
SHA256 d54a8f0340bc47786e0b58fb64a0c116727a29d0dc6f1a7a2e248b57df03b52b
SHA512 32b040a54c9b919c010c491868eed6ca9214c499ed59ef18df437e1aa2d9f7ee36b8baad342a7f17f4c4e9f35d65fed950e37fe97cf4f45480d9c798659812e4

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Beta.msix.DATA.avos2

MD5 662a65490098916a3686bd78f17e7b75
SHA1 0ee668f766bd76123f95212117021ad787b2fe45
SHA256 a801865d68515121aaa0d235e5d438dc2db576399d696ef451e61deb5c656588
SHA512 b60ec206347bae2a78da6e5073677180c76387bf4e45e3f4d740c498296eb60e591a12d240b149fb84ba1027ca690349be79384ea15ec58c596163b09939aef3

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Stable.msix.DATA.avos2

MD5 95daf03c368981189db843bda02a6bb4
SHA1 c05a9d4150c385016dbaa615416a3bdfc74d836f
SHA256 e56f7b1d6f480f35f9f24eafbf1f1ac01e575b4e24c9f01b07396930e0ca660f
SHA512 eea19bbaf96ded4a2a49d8915379575c330ca0d820558d6710937bd4951d7f01aefaaf8ab2e00e511b4ebe3f03cd77c18ff028b036573f4aa1a30db156080332

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Internal.msix.DATA.avos2

MD5 fbfba22e4e0fdefc600473f86bb90f2e
SHA1 c846d33db8258050334c3bd183f5b5a1e0ae1cda
SHA256 d124da7a0beccbf58019b6f1d6caa08f585ff692559337a94fa03839a7cba239
SHA512 7695190f5cc4c3697ce588c11d95b964580bed3f586e48d5ff3ec5be05b98400786ac949f27f9ea762188285d03a13eb62265a6a40fe02d78ca7f5be97cf90d8

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Beta.msix.DATA.avos2

MD5 42d8be5e2695b6dacf19cd24c8ea56b1
SHA1 af3a18dc59b303ff8e965153eb674830c082ee44
SHA256 05bd6a6bbad499d1999d17a15b15d8f330db9377fb8b820958b2b3e2f68af421
SHA512 51d2f089f479a93507d435229ed91617efafe63bdf6b183e571bbb7cdb6e7c174e385173010a22fd4d7addd1507b333a52adc37f429ea08612fd47eb75a143f5

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Dev.msix.DATA.avos2

MD5 911a40febe9e936aee3ec77e864eccdf
SHA1 aea3f2f725e90adb42faf2f41d042ea4ec7793d4
SHA256 565725f9834b7eed8e72c75fc4f5b3f7991c584fcc07bb42110efab5b9ae5b9f
SHA512 e5b3c570a106bc03f046d0cb1d4e28e0f91b61915ef5384e435596883d1762a32ae963187644a30a836579d88755c2b090702d37ca3855d94024b2053d3c1e89

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Canary.msix.DATA.avos2

MD5 2657334c808536943060ddc22544c36f
SHA1 07241ede07a8d955e238107dc5a43d98fd05b9ce
SHA256 53137727db7294cbc81bc892ec6278c42161e9ea1430fd5e46b858c8c3995c55
SHA512 1c996d291fc4ddac3fbfa089a3b0e49e7ba985f8546da7649f460e5a6b867608b31431789ca35dccc4bcfc9c6b31a15443ed2f07887c2c6a27a7b429296d5c64

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\identity_proxy\resources.pri.DATA.avos2

MD5 ec5d6b1e7502604912e8ce3b0cfda798
SHA1 bdd6fc412c77cd86c73baf32518176dd88cfe4b2
SHA256 aa7bcea4865c24132b6d65a9bf08890111ed3eb153f8ee8dbd80d4eb06d0a810
SHA512 86055a2ea4e91fd6ab61d6b754727b06d891bf96ec96267c559706bd193e78c1e113e64a42d9fd1c0ab8ea240abb6d30718094ecddd5113b210236837c51fbf5

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\zh-CN.pak.DATA.avos2

MD5 8647464fe212da7154124b792f00cae7
SHA1 eb0e22606d2d6ffee82311a4ceaa27a3766885a8
SHA256 8fd29b95481265d6ad4192a9079a447b666f53e8aaaf0908877ebe8b7a154738
SHA512 e2ff9a4f608eac4f4dd7b9f25e5f7395bb1b754d061f41a0ff7c8f777b95e40ac74977fdb5460927c22951c4d5285da25073547805ab4c52aabd5f4a1bd8c142

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\zh-TW.pak.DATA.avos2

MD5 863f234f2b3ed9c4336958983eb35780
SHA1 20f2c659cd46b054f8df8923d77c1d0385e3fcd3
SHA256 d30feea09cc5ad8cf6d553271e95290ffade3e856c1cbd6c86ad03f83e1fe131
SHA512 0309b162b6e8e40258989fd3a4d29dcf4dc04b8d3c2c32de919b05a577d6ac6af6cdc0a8333c42d0cbde35ea50537650ca8120851ca710a5767b2bc8e244b3e8

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\ur.pak.DATA.avos2

MD5 08e7b41b583ea8ee2dca6f1f396d2e47
SHA1 6f38cd7f7b72d30f75eb4b1b1b09bca341f56288
SHA256 cdb633f386857f1df7aa562d719233f0fbe7d9f201f6c746d425062485299ac4
SHA512 ac088467de54ab26eac3c443bbd68034873f9ce4e64b9c80e360ea4f90f20e61193d73379c6954aad30ca23d450d207f1f1086424796eca2253eb5f38f4e6d2b

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\uk.pak.DATA.avos2

MD5 f6f486e11cd28c57467ea0328b766ceb
SHA1 dcad255466c2947cbc61e19bb1accf6bf515705d
SHA256 1e661420a0cf37dcc87df079d65d6c9734619fda06a04116269fbbb55456c0ec
SHA512 585b6363874432da9596ecee54142d91b9dec7f7205db1e280f82662c98166924a3418a1ee4890733067947d2e13a83215cbb98e33eaa6cc46fd68e6534fa220

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\th.pak.DATA.avos2

MD5 adb96ee7df308c4b838837f85695203e
SHA1 36f51aa15f59d6087152252fd8d690218bfbd652
SHA256 429cf11268541ceefed28d2952a5ca738fe572278f4c535b82818912e4e3a451
SHA512 f1f725665ca8c958387e7bab5998bcf8f813d6b2b2aa8b3b96357bedf9251bd929749cc964b2f4a430e43e581713fe6526e6137cc24430c04cba75e697adc5ba

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\ug.pak.DATA.avos2

MD5 7ea776566867a8bd2a9d45461fdfcbdf
SHA1 39630da7938978f090683cb10a029c72a51d6802
SHA256 36608b71c40f1479811c965d1727fe1b046371e9029d5ade4a7bf38779eba7da
SHA512 995b9bbe0476f9e1b74c865103aa164335c266d95a2d62378b20fed3606fb3fd8ac3fb566e9954f0693043b6de55b7337d09131d85522e8b0261beec6b1e7e46

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\tt.pak.DATA.avos2

MD5 c93c3ae619dc3541c46da6bedfb8e3c7
SHA1 385a1b724a2be38b063069116d4bd53654c4a354
SHA256 97ac3db3a76f43e05315220d6d3d06be25ade4fa034c48fb8fa517d09c781a99
SHA512 a5f3869b6de27d935e3f85095393ceba0f0b20f5d17683ed7a29774fa383542f1138327e95865e5fb91954e459414141e0318436ea33b66a768c739e8750494a

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\tr.pak.DATA.avos2

MD5 cf583af3159ac347856b712bcf1a5cec
SHA1 759777a45736c99d9e96becfc564614d943ff5fb
SHA256 b1034e4d55ac6a4ccfc8f328c1e5e6ead8f2cf13ba6a548b3bfdfb4a9176f383
SHA512 2ffd0ca68f9047c88615454e26af97fb0f470835e3ed265594250ff2a38c4bd0962079f85c4662b72f6b42d64bc070f41f2525ae357ae638e4dca4e994c0a49f

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\sv.pak.DATA.avos2

MD5 40e96501d0fb21c0a29082702e75769d
SHA1 5ef19432b0a256fdee2267ed4f553272f0135722
SHA256 4c25c81fb6462e50bf48d533376e2e4f9319576ed07eaf47d4de4be7b852e176
SHA512 ca6421b59e136c20a56c0b68048b1fca922323befa0f949df5429b5ff82fab4a3f94ba5a2b5453da634e00ee498644bd153c5f260076c7e3b7ed2704e765dcab

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\ta.pak.DATA.avos2

MD5 69edd4b81d0327d19c6c69d777a98c39
SHA1 5b2b77f97fc2148293870688e175781575c530eb
SHA256 6d715be565f59d392e939535a540d8447b4d7f5db6d349eede97f2c243097a21
SHA512 265a98c1c8a7b71d3167595f620ebf71755f7eaeb2dcc50970666fc5d45cd8db9c4c600a8bf4497b2b7b6f4fe4ecd88231de9fd30d06cb4b4d84ea75ec17db49

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\sr.pak.DATA.avos2

MD5 59f6d72854a7679376b835e974b96a52
SHA1 f2bf6d242a037f94f343941747e80cfbebbb9dd9
SHA256 9467324786287175bb3cee31097c5abc4878f873473e5e3517d46c00e89318ed
SHA512 cbf76dd5d4a9f73779efd1005655380ffd0be28c51f60c36afe074e595c8784d2c669c1a50272533bb04561d63631b68685094d8662791bb66f4cfa683e25caa

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\sr-Cyrl-BA.pak.DATA.avos2

MD5 240a47c411b2f9b4351c5ad5d3f14dad
SHA1 893045eb0c3dcb51c9c92f0eaefc2b2747457b08
SHA256 6c37fb88b28b37a72b51010f992f2a8844a7a6c51055197aef7610d4dfc6d667
SHA512 7f67ea862ba6c6e52e1268b4a089ab4fca58f3f664a885678078c15b90a2fcb3f0b63964f8e560fd3423f4d8f123ed3b6f6fcd376f8ed8de2e141cca74d3ca20

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\sq.pak.DATA.avos2

MD5 f3d314405e49a151f1761b4001e256cf
SHA1 1bd9fba6885e656c2f35fa5ddd8eccc4feb3e779
SHA256 dccbd67410e3fdc1571d8feb931ddc727aab24d10a8971239b16f30c08c7504c
SHA512 0bef5082f6ad1dee4a32b6ec53a843842de51ce64eab6ae36fba99ed8c274aeb72d212861c566e8ea92dd111f0886e19c25d9a667ff8cf54ec735e86ad7af022

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\sl.pak.DATA.avos2

MD5 74fe7749e69726467ca594c6ed655d89
SHA1 ec566f7e4037c2a54b59336a0140d4b9c7d156ad
SHA256 8a272a89070dc8e0abb3ebfe91eb998c327f2730b8fc46e73c177f990fc65e01
SHA512 2daeabe75db74fa28b92bd6ad56783f7f8dd67586420a93b03b2aba46905256211eac5b9922ce570c74689144c6705146683e9a616d5e67d8a7c1dbf1ddb47fc

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\sk.pak.DATA.avos2

MD5 d4ace570130c8503b3527a6b90eed152
SHA1 85d05e12e980bab5ded6f607924dd556de97cedf
SHA256 8e094435b462626d9ebaf1ecd18f3c9a5a02a4946cf5f8830a436d8894ab3775
SHA512 20cf2a1c602f9f905b52283148a15e2ba05ed67be06d6eb121c4681ca46d181d737c182eade70a47391e7084a011f533ffb6846332d3d6dfdc5a8069d0752df5

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\ru.pak.DATA.avos2

MD5 ee46847929d8c0a657e2394473cc48ca
SHA1 02b2db0a38ed8c238256eba035f301185f8b9504
SHA256 b91efa2df57832090ec3928308c336666aedcd6a8823c75d043056f6ed78afa1
SHA512 abba2036c81301d2df878751e2ad9344bd15c7b85d5062600f95f70855a68d81a9c0e5c087f87377afa9b41a87836a1dd2cfae9a6dd0873ce28657db3a6f69b5

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\ro.pak.DATA.avos2

MD5 435ce3e0e8883a5eb7c1b8809023755b
SHA1 f1fba1c560b8b6d571f589093df9221053ed71b3
SHA256 0c3529baa2ea6f5330336e88a61aaffb668e2904524e515a01eab52a124009eb
SHA512 4c5dc3afd9ce0c26dea4440a966bec2b087d81cd42a03f872f7aa80da6618427a319badc327df0f5ae255ba3bf8bb0f7be37eb0e009c4770066effb468091228

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\qu.pak.DATA.avos2

MD5 12acbff4a04ca6765ef72aad6633a302
SHA1 fc9a95b9c41833c61be6f594138bfad3d3bb0893
SHA256 32349dddf0ca8d19a2168619342d9b99392b5e86d16e9aff5b09a9172e5cd9cb
SHA512 962f81f8c3bcce4d1219177f0973d314f419be6151d4877b30f9ac93d68c3e5ca16c75629652aef2fe5db953e58532b3c4c5e374ccad9611b2135c1d2d3862f8

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\pt-BR.pak.DATA.avos2

MD5 ff54948a32f034fe35a42a913e1862a2
SHA1 1e4bf24ab01af1986cb3b307cc5c6839865caecf
SHA256 c7374b074319e6a8674367fe683516030d2b25fff123f636425f9dc0c2f02c44
SHA512 eccb23c1aacba08e05e739a71b329360f7970fc8acb2f679a81ac093737d99dab22198797ee70dc950d0ca305b91d0788f49f8f59cddae2ee648dfc5c4f75ddd

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\pt-PT.pak.DATA.avos2

MD5 db39cd2cd9fedb8955458ecfa71686b0
SHA1 bbc3e732da0738ff42c0c38a95f0f177d858b511
SHA256 3bc57855215b01fecd26221129e8eca36e4afb39800c00f3513ad6da23887a2e
SHA512 c871a614d591ec3a1add13db3a320f7d5a742c6840446ba8ac440f3db6d8d22fdc9406c41df8aa1766f343c6662c94b867b3e78260cc5a61445a423ffdfe9202

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\pl.pak.DATA.avos2

MD5 1168c2a49e171b742d1bdb3a6cd0e7f6
SHA1 46221875ae3981bdf46d023c56fb9ac1313381c6
SHA256 41c4628063070bc8cc06af40699efdf7cb5d0d90f05e8cec96630d6f65999724
SHA512 e1e22218ece2f39a05a742357e2adbc8bad0bdd648a70031909070d63fbddbd92107944d9aa6db4ce5cf0daa3b261291a1fc76547e796e6bc8536fee1c107fc8

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\pa.pak.DATA.avos2

MD5 74aa1acf99dffce18eb01e1500edee6a
SHA1 6dd68aebc0907f60c4656fa2cc001d231fe99423
SHA256 003b2743961c80c59b86c7cf5b3ca37cbf694369d5f76b94e37681c902a2ecfb
SHA512 9a46b08fbb3196f7915b2008e68fadd2146c8afaa5c7b56fd106ffe0ee24e74da83a8e896ff04a76649bdd67ce90a23b628e607bb7ed3ed1f670008690797c4a

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\or.pak.DATA.avos2

MD5 19d9f849c87147cf9701b3180fb83438
SHA1 9581cc47b573da6d75e17b7f3fbbfed0b6770c51
SHA256 2b8d1c0f124989935c0b6e20901ae0c8413d03e302c2dd4ce462265638c510cc
SHA512 7ab8f6b4cbf4e8808dd4f4bd9c1c3ec425205883cd2dcb59161a607974c1164889c5b8aa9d3aceb1f988ba51abe9e7400afd282a0058b58d453b00e9240a8aa1

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\nb.pak.DATA.avos2

MD5 728ddd4b4c76533d87e61b092b995200
SHA1 f9e7c020db591b1fbea4935ace8d016c29eb1ccf
SHA256 e9761dfc58542d101af8d7a426d532632b24d58b0f033ca12355d6176ec3294c
SHA512 0e8183f37d52827eb5bb49c3f68d5d959a7690836623c3e21606c079758990aff891e2db034b7cc743fb391093e71cddfc43bb339bff0fba02bea8d3ff372611

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\nn.pak.DATA.avos2

MD5 17927092e006f467caea3c96ae385ec4
SHA1 6885f0f31c913c559283c5adb3263afeb9334721
SHA256 88aafc984299a699b8b332c9ea68355762a1757d4baa1a5545acc1a4beb551f4
SHA512 3e4d8ff0bceaef8bfb0c7c64a8d9a5a4fac715596aee23a6551bc224f8a4f898db781cbc69b7c268dd76b4160065f976c09f87063f3ed59b3f82a3c55603b872

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\nl.pak.DATA.avos2

MD5 990ebe9dd3107062d879a266feaa7d2c
SHA1 9cfd122912e6dc39a2b49876f47534d540d02db3
SHA256 b498c8937e3f373ed84f7303e0e27da82c44b61618c8ff4ae2170cd33bf6baf4
SHA512 b7c667cbff6c9ebd0f9675b19a76ff7f773446b3fda215abfdada7bd2f3969812dbc03ed5383b125490142b8763cba7efd9475a4b313e1e70fb1d4987d1da530

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\ne.pak.DATA.avos2

MD5 b47192c7c4b50aa5c14b59f3370000ef
SHA1 b033c781a95aa19015944c0d201f6b9b74a46ded
SHA256 9700685f947783f863666cdd96421c6f4fbcd80e581090e45f575e5959c147f2
SHA512 8619745545bad831d5a005fadf9680c7d2819be6219a732e004a6932ac65cce85a617a777e02325b4fdfb07782c8d40e7dac58dd46703f858229633cd832097c

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\mt.pak.DATA.avos2

MD5 f061c704d669097ad09fd1c5697c085e
SHA1 8c94ed806436c28495fc4bb3775ad7fef030f233
SHA256 3d2db9dfe831b7f5b5cf2322471cf64e600d300b1b0d9032c27e925aa6338380
SHA512 346528368ef97929709d68f1923249648be12c232af2687a276dd2f09eead385490e08da8478121160f3f26d10f23d4fb3c628fed012ef6c1726ed420b2b1709

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\ms.pak.DATA.avos2

MD5 515256fa31f58b33b4adbf37e958de6d
SHA1 acbad2e8d37a9f9e049fbe7b2225a3bb835c4fdd
SHA256 a935cd8a7943fae959a70137d191690335320a6741d3a8096dc4875d6675ecb1
SHA512 43e8e02197579673cca6c7005e4c27dad537d8df22ab9c49650de3e6cbe8d89ab71cb1ff5606d8a1768b58a1324a5e83aefe2cc5aec2dadf772947dbc1946842

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\mr.pak.DATA.avos2

MD5 3c8c07857ea228e2fa0c594784096c8f
SHA1 ac09010423eec1c522ae9d2b39c86a9eff6fd34b
SHA256 8447e05ff2ec46864991a981c3bc4dae37a84a98fd13318b2ad6730f92f1cd3b
SHA512 3685e53418da23ce972ef35044f77a1481ba870c3d06d973d8d4c1e067e33415d1801417ced8d2917cb247cdacb1a3db45d22707b8ac21a780ff57fbb36c2886

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\ml.pak.DATA.avos2

MD5 b5f7db64e12786cf120270797952d329
SHA1 c689644a3df29db087b381fa254de01eeee85580
SHA256 710646cb2f5b8bfb69b197a3af1167c35f53e94a74d8231253459ec36fdfdfd9
SHA512 4f05df79a5e073b13edfe4a3eb52f0104cd1c61bd76c61be61dec0b410167f64fe3cfa45c1aedbb2772a8903252feb9fc21d51f37f9623d8d71fde1bfa7ab909

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\mk.pak.DATA.avos2

MD5 d331adc24df2a9687eac258f1969acae
SHA1 ed9dda7c456c5f5603dbbe38864ab2bf8311bf3f
SHA256 5ad997fc450030e625d7cf9e2152e5df9282c4edebf13c1cdc48ede4e5b9c067
SHA512 ad9394cbf17c67dd825355227fb439d5f2306b18e2a750daf314d71519091a7423a8371f27f3100fe0b7d011a19f3f78ac4630595d8e20953dbd9cf1a783452a

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\lv.pak.DATA.avos2

MD5 601b28b8ffc75f2928e6ca1e7fa16094
SHA1 41aaa9af03bc21df8f6dabd9d46a7675e73dea74
SHA256 520a9a565a362fb1adce22fb440115e2d4b9fd881a99e8a56b1a94637b80e22a
SHA512 b87939417d684e4a639bf67005202cdc2c65fa6a41b38c9e75c604f02bc9434e5c6f1b24e3e146884f8af5ba43b7ac73d45287dc0e362bfcec4b368f2a8118c8

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\mi.pak.DATA.avos2

MD5 d203ab99f78889100937fe072a335307
SHA1 df81daf024eafe0a0d8b63402b5b09d66a6588d1
SHA256 182aa6db5dde11ecae2f82a204828c2ccd5cb779af2506436a8342f087e84687
SHA512 d51dc4a991d33c44704418461b814666785f057f64f4e6ca4840e4dcbb40043a967ba86d2c1284a9e9586f1d9afcc732b429f9e4e36497e370763bbf98d476a4

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\lt.pak.DATA.avos2

MD5 0818e681a558c4eca2a75806ed23b83f
SHA1 1a51b91f7baa81ea60ac5a32b0467151edc006d8
SHA256 bda5b017d7abda75fe11fa6d9a1e5f233d29e19800c317ad725d7c7a95417e72
SHA512 890cebb78e5708c9a86446d66cb61e0f3cf103400b4bd4896c7ef068a3425a81459ee1f8f3fc867f3be75861c753f407e639a91c91737158ed0c35ba39a3c0e4

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\lo.pak.DATA.avos2

MD5 012cb88d034e5e604b37af1501b9eae1
SHA1 92cdce0929f0a9445daa2b5ed03366bfa169f872
SHA256 7e91db6d0707b848f068cb908a42887d1ffed3cc5a73d379554ea724b005c00f
SHA512 1de18b30cc5491c364ee61b58b392ba45409521defbae867917b76a145ad7503a0e50fd0e2646519b078dd7529d43ea0d390805be54426eaee6dde9c4fda3e1f

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\lb.pak.DATA.avos2

MD5 8c162db800b3d505c84ea88b4bdad9d1
SHA1 8f2ca1a0dc8f2746fafde298163c26db1ab3d3df
SHA256 4b0def7bdced4c4ab0f59455d7b0516b64a77eb84ac491cab89f01cd96819ad1
SHA512 7f12ea5596d04494ab037048d29ab4c5c23c01e59d57dfff040d63284e7efe85ffdd33d9e3fb547551d1f22df1f66eb569560ac2fdcc643308bc11a2eb5d2086

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\ko.pak.DATA.avos2

MD5 c03c8e67a8526b4ad115632f01378c20
SHA1 93071a4f2cd74058a5e1fc49ff00b88f0a3119a1
SHA256 65519ab2bdde873d076813a2d9e8817a015a68392a479c28535ca8ac2dc935a7
SHA512 b52122cf8a4d5a317b02eb0f77e0d769b8901fafb9ea9bfbb27d4042fca8dffbde408a3f523b7cc323fa7dec5856c4aed0c3436b6054e791548b1ba29bd35e1f

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\kok.pak.DATA.avos2

MD5 c809d8c8905d481fb5f5a48bbd7feeb2
SHA1 a3ba2bb5b1c8a0446de0733e521621c5b8188801
SHA256 ea589e24fc4d6252e6cbcbe3027fd708f4007e9223a98dfaf5a461897985bc98
SHA512 388e79676565ef59896f2e91fc0601534a8e0738a07485d643f7f4852a9cde1f5443efa9a67e937266b4ad8e52df80c0b07cb93ebb37edb0c342195b5a067d28

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\kn.pak.DATA.avos2

MD5 e1304a440dbd8126fcff46c9ef615a15
SHA1 c3e27cc59e976dc63cbe2575e9dc927522a69824
SHA256 fad710b452165f14da36b75193d7e553f36ec7324560f27d18f4fa1451839265
SHA512 9c6bc8cb957c98cf1d44febe96d5d3a36082e159660d67cf6dc0dcf319053c0d0ae4cc843531c966bf68e5468f9166990dbd979502d02ad68171cb4369e64291

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\km.pak.DATA.avos2

MD5 81dc94664af1c87112bff8fdfc8e8b15
SHA1 fc560e31d7d4511f665afc1c14656a8858ac9135
SHA256 a712c521bcc6316384bf128ef5f13c512c5c2b753aa336a2b8bbbde2a473c1bc
SHA512 05fc409d1d22e095ca7f78afbd178f53c27ff5610eaac150f5e2892d7e4ed4af33f395c556b241cfee74989f539cc36117cc92a0d113052a360393e2ec45b0ac

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\is.pak.DATA.avos2

MD5 5fb0a754dc8a56648edc76cfae743e59
SHA1 4f10d300ca44660733e2d9f4c0dc849a48128fe7
SHA256 c98c5fcd91b5b65e700dfdf9cd0ff6397350ff1794c9a493bc03913ab2440950
SHA512 085a02f71c4de2d53468d4c7412c0c5459d4f9a9a0a139956301302182e9f6ef31782c55d26918c2d23fcc64b22574cbac5c1b2df058d98e27955528e6bec966

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\kk.pak.DATA.avos2

MD5 037784618dba456d859b6ee622facabd
SHA1 c3438b514a83737f9fe955867b07b14df35e89b9
SHA256 7dceb1ff656690c8f56fdf8468689f70431cfb0f2dd5f0141d506e4eaa8485bd
SHA512 498c15d1bb7ca104efa663e84d81e18efb73cf95858bc6186c1a650ea86fd106f0173b9e621a3c5a515dcf7e03f1c92eb8a6cf1543722ff00a7f3f4e4957005c

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\ka.pak.DATA.avos2

MD5 21fb6a764c1845b8890fe828e12911f7
SHA1 57465b231fc5fe0e5cc68c6e608cc198778bf301
SHA256 6a846073f5a68ca154554bd935d8b9208575010bff49855a2abefcdab7acb977
SHA512 fc03dadb9985ec09399d1ed94a7c6186c5b357c5ea495a2dd838f8e2fb3704b98073bd2fa0bb8caab63ec78c71aa249a0f3e443f8c510b5b546949f9697a349f

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\ja.pak.DATA.avos2

MD5 4f02c7dea47fa45fffc275f28cef9518
SHA1 811fcf1ac26adc15d0cca4f3acbc69ca0323a173
SHA256 75fb4102713f251ef1d1116c4ea9ccf4252e5fb0d497ced85123d488a2a3678e
SHA512 cac744f01bfc37daad8ef9c6edf1c21f0635eac202d0362e06d0ad37b5f8058da43e77bfbed3d2087131eabb48f6ef8b3825cf7c3ff1c9a0d01a2b52ed3ddd32

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\it.pak.DATA.avos2

MD5 8d42c32741d39e919e5741750c13e815
SHA1 4c0d80a68cac70a38c5a5a86c9106dd5580a0916
SHA256 a8cf639ca3df6981eb75d9a7a846f1e35a86a0d5cbca5c7bac81abed58d9a897
SHA512 f52b737f96a657925826f214c2aae6373ccf58612deacfd7cbf7d9662b1a06b8bf756425b03bfbaeb6020439a98d663867746ce40f2bb870116840e815bbc429

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\id.pak.DATA.avos2

MD5 523b6403fac77e0917cb0d6bb20376a9
SHA1 82c952aaa6006f39f8bf24dd42231de4bb49aec8
SHA256 adee0eda12b37becc722f2777ac68cfa03464c968de6647126bbc9c9215e8955
SHA512 a002175a2a4fb2eddf40c926402e01b0def43b7f10f9dfad71927c437a7451a7aac3797641741a16a36ad49457d534fbd607074bbb53f72bbb0a896c44703505

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\hu.pak.DATA.avos2

MD5 2f844976c9cc22e14379e17ec6b9197e
SHA1 035b874bf932346abc40760367ff6f1d2b4dda33
SHA256 3e59745f8dcdbc0891ff8faa557681000a8c33bc0e2ec541cdb9270f5ec0a92c
SHA512 a633083350c025279b0c4c201d239665ad7625b4df8a686b79b390cd6b8ec977f9c5e3a03abc0c71bef73f1650e7be7781bb1bcbaa348fba39da2ad1aa32ce4b

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\hr.pak.DATA.avos2

MD5 50e3f576f71704a286be8f8b986b4df1
SHA1 96dc4f1bb714b36e81e3065d48bcccea2ef5e38e
SHA256 7be9425b2f90c1a4992c8d4431e25373d46788200446dd01a2c1c106bf1baa43
SHA512 ec5045fbdb51f3047124ea58b1c2673e58819bcc82dc58234088fd5a03b19bcf0fda787a7642d8a0a3a8e08a24e42ace0bd42011cc8e83881c4b453df29d9e78

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\hi.pak.DATA.avos2

MD5 ac83848575d9a28b3220eb79b7a2d709
SHA1 c8bad6c1157156519b5f498fc3b9273876a784ad
SHA256 630ed2fd2c12cf1b5a4c5c13f9f4c527a77b630e901812a7b7ca66a69e273afc
SHA512 7596a660232cd14562052be661892c74e04d34588619a9b6d20a960bee68921aad8c6d22ce534fdda5ca8ea5fd7637d41c11f0590ca137a93cbf144989f887a7

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\gu.pak.DATA.avos2

MD5 a646e4d7879b2bae6c8e0ef8821a1fe0
SHA1 0d5674c36cd116ff2279c23e46eedaa2f435a3f9
SHA256 b492e1e546f489ae43b6b1cca9d0aeafba21061110016e85452a963d150ee5d3
SHA512 34017b1e2c59c60fa9e8fb1d134050ca493ec22a5198d27efb2c8c2093c7d723b673eb98fb6e37aeb74a054706ec2690147e142d20cb3b455874a71b76a843de

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\gd.pak.DATA.avos2

MD5 c833313a8257689c1faeffd0edc05d5d
SHA1 3ae0d8474e508ad5a83b53a9c1c76e358579bf94
SHA256 93521a5efc57789d31c3bf2909c45bbfebf2d3f6f450c94ab07b4b45f17dc09b
SHA512 ef2a33eead34abeabd3d95aa5df43fcb10056de60569bcb8fe4fcbd3e81e894f48645e619d00256ea528c819b2747248267edf5dcd73837662f29630fc0664fe

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\he.pak.DATA.avos2

MD5 e5cedd6d3ac96a35149bbafe337ebf90
SHA1 8503624ae3d79219fcb4a8435ed6545834839efd
SHA256 163af80b0b7e1fe746397b2d9a223aa896833d5ca0fcefd4115d338bb6060395
SHA512 20bcd816b55b49c53be610640ce7bf1a8e56c924917b5ad258c45ac19e9aa70fd23d86067bdcb92897e34aa03adcf93815c9cbd6b3102ec0e76e99269da66248

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\gl.pak.DATA.avos2

MD5 b63e1309a4d492d7dff63a0ee1ba8486
SHA1 50c50ff9993be56cbd71ce2dff57054d81cd29f0
SHA256 68a929e19ef45e6b499bd3df57211bc16255f5cef530085b28e333fa5643956e
SHA512 733822118c9e9005ee742bac185af63ac91370a889124890f1d7fc69e020b5ac1dc2369a4f8c05182e2bf850e6fc93a024bccbbec0ee72a5c7d6fa40f27cf69c

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\ga.pak.DATA.avos2

MD5 67a87a03c38fff968b740c921fb0da92
SHA1 ec35023a6c07b9d61c716561d7b3cddfd4baaa40
SHA256 907e20fe72f0e64aadab77a4da181fa76b3bd517eea8229ff6947a38410fee3f
SHA512 7af54fbe2b8b1fe7da546e499319e3fac59f999ecf0c360ed2e7aa184cb25f0a0b72d9b77f65124f1effdd0a77dc407b2126eeee950250ca687c973f5a5a5e99

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\fr.pak.DATA.avos2

MD5 5309aa8c3e722cf563c85641fb3a346b
SHA1 e0714de15ebc9a0d62fd1ff827864a7b1b3bd7f7
SHA256 a63697e3e2164260070343eee2f38e46783fededcb6c7e704bdcab77ec44de67
SHA512 ba181e9eb06dc9f562c6a02bd8fcf3fbd27fdcd8dfacaa1407410fbcbfce87c96eddf102adcfff4fddca6713f274124a9f26d5c9f8a5101c97228c7270bf80e1

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\fil.pak.DATA.avos2

MD5 dbc9f419af31dcfcca39506cd8c3f378
SHA1 2dafb00f7edcd7fab0cb156dad7840778ba18fb2
SHA256 cdf3749d8340fad6f9ed90eea952f55f830f9ce40280fc2df064abdbd396b011
SHA512 ffca2ba92362e7c9a4ad6490f78cb40828effc0ce98dc2043e35c2ecbe0a0b2e842f1941e97cafe8e75fed245264ab2d6ac0af8b7f3d67294e8e9b2047a6efc6

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\fi.pak.DATA.avos2

MD5 19500f0fc410c37eb120517a77bddb94
SHA1 8a8583dabba4767b06b4165093d8d4dca41527c5
SHA256 ef907a57070ca373c74f42f3fbe2734e3467e00b4308a8369bf2579bf23fc309
SHA512 28cc5d8ed9568d3bb000d96b7ea22fd4f010e0631d2f9dd10db2e1fc7d4521a5c11a6e8cb27f1e072708e537ab2fa21b97bd22c2bc8ebd024fb5fe4c20274a6c

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\eu.pak.DATA.avos2

MD5 fcc142f8bff2f542c9981e5bda1701e0
SHA1 15368064243331ae090a528b2a027abe8a5f2963
SHA256 8a40f85cda557e733cb7d41f66f46b0969c8ce5ec4d841863ced368b7594e3b6
SHA512 9896a6639e92c61e35fc3c232da5505b73e4f8300e87278c3bdead2c112f24bebbfab5ba2490a167e08f150d91a51f52943f21bb41b7d2f19b32701013334fef

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\fa.pak.DATA.avos2

MD5 e28e68f70ee01503a6bef8190001963b
SHA1 0f436b40d19f99afab83a0dc05be7eaa8e12bfbd
SHA256 063257c30e56e95cd8355c6218bd547d4b991da2dfd6d519f3e7cffbdd0fa6df
SHA512 8bb441fe2744c34fa928b7541bcf89a90a82ac0e159128726861069e755fab665b8a17cb300563feffee05783d180b3f3d078f179d3e2ec1926efee01218d685

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\et.pak.DATA.avos2

MD5 85347240f4d5978adb8748c5b18a0484
SHA1 5a2daf082326de12bbac516eacf22c95644b71f5
SHA256 40805980e7375b5f65eb7d816966dc2f186d99049d771984604dfbaa2ffef8d6
SHA512 eeb4831b9fc1cc0a40ee086736510b6ba487674e6b805743ef624702977e94694873a353eed529bab049af97fd3975f288ca7a13abc538ab42961b3a0c53d461

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\es.pak.DATA.avos2

MD5 f03640a9484a8a175f40d1f593279a95
SHA1 58f6314959ed7918f0cba1182c5086e50fa86eb7
SHA256 47e88d4fb77224311ed04fa4a6645334c21ef14f82032a2be904508d959494c4
SHA512 35433c6171ff8f4d69afba9c285c44f44b1ddebdcb5e9897d1f8e188c7808d6fbe6c3d3935a8dfede63f94e2b86580d8762712428411ce6cd831f7e6df49e14f

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\en-GB.pak.DATA.avos2

MD5 0d559a66dc669b9622f7f65ade489edc
SHA1 e7d53eed5c9d9c8fb6f9796b4089081366fff1fb
SHA256 afbddf81ddda955c14f4321437b3a2438c98bc5d22629cfa6f70ae4b0427ac7c
SHA512 025ebe4619a3209e1dadddb9bf94cd8c073923cde33196aa2ef0c293937f2c9f488c6d3d3d1cd8b35ded17205c2b67f99c37c6bb03c1a4e03a44cabb2b5094fe

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\da.pak.DATA.avos2

MD5 97ab1bfbf24b9edbb41be9f06c2c229e
SHA1 1848242dd75d515ba87112da9581e36516580fc9
SHA256 34750ba13c74cfe36f7856480a19dac00d45d01ffc7a9df960c6c58889862a2d
SHA512 4c6fd949ac30dfe5a90b6757e3824191eb89816a674a79f42241d2ee29ee9c6b75b1e09ebb915d9938643bbd207fcff6723be0497c47c07d04a865853259946f

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\de.pak.DATA.avos2

MD5 486bdf9913bb2406b57def2d12859a2a
SHA1 ce65cd9bd24cc8eb0defe1630eed1699326f3df5
SHA256 db40bd4a4ef48d60a73ae8949ea217d4b463acc14f28c405815648b35a573e89
SHA512 6298397c92a03f8b679addb388076700a32d03c05a1f95950e5ffd92a58efe6e1e83b128248cc307367b6d1b0ed906e7adb880ebc79595f12c006606db957adb

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\cy.pak.DATA.avos2

MD5 b25616e556a247b5d82ea4ae26caaccd
SHA1 498a768c55224012543093177b7ce20221453007
SHA256 fde42e35d9e48e3a6b0e65536e3a0765931ddd9e3a53f64ffd8b1af74c74aa1d
SHA512 28c8532672c42ef33171424834789f5ba3f15efafb3d0bd1de29f13dc3455f5bcff8ed195911cb7c502110f7d7728e580146f8d38569c9295a03fe2f2b85cf15

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\ca.pak.DATA.avos2

MD5 bd3ddc0cca87b9bc3e5b002229c9cc67
SHA1 b1b800cde80c0f131c185798fa0ea75c03765180
SHA256 796d63c8d61e54bc06460caed7088b31b4a3e5999bef09e0af51f10a77abed6e
SHA512 8acece5f06f301cb97cc91bc870061dde12e0c334b0f8d0f9aff4ddbb3f0b9bd16ed5b191ccc1269092931af450598394ef646609315b91d69d341bc01db578b

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\cs.pak.DATA.avos2

MD5 9f33a218feb6c21ee04a176c63e1a929
SHA1 38093a6f7a355e59a61e5f6eac0d5bee06bef54d
SHA256 e4ffe942e8e8113b3d57254aba14007ac49fc2cce5009d44380701467ebba51c
SHA512 25431ef698f1c5a845685a6515acba758ce708d67ed875c17d8b50914fa9e9cfd469f9cf3254b009873e478765e8523db65d60d0984571d0619832ccd1be97c3

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\ca-Es-VALENCIA.pak.DATA.avos2

MD5 62c6aa1d3c5b605bd2b33c47dd7815e9
SHA1 b056a1868a6a3d5636fd2ceedb20955bb0d88439
SHA256 301fd7deeb5e58d14d83c72644f85ba6e8729da61faefab1b55ffad16683aa35
SHA512 db1fd7f1155dd3197ad9aa09d4f789921bebf0c01b911976092a3211e29ac1cc062bffece397a8cc13f9d19d6c32c1f61efb1896e886dc095b17b17badca92cf

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\bs.pak.DATA.avos2

MD5 c444297b574978ec226f754d8d3c2b9f
SHA1 6b23d6eac85e273cb1b56c949ce7508a39d069d7
SHA256 619014d3c8a7d5fe986c52666a16a9ef6120623defadb07be5ae1464ca00edb7
SHA512 98601b90e173023e86d735c22d3320c2594005ff60aad3c5461cd613e8891e099c7989822aad2b92f7572b699cad21ada2d872b45d5a46961ffec67b7ce4dbb1

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\bn-IN.pak.DATA.avos2

MD5 7aae4c203c759d7abaeb08ad262e2a35
SHA1 68afeb33ef85ec7d31a528ac8c9b19336e639c1d
SHA256 cfec5e35a1c30018bc4c5c8b4cbf79ab7341fa565b787ede52c44aac53dddbaa
SHA512 e20ed097be75bf24c18be36d6c3c22eec451cbdf9596ceaa682c698b2095edb4a631ca5e070acac800bc031b1761cc3b303317e7adaed2240ab54480f8790def

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\bg.pak.DATA.avos2

MD5 d340bda6868343d43eb6936f44f6b1f7
SHA1 a7b2442647e5120e11f8b5792407081ffe48ca00
SHA256 a1e45612adfc9a1e700e577f4e8dd1a17ca25f0e722d0ea41713bdb712c7ecbe
SHA512 936c0bedf1c3a716c0c0f63f18693ea75c40c2c69af30de48eab59f16ea1b84ae237e053b01c34596780b8b26bb97772864e2541769c9c5d289b7aa9fb203b4a

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\as.pak.DATA.avos2

MD5 0d9cdeac64f83f6a272a66e947a9131f
SHA1 8b6ec5a2bb84657f72c7bcec67a3d88b9b2b9fe8
SHA256 cdde6c193f2f22eaa44ad76e44654b509eb07d844c33f878b5f522d92ac06792
SHA512 bb9fa4c73ee5a36597f953e947d0253b1f50d0e2e61edba8a32a958eefee226c57e9e0143480245e7211b75da23da6525c6ed596dddc0462cc685b79957d39f6

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\az.pak.DATA.avos2

MD5 30abf64ca56b7f8a3dd2f702f8b9fb53
SHA1 736a76d9f7105ecfb09c6d43479452dbda5a8705
SHA256 ba5146eb4633b491aac08f4150bf110d66de20d6f53e0459dd5f163559ff70de
SHA512 83f1df2b2e8ef71dfc05f703d8958d6de3616ef8a9431d6236dc3594b08beb6e7ab038602bc87fc3316a70111ae2cc03c324631c48c5e9453ab1d598f518bec6

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\ar.pak.DATA.avos2

MD5 5277d35b32ba479d96e6b8ab0f6b887c
SHA1 1453f03b923fba25f2be1d53731d00679c877b21
SHA256 cc013722306d514a4c151ab1cbe0229275eb388ec21e0f2e816498710e65b593
SHA512 fadbf0c96fcb69211034037fac99311f284370a1034a85d1f1c15c220dcd9c3d8ab34a52292576629a0bd2167571159f9de5677238cf4f9650b5841b506c06d5

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Trust Protection Lists\Mu\Other.avos2

MD5 5765e98e482c83c5dbadba96837d15dc
SHA1 9d1da0e2a8a8d56ed42c00ed9cc5a122ae310155
SHA256 f99492c77e83ffcdd55a2bf8e7dc4069859e19fbd10e7ce33561002420e90eb5
SHA512 37a3e86f45bf128c0add2dfbc0cdd9012adaf76ae97e87de566ece24b42f32aa208bcfe68a4bf7065f78cb82bc4d8b4570660592228bca1dfb3d9c26a2736585

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Trust Protection Lists\Mu\Social.avos2

MD5 de2b72ce434b16229fe3e4f5330ae4c8
SHA1 099e860ce609cdc90fa68fe1129f9a8d620585c2
SHA256 7e2284ebee0d09e4729e9fd674af0ffc87ed5e9aa87033f1c35121df0b6af0f4
SHA512 e460565d02046b96fb024e96305e2447cb6682eadfec723dad896ce361765b3eb838791446d94affa7e825b54765c68b22bec27938aa18c8c1bae20418b167c1

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Trust Protection Lists\Mu\Cryptomining.avos2

MD5 b5c8f5608bfbe3574d507bd22dbb1acf
SHA1 c4448c2164158474422377feb606a156fdee1a66
SHA256 a014c50cfbfbd9db8fb9c2e21d7fe6ef04ed398236d4a91c8ed06fa86b855d06
SHA512 767b3c0286d63a787b3befdd3d06714deefdf93f9c45e097b108bd3415abfd0f93217ece6a0970642d18e235ebc5171e20e4cd052b674942ad0f3019cc703bb0

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Trust Protection Lists\Mu\Entities.avos2

MD5 1f74404914f6ae35f1d6c786952ead74
SHA1 edfdbf997cf59eb09a3212607218fb78d44a2450
SHA256 70f98c0d35e267e1b4743acd2c1c452b004d13e927eb8d75354d4eff3890e229
SHA512 5ab3c9da9ae87df06a634b71b3388df376e741a5a3d76818bd4dc86b392b75129cea3853a7e3d1df9bf7df1f206eb307c45ed2279bb0f1d43f6985528f49bfc6

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Trust Protection Lists\Mu\Content.avos2

MD5 de14aa8959cd7ee1b733f04edec6961c
SHA1 52ab43641eca11049997d7dab910c400c183914b
SHA256 a8790ef0b2c350322a46b12365fc355b26f6fd815fbc4f877f6673da60ccd6af
SHA512 5f3552509b42e46cf56dfe1115b99d1ea2c9edc53602418ee78e78f901b953f9d80cfb38d41c9eaca1e56a9a8d71b8b948176f0ca52815f2015743f0aa22948c

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Trust Protection Lists\Mu\Analytics.avos2

MD5 d33fe8a4f2924da0ff2f96723de5a623
SHA1 539c64d50720cda5ddc82e324a24d6e7621f2d8e
SHA256 572eef88bbfe41a9ed54c5f15068bb61b2b418c2099c8db6e4bde3e80b50564d
SHA512 439537312ee631b787fd4f2bbc9529430b1b05587cf9449cfd5c843abef25366fed18f9f99018cae7a65a1e3ae882fe2138d2ffe7dde1c34c3f5566620e09e62

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Trust Protection Lists\Mu\CompatExceptions.avos2

MD5 0ee95d871736251c1f2daf600f51e026
SHA1 9ecc71b325576155ed68a6f51b2b70a0d0e63683
SHA256 8c4dfe4a15e2d69a70f50e4237f1413d4ee33bcdcf0f80c994fda52e2443cdbe
SHA512 98c2d1d57693b7b6b9804a7d015eb017461246fc4d62a0c27c3cb38c3da0798ef1f35a7530690a9577e1f57b45ec50d7dc504c836a98aca91cd4d31045a25884

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Trust Protection Lists\Mu\Advertising.avos2

MD5 435b85d2a0b910842769a72690a024bc
SHA1 41a2716162e3e7d9cdde93bddf6bf1a75e2f0463
SHA256 59f19f8f9c7842aaa37d15ef49b824212e78769e03a0541c71718c8a2a2d5637
SHA512 1444e4a6b0f84be1f7ba856b9ee0cc0779c321fbf55242456ef542b133e70172dbe9401f623b14a8bff9bf35f978d6dfd5c67bd3af6538e33601b1dab7697b3f

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Trust Protection Lists\Sigma\Staging.avos2

MD5 501c85c23394def8a4fe37f9037f0e9d
SHA1 e9c0ae44a0a889e25ce4d741974830f0be4239df
SHA256 33251fd8503cb62551fd690b8fa0184d8f8d89371fd6a178a87b2f22d8b21f34
SHA512 f0707550e29bc9eb4281452c051258d912ef32a0ce58c8e58796287ce04a50a1719c2355eafb00cb746ef001162367286815f20b7a7e89229cd78cbfb02cf158

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Trust Protection Lists\Sigma\Other.avos2

MD5 3eaab52537689ca09cbcd23074c0bbcd
SHA1 fe048a6af109c12e526f74e77c062b0fe197e6d5
SHA256 d81b6d4218fab5f61fd763efa2eec47cb5ec201b1dc72ad24c30bd6994453830
SHA512 2eb7d468e68ff6964362491e42701b29f9b396b22cc1309b052b747623a12aa7b59ce6c1e3ce6a4ee9cf41c774c8a53d7f73a675a93aed9ada80de768b680d24

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Trust Protection Lists\Sigma\Fingerprinting.avos2

MD5 6d69c330db8014a4f73c6d9544995bb1
SHA1 4ca776ec4d9e210f399327bee6c55738757f0e0a
SHA256 f25d20c0fbe559e1246c3e211da2d8361a046b1c39f004193a605b1ca5daedba
SHA512 cd6c5fe63a40d3926012f25c988fdcba971d219039f29e5a4a677d8913cb92707a7f7641e486cd134ac589070db5f2d3f1c29a304d52a2160f682f2e178af494

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Trust Protection Lists\Sigma\Social.avos2

MD5 04af839a84aaac8dfd58308363cf7179
SHA1 37382263bb323b7d7b3d84cacc3799e19565f016
SHA256 4534d5e5577dd5b43bd39508a700a43539adec2a016c7405b19edad3cd349dab
SHA512 5852d56e02ad58575085463d4833ab2afb17608a458f84503b0b1083e77bc62d060ac29a0e8f228ef790972a9bd6b6636763b87be3a8c35782ee27bc04f0eef0

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Trust Protection Lists\Sigma\Content.avos2

MD5 3dc835f51f952c91b5f0707fb867b385
SHA1 bc755b44f596e136616984352a2acb1120d96232
SHA256 2ef0bd31d06e9f9cb6441a1512af08202bbfdcdc1a29b8aa80e33843c5179f20
SHA512 96e797c1a8f9deea82a5d71e748f2b056a056c5741910e36246cb9be5cc3713ece414de2ad622c3a09d4e4a8a6aa9f97eb524bc8d55fce7d7f5d455cc54f8654

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Trust Protection Lists\Sigma\Analytics.avos2

MD5 ff3d885f0ce9ff555ded3a5656bc5c8b
SHA1 f1fec24ba4ce1c2339ea6ec92576385092c6a053
SHA256 37811ff6c6a7b8eda72997a2ebbd7bf656d1521567eea221b8bddbfebc890fc4
SHA512 1755b60fdc5cb253fbead69321cd5b96440d6a23da881d2db99e3dd6ff45ccd9bfe404a9c51f5adafc966bd14beef7e27bf00d66109e9e20b1b8d597d8332b45

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Trust Protection Lists\Sigma\Advertising.avos2

MD5 05177247690790af9e20895dd0b9c21f
SHA1 494ab6c721e85e1114fda1386b22ed5c98c6434b
SHA256 49f19e4db7d9d3a8bbb17cf26f1e5c1bcba1cfe3394220095455609821d7371d
SHA512 178f77eef2b6d48d4be021afa79e56eaf614fc13c34039765128c0a35547f75017f7727fb8a89b87c85287ab7afa41d094a527eeb6075b9bfddd253c1d0492dc

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Trust Protection Lists\manifest.json.avos2

MD5 3de66d50078f91bcf376df56c5a1c1ce
SHA1 b6b2165bc617390ce129448ae0b14b90bc65052f
SHA256 756752752387216db0075ada211068a7ef478d2598bbf513c49f2cb694520f2b
SHA512 299366d74eb5338a1c7e421f54b38e0eac5c5a394673485cf3f53d66ff002b21db4073fe73158fdf73f25c0fe69738d43b779dfb31454768076aa718a8203e8a

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\VisualElements\SmallLogoCanary.png.avos2

MD5 f3a223a93257660d15ca7531e1aeccc1
SHA1 0e9f81db3cf13b1875b74bc2fe4566aa2fccd8c2
SHA256 876ec003c4f571054918024a9e3476c073a996610ba0b97f8e20b2e8fadb984e
SHA512 8e980955d8236004e03c23a324c44ed86e3877717110f4f41a6d29189a3ae92569fe6f84cc71bf1bad568385643e0b1e80ad788d86e915ea387d548527fa0d98

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\VisualElements\SmallLogoDev.png.avos2

MD5 2d2d7a4600ae0ceeaa2773c9b937bd63
SHA1 bfeef6f97e2d03c627a9a7f0fcc2e46599988ffd
SHA256 e53e06391ad762b4dd3df631412842554b5c4f51af801246a89878d4d20b7c7c
SHA512 939d5cd7d1bb42b0c7c1893a97192515501f661b81cc530404832244d17dac928974c69d29dc5ff0b655401a646c64cb21e8d15a00632e9756a71bffdcc6c2e9

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\VisualElements\Logo.png.avos2

MD5 18858cebb180b61db65fbc1c6058157e
SHA1 924fbb9529cf5f0e14ffdd9914eedcb386db4a73
SHA256 9b65b363b9f69dc045444e8b7225e0cdeb4961aa71c1f512088fef514456409c
SHA512 795a743fba7899c74197881825fea00603ed216d9c7711fce927fa4cc7059276ad81a1f73675237509188951878c0f5753eb8897f151c4ac37c09d208d78c807

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\VisualElements\LogoCanary.png.avos2

MD5 beec50f46ab9767bf004de232eb3afbf
SHA1 8a1057b35fcefbccb657d440a4f2fd1f4ca6ad4a
SHA256 7270b129ceb944c62ddf8dee919fcfd7752617449e5ce360633a5d2431f7965e
SHA512 e9f67e82cc8e2d7c2dac6cd9490adb95ccf4749db1f8db69c31aa7a1a8ac8d1a3d7f334429ed069f9d4cd0fc4b7fb4dc3a8fde2db819b8fc210d8214992979d3

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.avos2

MD5 4f7bbddfa90ec624ed33020c35a27528
SHA1 71cadf72eb1ac3e1844f124f2d51af3cb35fe36e
SHA256 fb7f25ea65bc3837339df9b0d2fbb61fe000651ff0e0b593cf6fb888ae7b1ebe
SHA512 336a9530b8640ea3ce1487cd309b51b213281d0ef4bb84a4ac2207492d8b88ac0a42701c9d7b89e2a6b041dac45867b8b6bb414730a2fb814e0e4a6b13bdf13a

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\VisualElements\SmallLogo.png.avos2

MD5 3ac88ed2679a09dd71dfccd1a7ba8705
SHA1 9e475f9cc04eb662c5b70997b9f0d066bc1fcec8
SHA256 ca26476556a5c1f7b05c902a87255d62fe34cf1f71d03154ccecb80fdf11ec94
SHA512 fb77a485185f6e44253f0e7f1b18e172d1a8aa4de59476152041e01f3c89e2cd8d614c1542aa8b9fb0aaed18ac599d2616b2eee2cfc86d369c2a01aaae674b3d

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\VisualElements\LogoBeta.png.avos2

MD5 f779696acb0dd343ffe780aaa635b428
SHA1 2a7e0b24da7e1dde21986296f415a982e7c80fb2
SHA256 df1e90c761a34f68936b1b49f3f9b3fc6e6a7cc59fe15f929aa9af0e90bfe07e
SHA512 4a94257d03ac6534ad493297b07e8a0f93cc473e6b0a54f4397c07690a1b4a47dd160c202e81e11e5249692937b2964ca0d18ae95391c7eb84e700757c556277

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\WidevineCdm\manifest.json.avos2

MD5 b4b6e015310a823fd513e26bd0e48730
SHA1 fcb034c81a1dd053c2d1f2561f0afd37209f8954
SHA256 62ae9654b787afae4d2dbdd73398d6a0150a16c4f92a3f234e672d8e379587b6
SHA512 bd40610e4f42c6c040b9ec963c702fc8ae6b202d1687ddd812210fd4bc2cfb24b11128964833cdc6207d23e9955b12339ee40adfce8656eaf688d08a6b3ce690

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\vk_swiftshader_icd.json.avos2

MD5 6710cb4a785b925d7d4d4c35862475d3
SHA1 26ece9c9234c67e19dd636e6ffc5d80341f3ad33
SHA256 2a4b85dfe801e9b455a4022d44eebdc32064feca769851660f10403cc98885a3
SHA512 fe488456270edd2c45c198e3e770014bb0f85ead74d80cb29b7c229b754acba927e4581af8372d11ce75fa537ae0f89241d93525cb90206e91a0c8fa06d35c78

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\msedgewebview2.exe.sig.avos2

MD5 6aa17e50c1e953474b132b328b69c9a2
SHA1 d72eb4feddab64c628df93f24f4f0a20636d05c0
SHA256 1dae3c6a96c5b55e42ca95c7d96ad6ce3f51245ef475820801d0825d04e3e523
SHA512 94a3b85c75a3d946bb5c153ceb7a5028a764c01ef75d1c26272d7633fcf4ab19b146438a21568fd41a156faa1114e6e1239bda92560228434b0ffdf4f3ec5210

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\EdgeWebView.dat.avos2

MD5 5a9b3d9a29be26cbad2cc06359bd6647
SHA1 9203cf3cab0937a95364b853634354d50b639ae2
SHA256 50356e6aa05d905f829425b12294b5646ff4322e5549ed5e883dcad6ce4a5f64
SHA512 3850f6da365af71115ad098a2abbcdf0e7ebc86029e338022238786a655b5f5312b9e1fc5879bc1fd27937ab98885b192c3efb30ba776bbf0d0cd6bd94e71243

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\msedge.dll.sig.avos2

MD5 9d3fc866b6c01f97e5640648bc8e18d7
SHA1 31b55ae65ea78c6eba14fae4dc64bf6042fc8fa0
SHA256 7e231cc9d424af667b27cb119e116cb09cdaf4751ae9cf8e97abd3decf90c335
SHA512 b4b84ea2d6795dee19633ad42495045b5e394978ecc1d49caaf2a3d1dcdf29aa7c3d8c1e967cc344f5aca43a2e8e565de32faf044894b174f24e1f436ca4c538

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\msedge.exe.sig.avos2

MD5 f468e9e711968d543cd01ea578a9a481
SHA1 3e78f621d23dbacb0a5c56cec47f1d5fb8263461
SHA256 f5e0dcff0809b4a7f6e5563939116b60fcabd93aed6687b16227f58ba94726f9
SHA512 f785a71de05af22aefdfc3790b6e90cd2a1938af0a10c5db062570a8cf0bd4e5ff86fac09d805af6c41a379ae6f04e3b9169d17b2cfc9e17d867c0482243f511

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe.manifest.avos2

MD5 ca1844283fd22311d6f2aff00a640a10
SHA1 a5d442afc61cef1492664a4f47682bdb16f95b84
SHA256 18a9304d3b0e5ec1b9a895e59fad6d923e944b4c2a17c7ad9d71a62ff48eeb1a
SHA512 ebd8f483626a483d49a5cf33ec922440235f7546f5dfd50620ff20861ccd9851e0bcfc0cf78f31460578e9010be3dff7b8dcfbc0ff5a4923c411069585d78f90

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Edge.dat.avos2

MD5 25994670d34ec42d535b27f0ad1c2149
SHA1 ba79c21964a153a78220c59d2fb9ed89e962eea9
SHA256 4b216b0c5ca041a710d8d3f7ea9150d75356b87e41d599745c6781cc6e9eb74e
SHA512 7a38a07d5146d0a3f6ddcc9272c1b09b158e4ff63d426c7803ec0dad0ad54cc55e0a6234d988395bdc3e23aac881aae9105e2e21e228ecdc70f7d8e2df1b147c

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\124.0.2478.80.manifest.avos2

MD5 52b8dd653ce9154fc51bae3fb3044268
SHA1 97dd4856085e3b740a12646c10464431a276f527
SHA256 350ce32a81acbee0bb1a1b56ae0f419e52e2a299441b7140ea6b6cb9df9c3262
SHA512 f1b8dca4c7c81e25ad209e64ff643420868f12afec55822baaefa1cb7a441c328290c47265f38e1ddfb0e679f0a57e37cb47d979c4c56068901bb29f7176e420

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\el.pak.DATA.avos2

MD5 b9c62702b6f329aea8896e2b0962cf78
SHA1 c83036aab659f85412e5686152f5f9ab12003a70
SHA256 7bbde457144fd5b1b79132a5c677c3206198277dddcccc3d257fe967858f0605
SHA512 250241af40c25e80a5882621ce1a7589af8dd1088b54abd8c13c54efea653358d014459643dd124d4bf693a9294b8da3711ad2d8d6a1beb1f24933e957b98247

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\am.pak.DATA.avos2

MD5 84c909028fc9f4405e7d48291c7f6b56
SHA1 e7d1a679cda123d63a23b5783338620dfd23b82b
SHA256 caaf3ab4625605e590e3c7c086df4cc9f42d5eee2d3b74cc921f01b2525630cb
SHA512 2d22a837380e01aa038fd2086602e7f06bbf5e0e9df091fad82a4d322a06bceea544cc6d743e1bbd461248e1a6c59a7c1f7d770c20b1d95565e932c78da8a659

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\af.pak.DATA.avos2

MD5 be8936c0d6934b9e2cbb8da067e19ff2
SHA1 2a0b92bffd4943dc972535420842467076deba28
SHA256 b207788fbe793dda10d7b42729525cadbee535db52ce227f504dd6321f470ab7
SHA512 f7430ee066acbf5ac90bf2a0d618e70c30ee8b1682977ff6fdc00dbbae52975ce14b0bf04eedebf29b503c1ddc7ac44c8d744b9045a90dc475a982d59c7e1286

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\MEIPreload\preloaded_data.pb.DATA.avos2

MD5 6ac5b69f6f60c12f50ce03b358224008
SHA1 972c0015005db2945dce9517dbe1f3f0f02fe1aa
SHA256 7b486e5158e682115f075bc7c67a43cf02c486be2b61ab247e0558b48c969db0
SHA512 d8dadce1d0126616ba4d052478a976b78df1c9f76b7c6d78f240955a3850ede13298a9b18a1d30485577f6d541241e3980f4584c1e08b39c4437b94f2b2912a2

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Notifications\SoftLandingAssetLight.gif.DATA.avos2

MD5 65156aaa98846dd523a14d3de3fc91db
SHA1 e19941a3e4d6e98935f3713f29dda1467d6f8245
SHA256 f5c2070f735554a0e52b7a08a1760436f4774127f42aa974c16f730a0e8f0538
SHA512 44439386d78a95965a6cad04b027f53333e8659434a9961757b8c49c1ff7d306333410f523b32c94f12a3ee8bcd95aa231cd5e2eb678a3f49d80e5845fae93ce

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\MEIPreload\manifest.json.DATA.avos2

MD5 7cc8d4c41921fb6186d1c9c73ff57443
SHA1 cc1b4a9dd4bad4b118d4e64427e829d7b7e2ccc4
SHA256 be27da6fd222660e8a4747d54f96ef8c2e157f2b81e05763beab4f995ec5d82b
SHA512 6120319052c7a8f27b5bbb79bfbf86510cc4f78a5013f743bab78791ddd9c49d0966d6c8bcc278522555a7af0a04b1a4d330f21b0c92e31e9b32f81a10051a56

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Notifications\SoftLandingAssetDark.gif.DATA.avos2

MD5 fd92318b3d9beb3d29bd131ba5d474e7
SHA1 fdfe32aaa461e62966d4b8784c963fc471e15fb5
SHA256 befe57ca8b93265b8800816c6d6d4def147200c87cca9ccdacf88c70da4a581e
SHA512 60b7f254905862c0c76db78693de1853a535ab2cacc75f2e6fe6f22e06d426785200d4c19bf33297984f0634f16327052defc5442c9239c1d683fedc3230a299

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Trust Protection Lists\Mu\Fingerprinting.DATA

MD5 540bd65ea16bf9c0e4575fbe6cca5dbf
SHA1 24d63d0d814d9f9208bb36f837cb811cd3f28439
SHA256 332b35cc95a327c98c5eddffadbfe9aba5f923e516bae1575a27d0e4c9fbdfe9
SHA512 8988aac0173978da80e2a9abaacb3cc47a3a68cb5924ac22bdeab47c3dc9f320d2398933841adc2d695cebc59e861fe51faf408cea64401421ed48c8910ee97f

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Trust Protection Lists\Sigma\Cryptomining.DATA

MD5 24eb1ca483160d0359f579b59fe56148
SHA1 ecc3318ad64a8dd113952bc5c05905dd6e2961a8
SHA256 30fc9e54c4f51f1e6decf811c789751451b28e09a4d47952bbc488b23d4e1895
SHA512 30f580030f4261134baa874dd8f36e7c11cb9dd9a40343e0b87da851785ab20a162d1b56132dde1e9193c920109ce4a809f410cf1e6b9cbde27c3a7f9805ba63

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Trust Protection Lists\Mu\TransparentAdvertisers

MD5 ec1456c345e6a95781e21aeb68caa09b
SHA1 f0ba9b48a86041486405643de72208b4bcf08789
SHA256 14ce16a8aca3b21582d4b4c57b3dfe5d5fbb78498bdb1d5a931bd1c5657758b9
SHA512 294811c6605a7d34acebe3a3b8b0385c3c5f436a0bf30a3fc69eae0c06a25add708a95b921f17e0cca81b65cdedd34e77b8599c3a5e02dfeaa474942e4562d95

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Trust Protection Lists\Sigma\Entities.avos2

MD5 06bfa89b9b43923ca4f08fffe45198fc
SHA1 c5e2b548ecb0601ce064e32c413636de80247888
SHA256 376d78810a8c4c83c28efdbabe53a1ce225466d15ac8bcdb61149685c06f48ba
SHA512 caa174b96fe0a54b435213d72812d8c8309ba73b168faaa22176d0c8c1f90f7e292d896290387689a8bb2edaf82aa57354012711caebf94ce771adee07f7b68c

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\VisualElements\SmallLogoBeta.png

MD5 96e1cf3b43b58debadee55751a175b41
SHA1 f585c9b0adcc95e1f57c786b30ec700dd4d515e5
SHA256 62714465cba25961dda7cc4fe2c66ea234e0e8775357aed414ca1a51f50a56d0
SHA512 09d6d16dda30dec9721a6dea4f8ad336de0ca5e9b2c6e20f4dad05e8ed72d40a128b131ff104bb07e7b3b3bff8d0843560d9e41358d92753a7f1bf089d4eb700

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\VisualElements\LogoDev.png.avos2

MD5 5abc90404550c672d403bcf3c16d275e
SHA1 646442929f3c54453e421ea07cb82980800ea929
SHA256 f493a9decfef04d3d874991db032de29879be0f2043a4abec54f709ed7916b4d
SHA512 2d2f8e89f039e418df82503f06d2795433502652457cf2c82e8061efb9ebd348ebb472871615e9810a236133a8d42c0bfb989dad826130152b38656d2467982b

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\delegatedWebFeatures.sccd.avos2

MD5 eb8a250e088fb4748e98794c5eea1d30
SHA1 fe828a93e526465ddb93fbe46aff6eec30f676f6
SHA256 8bb29dadb5cd17c0986f823f2645b112098a0ac5f61caf4a7f9ad90a98a4a34d
SHA512 e39a1b0fa2414fca9970942b890de7e4a9382061b990c5c13a37cf54624607e7e4951222cf777a80091cce5db1f2ac2a34266de9b3f32944735cdc2fe87466a4

C:\Users\GET_YOUR_FILES_BACK.txt

MD5 dc0c59133c813e685e54ddf9bcb3601d
SHA1 d1d50426e562cc9a103a9f0bb63ae6faea6f410c
SHA256 a3f03323980be92cfc02204ecb15d4f282d5190949526dd4c7ff8a5ff0dd1223
SHA512 e457096e752303e5695e22bbc989143436f9939d945cff1fbe1d349ea91f2d78a8d46666dbd7ece1d01898b189342889265047515e0890914b81f3e7c823e7c4

memory/4516-23423-0x0000000000400000-0x00000000004E4000-memory.dmp

memory/4516-23425-0x0000000000770000-0x00000000007B3000-memory.dmp

memory/4516-23424-0x00000000004BE000-0x00000000004C6000-memory.dmp

memory/32356-23426-0x00000000745BE000-0x00000000745BF000-memory.dmp

memory/32356-23427-0x00000000031E0000-0x0000000003216000-memory.dmp

memory/32356-23428-0x00000000058E0000-0x0000000005F08000-memory.dmp

memory/32356-23429-0x00000000745B0000-0x0000000074D60000-memory.dmp

memory/32356-23430-0x00000000745B0000-0x0000000074D60000-memory.dmp

memory/32356-23431-0x00000000057E0000-0x0000000005802000-memory.dmp

memory/32356-23433-0x0000000006130000-0x0000000006196000-memory.dmp

memory/32356-23432-0x00000000060C0000-0x0000000006126000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0lbnu2ma.d2z.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/32356-23443-0x00000000061A0000-0x00000000064F4000-memory.dmp

memory/32356-23444-0x00000000067B0000-0x00000000067CE000-memory.dmp

memory/32356-23445-0x00000000067E0000-0x000000000682C000-memory.dmp

memory/32356-23447-0x0000000007E30000-0x00000000084AA000-memory.dmp

memory/32356-23448-0x0000000006CA0000-0x0000000006CBA000-memory.dmp

memory/32356-23449-0x0000000007BD0000-0x0000000007C62000-memory.dmp

memory/32356-23450-0x00000000745B0000-0x0000000074D60000-memory.dmp

memory/32356-23454-0x00000000745B0000-0x0000000074D60000-memory.dmp