Malware Analysis Report

2024-10-16 03:26

Sample ID 240917-cvjesszdpb
Target AvosLocker.exe
SHA256 f8e99bbacc62b0f72aa12f5f92e35607fa0382a881fe4a4b9476fc6b87a03c78
Tags
avoslocker defense_evasion discovery evasion execution impact ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f8e99bbacc62b0f72aa12f5f92e35607fa0382a881fe4a4b9476fc6b87a03c78

Threat Level: Known bad

The file AvosLocker.exe was found to be: Known bad.

Malicious Activity Summary

avoslocker defense_evasion discovery evasion execution impact ransomware

Avoslocker Ransomware

Renames multiple (2990) files with added filename extension

Renames multiple (1493) files with added filename extension

Renames multiple (3054) files with added filename extension

Modifies boot configuration data using bcdedit

Deletes shadow copies

Renames multiple (5318) files with added filename extension

Enumerates connected drives

Drops desktop.ini file(s)

Drops file in Program Files directory

Command and Scripting Interpreter: PowerShell

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Suspicious behavior: EnumeratesProcesses

Interacts with shadow copies

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-17 02:23

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-17 02:23

Reported

2024-09-17 02:24

Platform

win10-20240404-en

Max time kernel

5s

Max time network

21s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe"

Signatures

Avoslocker Ransomware

ransomware avoslocker

Deletes shadow copies

ransomware defense_evasion impact execution

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (3054) files with added filename extension

ransomware

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ar-ae\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\cs-cz\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef.css C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\plugin.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_120.jpg C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\msadc\uk-UA\msadcor.dll.mui C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\scan.png C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Internet Explorer\en-US\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hr-hr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\tl.gif C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\en-US\WMPMediaSharing.dll.mui C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\affDescription.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ja-jp\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\Close2x.png C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_folder-down_32.svg C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hu-hu\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sk-sk\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\msadc\en-US\msdaremr.dll.mui C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-cn\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\pt-br\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pt-br\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\de-de\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ru-ru\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_2x.png C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_backarrow_default.svg C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\de-de\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hr-hr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DVA.api C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\stop_collection_data.gif C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluEmptyFolder_160.svg C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_filter_18.svg C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_listview_18.svg C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_tr_135x40.svg C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_reminders_18.svg C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldBeGreaterThan.snippets.ps1xml C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\cs-cz\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\msadc\en-US\msadcer.dll.mui C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3104 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 3104 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 3104 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 3104 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 3104 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 3104 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 3104 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 3104 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 3104 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 3104 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 1852 wrote to memory of 38844 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1852 wrote to memory of 38844 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3416 wrote to memory of 38852 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3416 wrote to memory of 38852 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 864 wrote to memory of 38880 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 864 wrote to memory of 38880 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 796 wrote to memory of 38896 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 796 wrote to memory of 38896 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe

"C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe"

C:\Windows\SYSTEM32\cmd.exe

cmd /c wmic shadowcopy delete /nointeractive

C:\Windows\SYSTEM32\cmd.exe

cmd /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SYSTEM32\cmd.exe

cmd /c bcdedit /set {default} recoveryenabled No

C:\Windows\SYSTEM32\cmd.exe

cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SYSTEM32\cmd.exe

cmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled No

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete /nointeractive

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "$a = [System.IO.File]::ReadAllText(\"C:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"

C:\Windows\system32\reg.exe

"C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\1470808746.png /f

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters 0 False

Network

N/A

Files

C:\GET_YOUR_FILES_BACK.txt

MD5 01188d22b1675e3437b1418e14f4ffab
SHA1 6e7127f3bbfce49485ed8f1acf8f697bcb952818
SHA256 e4b3ac00a0b2eb195b26abffbc4368077384e73393e51605edda17dae05ab7f2
SHA512 6903ae3247f32ad79c60a2062cd6a7bdbf5a7c9db1bdc43bdbef4da3396945014d30968ea4c8531a2d0c7b695f1ea36e2b8c51bb39cc6157c4096ac04a6e187d

memory/38896-8558-0x00007FFEBBF70000-0x00007FFEBC95C000-memory.dmp

memory/38896-8557-0x00007FFEBBF73000-0x00007FFEBBF74000-memory.dmp

memory/38896-8559-0x0000016EF1D60000-0x0000016EF1D82000-memory.dmp

memory/38896-8562-0x0000016EF2120000-0x0000016EF2196000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rf0ja140.mds.ps1

MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

memory/38896-22614-0x00007FFEBBF70000-0x00007FFEBC95C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cfa61f06713f00bdd3e7fd7fe0ae44d9
SHA1 746adee259da003d65fcfb35c889a53720feb7f8
SHA256 8c92a68c4300add9aad716a454a5e723776aed0e092eeb8fd8e891d8b01b6625
SHA512 037b0be722df3a9383bca6189bc177f4d63b4dd887a73bcce67cac83cbf850f9bb860fe4d776166b5880a02e04ad5131cebbd921cf62afea6228cd2de36c1d3e

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 5d574dc518025fad52b7886c1bff0e13
SHA1 68217a5f9e9a64ca8fed9eefa4171786a8f9f8f7
SHA256 755c4768f6e384030805284ab88689a325431667e9ab11d9aeaa55e9739742f2
SHA512 21de152e07d269b265dae58d46e8c68a3268b2f78d771d4fc44377a14e0c6e73aadae923dcfd34ce2ef53c2eaa53d4df8f281d9b8a627edee213946c9ef37d13

Analysis: behavioral3

Detonation Overview

Submitted

2024-09-17 02:23

Reported

2024-09-17 02:24

Platform

win10v2004-20240802-en

Max time kernel

5s

Max time network

25s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe"

Signatures

Avoslocker Ransomware

ransomware avoslocker

Deletes shadow copies

ransomware defense_evasion impact execution

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (2990) files with added filename extension

ransomware

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-fr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-cn\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sortedby_18.svg C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sk-sk\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fi-fi\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sv-se\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\file_icons.png C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\uk-UA\wmplayer.exe.mui C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-ma\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\uk-ua\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sign-in.png C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ru-ru\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ca-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\AppStore_icon.svg C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\da-dk\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-il\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ja-jp\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-fr\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-fr\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_icons.png C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\It.snippets.ps1xml C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\s_agreement_filetype.svg C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sv-se\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\AppStore_icon.svg C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hr-hr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ca-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_move_18.svg C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ro-ro\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\Other.DATA C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ko-kr\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ms_get.svg C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-ae\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\he-il\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\SY______.PFM C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\upsell.png C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\main-selector.css C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ind_prog.gif C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4520 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 4520 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 4520 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 4520 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 4520 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 4520 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 4520 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 4520 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 4520 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 4520 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 4884 wrote to memory of 39144 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4884 wrote to memory of 39144 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4052 wrote to memory of 39152 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4052 wrote to memory of 39152 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2284 wrote to memory of 39160 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2284 wrote to memory of 39160 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4092 wrote to memory of 5536 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4092 wrote to memory of 5536 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2900 wrote to memory of 5604 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2900 wrote to memory of 5604 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe

"C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe"

C:\Windows\SYSTEM32\cmd.exe

cmd /c wmic shadowcopy delete /nointeractive

C:\Windows\SYSTEM32\cmd.exe

cmd /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SYSTEM32\cmd.exe

cmd /c bcdedit /set {default} recoveryenabled No

C:\Windows\SYSTEM32\cmd.exe

cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SYSTEM32\cmd.exe

cmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled No

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete /nointeractive

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "$a = [System.IO.File]::ReadAllText(\"C:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"

C:\Windows\system32\reg.exe

"C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\1137146776.png /f

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters 0 False

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp

Files

F:\GET_YOUR_FILES_BACK.txt

MD5 01188d22b1675e3437b1418e14f4ffab
SHA1 6e7127f3bbfce49485ed8f1acf8f697bcb952818
SHA256 e4b3ac00a0b2eb195b26abffbc4368077384e73393e51605edda17dae05ab7f2
SHA512 6903ae3247f32ad79c60a2062cd6a7bdbf5a7c9db1bdc43bdbef4da3396945014d30968ea4c8531a2d0c7b695f1ea36e2b8c51bb39cc6157c4096ac04a6e187d

memory/5536-17744-0x000001521F770000-0x000001521F792000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_abhqqv5o.sfo.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 c8861299853606fac3016094fcb76d2e
SHA1 8969dfdc86ceceb91bec0956f6a672a8606bc841
SHA256 07b966f55b6c7b2f633c7a4ace5c3cc0fc6f6dcbea8ff0da2210ed4a34c2cdf0
SHA512 841ca021eb2e9cb9831c2637f97739b0f2b35919b4e7eea3e39af808564f06b1d2175d618912603d1f61b364882c626799f68e069b13224d5db920ac7a267ef3

Analysis: behavioral4

Detonation Overview

Submitted

2024-09-17 02:23

Reported

2024-09-17 02:24

Platform

win11-20240802-en

Max time kernel

2s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe"

Signatures

Avoslocker Ransomware

ransomware avoslocker

Deletes shadow copies

ransomware defense_evasion impact execution

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (1493) files with added filename extension

ransomware

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\WidevineCdm\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\ResiliencyLinks\Locales\hu.pak.DATA C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\Locales\devtools\it.pak C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nb-no\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\en-US\wmlaunch.exe.mui C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Edge.dat.DATA C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\te.pak C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Common Files\Adobe\Reader\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\Notifications\SoftLandingAssetDark.gif C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ar-ae\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\ResiliencyLinks\Locales\ur.pak.DATA C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\am.pak.DATA C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\tr.pak.DATA C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\Entities.DATA C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\WidevineCdm\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ug.pak C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\Trust Protection Lists\Sigma\Entities C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\icudtl.dat.DATA C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\Mu\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-si\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\Locales\te.pak C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\nb.pak C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\ko.pak.DATA C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.VisualElementsManifest.xml C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pl-pl\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\Locales\es-419.pak C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\nn.pak C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\Trust Protection Lists\Mu\Other C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\ar.pak.DATA C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\VisualElements\LogoDev.png C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\Advertising.DATA C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\ResiliencyLinks\Locales\fr.pak.DATA C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\ResiliencyLinks\Locales\hi.pak.DATA C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\ResiliencyLinks\MLModels\autofill_labeling.ort.DATA C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Installer\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ko-kr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\Locales\ga.pak C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\Locales\mt.pak C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\tr.pak C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\ro.pak.DATA C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\Locales\es.pak C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\ResiliencyLinks\VisualElements\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Extensions\external_extensions.json.DATA C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pl-pl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\zh-TW.pak.DATA C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\pa.pak C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\Notifications\SoftLandingAssetLight.gif C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\help.svg C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\identity_helper.exe.manifest C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\ResiliencyLinks\Locales\qu.pak.DATA C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\Locales\zh-TW.pak C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\sq.pak.DATA C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\tr-tr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\ResiliencyLinks\Notifications\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\EdgeWebView.dat C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\Advertising.DATA C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1556 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 1556 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 1556 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 1556 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 1556 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 1556 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 1556 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 1556 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 1556 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 1556 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\SYSTEM32\cmd.exe
PID 1016 wrote to memory of 3336 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1016 wrote to memory of 3336 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1744 wrote to memory of 4332 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1744 wrote to memory of 4332 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2436 wrote to memory of 11660 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2436 wrote to memory of 11660 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3788 wrote to memory of 11684 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3788 wrote to memory of 11684 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4564 wrote to memory of 15496 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4564 wrote to memory of 15496 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\vssadmin.exe

Processes

C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe

"C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe"

C:\Windows\SYSTEM32\cmd.exe

cmd /c wmic shadowcopy delete /nointeractive

C:\Windows\SYSTEM32\cmd.exe

cmd /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SYSTEM32\cmd.exe

cmd /c bcdedit /set {default} recoveryenabled No

C:\Windows\SYSTEM32\cmd.exe

cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SYSTEM32\cmd.exe

cmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete /nointeractive

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled No

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "$a = [System.IO.File]::ReadAllText(\"C:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"

C:\Windows\system32\reg.exe

"C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\1344816717.png /f

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters 0 False

Network

N/A

Files

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\hu.pak.avos2

MD5 36704730f89c3297b63635c5297c25b2
SHA1 fa489eb0745ce1f52ec18c6d51d089fc1eccd8f7
SHA256 421be54875aac6fccaf7db9a56daae98f002552ddcc9c00038d13325bc7d5d7a
SHA512 1510ba02ea85cfb6a28f61178b7d6cde4c3ba50e1715cf2261b42dd4a11839f2704198c3000bc899f7f69e760ab35a7187cf79fdee8ea8e54cf75c2370b4e537

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\nl.pak.avos2

MD5 6976c86548bb7f94d2fa0c9ab49bedfc
SHA1 39800e64495f97ee769066e19e6c4f6f5d750c1f
SHA256 125173519398e7499f761bbb26ce2a82caf87fb288a94248168b838a57ec69f4
SHA512 6dda422d34a576ac056a2c4bd75fa28848fe4aa78c3d2b401d83d6699b453bef2f56abb9c83306c1d63263c908f47da9e837c54ac084be58f78131f6b9356515

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\pl.pak.avos2

MD5 3cd08ea25ae4f0b73e4566303f1dc2be
SHA1 7baeda3999a87e1dd8cafbaadf6d168e9475698f
SHA256 0d241f9dcdc120bd56b6c90de80f0dfb1cbf28e3423ddef8a754bff60e8ee51c
SHA512 e2431e4f388d18da5adda6f402c1b1d4782594c04fd14e0d80e6188927f1518ea0fe194818c2634337416f6d345ea4495be2da93c4f7f5ab30f629cc28579f44

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\lb.pak.avos2

MD5 7629a423d9f8b8ced7a187647f24f5ca
SHA1 07fc193cf58244cbdc843467773d00cfc59303fd
SHA256 e2d5abc58272a68973ef0dae66e03af5450743701482eb41c9d4faa048cbff18
SHA512 a9c22645de025bf042f95b8ab229eeee653cf39c76ebb8b5886558881133609247842a52d15d9d38237705c95902b2fea10882f0d241dfd62587f538023d9f84

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\is.pak.avos2

MD5 5f0461e987bb562037b298a4d30768bd
SHA1 1387225c37de2c72678ce30018c0c60389a31cd0
SHA256 b8b2c1674b25fc37bf228f2a0c5afe1d9f6562a07b52b4d7c22932251ca4b5f9
SHA512 f1e963a82e8be81795a927c282fec8f11c125f371220b2d38a294079d92aab9c5dca3e894be84ba39a6d81baa061d4b3bed9e3a8062ef4ac89306537b5e1c8ce

memory/11660-16699-0x000001EF6D110000-0x000001EF6D132000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ihth1ba4.ruq.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\GET_YOUR_FILES_BACK.txt

MD5 01188d22b1675e3437b1418e14f4ffab
SHA1 6e7127f3bbfce49485ed8f1acf8f697bcb952818
SHA256 e4b3ac00a0b2eb195b26abffbc4368077384e73393e51605edda17dae05ab7f2
SHA512 6903ae3247f32ad79c60a2062cd6a7bdbf5a7c9db1bdc43bdbef4da3396945014d30968ea4c8531a2d0c7b695f1ea36e2b8c51bb39cc6157c4096ac04a6e187d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ja.pak.avos2

MD5 d07645f071728382270bb057b0039ec3
SHA1 49546af9b338e17e9fab00c7b1f7f1a769602aa9
SHA256 933df49bab27d8cda3c9607a77e3b9fe4aeb4e31b1f83dc797aa4acfbfd4b91c
SHA512 2e1409b9fac68df59f9b9a4829cc8ceaaaf56a2801e287f82c1e58953a16230e3480ee7f67fa91df78131558964d27db8fc97b9ad9658e351e74ed09e58f20dc

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\en-US.pak.avos2

MD5 dc40c180fa16c9f141701b980a9c9656
SHA1 afa3b990588e94bb14223af2b6e26307d68f9998
SHA256 cebc0fcec41eb03ac7ed95d852fa28ca6accf24299695e71e7b29d0dcd821fa0
SHA512 ce192f7fd7fe8f67def56b79a68b3a3dac43c434362d063046729981d5860268fa1c99ce63238c465595ccc970f6620eaa7f5ce975b60e5c0b52d6615f4a0ffc

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\MEIPreload\manifest.json.avos2

MD5 c305f0dc4ed0fba6d059d902d1864050
SHA1 faa4acb5cacf3549e7fbabdc6c3f4da4525d62ca
SHA256 fd340508c48d4e6506a964e28ad2fc2f5c5eef6a5acb129134fefc5248f2259b
SHA512 534a5b732b93949ffb4b2af84ddb03dd43ae7cdf221366f67d666d72c0b4c1cc07b31c61a19dd388fd84694963655147c316d0f0d41fb21f2b13621289f49135

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\MLModels\nexturl.ort.avos2

MD5 cc19c121659e9b163726e4e5615c2ee2
SHA1 adef095bf8d6e7d2d03258f09113043c1f05ac10
SHA256 ae9121eb265ed3fdd7cbc1a514ad2cc8017a4b352405245bdbf82433c69876d3
SHA512 29d3058fec780dc7956c3863f22e1eb4829fd22adf2e21d1cabacaa9a6dd5021d7772dca4ed7c1bf9e6501ea6c3f87880a4de8a1332bab38a2e6c63296eb62da

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\MLModels\autofill_labeling_email.ort.avos2

MD5 cc2eec73ac6a5d12f036dd46223b9d39
SHA1 a53d0a1f62290aa7aec6aab5d1d9880bcb50236a
SHA256 1836dab39293cf33fe75e7476540ccaea6c345202dff24e9372361e87031c291
SHA512 c7f2371d9ef9fde28b8a1e91260c0113f07fd0701d5e55a690a829a1e3ace0fe82d0f48aefe32887558c1ac2fcd3e2126cdd77a41495a8fd8488e28fa9f2442a

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\devtools\ja.pak.DATA.avos2

MD5 33ccf154668a6ca570bd5cb7098b317d
SHA1 d7c04d20517dab9f35370a45b920c151a70f8a73
SHA256 67aa2ea041480794b81555bba50d5e06e7a1df49a3986a8908de717b134a8ad1
SHA512 e338b1207809a1157efa5d2cef3224785fffb1c4df8ee7dbe05e0e3f5c53a670f68524ca6eec9db5d7e4c2bf9559293ade5db0c63ff26352fb716aa7fa6a531e

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\zh-CN.pak.DATA.avos2

MD5 e5896b24c81bcd59905fe42ee4249f91
SHA1 33f91105b8b87adad75b8b1aae5b3f95eacb2e8e
SHA256 d3284c360822e1621257f947ea13aae988fa77d0d636574438bef6801db7fff7
SHA512 ffc97f31e90ce7d0d6de97b5a5914a3bc4b3fe3ff22a27ba40dec459f4da05691893a7d772a27d60c80427bb127022bf3cd0a3c4d0b60901e44db87dc3ae55c5

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\th.pak.DATA.avos2

MD5 30efd6eafac1313588cf1294cae6585c
SHA1 bbd1a092e7605fca24c616eecd2c5885d4bd59b7
SHA256 b2a98306057cce665380c9a1ccc6a1af6657ace9b18ac91d2a241b70f170811d
SHA512 43ccc56d73c71812bb90357d0900176c1856baad7023dcbd01fb90dfcb63f49c791e974093c24437b707b9f22a8b6e0e70832e8ccd1f04c9348c59c9e9d4307a

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\qu.pak.DATA.avos2

MD5 5ab2560b1b0bdfdd724d91cb7906357e
SHA1 5ca97aee4403aacdf513dfbbad34ef76b54ca942
SHA256 62a9d50a0d569a0d8077cc1da15af7fe6a4a5c46e05bfad39ed6851b3238552a
SHA512 fab7d5048c4753f53d9651ac6eefe15e299f2797cc960121eb5f1228c3db5cf1a45cc2d3f3fe11fb89c3bd9b015f626aff872fe1314519767c3f863b6ffc4686

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\or.pak.DATA.avos2

MD5 5e81cdca3469b158e994a2c91798f207
SHA1 702383df62934caaab74aa96f09de9f66fc08a82
SHA256 ac96477a0f7e0ab7fc1f1d72c986ca58da48d44e25ca540d082b03a5484dba4c
SHA512 0a418fd42ce1efcf2e3b38087d3ed4ddca69d900c86b3eca4f65df9501c095d5b6c7149c688cdae9ddda049196e5c510aa3619fc5d3d8ff8a92ed6c930045a24

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\kk.pak.DATA.avos2

MD5 8ef47f88b924107e0c5f0ec58157858d
SHA1 c3d8f4716f23b1b0f79c5d5a7a4086479d3e4974
SHA256 83dfb22c82d42be54372c04e90b8a3fb5b52050d8e7928e733b54d16f811e7f1
SHA512 30cf2531fea5e2ca7486a6b282eacebfbb233c5d357738bd976faf8b7b540b1352b9831891394c5bb2bb1754401eb83eb79a5e524cdbda036b79dfe8d31cb6cf

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\et.pak.DATA.avos2

MD5 348efc0b586f08ef00f3389f84531f00
SHA1 d2c5c6756e08f090416a4a2d7002775d64449beb
SHA256 330ef95812c3a83e26388d8ff5dfd146b5d8b86bcb8aad35c4312f92ece01ce9
SHA512 6fff84a4fd830b2b3bbb45177b8aaf185f2d49823ff1c3633aa829e40217fe585125682da1d37665d7778d611ff377bdd9ebd99413ac459511fab98e622fe1cf

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\msedge_100_percent.pak

MD5 bb56c00080c5369cab07d58530f97262
SHA1 320edbf17cfeac242e5892d83036acdd22347146
SHA256 2f681f9c60d49c48cafa9d0b99be54d18c7bd7667737a922ce15f3426b7497f4
SHA512 8f08c8b250d7487da10edab774dde3f66901760a4214f19a5c32b9dac868a5cae8647b0b5f4b22a4937381652036dd0ee95c3b8d2dcdc9c48256403753a2ecd7

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\sl.pak.DATA

MD5 f472ab7378b3a3f78ac854704bfd7b9c
SHA1 b3ea670bf8eca56fcc21c8bcb3ace3464a74b99a
SHA256 285b44a5eacf4ee495bb3cb83cd437faec24015c599f35b4b001cafa6bb1f4f1
SHA512 abb5ed281885a49ad6c636eedf62359ae350b4d409e043611e7f9d4574e6bf510e4352f35a51937bd18a9c694cfd3e9e30b1a5f74c5b997815fe9223fc73f03a

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Extensions\external_extensions.json.avos2

MD5 0b3d6d857c22654ecf061488b198ed0f
SHA1 7dede9dbeef4f89018328243b50508c21d77d0b0
SHA256 040edb280446c5021ea32902848366ae9fe938aba1c27e3e9645664bb15f3838
SHA512 490a46d09695003fe5b97a72f219fda2d881a892d44d7a4cd73b39fa17daa02964e10deae6234f8e03ad2b554c5eb476e71d6eb622fe77b98e4a0ec781384117

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\identity_proxy\stable.identity_helper.exe.manifest.avos2

MD5 8a083b4fe7c4280e2c16e65f7ca93952
SHA1 e85acfef960d7e38d49ccb419ac19920db960221
SHA256 c376a7628a081b86e357fa33c74a9aff487faf533b35b8bc58ae822a6729a283
SHA512 18111ab927ac6fe326db7d84f3e9966f9520f340fd1fb000ed5bc4c933e9ef9e72f77704ff28ae54527aedbfd1d29bd6c8d650e1bd15452846b0f5c8b174a89f

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\identity_proxy\resources.pri.avos2

MD5 e34a3bdae5477716c096644fefdf4280
SHA1 814aff87e7b572581e8ce080db23ce61977b9589
SHA256 0a65e29c2bea2f24f779cb284781e13c274764b1273c46bab141efc9c6502d95
SHA512 d51eab1c0f959ec82776646beee21cf71f0fbdc7a2df35166a18ee4f2ddb574a4851b1d1b9bdbc4a15b0239f701b8f37a1e4d04ac92422cf46b28389664a9d84

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\identity_proxy\identity_helper.Sparse.Internal.msix.avos2

MD5 4cc8becbb51e5648e0e843676a7523c6
SHA1 a483e9b12349f93c86894104b44df492234402db
SHA256 d7a364b179c2ee01e4163bc8c2118f6ce051f36e7cfc9285d1d802e4d8798efa
SHA512 4f6af6b830f2989fb65fe8c34e341f63eb8e9eaabe8195a00146a0217da40a8daf10d2f01ca87caefb2a7a25c69fd121e45fb7ba153a4140ce68343e75f66891

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\identity_proxy\internal.identity_helper.exe.manifest.avos2

MD5 c73c3531a212635ae9ce6caba86337e1
SHA1 3caf63dbe270cd78db65a4d88602a1fc1150a32c
SHA256 04335d3855db9aa494d876217232ccc7c596cef0bd6894802fed49505e606969
SHA512 d5baa3dd3ddfe388150e1402fbf959f8284b1590c734dbdfb0abc9aa8711abc514d32b18fb5cc1e12a82b4162729fa1365d398f0296a5048012eb2ec82ee293a

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\identity_proxy\identity_helper.Sparse.Stable.msix.avos2

MD5 2202a48e7e0c8479f63551294a312b15
SHA1 589d097bbbaa9376b053fad064781c527cd8fa70
SHA256 d95b734edb70ec8125e66b5f1756f31a3e973b95496e9cf561b5b6ee203682dc
SHA512 4f17afebf2a2b92ee183c34a0489c642a3a187c0962597fe1e916d737ce5d0f773c5b433e6d77183e53a25b85cf8187fe464229a5934d255c741066b0903c6c1

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\identity_proxy\identity_helper.Sparse.Canary.msix.avos2

MD5 43b776f4eff80ce6c93f9e61c235a6f0
SHA1 7cbcc7ca277f25af2e996d7e9e5e325155edc6e5
SHA256 01b68c5968cc01b5ca42f1a5100f3687fa0a5f07a65d572c9276d3d085613017
SHA512 e41cbbfa16e8c6ab729d9f009ea2e426d65989b330e87065767da349930082605495de66c0f6783d08b5c94f7e45473f547b111987ee32cfe0d30a0351919916

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\identity_proxy\dev.identity_helper.exe.manifest.avos2

MD5 b51fffbabd38a6553f2549e222705ec3
SHA1 d243712240209f73ba5711b87815fc04e65d4738
SHA256 278da8067e56ab54a03a8f88ebc4f163e78a7afb2be3d3d320a13844e23beaa7
SHA512 f038037b736a5a3eb1ce3ecd53ef44238eac1be53e3e7398417c88809e85d5f41d270486cfa520ef7166dd510180a29217bc2605ae096eacddeb801344b5607c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\identity_proxy\identity_helper.Sparse.Dev.msix.avos2

MD5 2e6278f28ba617b4024af8354a23854f
SHA1 d70b64e5b24bc7c781cc52237a3abfb6700c2adf
SHA256 589586850d39bc0c2d53eb0fc49af2870d1856c094558a76158c2cc43c696df0
SHA512 50f6578b791374b39b580b1248b406e6df588ee9ada145c2ba5cac30c2d24844b9025b0f33bba21561f7d3db8a286b4b77b702845d4263de23deded28abb9525

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\identity_proxy\identity_helper.Sparse.Beta.msix.avos2

MD5 dd16eb4f3d618087647eb7c7b162a26b
SHA1 209c3c67a1739ecf61eff6a243eb643f2bc0b8f7
SHA256 3c71aeaba7b2532c324440355098431378b42b9f261dbfa03f846564f4981ff7
SHA512 38948704cfd8d7ecd4756f982f1b2c10f6afb06195d318b5355b8db22b47860add304e70030cf369cd01e2f5681b574e520970b5856ef848787401a29e9ad9b3

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\identity_proxy\canary.identity_helper.exe.manifest.avos2

MD5 928a7651d85957fb1f350fbe5d770591
SHA1 9d971e24f2e9428c3dd9db5dee1a844b1d9bf3dd
SHA256 0211fd0762eb9bf708326bacfb6ddeed5007e42d669c8493cc2f236d91d6abe3
SHA512 5fe036d906fce5aa70412f34a192dd4283debda2c20a2316228aaf5aa948ab31706fc43a016f089d13fba0badb374d8518484d2f17779f5f0d760c9254c5707d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\identity_proxy\beta.identity_helper.exe.manifest.avos2

MD5 2e321640da8f01d00363c866fc646bfe
SHA1 0cdabea01e9051d8cf8ecc8dd80e4183b494a611
SHA256 4ff7fa1ecadbec4fa1432f4da0e01b3efd87197f129d64e19d312699655bbfe4
SHA512 824c0a7fd18db5f78c8f6d720148723df7df7a0ad902176222e61bf07b83753411e6a61c7d65a62df13cea360d28f06e448cac1c232caf50e0bbe475125e139c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\devtools\zh-TW.pak.avos2

MD5 7c579b0b26fce9ef1cb626f84b71423b
SHA1 1ad5dc894b2509fe57889d6fcaacdba741cdadd4
SHA256 cf6f91f00f0f0c986af449839159853e9eca550fdf34184c0c22dcde7f3c353b
SHA512 a1a94bb5145d30eeebe84fafa2c37c23a4249d86ddbb1aaccd7fff6ce2e9fa40b28890d8d3773ad654460c9c4ddf2b39667f5767c6e2f872982b7aa45943d840

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Installer\msedge_7z.data.avos2

MD5 dd2349216ee22dfafb633cd032575573
SHA1 a1b70ae67e2fe683d4f4416c0e98fccf4f25383b
SHA256 2c8354d77a7cd3f559e401dc2c16fc4d5f8d2033560ce91ea2b9d53e6ea6b982
SHA512 280fddb30b0200ac4b6c6723d6188c68b428df424694ab8f1af5c8425b827323d72db2235cf58f4fc481331fb32049eb60110927732774030aaea22b8dbc4c9d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\devtools\ru.pak.avos2

MD5 0bcaa8f5053cb689b358d4ede7e9642b
SHA1 dab1672c8f4cfa16b96ad23e98bdc5c0daed241d
SHA256 e3782e00a137838e733c1bdc5521571eb348848c6f0e9a95575705d8a70925a9
SHA512 11982f815e9a2f6c9f2ad14f2493a766354f150b88c196b6fc70edd098212e64dda8ccde836e1c85baaabb8f6eb8791ff454ef152d5b59e42954adb8cc375a41

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\devtools\pt-BR.pak.avos2

MD5 bdd3fa138ca9dbc102ffb99239fede81
SHA1 d5fba548bbc93d72d6024df6fb97e6273c7b0e8f
SHA256 2db563de0e455da31ed6afa6d4574eb04d5e758e703bf94bf1d3b7a56d376cca
SHA512 7626497bcd72c2bd8494e25b3620fb6229aaa7d8e04edd31bef4aa481deb302767b40fda4a0b7715445b7da8d9b0de4a43a4d1e94b49579c0318c5b13dd6ce5c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\devtools\ko.pak.avos2

MD5 576ed719510e463da6ac5af5868a7af8
SHA1 6b07cfdcb66efd91781f783e2b6e6ad80fbf3e80
SHA256 3176b2547b7fc0e7eea65ace376bd7cb758d1c3d39e4b6e07d8eef0a71600ee8
SHA512 75155e7ced42e6371db399b33605862529da8e19f2ec984b0cfc7931e02d36d2063824157eba842438c222b0bc77a7cefc26655b5a8bf319cefc741824b57aed

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\devtools\ja.pak.avos2

MD5 3ea8f7ba73fa1b9cf34307f535951ac5
SHA1 9e0ebc2db6ce68afbb79de57698e832bcafa880c
SHA256 44d0a18c48e2f065e8f5f12fb73e89bc75c1ebfb9f7cdb01a0c5009105300710
SHA512 cee34f4d6cee6b60fc55896cb425ed972d40bd1d5e80c8231e7849ccf70b78578f8e930126fc546d528e7ba175080d345f11604bbf558205c5b66f533b6d338e

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\devtools\it.pak.avos2

MD5 f2cf1d77f86a4d2282fcb3b379c2e629
SHA1 8cb53d598146512cb3024028a3de7d04c7eb121c
SHA256 6a61d98a6c15ea92f9176834b3feed71949900c7fb4f0744a38f93f374beb405
SHA512 65c261470b642a9ad6766e7dd4e88cd5336e8e6ed28d87ba0d45cf8a54ca3692b930d58a4e19d1b5b9c5bd8fe9849f71f5689fec4163c440048f1fc199319975

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\devtools\fr.pak.avos2

MD5 5687f4bb554be39317766779318ab66b
SHA1 3dff7d4c5ae32b14f4ac32ffcb75c90e2dad37e4
SHA256 77086c380868ffdc84f0719bd21a4b6b5f73c94532d4f86cf84b9815d082d87f
SHA512 bf730711a8e5e1b322a2db299c0862caa76ef1ea33c52b93f56676fb76911e9a6c146421b7553952743ad989d71165cced0ef0b03d1d5acba62c6f743bbce63f

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\devtools\es.pak.avos2

MD5 b8d5ece1b6ba7305f16b74286a050598
SHA1 d5e215230be35838b002fdda2af6fc1275820021
SHA256 8c14226e589347f83f645b314464f0abb9dcf54506637c499c4b7f9d4b17890f
SHA512 51e161f441ce0ec2f51325279f9162ce475dcca214dbf71e2773fd1ce536d109114b63dcfa1f39ae9905f0a0a1fd9e3514089c084b79adc78d6affba81c55bb5

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\zh-TW.pak.avos2

MD5 ba65d0004492e8fef8f20b0922c00802
SHA1 b583344c58f2fce2870083251424bc0fde11acc8
SHA256 2ea4b08d35cba23b1bfdfda92c9e968068007afe69a7508d236bf46b8ca1b91b
SHA512 61ac9fff9a23ffae09b39fb0ff406666c4b0dee3426684bff40500c9818f02fe3064debbaeaff161e739f1de4bf0fc5b48ba7ff80b65311b0eaaec795f4fa071

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\devtools\de.pak.avos2

MD5 099de45294fc52249e7d77192b234133
SHA1 9dd8c3c4c655895282960ae469624821b3a877ce
SHA256 c4f156942992bc9ff3ee4ea853cd896c7f265b36be1e3f2f6ca8d296161cb339
SHA512 8f465d152f837484ac76d32cff05c7bbef08063cf1cc55e0018f62fd72a460148a583b38470530bb14eadc1f1bfd4bbff7ab143ecb24e9d46697fc9dc80ddab9

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\zh-CN.pak.avos2

MD5 984821d262051daeb0f742d7d6a024e7
SHA1 7fb7f541c0f1f70bb9513630d4a03e9b2f673237
SHA256 d11a3abe85dbb32b176b1f24841a8da9b50e5b70cba49d35aaa637bb611ddd9c
SHA512 bb81027307075ba8fee265bfbff3ac41ca17e58afb924566ce3ef1e824da48a3406d08210d5192bdda25cd73d030a0a8d1ef92ef26e955917b417389ae077b36

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\vi.pak.avos2

MD5 ec18754ea6cb7ddfa04c6611932b224c
SHA1 7194c3c91ec7a9aad4ded51702381bd41dd80c21
SHA256 7c0eb5f8a728546c426cc0b2df27c7f98e18c80131965d77f4852c49c4ebb3a9
SHA512 3bbe7ebdf7af61cbac6d7255c5fad19f6efc7da73482e06b5e93e1f9294a1fc22cb582f7d7a9b2c3cac7d71de6ff70f758a56ece2fdcf8546f5b8f324edc2492

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ur.pak.avos2

MD5 1b84086ecc941a525d6ae54407d5344e
SHA1 2aa39023ab81f99df99b629ea82133eb7979f81b
SHA256 1020acad997f8534261878b7169979d8da72182e7f0f09d4bc7c10d26d675e87
SHA512 58095fca26ad9cadc0b8efcce82240df7c2cc6aa6810e1d957c89439e54ecf14863e9eaa91ae6a83ad7817c11e01c465258538e3263f76562ea990f52583b9ca

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\uk.pak.avos2

MD5 556c09ce137fd9c0b0881ed5bf285a01
SHA1 3db4d264751333b86ac7dff8ddc14f2c2677dbec
SHA256 03f767351781bae41e7734edc0442734538f37100474d3badfd5d03796ad2be1
SHA512 1df5751b35b7d5e36992a56c7622780f72d309ae6561a4ace49bf3d571d89337fe94b277226207e65eca815c28f1b723c4db9ca4d507ea65e495825b09ba413e

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ug.pak.avos2

MD5 b35dbd8da8f8da16aed5670de784fd92
SHA1 b7504f381528294c280f9b47360e4927003ac874
SHA256 ea513a40ac01be980072e61b5fcb7d9ebcfc2265d61209946de0737b16ed8ca9
SHA512 728d2189f31ad90c2889edf2ff45e3a9f224c2f9b84f517ac1f234855ad617849e65d8d9c45044ecb20ff720905f8d0c89fd7c6a1c37b1b92c424375ef79f464

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\tt.pak.avos2

MD5 25ae3a7d951616b12b740ca4c0f06223
SHA1 6856366252d8d664cdff8572f67e50c99725a98b
SHA256 c21f053293ce74b3ee90065698c4c92b267da22e84608cd840594a3d12bcdbe0
SHA512 f5ce59e7d2866bffabd19c00930615fb119ffe03e8c35c2729613d509f414b6aa1b1cce753318853a6154cd5082c203e0d588fb917bd86bbc62c870a4ab3345c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\th.pak.avos2

MD5 d2f5bc8f6fd10c0c82611c9374e1f877
SHA1 9b3d9cf23a84386ccb126e0d0e5b8e0b1e89e093
SHA256 313f3a33441a55aa1cbc0e8e3af9aada668bd392a0161944c2cf030e5c6ac1a5
SHA512 f1edb20820e928dbcdc0cc82940dd6bc3803f51898e57220f71b3886f84af23dd961c3b807722a2826e49b558897853dece09131edf5425aaa9547f6a706c014

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\tr.pak.avos2

MD5 97448909c53afd06cdf6a4db819ce7f0
SHA1 ee2a2f1aba5eda547b395d674a46aa073447f9cc
SHA256 3fa3f76dda3635f10feffaadfdb573e29f86ace7c6b962fd2bf049d1c53aa888
SHA512 16e36e0a7bcefef159fbe7b14dc7d1b3c0b440d860928d51a77e23596d9e53ff5a7010de4b33f3251e2f77ce2af3f8222cb1ba6a1719691e1942d33573dd761d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\te.pak.avos2

MD5 e385db891e142ba92a0e370805d457e5
SHA1 9f0a2cc5419f83dc901856e1855983388d32430c
SHA256 7b56aba7360b15bfb81240dd8adb76b5633ba86b5baa5a3f430619a1bfb6e4b8
SHA512 7da0429cf1d72e64cb317d35d915d8708a0b8a7168bf6dff772673f5813ead2a65c1f48cdaea2c84cba055739eb1d12200ed41c61d216a80c16f2464eb497a5c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ta.pak.avos2

MD5 ed6538e6c28383b1929b32fb39e2a861
SHA1 951509ceb83d44f754497ee8b7ac3c25bb851a62
SHA256 0db86d17a594812f3ebf5f5c31f4f15ad8257ee35146ba2d8faf7d35a2defef3
SHA512 764362123dbb4effe68c8b675d6199807e23f57f1b13012eed205475574498de00358415694076dcd0a8062efc5394d015fa9ee61bb466e8b17d21dfa038b54b

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\sv.pak.avos2

MD5 23bcbb1c22e9aa5e60ddf68811f380fb
SHA1 cbde258b87c3f33d48373892e02dd0b174422da5
SHA256 5e955963377a530281ea9bc9f7bdcfb66cb9b906bd9137b2ffecf004ad6a8169
SHA512 74b0e3120ed87bd5a394162e6440b56c590929a29fd15f8d2936614c94ca7aebc2cef5f83c4f968647272e8daf24fae488180d8a8122c8ae04dba4243fb18ca6

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\sr-Latn-RS.pak.avos2

MD5 647400597e89c9e08729e216075d61c2
SHA1 6668a5a3b6209b20e1b4a038226430ab4137ef6d
SHA256 f3724c4ca9cfa27884ca09bffdc874772c4f3f53998a68b3b62beca75f2705a6
SHA512 8c2e03d034c5d62ba6218d6c82140d5f215cdc073871fbcb33dc14bff96d0322259a556c8837970bef3022d308e15530253073068269ec472788d9f46aa0614b

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\sr.pak.avos2

MD5 24e032910a609a642b26059ce14fe5ff
SHA1 f228b178f4973c7ae5827e344999cf19a9780ebe
SHA256 6c5eb7842895d45638dc0a0cc4ac200b5e1823e7c1918b854a59a81625a51bed
SHA512 44965b80db4c45c0b3d76d9faf0fc743f3044087e2014dfb6c6b75e52fc8dcf8154c9ef1201df6c8c80e2b12f7057f157fca7e01a4b11a570134669db9455125

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\sl.pak.avos2

MD5 f00a04d12de645b1bd63eea8458a0d0e
SHA1 b5cbe149c28fbf9306579216d0a7a9d684f9d16d
SHA256 08251adc7702894805813c2c593f965c07df7b61b8f86ebb0235b98a6809454f
SHA512 83b4b54142d0e429feaa9552b9d8605392ad76c94bf2f2a7b5fdc23aaa018b2f2479ec52cd58bbac32cb7175f32d536d2a31764fef406ceb567fc87dc4808d9a

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\sr-Cyrl-BA.pak.avos2

MD5 32b7e468c399ddeadb555fcf9bd55f47
SHA1 ed5c63ece41d99833cd84f8c97dd526332f03785
SHA256 335b628135c0b9cc29ee6c9f7a3719da0515ffe820f8ba1ef97a0a4430898e11
SHA512 0e6b5d678c7530a0be2b57139cca2524a276b11431733bce369233e36d668207b8c7c829f516d93a698b66cd444fc66968117306addfd0a528e4e20e4de4298d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\sq.pak.avos2

MD5 96e4ebdab17c7c1ea81b2524c09de826
SHA1 c97cc3bcd3183d9a38a39c3ffd3696a278e2096e
SHA256 320656d0a99ad1b5ed7142a54a91d3cb865a72e035204a04493762ea57fa45fb
SHA512 1940ad0caa877cffcabdf1ccb7a036c25f8fa5474cb6d8eee0153884afee2f7526b7f0af88ed008b65aff7074d720a83ca4339608d6cec2b6b3e125eb8173e49

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\sk.pak.avos2

MD5 c3e3288d67938c188b0d61039b50dc87
SHA1 6079dc2899efeac5046e24795791fc41e274ed6e
SHA256 ca137325a27785ac51a8a632d59adfe59f49c8bda958c085b9707a446ac17bdd
SHA512 39a8cb9ebbe697e76b809543f3e2f7060e70b9bd8544300441794656fdb2303aa8ce9d74390a12954b41644f533af4617eeef0f40506ad2aed96f7df4a9f0c0f

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ru.pak.avos2

MD5 db93e1cc0019e747f65025e23b058c09
SHA1 b475b20627e7343be1a47d59a2c8f6b56ed0923d
SHA256 e667c4d9d42f2d20c43b3650bbbce455cf27457b53289064482466a7333de596
SHA512 15680a64e5d67390d6a1b8d5625b3a5274706cc3ff488b0bc71ee75e10d3a6ef58a3d11d28e4894c126817f2d27232d8cbabf5bcbe0c4cc82c32f980d4c2efc7

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ro.pak.avos2

MD5 79ebc02ac625aa324667aa4324079305
SHA1 d9983d6a42abaf646204c4e275506b006690317c
SHA256 1ee1693812805c67a53b5c7173f6c65451400db8e2d0a297a92d9b7e44e7679f
SHA512 3a9435aa979796703694ee70c296c423eeacfcc476d58f828ada46a69d80cb7b814eb8056f360a8088580aa4d1e3f7cb9d69e2a367a5083b9bb8f13da93e48d4

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\qu.pak.avos2

MD5 0e5d43497a27365bfe03bc9630305326
SHA1 fdb411f8577f77249600faca5c6a793a46864f55
SHA256 1d7c894b1ada51ccd1747b811330c72c1cac4b87b9e7f42b4e37d58693db572d
SHA512 bddb373cc1724dd0ec44c70ac5a22a2e8cae0dcb77dcd5e3e5e946ab1d4bdf332c0966c7cf3df0b79e673d0c5c8775f18ba22239a8c9e9db13779ab75489bb1f

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\pt-PT.pak.avos2

MD5 fb9d3f74cd4d5b387ecf0eca88f3b256
SHA1 d412294d00e96c261c090902f39eadadb1e3bced
SHA256 7c80035668e9c8aa4b6e6562f31907630b91ddcdf5214005bf0380b36c9eb6f3
SHA512 8d51e6cdca8181eb97dc0cd8bde90d77845456a0c1135df7e0586ddc0f519840163b3e13508cd7eec0a86d1df82b9127cc0f0473b5a7208f8c71842185acc1eb

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\pt-BR.pak.avos2

MD5 58ae0970d58e764f6ad4dbbd5a70d40f
SHA1 76720cc3b7184c77f00d69b3359b0db33c6a4aed
SHA256 202f27d74fe433b17f57683b80aa26f80993bce068b7d33d2e118c33ec69540c
SHA512 c48c6a198c9fd7a132419db9a40a8e1627d20be73b008cd110444ba45779fd649633c2f9f92728f26a2eb60d91c99e01862607ae7fabd82d3926adf7cad4a2be

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\or.pak.avos2

MD5 8428c6050bbaadeeb60cfb9103087d7b
SHA1 806d0db57259700e94d3776eb3d80fabfe9d1fb8
SHA256 149d89df5d5802e4d5c4150f3cdde5df9b97921ca2e3c5d8acdd2b02d686cc78
SHA512 38ce43d4b160ee769e8d144baa2a1e8df8bb16d8e3d1def822c3e816fc1b85a44c0941c568cf3566b6e391982a5ec4c37340f29a3b2f098efa0aabda16d24892

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\pa.pak.avos2

MD5 74fb57d9ee843e4a7f15e035b98a31ef
SHA1 22c785d5f2aeeb4bec1a11d5d442c6b162190951
SHA256 859767a1178e33cef3b3c404c0415ab90272bee047e46654fb215b53eeea446d
SHA512 9173fc4b56bb418c7182003888e1113e4195ff2543c9df71f52c61e3e903ba06c81dd80ae6edbb23236383b6b388b946f785e72fc18cf82e23044a2206837607

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\nn.pak.avos2

MD5 d838aefc81c283a6b1a0364272073962
SHA1 022a5044f941462304b2cabcd1de190ec26152a1
SHA256 c0c36c73e73c79f134ff1d65dc28c3f4d0061140411538fee88ddff1e6d68372
SHA512 1f7c192b54c07083f51c61f692e652bbd0d6e94d84b900657a5a8ff558c17d0632218e8f03ff5ae2b28f3579b6d6a0bb2581970ddd6ae8ca5a68112b884ea4f0

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\lv.pak.avos2

MD5 bc5111ac03d4c1ca97a3ec990310f8d3
SHA1 3deff0316d981188cd67c93c5df891c7ef8b0cdd
SHA256 6872b13f5f69dc0f425648edf8bc6a7a4de85bf8acea1c3c1b8b75daa8acd671
SHA512 9b7196ec8ff0d0b16aff25b8b76807aec3c0a836d8516fa6fec32015915148bd9a542cc1021e4da5cfa7383f513da6a8b906219248b073ad2a14c0258ff3db53

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ne.pak.avos2

MD5 69dbbfcf3157383cdf602cc33ef9f023
SHA1 5fb4e8106f919ebadaef25aff0d33b5e6d04f81f
SHA256 76d72846f6c778a75513f9d76266acf0dc2f70047e93a2538379199d77d676bd
SHA512 440169ca294873d70ecfbb166c0797121e34904ad8dd96c2575548427e6d8ef9b1ca29bea23ec207109693fafee89bf4b35f259a1615aa715529047a2e07a2c6

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\nb.pak.avos2

MD5 e7abeace8c3918252179c7a5dbcc4406
SHA1 551d1f3a8ac52b030605d3d321357ada4c9d38a6
SHA256 956b6a3dc55b6da03319040ffb8a44a76d6e5d3b0f4ffb3e6f2c3f107d5507d2
SHA512 4949a778eae6e8c73ff5975e0ed62a1164fada0e5ee34e3b0b95188e72b7f016ab5ca416b7547467c96880dd182549d752ac1479e5971d8c2298a87cb7b77bdd

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\mt.pak.avos2

MD5 385944ea1adc38f81308e6ba74cff6ab
SHA1 d14a0d455143c12d6eae43d8b49a4b8959508e24
SHA256 033c6c0f277773bc151b693f3649108b97ec08dadee84bd57e65c12d64e34cc8
SHA512 994db1c6a00c4f42abbb9579066f20e4cfff0440c6c03be2d0358a56e7bfe819c2802b2497747973dc357d21688e13dea3f428cc66ca2c9bfcfb834704b04238

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ms.pak.avos2

MD5 3203d2991b9474896b2c667543709953
SHA1 5aaa7941fa24bb5a3bdbb404797479a6eb628ef0
SHA256 b8a6b5deb8d33c20de56656925fa5bda41d7c14fc9246d4ef103f0f5a6cd4caa
SHA512 08524d11507d35fbfd278c1bc961fb7584b4f1186694287b601d6de356680248dce819fc5af1a382c2bb0d444c36ca99d14a8c91dbf787072efb6896a435a82b

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\mr.pak.avos2

MD5 69e3b298a380c35695b526ee7481c65e
SHA1 741dfd07746347171e2ed1c889e8b4ee087ada09
SHA256 44aa02778870b533620c0573296f209312950d43bd9ecabbb4f59da4f54af20b
SHA512 f74fa12480b3df31d8cb68efb2e4430601d4f5d7f215685c097a7c2bd7e8c166a23f0339b56042d10205286618b0ce21424f41d770fe9045426d07691f8f882f

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ml.pak.avos2

MD5 a7ade41f06933d543a1ff72129be3595
SHA1 8f062a5bd1e1614c4d599071e6987856cff81b3a
SHA256 f32d2aca49fef42509f9293f28553a4d39a23f94eef60a18bb9b01e09dc6e30e
SHA512 901a970167cd6df1c5c7efe42311ff3d9c289a20b6a467b432171c0d0564821c1926004d24a2b31a766a7960e30b2ff4df2a38522a099888ff318eea57118819

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ko.pak.avos2

MD5 484e0e47590a98f66fccfab3e7663fa9
SHA1 1272b1193afb87a7d19fd4e55eabae33909cf492
SHA256 f875ddea9c6fc79290f7a125df999c881e6e319851727b72495ebe0f87481115
SHA512 76a80287471822e5875faf88e58eda357b9b4f9cd2f47972bc9fce92888604a8f8204cd6a3098480458456457612f7e25e8953668f823f756ca65223480b7e53

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\lt.pak.avos2

MD5 c1cd8e6cd45156847086b8a9748b0a94
SHA1 2d3d9780bc40fb5ed4ed5646fb33726b7e7e5c19
SHA256 033d7aec50692ff0f0f8823765b78dded2b9bb936e7069e4df51569f25191100
SHA512 4721ae54378c993b37bcba5de88aadbdf5dffddd256843257e8e7c92a376bd34b7158299535a23283d4ce9282ae5b062477e0e466d83bce0697e367f5929d9d9

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\kn.pak.avos2

MD5 a4449f8144cd9a29d9acf5fc5868b70a
SHA1 6a5950fceaaecebaa4d64666773723ef815c4da8
SHA256 bee006dbf4dc5207e88cdd92d91c0deaa5cf900d1ea96e88d93211aed6dd969d
SHA512 eff005fc24f618d49304f3317fc21b98da8498b9625ded61c59314a8aaf3f96faf6baeb3bd498ed3abf239558aa8bc7ae43a3920d2af70b41713128fa348cf59

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\mi.pak.avos2

MD5 65893ec0029a68d3d94de2fbeb1d38d9
SHA1 2d3bf3a9185556625f34c110c9a8f067ac320281
SHA256 bd4be75e6700871e5d974b7fa2d628cdb3c5d1f8738842e04246c0d7672a3356
SHA512 775eb1f642a922a98939d19c3c2e01849910542bc77117f0e9a1e57ff0c10a17aa68be0561338755ed90911862104e6bb17e005cb168234f32bdc255d6b44f43

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\mk.pak.avos2

MD5 7c019bacf1509c4fe3888afd48633fbe
SHA1 f4ed8e966f50a02376def4d1f50314cfdd457d68
SHA256 e7a8c41c77c8ecc7f35ecd416096ac3950987415135336d3abff168d416eb7e7
SHA512 a15ba3446e8481feeacc332785b2f7840d0bb4bf31baa4f1b845b49c0e4d4e39f5f1ba3ee9015232de7021d56fb5948623a1747bf51adf5e55b2c9e43965d079

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\lo.pak.avos2

MD5 acf90e9092b295b88d643d555d38f9aa
SHA1 d0289266a3a3ab68e7ce302b062676259dda078b
SHA256 777c46c38647362447304b00b7f3bde43053de53703a06543ba9085dc10907f1
SHA512 d827b912634985cf19271ab19a4d89aefb31520122bf9ade820bbf8b147fb24a075355736832249df0c739d69f5f01385501683dc3beca7444654e329ac4ea99

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\kok.pak.avos2

MD5 48ee41b6538dc20e81cd2b81ad52bed2
SHA1 ef1587b504bec5e8b8f083197fb350fea46f6bb4
SHA256 26ba055c0c5da7d7ee36075e4032acee2056a4bcd8ebad541f4fbb0c9981e1b0
SHA512 1471880cc408a8ccf63b308a0e9a217a0b8fdcee75c9c4cd62aee68f3229c8f8809afe3bd8312f6d31c3e2a7e8979afd2e8162eb26a10d448417c8c9f2ce4fb5

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\it.pak.avos2

MD5 727200a5f8a1052627d4e5adbefb47b2
SHA1 80904347763c2b87dd58d3487ad0b233d4e62420
SHA256 46d782eb1f30dd7b240b8f4f8b53dc41b3ac368655db3e096102ffeab00082b6
SHA512 62447d479e6ccb297972fc3538e27d8ae0e5872021b0ae00914f146785c28523ecf072dc763ab100f0db7451fd1fb39e2b90bbba7e93c617755196f1ede029ae

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\km.pak.avos2

MD5 d5bd3cbfa45a03a4ceddf77fbbcb6488
SHA1 9311399cf23d4728749ee9a12180091a0c7897d4
SHA256 e8e657df5dba2eefad0a8a2595671ba5ece7787029adc3efd9751e631625da7c
SHA512 51ad48f0eb9808e4d91aed232dac901f1939b8d9b2fa0c2fbbe308ba0cea1cef250009adb0dc563123930c3c3338b2e1be696a297a5c1827548657ae66d2166c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\kk.pak.avos2

MD5 4e28f6f5c344230f39371b411765f78f
SHA1 addcbdc6bde43b7dc0031d78b0a3fb14ae8f7c50
SHA256 482beaac6bc0441a69ad79fe070f41439728d180718b68cec43598755c3450f9
SHA512 d62bd49018ad6070ae389063c0b647cc3a9c0fd6fc39d81c73dc70aee994d8b9b6148e6eaefd862d77c5b7aa101100f557ec48cd46898f89f3ab1f9ec3045fc7

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ka.pak.avos2

MD5 67d2d214d2f5eb5a515c0057b216a2ea
SHA1 2b668b44596f91fe944864b36cf3843004bc4d23
SHA256 c33b13f1db0dc7ba2b41a007de9ce067c9da19f6fb8394981f6dbb4b78cbb95d
SHA512 e79d74c145c6c43c518ef780aeadc981c71900ceb3d10a8fa46b72b16f38b601cb630f2896f517ec2201b66439be9a40bf3d57187c03aaeaca2b55b93b9d762d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\fil.pak.avos2

MD5 a04328193b3d86e59465b6d57853e4b6
SHA1 74b357dfa786031d1d800d3309c2171f8e18e397
SHA256 c48645c0681f04671b0aac2e67f67fcb5401c38f29e5d65a5a7ffecc3aafa4fd
SHA512 efb7df7dbba1f069c88b09a469fd685a6bec54b19d0f889faf69471532cf79a8504125a2999fdc780fab36cf76ff2cffad87efbe18196b93f0196b481311df65

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\id.pak.avos2

MD5 03b04f0cda01b6b1e4abf39cbe8bd184
SHA1 3a72f8c8e64a7900673d9309df19bad9d9a09298
SHA256 9753cfa466c3cfdb4f5f3d62f9e88447e6b52ea8259e29d2286cc0b253f042af
SHA512 03f7b979900fd7dc000c8260f30e874a6bf843f849ad725e5d053bb3968dfbd1fa1f7a07c01b217c85440e369b74b70436f09b0886d97480b1782289f6136114

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\hr.pak.avos2

MD5 c51262b14f7a99d8f957bd85017f1034
SHA1 eb88063a83404b82f0a9a3b73201a25004b9dfd7
SHA256 a4f31e3f1037e35a6089a00d363be10925a5b793f41024411d8bc4deda8e51ee
SHA512 8018d6b597f159e8e8399a9e49079f6ebeaadad413649d52f7faac8f80a5f052416b913766f34a6a61ba07c3fea06d8e85365dc763afb8cc354f9ab2b79fee73

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\hi.pak.avos2

MD5 592dedf3e9a090002b14cabf22a284bd
SHA1 f6c7edf270cc3700c94b76eda7875ab713be1e42
SHA256 928d3b6b022bb9f1c666aeb2453d8c49d8f38c6f56d5d1c63f15fb1d4ad0e6b1
SHA512 a164f23fb911204f528b3a8bed90ebf7efd5d35e2ae8b1f80579c3508492836861e5aa8eef2c263e9f32f751aef6abaa77c01c8fb7e6469eb5a5096b1e69b065

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\he.pak.avos2

MD5 ba9129c3d151a39db84f791a796397a6
SHA1 01708c41afb4b3310b0f97488a5f6f46f00a25e1
SHA256 af5451a865d1e15006d14b59f85b49b671fc1c0c945c6a489b186642bc090c41
SHA512 7b4bdbadcb2ed6586c713b771661b6f1ef05f0ed576ff8d36371cfb690f5e2f6534e4b75a279f22824b2e7f3d4db20b8f9933480b185719ba34b321520bab019

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\gu.pak.avos2

MD5 8317956bd14f3dea27b39ff22a8e8c1a
SHA1 fe23302abe318288a79725c06f181518272e8519
SHA256 8871f291696dd444f13629e9927832f3f317774afa71d0d49984583a6e1e0a49
SHA512 28b2eb3fdbe318e9bc361e10776f0ef324a6d09667555326d3e7a3b484bc940863f0f6751ac25970a21007ffaf7000803056ac7a557fdb0f3b7fb54432885338

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\gl.pak.avos2

MD5 a56a625652bb6951c9a32dac65ec9250
SHA1 22b628c63a9abea3b1580bdcf2ae5c22efe13d18
SHA256 7d768679a832f957919c0fd7413c433d20bd3e67a0e9aba0f2696a03d6aa7734
SHA512 3db4b8363ed69bd1b7992bf5520faf460682f01c0885ff1c3880c0de112a75b29ef1fb4fb5b04c1a95e50d651d2303e82920383a38d8598419252e66a09f02c4

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\gd.pak.avos2

MD5 fa2e1d4231f521129354f58a8a8a472f
SHA1 6e7b4bf35318733e462f722ee5fc598e4ea77618
SHA256 2ad0e9f753c50738d95c314349440912b07289b78545c72f1668c1a338ed9e26
SHA512 2ef05657ca83eb0d69dcb78b790ba78e06773589cc31c4ebe5b83a2e129c18a59b9137923c0b088194226f7cf10dbeba1c828142047f3b0e52383c0b2ee33696

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ga.pak.avos2

MD5 4b07261885c9c3e1db3bb5ebad115b86
SHA1 d2c9ef02a51f7f7a471155c3ac9baa1d564d15f5
SHA256 bf5f7caa115fa4133daf94ff08ed1cfd144f92cdb03ba0f2ce42afda1c2a5b6d
SHA512 c70da45efed0ff39ac9e858b4aa30540904cc614e1d49fb61d87ec978c6948240bc35ced3b9e5843d7cdd5574baf33e1c8dade847012b2fc81af924e71e3a5d4

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\fr.pak.avos2

MD5 76b9ba3bcfcdb349ed3eb5dadf5aa348
SHA1 758bc53e238fddf98783ba0047cf926c2965942a
SHA256 b113712cdc14810ed4dd25ba81327f8820d656437a3f28e6b109456bcfdd5ec2
SHA512 fa07f9788bee01e2277bb6f7e770007f3f4b2579f2b2e6597441ead32248e75e941e9707623a1f0e93189cda36d54bb9a047b3d483b35c6ec641f1b6dcc20286

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\fr-CA.pak.avos2

MD5 95b3a9e4a7f3314dc069c9597b1b4006
SHA1 2e481a06c624e635addb0b35a74056d4f97a260d
SHA256 a6c693bf5e1ddbc4b3ac752633bbc83d504abe59c6a801a8e062bae06073f6b5
SHA512 9869c9821865c596139cae9f08c8e7155abdf995d37b0857bb3795305be5329705f3013256645f34d72e6e5d42d49edf12c79109740346aaa1c84f5f5263671c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\fi.pak.avos2

MD5 47c1135bc12943e0c2ab0e5545cb6523
SHA1 f5451d1bdaac0972076c8e094ee5a2fe6c8caf56
SHA256 8e3273477fd24720f707dfa4ffc01d074dd52d3a08ba2997fdea23d2edc51eb6
SHA512 4b9f23dd339cef64f563b92b37419a3cc372a420cbd3cc4b6c753dd1576cc807a4d58a491506f00aab2ec8da91b04c5a0b6bf30e3657a0a015302857867f4016

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\fa.pak.avos2

MD5 82fd5018a0c69f11d203a11018215dfa
SHA1 ab6c8f3ab291acc830545b3661a029a43b9751a2
SHA256 48fcd4c54e56ca665b398a5d785b4000d3283e82ee81175f487346ee8b2316f6
SHA512 4076f6e9d2704a63764c0e6f9f4e9b78a52551eee5104d684abf46ea18956426de503f4bbad15a085220c3ed4260abb1e0791591caed854eac206d2bc32a75ee

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\eu.pak.avos2

MD5 9ee7d59519b63dfbc7127abafad2ca36
SHA1 76a3739ade2c6867488b016723e61015a78c045e
SHA256 bc5d93f5e8afc1bc4b7f57d7fb488b2ebc4e82ca9b71b655c3df3d2db9c23d8e
SHA512 cfaa3540ece28db20c50757c24bbe7fe7cc48226d394066fc55793d9855a5e6a8b46c43c169d511e2dfc58e37f409ac38f6be7ac1afab5e5aae6d63efe56b7fc

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\et.pak.avos2

MD5 744bd657e01e859b07e3ded59e35967e
SHA1 646197cb44150d450116e32911ce413e99e60046
SHA256 0a390725dfa7ad3eaba441344162fad31a631df3713091326c33184ad9b625ad
SHA512 2d581a17d46e8373d58bc8857302d4a13c27ba5ff7326872c02aa0dfd412e911918f7319ff1d681475089d0fc088322d6d87acfd5557b7140d5170fe42bb4eaa

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\es.pak.avos2

MD5 eaee5c25373be8367d8439a61ba2345f
SHA1 e582ca47b5b377fbf105a0e633b306c1e16b0c01
SHA256 9a5eadb57fc7e27e2facd6cda0c9a1f0357031ae7bac10e3ba081199d5884660
SHA512 d20983b8de14324f19242e36212cd6990bfefd4e51e62c8637f33d4960847d3cbac9550ac5f7a0fc44421bcc6e43832502e8da7e56925b1a8397b9bd5686ee29

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\es-419.pak.avos2

MD5 b6deeeb30e0752a7ef2838cf35885b88
SHA1 5ff159d24567f9ba6ed17fa462d5641c3f12be9d
SHA256 ef8b90d2a6df086d35de011adc94fde74c25cde43f40cc6ecaf0f3d9021549e5
SHA512 12d8b411351c2842be0febc2011b204dd732b966ce6429b880d279e671e579ba5c94021871404f95629deb007770bd423cb62808c7aef7cf70965ba05effc35d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\en-GB.pak.avos2

MD5 58eb8cadea2f4168c4b8826f3d0ec568
SHA1 aed0dd44f96e03fbc7a935d494b5369011b7149a
SHA256 a4a754e7060628a748bff26189e627799761f2a82759b3a588df032c8eef0d73
SHA512 3706626dc2f5ba74d863d25fd60bcf5fe21dd02cf55e3f3da8858451915806b88179708d1de0f2a5532c50f3e22d73e2e7020951f28b8463556fcdc122609246

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\el.pak.avos2

MD5 fd1169b067138eacadc5ae2cc8a12920
SHA1 f1c03075fbaae00e56f26ad85d4ab4fa2c8fe2f0
SHA256 e0c76868ff7b09dec43b6e5f7c5240bce215b84e5eb4016cc857002d3edf68cb
SHA512 35c97714e347441a2722a3ad8e5a29decd278b23615c47a18cadcb9e30696e0177add62634631cc109c395eb619d4e6fed0361d1eef0955eddfefe3f40e5a40a

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\de.pak.avos2

MD5 7be632c9a5a2811233adee492f98f943
SHA1 c8dd899994c6dab0b04934fe607555672ff9dca5
SHA256 45ef4dc08f4253c32b26504af797b9aa6cd30001e36e8531f4aaa8dd49185649
SHA512 e48b730fd4490060e6ea374f303bdf64846e216f8ae99c877bf717f563c9df5f7e2233315fc4d0dc2519cba1d9401df094804127618424a37b7edb5b0db28731

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\da.pak.avos2

MD5 9e6eb0637102b2e721ced3d2ea463607
SHA1 65eb9e1806f8de47a711e10289c9175bac858fd1
SHA256 93f33634f795b489c29664291f4ece157c8b10b67f5cd5c65d5dc0ba08f5a8e6
SHA512 b3f619522a703cf9047b4373a3ac4657d805b8eb232533a92701f24e24dccc50b22cd83b38ef7c8f905dcddd7a6094d9a74ef5edd7eccb1a2af72b89cdb7826c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\cy.pak.avos2

MD5 6c99ff781b4b424867d42ad39a9740c9
SHA1 3c421e35f14810ab261f0cc8feb9a21bdaf7e6dc
SHA256 3b083c53dab8a6d97f3fd76a47165c5106bbdcd15197d83edab1c2a75cab6942
SHA512 8991a7b947ac71fffbb21d5c3b6d096d242cbb9c5521b1a3aed52dc5e5d73f72af1646a724bc6e2bf8161c4066ca04b2b059b56ad715e65590a8476ec9e34fab

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\cs.pak.avos2

MD5 43f0ed14f1da3f80ca62a3f90bc48c7f
SHA1 663beb3da2bde2d76c7181fbb250a527ad61c503
SHA256 5a6907b68a26ac1136184fa7a4a7f77da94e816d76341c8719a50f6ba50a787d
SHA512 5512ee0d9326525581052803c686302fef8b252075cc80b175b8e62fd5f63c8aaebae9a0864a8b9426e3b218e29370a865bc314636cc7c77b02daf0c8eb4b06a

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ca.pak.avos2

MD5 e916f9eeb5057d41ed4e0667778142cc
SHA1 af5b57f024b6965e5cb095af70bf4d2417d19b4f
SHA256 a3423aebd284613f429fa2bd027b22a9d8f05fe4a9f5e13b7800b065c252eaab
SHA512 007a418dad0b882bb549b9732981de9cae4cfaf2ffaa18e235da1e420f2daae373f00e111ad5c5a27a3309087f2201572a97db540c20d99d8dcc34b2326412ee

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\bs.pak.avos2

MD5 3e72e538f5990c72b06cac8891fd35d9
SHA1 6b2b99fbe9be6c6132883502b3deef589285f5dd
SHA256 85fc52a1f9f8a051d4fb55eeb3c82f2a6511250e111ef465ccb33cf79a3e0666
SHA512 b1d02ccdceacb1b7c67347f5548fe93b0b3013002141c1a4bb056c43e845dd559fce1312fe42eb0f2a7f0efe1b66e8b2974355d9839039ddaecf49da134b0ae7

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ar.pak.avos2

MD5 9d9859a126d0a5d9afff2d809f1afc57
SHA1 c20fa21575cf7c815255514103b872cd588e9c41
SHA256 dede5796228a62b525fce64b45423e8f7f21066a99b05904b85d6501b825a033
SHA512 494f1414c5e6e4bb379a993dc09fc86d8ea75032aa60c5b0bcc2e57900d76f5e9692f6b54a02351bae0072adc53223929d86bd3f5a2a904cf98663af19707beb

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\am.pak.avos2

MD5 43fefc16bbb6bbcbdc2f44598402ae42
SHA1 76e9970709945cea65ef3848aa6c86c3192431db
SHA256 acc0e193cdc9084367709d2db92306b8301c272c5d53260a9308fe8f955a246a
SHA512 9dd2c6eb05111d93661699f2a46ca46415cad21e68ec78edf236bbbc30b38c7924864431c3e700e6392664461eb0d5b20deff587e39949ed48beaea4cc90f409

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\bg.pak.avos2

MD5 ea8b36725752061ab1b8a9ed69f4b046
SHA1 fa355d75b82539ce33a3dd23249d66a701c5d511
SHA256 32936a78969891786b74ec8121d82e1684b52bc7ce7c8b63ad705378e7746540
SHA512 1e3b19058f2951a706d8f4d846f4f0745db7fcc388c9ad37ae14140af90d04efc894c52ebf9c6cdeb0c19b7454273c22baa2b79b1ac28c000befbb2662351407

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\as.pak.avos2

MD5 17f1a95d63b191484ccb85aabd31a3d2
SHA1 053f40dff960234b02fb31a2eac4cc782c766ea3
SHA256 00a0b15d9f06dee823dc555f572dc0c3b4b8c3cf06839f2f4289a678a7f48519
SHA512 96033a127c8447f4455256de1cb76f171ecd2083cb4b4d6c5bd3b1aea7194529f9d98412e707c677e2591bd53a8db8356188327e6d4cc14ad44d9ab886661720

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\az.pak.avos2

MD5 4f5cc1c78ebbc5333c41592dcdeab4d2
SHA1 c2de4195aeb2037bbc264e07c162491746997ef9
SHA256 19c451e84dcdbf5e860ceb8211af50de2e0fb75d791120d46a49242ca0129c8d
SHA512 332c509aa64ce4a030b9601df19e902bffbe1e6e3abf58dc49e56b80ea0760f4882b65998c283fc6cb3789743ad5045947cfb8b388a37115acbef2e544169c03

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\bn-IN.pak.avos2

MD5 b41c2db56922d566cfaffa8582f982d2
SHA1 d8afae4ed12e521ffa680bf17bfa6fc3ef8a920c
SHA256 1fc1ce3d17f026090a50bedb017ecf3b9612bb2142df1dcaaa87cbbd1ff6e07c
SHA512 35bf14cdf684374810d7e986bfa824727f1c5e344d0df79b7e246d760fb744c3332467a336c2ffcb703430892f13de9ecc00eb9c4e4bf3065c59f06a26a3e54f

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\af.pak.avos2

MD5 be6811bd596454ff57bef407bbf92972
SHA1 b518ddcfbb2b5289b00e41eae5802af9b8d3a05e
SHA256 dc7eb80610d7458d57ce9027587d9355c4d14a3802ee7d5c10c1135d82982037
SHA512 f7bdf0256e784a7d1f4739265bace8e9ff16cf177eb544983c9e20741cd5ce484c8b722e07a3c5009d96d4a6dd6f0ab1588f6a8f3e7e04f38c75e368590f0be0

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\MEIPreload\preloaded_data.pb.avos2

MD5 4c1d09e9f2275338bd69826f91c5e0f9
SHA1 03adbc82b230308c8087ee9fb32073b26ed454f5
SHA256 f5940bb41c603950b3077a94acf1f15a602ee56ef8ea36f0ed26115a3f0c202e
SHA512 38c62fbb2aa27464d16d6d3c51d04fd03ca267b1c7a80f13278d29fc0928afded9d873694e99cfe5e0124ee02f7cfaedb28da9b1bbfce2200e957d4a13c98347

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ca-Es-VALENCIA.pak.avos2

MD5 a4cfc724d4f24a6695631d3199e39044
SHA1 1b3280d6a313d39ef4637eb93da840d4049f6b98
SHA256 27f7c740f7eaf8827ba9d96800203b123034d6ab5e66b143bf2f0bf7e2e2c8b4
SHA512 c76e1b3c9ed34d8f88dbf4e47140e4989fb0db47158382853f9e0736118f3b1605df046149b3820add6ee56e89fa5563cc79ebc531601b060ec10829e1a8d633

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\MLModels\autofill_labeling_features_email.txt.avos2

MD5 519776cabde0f3240e7e6c6a14023cb4
SHA1 5b7e295c6121e8f78cf8894ce8df25ce599d6de7
SHA256 094916373a2c1b7079bb82c3c01ca541ea03de0def0588b6bfdf79690ea20ee5
SHA512 5bb1df3623c137ff8d7380c63c559df40279236c67dddcae6fddff16c57edc7f235fc784001f6bf15101d07bc4d8ced42bc69039fbecd50f1099552ac6ae7bc9

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\MLModels\autofill_labeling_features.txt.avos2

MD5 96b94c8417b77657cdab659c5568a500
SHA1 dbb1dd91f07c303009ae73c1178a821eb1ea6e7b
SHA256 f2b3d39467aee8f93955a0e887eab838a6b9ca536d6d22a809f8b4c9e6e4cd08
SHA512 5a1d881eb686d56610748bb7b7310fd4752f544ba44c31beb58424217dfa4babf4ad2c4416aa608187922ca918577a3746650eeb9597cbc48e8f684f05e4ee43

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\MLModels\autofill_labeling.ort.avos2

MD5 6bcd6ce104a93bb3eb94d99ed25c66a1
SHA1 0b012471fef6f3b78a46acd4f053be9352ebafb6
SHA256 23bf3c065e02b7b0c5a3a2419cdf46e5e56f3cb9b75296a90cb0907554298457
SHA512 4abe0b56f7bd7e941b647375135c573ce42052bc006ace7b86d1dfa736d76598200f22a496a4132773589c17646b42209e868c47db77f3f1ac49f7d2648e4344

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Notifications\SoftLandingAssetLight.gif.avos2

MD5 3b7608a087ca4a51096c3f20310205a7
SHA1 c286048fa0bddbe3cda50833cf9912743484c8ff
SHA256 ab2804ea51763370d3c080edca9dd4ea6a631cbf062c05c7e7ebad5e28c60dfd
SHA512 6a8607fbd437260e1980fdb8d1034f285b42192c2ecd758188d9d4221d1977f2aafcf942d9807e1cc2e019ffe7df5a8d784e5614fc5ec01e980d47535cd5be8d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Notifications\SoftLandingAssetDark.gif.avos2

MD5 822fb8cfd07af10a288f5d4d41eda32a
SHA1 18c6607713f05b748aa4ef4760956a0635739cc4
SHA256 6c57a696c5fd21032bf46c52a2974b8a41267faef2201ccf79cef7ac2dd134da
SHA512 6caeaaac3ef05fe4144a7a37edb80bfa993d6d80171d931de10ab9e8d33f8e224ad3ea27002026d1e1512352da3ad76ad5cf9b4a674af5627dd1790cdff8dd04

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Extensions\external_extensions.json.DATA.avos2

MD5 186d4485d375df5b9c6533203c9d886e
SHA1 df6b01f2796862f9f85d6da59b35de0c54b5ba93
SHA256 88f61d91c9755436063ba73c6c2de548a8e8e1760e3bc5aac71206d9929e69eb
SHA512 e5f0c7798358269d8c753eaa60d1025811978ffba6e20139d0fc9eab03507563906f5d498b25ab6d74a9f6c7ec4390ec1b05ba322bb8e4a630a72b81510405a3

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\identity_proxy\resources.pri.DATA.avos2

MD5 4f61f400a185a217740eab2ccca51997
SHA1 6e16048d684ac554844b302719fa3cf9870fe961
SHA256 f3582bd28c2e63586162f513a91415d17b49cac603b12be0c662fff88e1a9f45
SHA512 97a95584197356238c5f0ce4aa1524f1de7dde25fdc6afa01ffeea8379c782c2e706e8052c28e32bd38059720e156b0e9e4bfc3dd237432c92aa2fecd5f26f44

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\identity_proxy\identity_helper.Sparse.Stable.msix.DATA.avos2

MD5 2ea2ee06e8ad7310e2143b3e4697ec3a
SHA1 0225dbd77f2bf56ad6948daba94958c10de68ce0
SHA256 eae33baacd474321ea12ac9be8b30ddb13249369433bdfec88f321f64b2cb911
SHA512 178f0561e90d9608a0820a0b83e555ed70b2707707f9543a18a769ede1d9c444749b4bda7f5c426dfab7fc88dfbf621b68a9b90744406b3d932a6efeca35fc58

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\identity_proxy\identity_helper.Sparse.Internal.msix.DATA.avos2

MD5 4bbad7cdf75fb49573e2dacb092242c6
SHA1 0f663ec31e598854a9d63ad4bd184bdf0bd420a5
SHA256 7b34bde72577c84e242827be9befc487fdca5a28f005a98ac533377796d674e1
SHA512 89ae561cdd67fe251fb7ea8926d4dd2dc4a6c2c4d3b76c96ff6eee9fd99beca9a955bcf9df8872c1a07c5fbb705e249a9dcbf25a373138ca417c2d927394c8a4

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\identity_proxy\identity_helper.Sparse.Dev.msix.DATA.avos2

MD5 f7161fccc1a3d9655403ce1a3902a33e
SHA1 09cbfe3d372accf85f45247b696e58203600ed07
SHA256 9f9d1b6ca1a03446e831b1cf71a4445c1f33a02df5654e0de6d33250e8a7fffd
SHA512 11b3f4001f27dc432d4022192e9090fd9f72e13a14dcfded36bcb2e25bba565bdb329bb6fe9203b26a5edd72bed7b25d65ff1346d7d003940d3d4166161a5e6b

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\identity_proxy\identity_helper.Sparse.Canary.msix.DATA.avos2

MD5 695137d51abc22c58d32a9165e2c707b
SHA1 f6d6cd6b35189f2dc67e52cbcb01930dba23cc8d
SHA256 ceb98ffb884bca9df12d69ebfb3e125a33592957e887454a37156f624c5184dc
SHA512 4202ee17b24603222260feaf45636091926f932ad195cafad6cc41506875219813994cde4c69c27f45562ec281b7866b86e514285a6e8bde8145f08179632d42

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\identity_proxy\identity_helper.Sparse.Beta.msix.DATA.avos2

MD5 c64771f0b057ea807b75e1eb855edf4a
SHA1 f35ae58cae9efc48d1a709ef514a43b0cdd3a25a
SHA256 10d3b81eeed2d33248b0744788e9b69645e4e29bedf41038a0d06434e54ad09b
SHA512 64174556f5a691ece7d1c0829f69232d66f2c4d48de3292812ea94ac51e90d065566145622d5843a2d0a90bbde27ac251337306817581f1966e4f0cd76ea6a0c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\devtools\zh-TW.pak.DATA.avos2

MD5 87a170f47d21d47c0ae3d934ebc1c3fb
SHA1 7998adfc86c539d763fbe1f666cffd4212f173cd
SHA256 6f3fa64344b1873863a3c7862a9c04ac3900a99d1464ff0c6f007c6addbe7af9
SHA512 4a063764d3e46d2864b4a3c3a4355f683a8e2f7da99ead90cddd647e49b903a29847ebd349342e615c94b0cc6d9c4d84b3feb034fee77f8b5362eaf1f8a6bdd7

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\devtools\zh-CN.pak.DATA.avos2

MD5 ecb1fc330a7467f01c6b6e7a368c10e8
SHA1 b8312a43f1873c915cd0e36fe39d8c74961bfaf5
SHA256 e079883ae9fefa228f1b219d2453fd7d5b739883e915ba179871342f5f4766a8
SHA512 bdef83ec6bfe2e73c99a1ffa3ec4d651266a495ad036b7a6a17e5e1f8526f6dab850feb95d2053654f2c1993aa6f816457a3cfc058c8411f5fe0c67f2ccd9a44

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\devtools\fr.pak.DATA.avos2

MD5 c8a26be46cd956b89d7d80f20468df64
SHA1 bc40af6e3ea22fb44009a2671c807a8d8da7cc4c
SHA256 231c7c5e6525e17c215cc0e175980dc338985e6dceec66c7d077c77eeab68b05
SHA512 400848cfee848ad289937ceebe97e54a87605235d97d977b9ea3bc3ecbe930e9156bfe0368e9ca41201eb6bf7759529bb7e9de35d27b26ff9bf410d61bbccc8e

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\devtools\ru.pak.DATA.avos2

MD5 de00b1cc30f610e3d1130c698a739e64
SHA1 dc364b79eb9c7fced28606fb433a0bfcaf5d9b8b
SHA256 e2823fe094a0cd6b4e23f02b9766c422c71a91abfc009c253cab7095a049fea4
SHA512 8c0699db42ecabebd339e6612ec6335a330aad391b19b1687e63a05c561f0eb513997b8fa38492eea6cd9a3a311953f2643158bde3040e87a89f3334ea87b231

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\devtools\pt-BR.pak.DATA.avos2

MD5 1ed5f5570589f9c0b85a5244cd7cc55c
SHA1 e08b81b872d5415c9a0ac8270d778b5906b0726e
SHA256 fc5f5267a92ea63fb827f6ad6d7bd758201ba441301ffd1659c57690470778bc
SHA512 7368483e3e8107ac3b1a478eda98b822d605a73239c6ece84b2499f4357d79750bdea8b434d13448687740ea0967aa7320bf42f2dca0b7250291e51cd55d3183

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\devtools\ko.pak.DATA.avos2

MD5 5078dce6cd8d55297d9428a93c03d92d
SHA1 3ff8e09ca51792a4f220948377af8c068126951b
SHA256 e16a6e3dd23eb2e5de5032c26d401341ce679d58407d95433345045e6323bcfb
SHA512 4ccd6f125084a9e8b450625e5b6f737aeefcdb6242b979eb39277e6829fb43a8f75214b3ecad6c37d095027dc96365043debc6eef169983ed2cedafe428593f1

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\devtools\es.pak.DATA.avos2

MD5 dd79e262891601268072acb9b10d5945
SHA1 1f4ed84eeff840e81d03af8ba8433724f882c8e4
SHA256 2f979779e1a721656870912964fcc5c187707c232ddea56c47939f1b79d3e2e1
SHA512 38f599a161bd501fba39073a0a129ad708741d7b96dbf1277de7e58ec049374808b6f912c0ea07ba409bfa7891d062807f2e5bd4c61dcb64eff54f60b2a37368

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\devtools\it.pak.DATA.avos2

MD5 ce0170e216dafe5eb42e6389867b0466
SHA1 278029454fab6b3252748a709bb697db76f3e1d5
SHA256 80c933e1e29c45ee31a96f60212fa3d868d6a8fc523a786ea4d269021f812602
SHA512 1b60656cf42d8d3cd3a4bfe4bc755bb0833d6bc48ee3bf785355a6318a9c7ee703b20cef47f95de6e12258098b36fc03acd73dbfc50defdaacadcc436b1c32fc

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\devtools\de.pak.DATA.avos2

MD5 e7e3c5eb3079cad75764d87736434937
SHA1 fe4aa45023462858196716cbff110959836da290
SHA256 5ddc12198492a8fb96f7fa6f42cc99f525958beb428a62f39adde2d5b51f4321
SHA512 6a27557df111238b9b7fd2a8364d0afa5119527da8c25f30d58874bcff67f564724179155e7f6c46d43e8a2ab062787689e47cd1ee5141a27b69edb9fa5efe11

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\zh-TW.pak.DATA.avos2

MD5 c18198d51d4b47911743942249aebf21
SHA1 d56f54f46628637acafaa6ee21e825bc55e7ad04
SHA256 ae30d149b6c2b53382fa2fe05124757fa83370005a599c1f48064aab50b807b4
SHA512 a11e661e35a48269eb7b156204752181f94092b52eb58b49624f6f4a928369f45df102284300a6a3e60c9ec3b260f24154b1d60ad0681a7a0be5dafcc20bcdc9

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\uk.pak.DATA.avos2

MD5 e5006db5377d2daebcce470e41d8049c
SHA1 7d3da0b9aef38390d0fc16d3cdb1cbafee75a12a
SHA256 297860255a8c9897c8b10af84aa1af69b1f514e26fd46d52bc1a2c2309dabb2e
SHA512 3030e778c01072e2ab3c2cb0d1f25085a87f37249faeb5ec206b279b482f963d0a0ea9d15e2042b5fe3e42a16e29fdee25cd40f4cf9bf8ca1d7cc289fdd538e8

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\vi.pak.DATA.avos2

MD5 32ed22817f4828f46df3ddeaac326037
SHA1 a3d2ea8230a316dab1fe400adca9b8065706f4b8
SHA256 4320cf7dfab47bb3865df92a19188af5e994ec4a0d071620060b43d82da4e04a
SHA512 7144b03fa0413b64eb2c773ea7d9594dfad99bf5ef4c2ef94caf0086a0aa50188cecd8229c495bdfd4c08c7bc00fdca573d29393bbc267db55b86f764b96b588

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\ur.pak.DATA.avos2

MD5 b71c8ffe64897ca63ff5e1fcfbdd7344
SHA1 2f8e7cf2d469cfbec93992fa29ae7f1a1b807813
SHA256 031eefb042e4fb4193a5ab7c5bf72d45f01c5c13715a5c78273dcfc73a3964e8
SHA512 a3db3b006d838de0a43a7af9e5af86e57891b37193b2e1dfd0630afe88e59365d8abced19990d7ce653f03cd4b82c1197fa92c29989b7ed50e6fc382bfe88c05

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\ug.pak.DATA.avos2

MD5 4d3bbbb3c50e2fd2469bb802f3f548d9
SHA1 6dc3da2f6fd8d085b785538df78b1a2742aeaa55
SHA256 9009436e0cc4d257017f9c804be8c237b6e927b095fd23ef7a5d4841bbf62ee2
SHA512 e27cb31b94a5109bd9940c8e821e00de78f14fa24bcb6248187455b74191f52e8c96d83f6d0b3c0a46b9cb02ad30f36e6283257c4d7ca89ed58030c20ddd5c34

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\tt.pak.DATA.avos2

MD5 db5df52f32c4295f5a74e6cdf74caf2e
SHA1 f94966bc8fb2528f8221a3930d38f6adeb601904
SHA256 5fc99e658f22d6005ea687096a76f91e141795b23a0e497265b6b07d204f5378
SHA512 82673734e54eac80c0aa11641643e297118503b2f71d4260d0d11c886b7e8acedaa1c2aab8bcf0314ebeb9d3d29b93a6ced2f01ab6679e815dd092326ddb6bbd

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\tr.pak.DATA.avos2

MD5 888a4648e3e6b150b6c38d55def4568d
SHA1 42a2d8701c6a5aebd6d1b3596d321727a9fa6e05
SHA256 21ff616cc135b494bd57ea073885bc2ff09f791721221cf3b4f64dc570f8cd6b
SHA512 aad5d91ced976122094451fa20b176f4f587c9452442c0f568ae9920a09c146a6b847326aaaf18da7668be338d262d8042735fc6d2ca95d6f4756792b812cdc6

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\te.pak.DATA.avos2

MD5 126951a709f5c3939cc88e3c9ea8f16b
SHA1 8cfa01216d411a2a03c647b47e2f0e1d7face75b
SHA256 4b051a16ad717628c8e99c441cfda6d55570c12de235ae1712c4b2ab0c713bca
SHA512 3419f8baf5df2519527015eb49a2dbca2c6e5e16653d5b4a42157ed7998a12fee07f1b9cf239263ad3ab5c4f3a7371392cd3ee98f5d957eeabc4d1df95e82cb8

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\ta.pak.DATA.avos2

MD5 ab65f4884885085361f48db51a897b34
SHA1 97ddbd854b5ec2ac5f7ebd1fbf97d07a4064340b
SHA256 f2e8332493a6e8987997f62ac647c668b3786a059624a7370c31fec8b8a19789
SHA512 41280959d1337a2fb7841268f0d416e3aceb6f0d895dcdbe24619e03f3c872f1f716a57059941433f293d92c023aec3dac5a406aec73f0bcf23e4d3cf5c2672a

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\sv.pak.DATA.avos2

MD5 6968a7ba6dd40360f7522c10ac1187cf
SHA1 15cd158f8779982bb727766533ac710958808229
SHA256 3db4aa8450d5d3530a4e94fd6f7b51185b65ced06430b5724386953a028c111e
SHA512 0f46a024ca85e9c737f2bba9e5154906224ac19d4c542898fc961b4ec0ec3aef099fe221acc5a59dbd0858daa0f28c38c930be9816c3635eba5d1cb648c8d7ed

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\sr-Latn-RS.pak.DATA.avos2

MD5 8ba6731e48d4d828218a385984ea8dfd
SHA1 390c3f6fd6082707c185071b1162c368c333f756
SHA256 968a4aeec68446c876b13c92bcd71616c08d2374f53bb3a3b754aacb3c4b13bd
SHA512 f69eba6d640e26b9e80ed51a138e1a312f953dab5f0ed162d567d63f3e0a869583ae4595f562960d7109e30f2fa589ea469fce46244b378c482fa6c5e07b1c31

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\sr-Cyrl-BA.pak.DATA.avos2

MD5 2f337beb2576bdc72d3b51ad55ab9a1b
SHA1 4d1e7f61d1fd76b45dc72eebfa0045a578f68701
SHA256 39840c97a9d0e4293e7b278f20acb8827a067ee142ea2998381a689dec3685e1
SHA512 a7709a91a5204e45fd5f7f72b06fa9a3a93ff52e1707574ea43fd4f7af3ea4f60f648f86ec8e5a121855b9b79093270f2b030a0dd9afd17133ce43913a80b249

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\sq.pak.DATA.avos2

MD5 fa2a4dcd1ed54ebcde045f151220d7a5
SHA1 32a6d81d94b88349b6fad7e2d9f11ca8c3763e37
SHA256 034b27e26ea33a3c77beaa58da18d0517917ebc512b5f19cfa515a05ffad59ac
SHA512 43dedbf8b3e3344bcd04b598014424b370f7249ddee629d12ec40809feae7ac08aaef6f80d562e306a614f37fd5eeb607ab090fef57294e0ca0ae1f5346b4212

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\sr.pak.DATA.avos2

MD5 5abb0f916a63e0ebaaa8044752712d38
SHA1 ccdc354ef3dff9fe68f335d0a5459c45db0b3400
SHA256 005b81ec17332ae3913e3984ce42b8b18099d47e0d4fdaf0655b05e7dd3d5fa9
SHA512 cd963adf53a2c9e1b1248e2bcb186b57976ba746505c4a77eda44bee39844e17a45a39971752350a87e75bb9cc4df1c5b918f8a05123b20a3e0b1306d8463506

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\sk.pak.DATA.avos2

MD5 c12c63f5298622d120fe502781b4d2f1
SHA1 85a95d58404466b37971f75c7d27538c88055ce8
SHA256 5be2b45f0966eb297cebbf35255481fec3aafc533f6674249ef65820ccf33edc
SHA512 62073e37f77266202a434dbceed5d042cca51bbd74757f5d8c61714e10c4a8ba90ca148135d98828c06b5c8db2a3e335fe5ac64a6e80390b041ce1c6581741ef

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\ru.pak.DATA.avos2

MD5 9bf2b39c623fb3a9c7d5c2a6fce3e1b7
SHA1 f2e7f6eb95e965c798584db2824d3f462bbbd54f
SHA256 0f3cf3054c6989dda701491557b5237328e5bf9c43adc22543a99c141404dde3
SHA512 099178409173af305130288573f88ffaa5870b79a213e0ff7ef0c3b7650951a552dbb50e090c9fb539fc7b4d25049673b3e077995a6dccb504ab94849a30e992

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\ro.pak.DATA.avos2

MD5 1a8fc30fb052d0d9cb421fb89854661f
SHA1 95291b4d4edc42815a2660f028dd151c534ad8dc
SHA256 bb14eb5e4ed6393c6ccc6e24be8aa45fc3cc3bcea2cea5b51bb6caafcb4c05e5
SHA512 c83b4f7de39336641606f8443aba060107146977193592eb82aa44687ac8c2993fe6109987261a16bca7b0aa8f49587ead02cb6dc2e272c92b36e601d161ca56

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\pt-PT.pak.DATA.avos2

MD5 5c64d634714764ceee20246fcecc4775
SHA1 86bfb9975cd1aedaa7d6f257a895485e24b8c74a
SHA256 3da5b45ab63711ff919dcc456d443174bf3d57616a7752848099ecd17d250cde
SHA512 541f1d846461093ba970d947625fcf65308a4deebc6e84de579f1e80cf738bdb7b1b9398b9ded2ae2f6f00febe3ed757a112d8d39da0d3eceb0bc86657abe770

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\pt-BR.pak.DATA.avos2

MD5 77ad9b741f5c26bf524a17d52571c8b3
SHA1 ff48d0af795bff28b5aafce7e469a6a4cfd81bd9
SHA256 ce99299f39b5168909490f1601d39aab8c529021664924bd513cb1450ce4fd09
SHA512 688e456169928ee1b02e8693a438baa700e9b23571eaa03eded8c3f1db9253fc11718f641545f7eb718a891c5853051fed9bea8cda03fd8140e7076f22aa60cc

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\pl.pak.DATA.avos2

MD5 c44afcd16253c72858f3b044154324d0
SHA1 0d29181ebd76811f9f81b9e30c377a280fa17ced
SHA256 0a6ed03101af8fa302718ac7879af2d71f056c3d73711885bdb35b4127181e0f
SHA512 a30d1e04cba3663b57a967bab05615de26a4a330bd7d569fd4e469b352ead9a508f7e4351f4d7bab9a9a64497cec39dd30195e2f13070191539f01b1e74c3a44

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\pa.pak.DATA.avos2

MD5 4d8e4c0fcd9c77030f93988909df9017
SHA1 b22b5ae045cd1d365f63771ddf11ff68fec07c76
SHA256 28c89dcb97de5bcfd8759dab4048027f4535e225ea5f94f347a7d6b788db8898
SHA512 0264fc04e554cc6f41501bcc59e7b72a24ca210d5eb0fbe3d95ba498cad934bc601e960f7622999557870f31256dd15a1faca2c2e6f34d4806ece59bd08c71c3

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\nn.pak.DATA.avos2

MD5 ddf0f1975ad7220c37de892d119e2eb5
SHA1 b0c0eda7864ff79543b16740f4d86a34dc67bfe2
SHA256 4157984f8f7af85b97ddcb31fbdeef4a11a9ae0f2bce36fbe44d9d331f751dfc
SHA512 f81c89f373ef14a31928532c9b0297b08de4db8a1c942235a6dfdecdcf537e9c93510369a1ed346fac30b1ae0151e88c53c1229cee4da10048c70eaccae357cf

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\nl.pak.DATA.avos2

MD5 4101418f85ec1f102b146f13bb636148
SHA1 24ccd7441fbaf80d5dd1d389b3ecb8e73a3d599e
SHA256 f9543de2dca2f31556c66b26b1223325a456bc440933377367c5dbd5c6df43da
SHA512 f497f2dafdf0104f3e0981dc245f8347cc0ed258fcdf03c264992057047ba2fee9002ba77b300b6a5651b20b972f6c01ec68f14094e0623140c4a91904c11cee

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\ne.pak.DATA.avos2

MD5 97f74f8578f048bc2f703d212a51601e
SHA1 f219dc9a00037a45a2c2b05a318a5b0fb7de939a
SHA256 484cc0e2f722e944bb618b83a71edf76d0b178b8c78ff36aa836000cd53297e2
SHA512 c9eed96366bedd6aae3d11d3e4a3124659114f6180e99893a29a5db6efdfd6760de6a6fc4a8842ed0752655a113d4eddbe31a4b19d1d64a67a4d79aacb884cb3

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\mt.pak.DATA.avos2

MD5 df95b497dd287242193d2302b242f35f
SHA1 5db6890e1fb0eaa02aef63a037700d74532d41f5
SHA256 5ca66166241a3468cf494724b903db55023482c21c13526f02178c12b992fd0b
SHA512 86e32340ebf0bdf3f155e5f4ddb28694b9acee10d68275ef46b1aa95d59433c7edfc3ad04994b6bb4f752569a25a0460586e8dad6d47897e46515647c7bb223c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\nb.pak.DATA.avos2

MD5 a81a8e32e818e6e605aa7558ee3c1641
SHA1 de958502f5b7ea975f46a307206795ac9c47ba52
SHA256 91c8937d964cb35fff96a0ab147c019e3262c9f81c8e1c4856c261e4c212665e
SHA512 c71e9e3a2c99cbf777b77bcf08542c7cd24892046106ea077fffb4375f5d9128b39d27f02f5e3fcacd9b4b3c84d546f7a2c9fd654023e165a7ef3e19abdf38f6

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\ms.pak.DATA.avos2

MD5 6b51c40c9035eb5d56f37b8f20c8f050
SHA1 181cf7e8ff76bbe5dbb51999eeee5ccb9319c5a8
SHA256 4e9afd816da4892f9f46963dfac3b15820db25edf4cd8bb9e352855f8b180afe
SHA512 44749e7186f96cd2cdbe2d86392eaebbb1995aa4162cec55ef4d1d3b031cb2bb5d14e7cbecfb639b4d241f0bb4f787130194b9acb6aa19fdbc9bcef34cbb3f06

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\mr.pak.DATA.avos2

MD5 541a4599639d6fb610f9943c44f2a177
SHA1 53883ad6cd27a12b5f39c992c22b48d62000d79c
SHA256 a1b9c77c6565afc98c2a4d5f8fbfc6adb54033e7fb0bfd6d63e9684f40fc602f
SHA512 fd462858644956fef0f80139aa919ffbb68ef48f5336a855761516ac0da6cb33ed2d0949d42020cbb0311cfee019c929d75797802220e295e73c784d3106d1ac

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\ml.pak.DATA.avos2

MD5 10e42e287f371f7007e7f9bd0954e171
SHA1 4133b59d0863a4235d7d9ac6b401ac64af0375d9
SHA256 a4e8fdbf2c79d6af79f8dfdb93af0a219163ab0dd48411ac1f58dc4594d4aa01
SHA512 429fadb3260bdc93f643223c0252689f5097920cc8e989922308183cfb22c4280de65f40fbdb895c92f965b23c0bda3b21fb2dbcbb9e93c78cf1556d5f1d08f5

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\mk.pak.DATA.avos2

MD5 e314f0b25d4c07077246ee035e1d08ac
SHA1 489fb52bb6fd261cc10951317e6ca03add63a19b
SHA256 d8dee793a37c9fa8176b5a5f5da01de775e336f0e5dc405f47cef308380b65f9
SHA512 8acd8f01260112512bee1c07f6d82f789550f3fb6f6b60e37f4220c97f9cc15ebd78527c944894d3b06c0dac3a08f165602e4a12bb263085aba9d92247afcd82

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\mi.pak.DATA.avos2

MD5 a3e81a808c864f37aaf84bca2e91c950
SHA1 61ffb2991065d03fd648e14e8163598972a4c8cd
SHA256 27282d5cdc16d69bbc901ce86d8dbab83b4a1af37c3bb7d1fe52915123a59d23
SHA512 1c26e6130f7d9d0547c567e3476bdc448cd37aed2c3540e17fa5cef4848f2371f4e57c27bbf1cf29fee3a8130dfc9b796f2efc52eb61cab191352bb18cdd6937

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\lv.pak.DATA.avos2

MD5 37f6f36275d803f19f54ce87589ffe1a
SHA1 f6947e0b847f56a0477bc8a58e2a8aa8974a6785
SHA256 df765ba867066fdea5573d155775abb434fcca427304ce00461ed5893726ddeb
SHA512 850af5dbe4a486a7e8c0faaeaad9a7fda86847a8dcc9b9c2657960ac407a68d48edaa21381528de4381e07763af283b02ae4131693ca927c5462ccfe084d6f24

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\kok.pak.DATA.avos2

MD5 7bf74cce3d003376568115ad7d75f6ea
SHA1 ebdf8ba9afc62921bb3988eb9ee246f2e0b341aa
SHA256 b118036a039db964c186042db32c08b994ab365be94080dc954e3cc96735bdfc
SHA512 963a973005d967dbc42296bf8c9c0fd62e30f1fdf6b2c18b3a014f2a8b6152ded968b17c81ab4ad776bbb00e63d0f0f04798c4625f17b999af5ce31e6b140d27

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\ko.pak.DATA.avos2

MD5 dc398e37f5262f21155b68fccff7c2e8
SHA1 df6cd46edc8afada9f493663889cac23bc479b14
SHA256 1a354c12ca8338972d23b25a22a92b2596af600cc2c3acbf3eaa7b7d20e71e12
SHA512 005b5f5213f758ad5420491b45086d20b5eb2d80585ea70633c833e798ffca53854db540e6fb79ac2947914381f719acff155152b974cc1fb201515a8434422d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\kn.pak.DATA.avos2

MD5 53e2da322038ddbf1dd0f2bb3b5de7e6
SHA1 d1dc92a5591c20c9448192264344b9d4aa78649d
SHA256 2ae7cc6caf73059e7ffa8f76c8234fdde9f6a8590591a3c01243250186868493
SHA512 67a3c4a86ea503d6b68247427a59f315700d8637e1a698fd893732b2424aeb5495ab4f71b56fcd43723a1968f689b3ec20798e2fd7e4d5ba14a620eb6b06f7b6

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\lo.pak.DATA.avos2

MD5 ee59dc7eb851dfedd6560a8db335b0e0
SHA1 1a4a894660bf9feed450c2f1b631834157e05592
SHA256 a1038697db884510a7ecd6fe655e57f3f2030aa177dadace3906d799a555fe57
SHA512 e79665479b08df7db544437ff6f32affbb441acde8fb645cfc2b86db99168793af7bc10451d20d687ac8dfad03a9f347af894eac52fabb8d96e5b272ec31277d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\lt.pak.DATA.avos2

MD5 e53ad93d479fe0a57aee9ae9c4940ee6
SHA1 458631db1290cf78d4f54cf87522f5755ea1f2af
SHA256 dd2ef2fa9c33738bd1cee5b38fde4ce4e147fd74a32aa729deff7758f182f350
SHA512 04f69a2c3143de124c04b092e69e37a636ae80de7fef23f616b64f7e84c353bbc1542099a6178a5467c0358f2dffecfa03283fa360a2603dc236bf9048fe02bd

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\lb.pak.DATA.avos2

MD5 fb699195e19c6878738cfb7e34b5ad76
SHA1 58755c3028380b03c3c795e4b7d846c324c2f38c
SHA256 819d414c9110a601e516ffb7049e3d5746b46eb7f8efa8d26a8f8e72786666b9
SHA512 fc1d0dfa4f22e94c48e83e9ac45ed3b64687305230ded3d88af6472e3cc635da745f5a3f2286c16fae1860ce96edb1c7e14e42ad4fcd353a3bc2b71ac4c25366

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\km.pak.DATA.avos2

MD5 4b6318c181cf93b2ecc307e4c5fdf539
SHA1 220457139dcdad3d03da518cc629b76fb1cbe242
SHA256 234891399de38ec9fb58a5170a04403fe71ca6d3e1214e2ead87871f7e4639b9
SHA512 7f8a52c269fe63ae09bc98302a24380e4e40907078597046d563dfdedc5e3358cc6286494e71fb75df5d2caf1389d8cdc2b29cabc5799764f2de8df1104584c8

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\ka.pak.DATA.avos2

MD5 2801a61585644da927d506564a6b5034
SHA1 5795d88905f25296536a27ae85e62cd1795af330
SHA256 2d56e7950c153e7a2f7360c8a128bdaf0c9eb529924d2a6985d33275a8c35553
SHA512 0b83de824034bf263345d99085d7446c470a9306a803f9512125d02413e2b2236aab574cad18877584a8e31a6088976635ebb2a2cfbd6eb3b7afa105503e3328

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\ja.pak.DATA.avos2

MD5 bfbc5764a1cd31ff6dec2036e68c995c
SHA1 f91bc490878e7044741d576130d4b80972898c71
SHA256 a1011515f842730f9e0139826f1049cb7375c36d751ad3706d5d28132f9ca6bf
SHA512 51bec8f513719a3cbd3dde0c33a0cf95d1d1ac1d78951fdfc8f1c19dbbe0798008f15053fd4dafceb0402fd2bbd2925e764f601802c7b35241d5ad7f126a75a8

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\it.pak.DATA.avos2

MD5 66292bf4b2fd485deb363ba1cb694eb0
SHA1 55fc6e0bd091b9610b4a298a0d312ed2bd41f6c8
SHA256 36973ed253961fceb319bc663955e0d5e57016f79183e43878b70119cfb2dc17
SHA512 7b08f5369f6b11806d34730f21dd6c5d1fed41b11ca3ef2d11a0396d9da4129cc489979972aef58ef4126f4efcc26f4c4babf0064a9e3e821da44e65a80983d1

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\id.pak.DATA.avos2

MD5 e4f6697ad57e9472ed4e5a349422cec8
SHA1 87d8574cd4d29010dc6447484a268026cc0fc31d
SHA256 b6c3247ab3784c00df4592e28b610f13cb443bc991a4824a89ce61a5c365f936
SHA512 3173e4269e455385bffce2d334fd5d448930f82e517aae948f29c8fc561cb0893db6f992e50958982d890727132b78913243852435591b04492e994ac426c088

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\is.pak.DATA.avos2

MD5 c7b7b75c248aa6b9589451740acd5646
SHA1 0f0d7bb52bc9888ff5cfbdd2875142da07e29df2
SHA256 0f2099005860d6b02f6db0598814677efd565d21a2c97ca756107531f95151e6
SHA512 d1f4129b4bc5fa486ed8bd634d56da5a796eb179a7c0a19398129ece5e67bdc7a9742bc656e0bfdebcfb4f1ad7f443b6e688c2c3ef5c5e836def31bdb1934e1c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\hu.pak.DATA.avos2

MD5 6e0d25e3020f8efdffe91dc8b6af72d1
SHA1 8c9d2b5ae10108f7665c8d85af10937bde2e59c5
SHA256 1fc1b4df04995e8381d66e3bf7650d4699e521fb6f05757cbf0b1c2eaed08030
SHA512 512171e11debe2f7311295603f0cfe45e2b6ed1091a053c30a464e07fb5314202d6a6ff2777fbe63d71a24f3c0ceee0591a9d841061c64413e5851bb0c06ea7d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\fr-CA.pak.DATA.avos2

MD5 c27a2bfcc8012b452dff99687cd0264e
SHA1 b65fc4c403457ee0c9679f5e6046408829e15476
SHA256 716418726d89dab45aa6d36d6b7d22022fed8c429403775768a798a57be024d3
SHA512 8260092e1d52fb78b4e12f66ce7a7d77ff98f7fb4a371eaf2115a5c6f404d5456a050a2aea0bb4d425d21a97e65c841cf6a4237789691c13409264ea97bc9037

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\hr.pak.DATA.avos2

MD5 da0e15a832c0b993318a31e323a272c3
SHA1 4df0c56b6fbfe436d98158de5b7c4f120f503826
SHA256 486dfac9f612adbbcdff4c9364a926427f40e481e10d4c872628a91a3589f0e1
SHA512 8afed574bea1530b3a24f50173ab146826575b297d6661fd04f93b70ca3aa5c50b034ba6e9bf12605c8ede1068f70b904eaee72a62081f59b5f1e04d527b87a0

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\hi.pak.DATA.avos2

MD5 5963d38605e7d6c60fd54b8a01ede0df
SHA1 72152deadd5e480dcbb7892e1373983050bb24dc
SHA256 0f1d14d47481c06730341cb3c1d6cc97bf255f7948989b012e006c80225cf79b
SHA512 d9dd9b31f3e03b2709009ba6393886c56fbdfd016a8a0121bb6d8b0a76054282b0524ff9f0baa3b870526d565ce5c726f646e5dd47e558e1c0e6268fc86b190d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\he.pak.DATA.avos2

MD5 d51a337b6ea45a26f275c17b1f9dfa4f
SHA1 6c1d456d87ef6a3c6f65d719ed51960e08dbca4f
SHA256 a650ac6ea3fa1e0e6f3fe697cd3d4c4eb4966078585d06471e4a521893f8ef8d
SHA512 3e60a63a191a1056e41a631842175bcf70300dc37a2c55e8b9de1e9a7fdbdfdd367a3a6cf2a73b709de40d46b3fc5a6ee67fa4310aee3d52b286be3795fc40fc

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\gl.pak.DATA.avos2

MD5 e1c78a2d4e5e884be79e097c9adb4bfb
SHA1 ed26710866eca7907a23c1c78c27d9b1df3567ef
SHA256 8ff498537f5fac5dcfc4df4a61afe6a5d6a40797a150a1ddacacaba7d6e65875
SHA512 79add3e9faa33798fd1311d28e592302b1f8c00f4376d9bbd46c7b4646e92a3590cfe654406bf4dcdcdf10beb26f9379e04eda7752b142300caeb7caf77f3fe6

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\gd.pak.DATA.avos2

MD5 d311dc7f04d0ef2c1fdafb57de095f76
SHA1 9e79fca95588688afa8260ed57415f56a9c73196
SHA256 526eee4059b9574db98ad43cdaac8634398e1649dcf63c3d9e940dd26946bc3c
SHA512 c3ea64f0911afbdd798ff6bce95e5b9b2993874e9beb5b8720f499a93351591540f09c89caf63d5fe67494d483ecab3036c9750fa5ccc6a4d05f0a358f0ff9b5

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\es-419.pak.DATA.avos2

MD5 33c02b059dc1984a1a5bffa282ca8ee4
SHA1 43cb5a585a5deaaa4cff8322bc9fe5a50b3b74a3
SHA256 c49b4211c50eafbc6320a466bc8dc7c809beaa3e448c87c7a9d3fa66150b23bc
SHA512 29bb59163f1c5fd2eb984eee1c7ec196612263b6846e9c472e2164c12dd619bfc0e68f4b798c394900429b11fc2ed95ab8dfd63748dcfa2d4f9f959799a88b1d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\fil.pak.DATA.avos2

MD5 6addd602e6a77098d800730b9d94195c
SHA1 e46ecac4b58e4730d5d6d45b04a6b859606c739b
SHA256 7ee5207f6fba72d93c1d62d8f53567823d8dcd300ffb564c810b9cafd7253339
SHA512 b188497e1db87bc7878448cab6ac8da6546455d6c273d8670e82268cc005ee0f7b841ecd9839e2d1d65607045b3bac9ee9b77b0a50459dd1263250dd5922c880

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\ga.pak.DATA.avos2

MD5 f66bd60b07b275f6506a12a97c713e16
SHA1 c771883f95bf19f4ce0bcdbaa19ccc0c9ce42913
SHA256 dd6747b60f9d942a2b3f9bd872f2d01eec0544a573da01b3ea82a2b1ac6ee0e9
SHA512 84d3e9d876538ace23f8cda0dc2491a34ff738d34356d6caecab50278db5f109d9576bd89d356b252fc72115b609eb861b728856dc3eabacb279703dd842ec4b

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\gu.pak.DATA.avos2

MD5 c95001fdd23c33b5ca95d3e6c10781ac
SHA1 5d0cfc89b96f938d8914ca8430616e881e7d8d20
SHA256 adefce0a0d778431893bf0b10387cd06f0059516f1f84e13083eeae8bfd3f7ad
SHA512 d89f9f86e5fb8b6847ee57f9cc3091e1fe90228a3881e19b9e7a26d2c8079ba46decc8d029d3072ad28ed80641dc1efee92faa56f17de448621ea8ded8586e0d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\eu.pak.DATA.avos2

MD5 2dc6ec022a2c801d6350f509bbc52151
SHA1 735b49f5008151e410e03b78e7d8216dc4bebd4a
SHA256 f15723112be5eb38215ae43900786ec613c3cc050078429a1875324cadf73dc6
SHA512 62d56693b456dcc12942639165134fcb47f983abff3bb1a73a72ab76d86147dc2b581b7c73090cfc5fd3e3d7e9898185aefd8456a96919c52babdf1be9b51226

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\fi.pak.DATA.avos2

MD5 6160a93bd8e5cb389fffed02d3668acf
SHA1 9c11612d939b5634d48e00581deb11a06ce01948
SHA256 dc68b5094b10f094750cbded324cb01f5fd83f62c310a4c7fb7fbdb0d2ffd70e
SHA512 29b80170e9c63386074a697d4cbebcd4e60e663e9302d519d9be80d7b77f02de8d7d39d6a9d8ff9b05011c112b12b20a1eea816cbd487c7a6ee9de3842cef274

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\fr.pak.DATA.avos2

MD5 cea73af127fc170983ec55f8fac7949e
SHA1 ee225f00ff216d5a89af0354eb13838b822be0f9
SHA256 8c0a62385f29a964f367d44b68bce979b59f4982df5f4b88b205f22928c0e463
SHA512 d711aba1f57becf5a72272678653343aacb52be4808e05a530d80219a2825679b3fdca07888d827d79bbcce5247cbc6d96ae48af7d5ce5f07c1af6e069709436

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\el.pak.DATA.avos2

MD5 64ecb4cdae5a684fca26493e522a80d3
SHA1 4dbb36cf1b0be184149d93729182b103ffa1bced
SHA256 7fc0ca08b54c00498d7e13275749a5bdb070a9db28de96b26c0ca344248d01d5
SHA512 8755a4af59d9aae744840ea53bee2f59bc66205f73c17d890b7b1bdcdc696f4debe648d98edbaa667633fc8f337c63679547e630d5869e0505413cf123167b41

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\en-US.pak.DATA.avos2

MD5 879f07c0f25ef945da3381c3b2c95382
SHA1 1ed9ea8443ad0a33011ca7b202cb0aed644f58b9
SHA256 50673a314014b49dca4806713d2cd41626e1e5acad82987b8381ea94c3a1cfe6
SHA512 c1d1229c058aacdd8b471bbcf2e939329369d159dde0c5fa88eb5c5d5c0ef2d2de0b53f87b37bcc0bde6ef0969bfeed42b58e5c0cb3adb50a09ceca6dd261e24

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\fa.pak.DATA.avos2

MD5 3f1cab58a600b715100262fc986262b7
SHA1 a2e07485356fe66d9a50023efead67ed10b704b3
SHA256 31e71daa13afbb17c8884391f6178f4a33c882aca172900481b5e93f7dd8d5e7
SHA512 1d1851d91031075c454c255fded8a3df2f7aa647050bf946b9cef59ce218a95769302e06ca8edbdbda8bd2c971542f26cde9a4f64542d1dd7b5d58d409ce8c1f

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\es.pak.DATA.avos2

MD5 84614a23fe51272bd289c402b74d127f
SHA1 55cd668e9e820fb38d945c8cb172a5ff106365dd
SHA256 352792b75866947a0395cc6aa1d298f4dcfbdd379ac2b9fb5aca1ab9a4837ddd
SHA512 7a38b67d40cba7ec0d1aac0c0712bba5740f42b1253ca337b2ffe59158be14938af0f4e76d1037633ec59d6ab3b7fe4106f5bc8be7a7083e1cc56ed7bd0f0188

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\en-GB.pak.DATA.avos2

MD5 9dc76cf6aa4e6710f589bbf3887aaa61
SHA1 40f4ac93a8c5867dbe595e2dc82b8312b0fcefda
SHA256 9cc753f0f7515b804f465e056927d717e75a666589055e472f5f52be6042b876
SHA512 be84835159f71289c3829747479164aa3483fd564ec8cb455ec77b0b56dbca062bab25cdce1068c951117b6c367dcf458b5d8e44410cf92b95e04bca912dd2b6

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\de.pak.DATA.avos2

MD5 ba00c5081a7049850c86f0d68d76c91f
SHA1 09d2fc521b436beb2c66c80bd9931c3faf50201a
SHA256 65090dc56ebdd5f12c569592867ed78ba70fe053c60dc198899742361a12aa85
SHA512 2f9d1109f190665784672ce2e1b27ba14ad504e26b7eb2a7184d35888f085030afe581075ae75a00f6b4726f3e2713b2515e589cdf97a65be26c9ed4bd605358

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\da.pak.DATA.avos2

MD5 b79b7c880babba80b60cb51fb9fce48e
SHA1 16ac2adb0d2e14480a206628645b9f6f70ab2858
SHA256 f0891d6b0fa8aa082a5176aa8cc625ec8e169a60e515844c9a1f6cb746bfa068
SHA512 59a39f75a8c6422d5a81bc1e7fda5dab986a30427c3018a864ec2e25d2c9473fcf5e85a9fce8e96b4a2a12552be7847ff1adf2d0e94964c2d07e7899c87c20d5

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\cy.pak.DATA.avos2

MD5 5368c04fdc18917c6f093fb291f65b36
SHA1 cd6879c627026f1d1e7b700536154d461c915d0e
SHA256 3a8760f3b0a4e4fc343f733d11a1044e94b3bfbd8bdc4b959752261ea88075d8
SHA512 d09805147d6be41dd16a754e58e47b23d9242233222f4e68a72da98e3c35176e0acc4418ced957fc46f9635b6e32eb7347813e54d6be58313fb44df523ad4da3

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\cs.pak.DATA.avos2

MD5 0c4c86127ef80da79b4bca7518dd3781
SHA1 12621b8b8d12b9577eb5e5820a3ffb7248a5b6d7
SHA256 fc07c5bd5e5ea81867b7b51ec86fd7730014991916f5a8a4c0b4779a457280bb
SHA512 ea9f8d081873456738338708f575e3ff2ca95014018ba4477bd01a34b78f78b2367d8ab0dceb807ed720769841fa53165681338f4e109712832af805c2635937

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\ca.pak.DATA.avos2

MD5 0b007ef7abc4c7ec83a7c0baf13dc8bb
SHA1 3c0909673bde7fd1280c315ee2fe55297fd2c7cc
SHA256 59ecba1a3ea2f91ad0046d1a72b0f0a4dbe576dae8b46de7f67f228a12322a66
SHA512 0460364a13019fcb043c438c5de0bd0172efd06065d859a8c81b975c6fc33e97fcf563b894283435dca4f061940c7baea93126a8e57df3aa26fb32089b1d3f8c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\ca-Es-VALENCIA.pak.DATA.avos2

MD5 f6b8d906b8cab124eb591efdcbd7d755
SHA1 5f6193040ee9b005602e829dfece782890833cbc
SHA256 a8ce9af270a25d32a908e4a3d8f1ed1f7e3407892db5ebc9c3e801527ea6e3b1
SHA512 d71fb8a3d97f6bae4e928cbc9795f90302d85c02ae7a3f396849d98f74c447ae8e811635d0a126011ba41206e78d086c3aa3f6f0192fc5b2d93575430c3f0573

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\bs.pak.DATA.avos2

MD5 9b0e6f78472c7f2755b231d89fda1aa0
SHA1 43b723059bff238d689bf3533133cb41edb6a4b8
SHA256 267b82073106f9714c19cbd3534383ed3c611e94c26ce35758106a712b8a377f
SHA512 e762cf7152473aa4dbd3feb05e618a604ac1dc75037140142e1263c2c275c6177b83df758b906121188afbbef20fd51f3f0848e66f3a43dcb426c769bfc0b62f

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\bg.pak.DATA.avos2

MD5 7d65800ccf4109d274cbbdd120c6e044
SHA1 34a1193803641e67bb1acb32519aec78a6b4d58e
SHA256 426e4e043429631c7f7b2877618ef06c878d8885c61c92fbef31bc14df174778
SHA512 2f159e967e2a6b813d7756edc24c74db966fd3e4eb7f6b7d9e0ddc54ec0c0a5d2cc041ab4303a02bfc5189c9e564a4bc5031e02bac7d4ca414bab1658ed779ab

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\az.pak.DATA.avos2

MD5 933a8de384166080b20f9f8630cfe5fe
SHA1 8a8f8210e71a9742f6a2d45c89e0791749569dbd
SHA256 396cca934cadbe4a7b454c72aac5ecbf99de592ea330dbefe9f7db51cf30a2af
SHA512 e40453a92bfe6e5dcf1b3f8af8862e15e99394427fdf2776b7c2741e98ea4e533186eae34156af320b831e08119e1f6a0e5278c7dfc1fb7a10fe14918b96749f

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\as.pak.DATA.avos2

MD5 054a4e97ca2461cc9b8dcf7db41c4c40
SHA1 9688efb4dacf74d6807c452a8a4019c7dcd67ed9
SHA256 a0f85f8fa70145beceac511612e45b0f1aada623ea7b600dc8d1ae97b9623bba
SHA512 01a5b7867e2b3022efd6b5e3201429a12fbfe737f38c88786f7a0fafa120aa010aba33f9ac6f527a9a6ed2778a91d4808a9380cc7dfc6c2cb5ca418a1444ba04

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\ar.pak.DATA.avos2

MD5 08278347559bb0723b9dece7bf74c09f
SHA1 4a0b2174d25b211374ececd9cd04a4e3d26624e7
SHA256 263bf4f591474c64bcb7e56033b1b1379c4e0aa62baf69801589bf4b8be7a5fe
SHA512 fe34504e3314ad45a6275a33624e60af4e6ac8319e0bcfc9c08e976903e258ba423191d8b795e7556f08b7550426cab413bf91f35f10e209d7826279fe33875d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\am.pak.DATA.avos2

MD5 c42e58493aa9926ec2cf5e2d818b47bd
SHA1 6b3e15a75d2bb557b6dcf2a6b297eb4ef45ac493
SHA256 fd3e62b2f9e9ebe82b47f4171bf6f618a99bc5204d6582a6de88c15e7ec88c69
SHA512 96b4b1604aa4d702ba7d7c25e8171d77fa9ccbfb8f634947300c7bf2fcfb551561badeffd7e937b9ab0cfaec5ffb5f9c75e0a735ed7f9432537e409a505fda3c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\af.pak.DATA.avos2

MD5 e60f059ea77fe7130a55c47a5c80567f
SHA1 a90877e450530e4b3a1a7f5b8dbfb6c2b1cf4c1a
SHA256 43afd25f1bc6d0a6d21c5897b411268b94a0e6ad8fa78440c09d2aab2722aef3
SHA512 d618dbbe3a6d99111d3c94296fbf74844e99520de3ad1c6c6ccee9f777a07d3131ecb15899ff6c9f17ee8ff417764052f6c709949e587857860b0b27fd3833d9

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\MEIPreload\manifest.json.DATA.avos2

MD5 a4d9119c367c086411fc866402f9d4cf
SHA1 1cab04e2e242e88ff24cfd05e719a78915e0fd11
SHA256 10df7b7fdc924d7ceb12a194807bf024a6544f943b588b882b6c62aadfc8b89e
SHA512 3dd03101fecfbfc6fd16b02cbb54877eed22896b87ea50ee61169613bfae0f22327377e765b75d3343619899e7c09fedd5101c9f176e13901ea573a9caa01ade

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\MEIPreload\preloaded_data.pb.DATA.avos2

MD5 caf85bbfecef6c5575d6108a334e64ce
SHA1 e7eed3483363eb6f051ef435ba4404bab2d2be61
SHA256 9fe3fb0dbf368a8516c26c0d62de7772c2568d9fb3bb3c22be996ab8ab8d05dd
SHA512 3c8dfee5a801991e87633b5946a86bb2680a6be9aa52bd7bf57395e8fc80bd0fb60cb73c434a153d88b6884aa8c84ab04898e5adb350393c5ee7fbf86db1dd57

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\MLModels\autofill_labeling_features_email.txt.DATA.avos2

MD5 920a14537b0b4845b1d9e63c322f8ddb
SHA1 5096cb35bc461c7528b37c1886b0adcacb7da2c0
SHA256 2262ef59f1127abfc6903044bb3c7814f9f6b50e63998e132cf338cabd7f153e
SHA512 5bead13d3c9b3552630d0dbaefc3f3beba15f9477cc92103f0873f7ac9ce42d541766ab185e01ba8c922beb1c85649b562bb0887ced4aa1e2314aa56388bcb21

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\MLModels\autofill_labeling_features.txt.DATA.avos2

MD5 930d7256c9245154edf8829802148cea
SHA1 f226958a66da581f69d4bfcea288fb3cb48d032b
SHA256 19df5c0bebd4ad5be04fcdcc00f7e3f1f7461d7cef8658a4b6422baf46b663e5
SHA512 6a80149edf638b6c64226c4f0dcb8f3c126b0a4c11a3630db2454725b23282e8246ef2ec0720371653e4d967068a5eaa46fd4a2183a0c9656af106c7074ac323

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\MLModels\nexturl.ort.DATA.avos2

MD5 329961762d5165af94a70b65672afd1f
SHA1 661233ac526f8100d92349967107e60ad0b5116d
SHA256 9c60a4bb909b7001ec8a7d73ed3cf596c2fa2e1fba66b60c6a9012a10a441d38
SHA512 afc9edb9d453f71322105157261b7ed45b82bb561c1fa641c0e6ad82de1e05a66f9ea4dc1c7b36aec4651f1718a7134cca852f0784b26512d5b9476165c09ecc

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\MLModels\autofill_labeling.ort.DATA.avos2

MD5 332b604495906b6ab26e357ffcefffc7
SHA1 50a0742828872770198e1c18e587db5f506852c0
SHA256 e8fa16cdd7bb216019ba3d49b67a4d46f2f8eb198fdc2098a5935671574cb5e9
SHA512 35c06c1d577e50f7fcd508908fbf873c81a6d8ed0fd16b2d6cf52672c92a3f4186cce3369faf7050111368dda4449bca2eb0a1b2c3b7c58dafbc91694083cc63

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\TransparentAdvertisers.DATA.avos2

MD5 2779d07b69dd7a7d80a7ed84ecbbe823
SHA1 b63b29638ec8ea864b29329f29ecb7c0332dc6fc
SHA256 f7938e7ec5c39047db62daed171c6512a4d0b66d610eb1fee6b8bf917a62d566
SHA512 5772bd1370dcedbc390e719662ba658930c4e99b9530c381460a125862c7ec0d6b4f5854ce78abf37f061e3d1c162742f52abe4209e6be42dd0fc5dc6dbc8b78

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Notifications\SoftLandingAssetLight.gif.DATA.avos2

MD5 6ee35743a0e4f3405ebe17e9ca8b16c8
SHA1 2f058bbc505bca7f789918b4036ee4b3a2d6bc0f
SHA256 e0ce4e50346e3f2dec956803cab36b5161718724ec2e3382eba12bc7a58e731f
SHA512 9803b3d5ba264baabc561acb9c9e253decf7c1ca4ef971e9265a86410373eb7a58718c5e6a71e61c4c103dcffea0ae4a19aeacc08203a76ae2f3ce714cb2c05e

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\Other.DATA.avos2

MD5 db745b49ad88b167ff1fada54a806fc1
SHA1 58e9caebb6c53875fd4a70093840950ca55f5ae5
SHA256 df60868aecc9868a7c3b0be11c3043df79862cf5dce7dae8807ee10b7ad1dbb4
SHA512 d941fab1d123367f24bd275ebb4cd6e824448db7040ba452e1e4165f89d2844bf0a272296fd754fbba49a1bebeb5f39e57d89d40d38d08f47a2ddbaea45820ab

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Notifications\SoftLandingAssetDark.gif.DATA.avos2

MD5 89f9506b2f94edf304048bed6cd1c5df
SHA1 875903338745da70544a5b480495825c561d1f47
SHA256 4e38403b03bfe8fbc7e00c65766ea7af515bf7c5a4c82ceb8397a71e637c5cf6
SHA512 f3264c1db20dbbc43bffc5107e455e2260cc7e822b87a5b29c3b58a76b8fc7c38cafb7939ad90d5118c6bb5f8cb7d661050c3314977f5670329b98cbd04daac4

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\Fingerprinting.DATA.avos2

MD5 84be33866e0e86fcffafabf138a07bee
SHA1 3202567e2217085f9bde5a6a537a7df7fb61e8d0
SHA256 278769e91720aeb04b99860993284db36678de5cbadc97bd2236ab4c5958fece
SHA512 15836e07a867be43d72d5f557d6092da0d3a301a2bc42c8f92cd2e40566bd377a6f6824b2be02acbaf5c408d0846b976cd6c8f54561d43500e741e2f69b60efa

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\LICENSE.DATA.avos2

MD5 5084aaee0333d464561b96d628be4da7
SHA1 691ccd6571650d588f88c0587814063f6abf23f9
SHA256 a8fa648e71df793a63c90cc9d516111c40c46899afeed4fbd5245305ee7e640c
SHA512 4e76b98b38ad42e0bb42d85623a200ab9b4fb7a5fccdcdf07da2d3b428279c25073069d01434c92e63dba77f1eba2c0446c60dad189e7aab70941272c2dda87d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\Entities.DATA.avos2

MD5 0c9d995a2bfe42abe87bfb07d27e452b
SHA1 9990b9c9b5dacefd5c37991b3529a59fd690200d
SHA256 55057b1a24f4a481d2b9eef7fdfd6442358e48d3b3703758c8c5c3967cc39a27
SHA512 76bb941b64dda4eb81465878d19990516e845b65c57003c0bf1806bb088740fc45f92a46d67e38bc43c406a11d58bfbcb7f7ccfe0654d5c23af973bb27102f0d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\Cryptomining.DATA.avos2

MD5 f4ccbd667e83dd39f5389b10381cee46
SHA1 f9c667573777fc9887f90cb91e657d3da6af8ca4
SHA256 80fc625c0cd599112a470920cd43cf4568dc265475a0d2e82fc55ca9bf87073e
SHA512 23d3b30e0ae44b3953b6d049cf189cfb8b4582c5fbbf259710e6431361e3dfb4d5181459528482b08620489d1fbeb5f70f6c883b4aeffdcac965697594e149a7

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\Other.DATA.avos2

MD5 8c6ddd3df5a3a4cba8df6b457b56aa3f
SHA1 aac74b78fbf11ee47a399661b6ac27c84ec37eea
SHA256 667c9438cfd12f67c4eb7322ca9b6ee7012077e724c91bd4e4c8f53b39d80ee6
SHA512 2f112fe98297f559b168bb015a9edf596e7b84f21a0ccd3ab2796e017e1cbd8b51786d18d91044cd3f9ba3071e8678b91e3b900766bad187b65bb31f1bf2b80c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\CompatExceptions.DATA.avos2

MD5 58979b29d2d9843cfeca6f08cf649d37
SHA1 e010eb88f0df5f5923e404127d83adfa5ca53941
SHA256 cc9c372ddcfac5d7f8cb1888d1043ffee2abdefe9c91fac31f6bfeb26dc3819d
SHA512 238cb782319e63abf3f948cd04f94ea891bbadf7020b50754c0bb34c6a8cac410b0868e819c2679756a667236f30a14adad336e3b0a011dff845c5054c82216d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\Social.DATA.avos2

MD5 1b5181f4853a4976a05c5bd09a0c2af7
SHA1 a263380ad5be64eccdb1eeb076d0794558a6b455
SHA256 cbddc55fc127d7eb9ffcee049d43af05439612e9289ddf0d81d950724c6c73be
SHA512 6a1951c4ef764de0dec31a4a4dac4852695171ecf682a74b2b4cbf4352e4e9a3975fd9f1881607dad6bb62b73bf38eeb600cccca63659bcda3855ea0512be22e

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\Analytics.DATA.avos2

MD5 051cc31d50855248af14b22d0cd13503
SHA1 cfed83466140809607daabb68d8e5b2fde22ddbb
SHA256 49928f7d6804e4019c06ca95d42ab00cc08c41ffac74b2a8087c7de6b6b15523
SHA512 77db69d48e64134c842bb5daa66a265bb213bc4847f07125d0b38801bf5341011598e451279621d5cf9d20a7802200271783876b39bcf2fc28f1c88eb955a816

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\Advertising.DATA.avos2

MD5 4b6a512d610a0a4f9f4f4a062521ad14
SHA1 7061923f0f179b4218f080e4b97ea3a57bf4ee1d
SHA256 55540c242824fb8a1f76ca9e10b835091fbe0c27516d6929dad7708f11f91eb9
SHA512 29953e243f80d55054e871c5f94798c9db6cab422077767c700ba815ab4868c2741e116b9a188df56e342ed91cae3a65cbd78861c704f31426cc5605196ca4e3

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\Staging.DATA.avos2

MD5 43c8cbabd50294e21ad65bb2b1f6202f
SHA1 96dd3de9ce909b5358381c31ff50c4a93423e53d
SHA256 4892387a3e3d24c3ab55b24e4eac01181dd3fe0eb0ba25a707d12e97bc58c593
SHA512 593b106d6e6924dbf1382befb1578554dcf6bfb739c0809f52484ef2eda1a5b6570aad05ac05dc2708300076bd523d20cd6d96efe8e7eec340b74b1d8fef0f84

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\Fingerprinting.DATA.avos2

MD5 a2ec2cf73da82e95ea292a1872b929c7
SHA1 1a3ff1672f599b5e5687b72d144225429519bf4e
SHA256 231411878eac9befacb93b0373f5269482dfd7ffc86a80619a5f8559be0c304f
SHA512 ff4c7cda3e41a1e9bfaa6ffaf84f0229a504bba620ff5a6313dc2fc907324b00caa1575e876ca4b5478a818a8ed62727f5fb1b4c604c65db3aba7b60941d3cbc

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\Entities.DATA.avos2

MD5 8c24247086db2c67734560786b207a6f
SHA1 b714f2294f915053e19c390f2227404835328ab0
SHA256 6a5feba5ad474e657706148faf35c3e75b01921dc78c6b175c5b8cae8c3dcef3
SHA512 94af0a04f6ac788dc1847e40172ef74b120c457bcc52ffccdd6ffe627dbd62dc6b567dd6a06daccd81343bc762c7feda5d14e1a45c2b1fb190c972e6b2e1762c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\Cryptomining.DATA.avos2

MD5 7201ee2ed71718bdc7adc9a7f91a5159
SHA1 5ca42abffcdb7650547f04a42f72a630bc3e1501
SHA256 22a8ba999009ab7bfa51168c704f3af8c2074ca99668ce1e78f3dc475595242c
SHA512 57a6276b8bdc2e62108ad6dcc6d8e55de745c158e163344dd9995ed92a323fccc469c0825a7742517b11f8d359ccd1261391dc1909a13c2afe10b6a6b84bc1c5

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\Content.DATA.avos2

MD5 ddb4fa72079ae422f933a6ce0ddcac9d
SHA1 32dc697475a281ee0c3dc7c773a67a2344225a90
SHA256 e911b8ae2ec589b56930fb9e2fb940cec12424a384122ffbbd3507fc4884d417
SHA512 15c8edb0108ac9c315794c1e29e10470070d4b5221da846cd989ece80886d277b73e840a619ffc742a70f3beca624caf00124337fcf69dbbcd9012db4de00ec7

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\Analytics.DATA.avos2

MD5 3765434a65b01df43040ca5a1906bdc2
SHA1 6b1a1218869f69376e87b152e50e3774cce4f257
SHA256 8bb34bfac316188bf4d2932104dd6b76becb8bd3698acea70390e30b9cdc33f1
SHA512 21bf6c2687ba28071810810da9c45f66aafe354f0a34d4ef47c6d2f28b554946fbc53c87f2ecb5044dbd7e1868c94c310042ffae98833cf6681b464bb06db135

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\VisualElements\SmallLogoDev.png.DATA.avos2

MD5 910d091356f1ddde53bd3641ea4bf0a5
SHA1 fb4a941b0a79751e1c72ccaa7332664d26df05fa
SHA256 0cc58ae192dcf2df6ace6af187b024992197c84027758679cfd6a0f377fc22e7
SHA512 3738f8bc6ddff735d2cbfa27c6e1bb6f999e80f7531da24bee98dcf8b5333a8e4b0cb17b4415ce9a0102858f34501626e818cf3b0b164803efd19402f4ec6df3

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\VisualElements\SmallLogoBeta.png.DATA.avos2

MD5 af128da01cd61061b12fe56664180124
SHA1 82c594b5082bee1303d808b6ca465d524b054ef3
SHA256 17085d2f06a18446accda9c52dbfb6c401745b97e92dc83c28828db08023ad93
SHA512 478af208f9f3d3f7f2fe21057a0c72fe378c646ce2434005ba986909493ba0dd9bc4822999b48cddc85b889c3f512f8b88f2be0d4d4a774e79bd803947daf867

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\VisualElements\SmallLogoCanary.png.DATA.avos2

MD5 db031b9bddcfa491f800a941835bedf0
SHA1 b6efd8f6af579e470d83d718c8675bdee485667e
SHA256 151461e58054e14f6efc8b1c71b17f33ab62196af446f7b6e6b2c929cc1ce623
SHA512 46a2898f1fb2499b0fa669c8a66ca410614e2ff6fc27b08f37f4ee21ca545e46fa8fff3aade630f0862e22da0b7b98a6313a5ba71ae103e776195b893262c9b2

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\manifest.json.DATA.avos2

MD5 0948a73befc183665a9f34bcbf7422c8
SHA1 b2c240f3bb57b943b8514b17416de0756cbffe13
SHA256 80926835006a9ed5c71336c9371aac074e73da3c71c6d23e65b7574ca9f96369
SHA512 971d411926fbc004208a95b210f486a0a66a9326296f6be7cd508f1197c9b910f3a83a154c5703764e62610993fb755af2707cb5f5f36c83e8f81c6670689a3d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\VisualElements\Logo.png.DATA.avos2

MD5 804f9836d5cc8c4544ffe2f9c9a7b2d5
SHA1 1a120e273c47394d8210d5073872ff07a3aebb1d
SHA256 f1a758a612d31edff7fa454aec01688cf905bf49b0963f581ec1e7b7d9b2821c
SHA512 1bca8459797050cff09b78d77990b8f629276eee6d05acd4602b80b8f19d6eeb90ecea0b5a63ddfa35f04bfeb547683de6406446b007b3283253a055578e25c7

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\VisualElements\LogoDev.png.DATA.avos2

MD5 6892d99e6489caca6609d48337b3697d
SHA1 bb8f12d772ee15e8cfdd21d17f832cd6a07fe306
SHA256 a216ab84dd6df56fef8e27ac2846d226bffeba96ae1e71d7a46baf78e9d392c1
SHA512 1d577dba4f4dc0075ef9ac2e52bab1f92b76dee1a33f516318082b7553cd399df030ccee174033c8cbc452c56bd41898a5ee3385f1ac0e95eedf47dbcd3d19d4

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\VisualElements\LogoCanary.png.DATA.avos2

MD5 611d08dea984f8ca9a64872a14f813de
SHA1 23b72f934fd2eeda5cd3a9f5231f83cdc5136000
SHA256 8a760710e1fce4ea6d1233e8dce1cfb9532f4730703e1babc25627a257f0edb4
SHA512 4f85c1957f292065390bf9ec60c989b47442f7c53cb08c9f9f6fbc30eeb53bceb236fdc0adb7f9e97da7c5be55c0d622a5df2e8eaee38a28b9efbd73bbdf6963

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\VisualElements\LogoBeta.png.DATA.avos2

MD5 f78c4364402b00c9b71862bae9c5b806
SHA1 90bea52cbe90b04457e3e37dcf83a1ba01ca77ee
SHA256 fbb9043588f6c60ea149f6f9473b205c5359d06270afcc580f3e422277c948e5
SHA512 bb9937900ad763a08ceb2a5a005fa8f7206036d75d8e627152931d05559b5077612e6b7e04a8edbe367f45c533a93a19bcf48d2b190a8d0fef7ce5aa7bd34870

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.DATA.avos2

MD5 bcb431a7d4adf633610cba4b6cc06a4d
SHA1 f1988772155a590b979933fbb7415999d5904a2a
SHA256 8c8f977703ab74d4e5de66dae6b6da3c796c9d2e9e000adb66a9ed79bd314e0a
SHA512 4eec822cc3a58e1cec2609ecca357ab8347e30e00cbe88e013e80004fb7b0cdd24320543ba38431aa3ea2de1baa0bd54ea3d76cbe0358bc6cb0b91418dc6d94b

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\WidevineCdm\manifest.json.DATA.avos2

MD5 55595405ef4aa8ba1fc3900159ba4c88
SHA1 574a747570c926775ba983c37d2c35deef05c8f1
SHA256 7997f1d59c5817983fd88749afcfd3794456e6c6aaa9c8c5c7c0eb7f431052fe
SHA512 d0c18e68c2934a0e060f783cb9208ad06ecbbb09e5910f12d94b6b9244ab8be57b509a3a6d6aef2c9df93d3ab3877ccec83fd54e9f5fef598ab26d8857104907

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\resources.pak.DATA.avos2

MD5 dd5b4dfa0dac0b0f0094e19b67e06a68
SHA1 c5938106c3ca266c208caee896a7ded0a72e3d1e
SHA256 740749a1b8e7ca4074a52588467063f7a4f3c4ff7b2f33303853986464c51d62
SHA512 6a8709c697df6a570dc7f57dae94fab795e38ef0b0f40d9403b172397396d3c5636d0952a2d8daa9aef4286063d98f06276182c06b67850e7b8fe4bfb0b26cda

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\v8_context_snapshot.bin.DATA.avos2

MD5 5dbc010646fc41bf753524a926a84599
SHA1 01b025f6cd619bd7086f3d447b2162bf008ec4a2
SHA256 f5171c5d5bbb526414fa8ee89604722dd3ffb2f11337087653d877232dbe721d
SHA512 feef0f4fed8e473cccf3205a0b84b26dc0f8e4da1d8d4bf04dd38b4bc2e1d30097b0bf64c445449a6bb0f789e2a3fd72f8b8eb6e8191b35887d4c8f809b8ec86

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\nacl_irt_x86_64.nexe.DATA.avos2

MD5 652920770c82504464f96df1193ceced
SHA1 114879b5ca113baf4e58b96b926c3e2b64aee72b
SHA256 e3f056b47a4d3feb32091203cfbd5eda4d8b9a1613a085f8a7668a5f62a25b1e
SHA512 d429ba26b6304d788b7507e9214ca7433f28649bf319c9828eb116c2a8bcd43f2268e4f5037ef22a1499ab31800ae4b2a706f9016e712f8d5cff41fcd3a49294

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\msedge_200_percent.pak.DATA.avos2

MD5 c91880d93bf49abe5996537e13dd00b0
SHA1 435327d254866fafd3b3ef150e5d2273a380f347
SHA256 75a78e80580dc32ca3291a5607ee476c6c03e2a9078b54075584dd0c8462b482
SHA512 2c713f9d45b2e82c4f7a4bcaa7e9a69e8f63d1031b1d8c14385e32cc922a53acc4975f9130be60ac6e6849792267abed24f7570aafdc9941ec6dad6abe0a19a5

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\msedge_100_percent.pak.DATA.avos2

MD5 fa0615df84061619faf9ebdc6f4e7c93
SHA1 dc417955aac35401147950150e1da321524915dd
SHA256 c03d866626b93b3f813e3a9650084af3f4d1cdbd4d4d791a220f6ccada33b3ea
SHA512 695cd12bb17be716710f65946531cf7730469dc6f3f04f65b4a571dab6eed72e6602d81cbb09e92aa0eeec7ae5ab4db98997ae98dd2ffb251ad28a1c0d9e4b64

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\msedgewebview2.exe.sig.DATA.avos2

MD5 4d359257fb96c6cece8924f37dc6a141
SHA1 4cce2d62acb91ac63c4abcbdf3bd14729a234080
SHA256 c6de13b7fb1f19c9dddde8bc2ac5e9575d0dcb4b2564205b41489cc2007d6993
SHA512 9e16fb8dfb2b5ff89060d420b911fc838eadd0079ca053ad37ba40e729c60d2879ff68ea8337bdd780f6e7a85970958c9e401a1d304533c5e059995f10dbe33e

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\EdgeWebView.dat.DATA.avos2

MD5 2624bdc909550b375817ac7ae2c04796
SHA1 84403edea9395df998cfcdfd51adaa4a344a9ae0
SHA256 a65653e32f2e039323c7309fe9efa7319a45e3819787d07479d415b691ec3637
SHA512 24c40fc2f7d113c98b905b71a1c9f4f16efe60a15ac5713e2d6aa1fc1e35b8abb7dd9a365afa715d6077b22abf69362ddd8cc081d7a7f2b71f21bf0c640e1874

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\msedge.exe.sig.DATA.avos2

MD5 f60dbddc9b7b4a906aafb1da0266cae2
SHA1 8a6894b7225e832ff9dd3780463eb528b8d4ce11
SHA256 ede8f11e7955f8c97a828290e23f0f409195db3f103558d79fa98298c887ca5b
SHA512 3b1d8c003ad3a555d3e0f792fe1d9de57abe48acf7df1a12238249e695b1e2b24a645e411ace0cb55cdd644e4d47970ce8244c269eb4d8aa708eff2d4e3842f6

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\icudtl.dat.DATA.avos2

MD5 905a31f5861dc00947e26488da0b6689
SHA1 1d2e2118c2e6514047ac107e717980ac048bd558
SHA256 bf5c678b3adb6c18e86ecfc11ad2963d56bf54d7d599cb421367b9ce49fe9867
SHA512 c13ac0e2b3eef9515b642d4b37ddcffc9ceea2c548308a94c3bcd644d6df8327a1e9304b50aef821162878cc9da404f70448dd6cde244b0c88fa77bce85e40bf

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\msedge.dll.sig.DATA.avos2

MD5 1307aa2dcedb9dd1140cf2ee25aa8a6f
SHA1 7699954c8b63129146249ba6475981113382cf58
SHA256 7b196548df7dc0dfd3f803b10d76dc46f931c9e1d66d9b8d92aa3722650f9100
SHA512 080d5e31a1d293a5f1b27abf94128d823baa58ce5c78c882de8d5a376de5d170634d19ed95ca06e5251bf49e38c22b3d204d921273d50822e210704e4f2b5d06

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Edge.dat.DATA.avos2

MD5 f113425667e3864d11a4cb69cf9efa58
SHA1 063c4eaf1026cdfa438c3235e2d1cbccb1eedd17
SHA256 0dd259b5f05ae83b0713f770bd5bc47cf41516b306e87b0948200e25c11a42a9
SHA512 205785312d43c7f998051cf03eca0d6aa1bf59c8b329f7b9abbba011311fc9be2799d419a1f16b21240a0f8a0e951ef971bb937075ba158274a7172c0838b514

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\Mu\Social.avos2

MD5 ed341d8387ff5cd7c20174fa51902615
SHA1 a06d5c4fdc7310a3ceeaeb7bdc6403da74a68e1e
SHA256 19be6fd464a1a2523a5ca638909cabadb480f25e1f83e45ba6f7cd06fd1ae649
SHA512 dfca11ae20a54483e592dacd4cd432dcefbf3026eb9b890ef6a4157d585138951b55baa760c035ace244998c14849954749b3d73c455c0bd2392b78cd4d1411a

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\Mu\TransparentAdvertisers.avos2

MD5 17aaed17589a1acbf2f994d798e6e843
SHA1 32f8609f0eca2a22f487d7a640ba5127072ab0de
SHA256 f0586017e609f8d1764fed0446419077e6b44a0f2036f180fec61aa62bb9d327
SHA512 60aa9b521a9a9cf41c7bbf9f27b42bd9582547aa9f3fad8caa4c78df3574efe7af9a444b7604efdb91e56beaad97ab72323aa7b77da763c6b705233fdd42bad6

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\Mu\Other.avos2

MD5 0603c1880c87843b88bb2c9442d45e4e
SHA1 d2a9d825c6ae40fc37dfd4dfdc584e4a22dd818a
SHA256 ad484ba3bbadd44f5ac7e722ebc30fe1058065bd3973ee76acd6a7d1d14ad88c
SHA512 b1ea86a3216de66a0ade41417a5fb5995bcc131cf08ba893d8c57d7ca8367d3f889c460492bf8398ab9b524c18b593ed1c461f44cfa3d2563543b866485b4fc2

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\Mu\LICENSE.avos2

MD5 f4fac4b594c52d2d0eb30f154a9b8477
SHA1 61c58119eabc72e6c06bd7bd4e5509c829b66f94
SHA256 c6f7fb0058b041742ba3df18c7fbf037cbb0504c87e200acd258ae0afdb2f72e
SHA512 fa0e64b44bf5f6b32b2e044105a5da9056248e5c332d7d7c25dc479d55ea6ed7f505a40adefa3a79dd9869b3a0611cc5dbd2b103d8eb5b5239c55970db499e9c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\Mu\Fingerprinting.avos2

MD5 cbed27b407e2a4d8ba38414478f628a6
SHA1 9374f058fe9c893a43ed4a2344511ee664cf7a41
SHA256 7c595ad643d2f4c45471a2a3b55c63e605271f45ece615f349e440511f3c5c1f
SHA512 15f82588b78079da2510684fcbd14b7ef50db34990b82adcc69931b3d29a203ec33494125b908cce4fea68b33315a6c04a693361eb6ba0a4e817084f90e651ae

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\Mu\Entities.avos2

MD5 6f520eb964ee74afc0c44476c5e549b5
SHA1 85ad11d2baf494082954a08b1fac5230d25f0def
SHA256 aac642d344ca8464d72a3449933c9fd9a3046b489a5e00176e8fc1440b325c0c
SHA512 32671cd58c0a7a3f92d571b777e3813caaa086c7c05c2f0b4b9812c0b90db8f8c8baed2826c9e38642bd014ce5c6fe8001aaa102c8149dea850048176f51649f

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\Mu\Cryptomining.avos2

MD5 d950f3c123247e02834f8f3a9bc1ca55
SHA1 f23601d68c7945ac567e124a1cd7cb1cb103714d
SHA256 49e741fac8364479084eea8063f47caeb07b9893b028d1f8519f09fd320cbe4c
SHA512 5d56eb1ceccbc822f0c8e14d804d7bead0a934ee6a1a7e1759dcc630c465a5da8e511d0bc9a043c589d7fda1848d430baa65587b6aca039dcc9f91cd084fe2f8

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\Mu\Content.avos2

MD5 7031bacf08d1ba382f19235f92bf1f15
SHA1 bdb543d90ad7196a43fbfcaf2c73a83fe3eada94
SHA256 7635e028277b3e615db9ba4a4ad771c683db5f1c4ade32b36eade2ceebc8790c
SHA512 760325297064cb3c59afa25b465659c98acdaa22a7b04859dad7e0109487eea5c3d7ebc32a16261450f53f0f37d09c9de8d771f65b88891c1c299936f4e8e575

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\Sigma\Other.avos2

MD5 a2d21d912828a033e359a596a040850f
SHA1 d5055a289370e12cbb3cd5fdf04ee9b93c7fc4e9
SHA256 1bc33cd3bdf2737e0317a3ec8fb549c297b6857df087de323ac2ba6a85c87b90
SHA512 3ea4ea93273296c6e3e1df72f056258fcf24d6e86a2ea3815a22865137d6c467c539549b651522d8e28d9ef66c5397e0c9903acf19d02112c28b49521423878e

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\Sigma\Social.avos2

MD5 c1dc8f91426d7325318bd9a7cca8f093
SHA1 8bb1c2058eea4e74e9e706e8a8d96f9cd82041d4
SHA256 8954adf827cfb80cd0ba32f5f224d704a2b9a4098fa9fd7176b314796615002d
SHA512 f6abbbaef6271d27efe5e58db88d393fafb5f61436bd62cb69523c90b490f4b5885f7d6db5af6b3a706309353f0efca0a37feb4faddd20a317cc95939e4cd419

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\Mu\CompatExceptions.avos2

MD5 bb5ab4eec65374ef5a4e1e48ddca4822
SHA1 37d176c39859f3feeaa39fffd1d303ca86fcbd25
SHA256 675da027957f2c5cff016ebbec0a482d936022c373ad0aed2cb1432b64939943
SHA512 9c005eec481139119b94c7116656e16aa25d7d40fd59627dcb518feb4b6e0db45951c049eb2d993e90c7c0ef3b822e02ecfe6e8d2628e5285f3a439735823969

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\Mu\Analytics.avos2

MD5 abbaaaa134eee08a551f88b0afc368b7
SHA1 88138cdf47f7dffd2efb3806e61a9c2df5ffcf6f
SHA256 839d1f30e28b27fcb3950c4f76b27d052c8adeb9406d8f05d7383cd8e617e315
SHA512 b0eca52716930b5c5661cac0d18826c4f27fc2b655180848c92acf3333be76a40b1774c36455c80bff83a0ec38a209af39d39a9865e03560e1e9913b187ee342

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\Mu\Advertising.avos2

MD5 497eec5b16c35d524b69a45c050b2e94
SHA1 b7c103a355c3d3869ac1a4defc7325827c46dfb4
SHA256 ab6c28b99ad97de1821c3dae2182104ebec83e9139df0e54331b85b1994cda85
SHA512 fa12ac00b38fd049b9dca67fd837cebbc61a62df8cfdbe9dbd41f05a9403becd4ab7dfd6c414fe0da87eacadffd6a878a173c82c2b6b24a1578c672344cbe945

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\Sigma\Staging.avos2

MD5 5949d79f51efed5708dc12acc8a2b981
SHA1 d05042e6580430233bed901b3a76cae7669806ca
SHA256 cd90cef9d10261f0178533f947e9ba0c9762e6b94db825686a2640a084b7ef33
SHA512 2bdb5cc828ccad285a4484f4725037445a88c5dd8521e3c257a313c8f1f4b1b75369fd9123e5b0163599d6da1c48cbc25d56e4b599d5e29bfc20054c89d96655

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\Sigma\LICENSE.avos2

MD5 29d2faa82149a1af8517dafcc43249d9
SHA1 fb9a217cba618a472dae52973925aeffc8b4e99f
SHA256 186605f380c7eb4dc4dd6064df954cbaa323416f06960cb24668ff8ab5055622
SHA512 40b3c1c2dfac5842819d8973512f0df186ae46438a4db4f08f6edbd7fea4e5eeb93fd8f26544b55eb0a6c6cd61fcc30913e4f91b9c8d3ed1ee517fcc57beeb5e

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\Sigma\Fingerprinting.avos2

MD5 d3e09f0d0c7677612f8ba77a08c75916
SHA1 35f999b21189c9813dfaa8b369d6ddc24c55d36e
SHA256 d96aaadaae8562dec4c4d1987c84311c339d0791d31a7480796a7f7603707186
SHA512 00464bdf15a897455b643d30af09bf870db03f21bd9b5a562cc3ab91d4d00bd4c24ac69dd979494dbf39fdd0b1abf20dbae47723e8b8f5ddc5488b89b7050e9b

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\Sigma\Cryptomining.avos2

MD5 6e2d3aa8fe36f5e802eda64cd7189013
SHA1 125d8fe69b6d162d7fea6ed01209f22cfd448fae
SHA256 dd7d6b7faa01f131f10d31eb98458586b80d1192d56fd944c538f59842b13012
SHA512 d32c63b7fbdd6bde0a2d899e4fde52b8af31845a9c84bad140256979d2162b64584b538bffcbf68afedf345661b11e36f7498c33125c7cafe91b3024a92a7131

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\Sigma\Entities.avos2

MD5 a03350f4bb37f53cf497d5d093b9af53
SHA1 d0916459d50dd75d4e142df6135dc19501b645d5
SHA256 a3b12b18af799034da101a14c40c3f1e4161048bb3d9abbd6f7bf0218f32f8d8
SHA512 b52c1e38c69baa0fbce292924ce95b25a008a780ec01b7973815d42f95c2602acdd9ae5e46bbe68c992a4883ff5bc919e8aa48b1341d5f1c42a8ffcbb5d93dfb

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\Sigma\Analytics.avos2

MD5 0731ddcbef656088d0058c8e012f6e43
SHA1 de5c92e7ffe4615a7b67458b4d518d8cb2960a99
SHA256 0acfea0974f89d167d3d74d644db36f6e988e61e8fd5c88568c8d2e81d049289
SHA512 92089b6b72d9455e28c8e88708a3bd924084c447a86ca4762d556195322b008223b9a798315f38ab6faef556a6a5554367f71e1b561bc3e4a1ad22d2e551a0b9

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\Sigma\Advertising.avos2

MD5 5c4141a1019469055ecb3c94111b327e
SHA1 6992f1ed308df6fd489d780b98479e63283986b8
SHA256 fc03de1e47d439b2b9baf5b4334d0f75c6435e1b90b11fde27687916e3c429c9
SHA512 a6506cf00a91d02fd1ec6fb8ffa92c3de6f1dfb298b91e272f0ac422157100da4737ab1c76e5a79afd384e7bf39a3b4ec22306f34f5a24723464f8b8b2399ff8

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\VisualElements\SmallLogoDev.png.avos2

MD5 2ffa07dea89ed10e9af9fc3c688a6c18
SHA1 87d11d1efbff6aa5b6e9d9ceb3f2fd91f78317db
SHA256 3929cdeb6a4324d51a059eb409419efdd6fbc8b4e29701d993c023bcf3a81b71
SHA512 52455927718cc33126d8d536e6ed312b028a5eadc720a1bda2d0e9567fdb6ce7ca92fba0a2a580870ffdc3cc85446469cd7cc215aa2b6fca071ab9812e163dc6

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\VisualElements\SmallLogoBeta.png.avos2

MD5 91c2b2d5256f6115733c3b7b32e6ee35
SHA1 320e5f7d171895d42baf640ebf09a56170863a52
SHA256 6f033f5b365f4c4fe9bbb2f890005a97a8a4c233dac96b90acb2ed97492283c7
SHA512 754c3e92c3a7c01717c5e043601ac792ccb463a10de281e2d009da6e3b793cff81a6439d2c01d593d9d94043441254be06a7b63091b910dd88f6f5b21a8338cc

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\VisualElements\LogoBeta.png.avos2

MD5 a3c4eade7932b455af66d9ce56c4b342
SHA1 e9bbd372e9336e9b94e4bfbe5a22274ada9b0beb
SHA256 bdab2410a78fa043d831ecc15d78942340271658ed4d0083e58240654b6d10da
SHA512 31d28bf193452122230a325ad5648e105b0b31e35af0a7817bc15bb1cafe653bbb1b0be950c59c1daff56c9092368bf15ae4a860f8a69e0abd4a6e0b11d3886e

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\VisualElements\Logo.png.avos2

MD5 1f744293923b34cdf9e07d12bd9f8e31
SHA1 1203706b317f5e0259b72899c3d8489e2810e72c
SHA256 15e519f388315bf9c90bd133f36d5bf542dd0eaf1683c1f6ca56d65d687f6f6b
SHA512 6769806ad79802e637846c762a359359c6b033b0de9bb370e5ad3bb0695ce8a258bc4598aa2db6e55071822d0a532348b5010c07f88aa3eff0f660f6c8350da3

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\VisualElements\SmallLogo.png.avos2

MD5 986bbddb4ea69446a460c73839bfdde5
SHA1 8b915b51c9629bd456baa82a35bce08a35efe20e
SHA256 8709060275bf6f75a07a3091482c4a512c05e68ec8df7d20276d5cbfdd66ad20
SHA512 6c768699ee29137fefa775817d2f6ba034f0091ceae09ef2fae02054df9cbd2299e945eb1195c8cb074365f2223c283c64969df61e617d4648b1b4d5362cc745

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\VisualElements\LogoDev.png.avos2

MD5 6a2fdaac41aeb0038ea9f5c741dbd9ca
SHA1 3c3953a3dbf19daa85b2195648a7c0a15bf48f10
SHA256 fe3b5bc5ca1eade44e406d17169f6623e2cbe7c88045a4f64d35edb995cef86b
SHA512 6e3842b90f5203aaa3788769ce7503f868c46bbba9f8e323a8d7e5e245216bdf94175ba2b9aea24453895c7186975c8f2aca7ff8b61301a3112f31de8ea998e6

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\VisualElements\LogoCanary.png.avos2

MD5 0f7a439e04435b8199330e5060d198f3
SHA1 a2fa15b8b021b7d406f5e4397f1ca00780f4cf63
SHA256 ec585aac33823fb9d955b223268d04fcb44fc96299469e3bdd91bdfc5f55241a
SHA512 828d90f407d78da0708b96ef8c82670c33134bf205c7c6b82b59dc4fd7450cc5bad64a620af8a158f42bb622559f853b96c076682fb4b7f7f876a28bcd4dbb24

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\resources.pak.avos2

MD5 81c6d49eff58bf762504fedd183d673f
SHA1 af8d323c07d1747962b2d215e0644f9e1227e917
SHA256 db4e813f5f0be2ee1f35a9da7ded252149c8ca30feeda67e8e5701580332f119
SHA512 c55a4da839700aa84ab70c97c04ad32507dba0cc834888de1352aac8dabb516148a8c98386ae26ca57863220bfcd5bc725341db58d29403c9ce4dce35e1b4270

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.avos2

MD5 d89bcdb10225686d0b433550fd25e010
SHA1 e7d2bb42c802f70bc29d4ca212c18f8d3335f477
SHA256 3be217c3ded822383e71fce850cbe55fb80a646c5187da9a3d0cdfad291e3d9a
SHA512 b523510d77625be717c886eb5360b39d888752c5a0be4fc30d84f86099068e91ae7e949c92faea3cffd81a1667d7b79ba36ad18c6db9646fac46ce70d2799d71

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\nacl_irt_x86_64.nexe.avos2

MD5 879ad5a27b6d1b3c26695d5d885556c0
SHA1 4e4d4ca04e59c2c477e9266db2f95b91358daf53
SHA256 cfa1cd8bcd957f2c4b29b96f2611d39bc362db7b89805fbc9957333a2688cc49
SHA512 c4793b2259daab209ebed0671131bc34509d75dda4aedbc15f2fed71e2a01ff8a174d640831437b4515773d9f7e9531b3a64e350cf1c549cc3b12b05503661cd

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\msedge_200_percent.pak.avos2

MD5 598b34eec5986ee70906bed3c78955a9
SHA1 e04461a9390c286d06990448a4cf00024bb67dd8
SHA256 455f7ac10726a737a410b6e8a59b3efb5134780fc9bb138526f1b8fd1232187d
SHA512 5317e5b317dfaf3d65970ab1ba5a9f971cd3e1b8c688a9af03b25528044d446dd33da6f96ee657af48a3d6e8fb7cc8eccd0af3fa2fbb9637f0d6ad1085fb6eb7

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\notification_helper.exe.manifest.avos2

MD5 e71db51333d3afdebb7ac2222b9aa6ef
SHA1 f189ebc59fcd803d0338db2909aa21179b807255
SHA256 df35edfff2f2190670c220927eb616539bad92a2c5abbb90655d8fc6f0c9c568
SHA512 dafb81099dc08c37681b2337fcc8fc719e674159783b2cef246c1fc54fff25165ac8d1f668f340b6ff3f39aa9da12e627923d78bb14233b060835f87ed147ff0

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\WidevineCdm\manifest.json.avos2

MD5 f6cfe3b51a315b2e06664e3285136957
SHA1 151b124b6aa28b763ddb90667c504a7fd02e6a3e
SHA256 e6f87f35f0b6f5d72d2e49efb9608950ce5897d5d35a439eb0118d99acdb63f6
SHA512 82675d874aca7a17e06d3251d815fa70d9c655c2b2220c85437a50c4bd177931a23b7c9cfd4f23fa98df4178c2b3f2c0b92baf161d052ffe37c4cc1b878b7871

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\msedge.EtwManifest.man.avos2

MD5 2f1998e0bfd4ed0aaa2704ea4614ec5f
SHA1 b940df38c6ddc1a32e8ec214f149b1ff8e5d89b5
SHA256 23cff54c0e5aa4b137e5bb21ab204546a9e389579ec93a2b71ff9d4481293e4c
SHA512 ad6eb62445b1b999cd90cfb156e92726b3d5645bd93cfe7a66683f23b439ce8a8c5406741ec21f37041e7b92bcbe449af661ee640c4e58a462f0445812ab1133

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\msedgewebview2.exe.sig.avos2

MD5 c6290bd3396d733c4617dd2b3c803994
SHA1 dd67a204b6216cab6a4dff55dc01a17e84e8b2ec
SHA256 45bee19276b6eba62158ffc0bff557b434625cb804290ff2d6a57ec3821f97c4
SHA512 f0467e76dc52a30014a352c0c45c92240705afd1c00bce45ce4a7ec472e6da85daa1d132ff1bf6d2102dbea4298acb58fb45d65b3ec2fb93e9b24ffafd13be1c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\msedge.exe.sig.avos2

MD5 189a4de32db56520f39579ebeddf78d5
SHA1 9fc4dec1157e65abacf94fa19bd0d4ea4d4bd847
SHA256 dc5688909c4ebe2f704fee44820d7a64ad4c3250de8fb8d76241d0c571f9f49a
SHA512 e3a8c8ef5dac5fb03020d460cce8f684ce268f7ff4ba4684a0f9cbb20728ab0e019059bf1316c80da62d104faba89ccda9748113a4359c98044afeeb45a5ca43

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\msedge.dll.sig.avos2

MD5 aec2666887932bc99e2dd8617e982444
SHA1 3bb08c45843847d853ba83060af331f77e071257
SHA256 2734cbe02bfc9d5bb40e8986c44cafe29b089cdde1505a41916fde7c80edd034
SHA512 085e7a94a098a5e5cf3a0b28584114ebc9eb5db1fb47652b6bc779111957aa63ef234840e841ba9fa6389dd01e74ce0010a748e40674031f9ca3f46698a0781e

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\identity_helper.exe.manifest.avos2

MD5 b8e0fb9c2bd3f11142201bbc3d60be23
SHA1 5f337e48f1bcc1f0cbd42fcd7896dc14ede5ed91
SHA256 5bd1278c765c61b7158b7eaa35c2e8f6b2a33ff88592358da4b5392d47867b71
SHA512 a5a6489f39c154c37c2d009072bf0c31b856f0b292706b0bbd753da64773e36816bdb4b8289e9abba81165aeea17c7ed2566079a7ba69d737d11f34874740239

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\icudtl.dat.avos2

MD5 781e820085513beaf38fd1894006ad28
SHA1 e921b5c17b71d9b1772378d8d46502f94d76145f
SHA256 09cc6116ab70a5bfd7609ccf8089467ad6ecfe9c9037617b09bff9f91a9fc87f
SHA512 8c9351612d07294643317312f86cf7b877f9f18349ab9eb9015dcd5859ea2052946698bbb7df040c633be3b79dec6b71ec4e588061a89c0d29b8a7080a550aaf

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Edge.dat.avos2

MD5 1d682804ae78242a6107fd0e073c7da3
SHA1 25e20fc2b1836e6930fd1779d1e60ef033920241
SHA256 e2cf188b3efa1b6a803a7acab8ae1359162f330ab1600bd079c50a71a592ca65
SHA512 101eb1cddb726e1e9db86e65f767f947592d3cbe7832c694350303a654897dc5d6bc3fa7ec9653f4eaed4b96e3213e2728e2dc01a517e6a9dabd58fa8d4361c3

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\90.0.818.66.manifest.avos2

MD5 d8e6313da305cbe5d7106ad5aa72eb98
SHA1 d424a8bc35b0dd4d74c5f076e5b72cdb5217820e
SHA256 4779aea0486d807997997bdd5c4213f7dd10b12119e2883168a0cfb55a87ace1
SHA512 a7d07f4a43cb7f03e208ed56bb5106ce842453d8badf7def1f4d50311d0d5e5711cd3f5760e3b4e2e40f625eec9cd937ae792a94a1c8d5368e8f83dce0a25445

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\devtools\zh-CN.pak.avos2

MD5 2a2eb439f7613cfc3de64bffe3ac6400
SHA1 c722dfbe2939dcd2c60230333aed67d670cefc05
SHA256 d3738d77c6f2775abd072af7fde93d57d092fb954fcddbdecd4edf01a0475d1f
SHA512 5b9cffadac2079e92dc9db2e651e0e828c823460e405885424a3a5c6de9bd9014d79b00ef83585f64b73dfad1eec70a3150a54a676916106f74d330b68bc67d3

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\bn-IN.pak.DATA.avos2

MD5 8baa966b09e83ae9e46829cedd919850
SHA1 6afc440f5055d089473e20c2e0f69ef5e85da089
SHA256 5342df2bb23c0bf93243a06902eb5bd20bd3f753118749363bbac79a3cc1a493
SHA512 50256e0e809a9606e42a7463a4435fc5579baeab8cb97e2f1faa40a4cbaf7d47c991be3871f0941884e74adc8dba6c424c7a619207693028fac530ec19ce2d6a

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\MLModels\autofill_labeling_email.ort.DATA.avos2

MD5 ebcfa5a5f3a41df8b277f6534c560477
SHA1 d6edece9a33a3012bbb874f527a79909fd7c0a9f
SHA256 1190ee4db2a54a51bca6a80948a1ca9e90809686d97647da255f8140762c1b98
SHA512 9f0fbd1d8eecbd9b8819c4f0f8f4cfa5be570af6e3473c73f7262982e33dd1eae212280431bb6c05e64487e4322287056b91131125a7f042349855d4a0f9b11d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\Social.DATA.avos2

MD5 57759196d21e43433fcf92a9dd209a81
SHA1 564194f2e300957306e91bb8f8122bffc93f29ab
SHA256 b5b1538a888c389127db3f8808cbc4bc4e47f25840f7f8f8ab7abc5fda50373f
SHA512 3f63c01e277486c4a835e95f1000d3a0d2f4956497fd2a14b5a3e6ce5735afc966d386abb0f2388a20cee15e5239f1835173d83cb1429fc348c6a553c1b35a59

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\Content.DATA

MD5 b851c4c3ff8c73b9219d343e4ae3d09b
SHA1 c51aaa188d56ce60855b77e3ff74a88354f3ce3c
SHA256 bc0762edc9500d62846337fd0912bd17a110bf30a49cadce415be94273ffee70
SHA512 7e74b6e9c09211f311178cdddaa9713eb95ac88c168bf1e5e04557469ae3337528da412ea8acc30c04c054b0c5edfed6474d649d24102a5008791fcb9844097e

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\LICENSE.DATA.avos2

MD5 78e56ed88f7142db837cce61bca26189
SHA1 2edf78db324dc8d49ba51e271482f00f4e9ccd6e
SHA256 ca9421cd253ed25c37e7b39c854badd4e188a453a22a165b6fc534c121357002
SHA512 a3d72b744d0fc6b8a02eccc5a701749a45a5f7665184cec4a16272e75ecd8e136674d0d1178d9bb2f57fa9ed8505b1d2a40d0a0e8d5d2ad65994e95cb155450c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\Advertising.DATA

MD5 dabd49da6154636cb47ed56a1d53f705
SHA1 818274a9fa3f965e9da7983e69816d28ca4fcfdd
SHA256 dd9ec4d39eda0ef23014058d80a4a88e56315e9606fb0e5b515d417ddf972539
SHA512 9b68dd816a51d12cc6692600932109c080024a4eb904d22eb5e497f98231e4c822176bbe7b84dff17057b47c9a28de05561ea4f6d2d8119b6bd09d9fdd71e005

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\Sigma\Content

MD5 820d59372ccd642754a60c0895f60e5b
SHA1 ec1717d5119ef409d46fe193ba263eafab891954
SHA256 84795c0c3fdd9c9d8e90b342fd4e695ba62f0b9d5ca80b08182e59d262ed32e7
SHA512 ee94ffe1c1a3580d3ea40a577059dbad84697a6a2531156a44fd6e0ccd2ca27296f848e9116f2e3e9134a0e91248246693bea567a8df1c2f538d556b2ce24cbc

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\VisualElements\SmallLogo.png.DATA.avos2

MD5 2eaf790d5a090139da4782188ba92ef1
SHA1 36a4539801360ac7e99ab34e042baed5d86b6058
SHA256 4388b732529dfe508009e82b3980859547eff421c7e4a73d95e924dded6fa1a6
SHA512 e7923f38fe5ce26867969270bc9738fc642098ebe6d7e6ae649cd5499f213d5a545493df984cc95c271ea385aa04001a1a386f266fc144ada3f363b528730c94

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Trust Protection Lists\manifest.json.avos2

MD5 7ea2bad3df409ff8c14a14583bb08b92
SHA1 7c5344bcd3e2faf49ce1d59aa5b5f7630d4c5f9a
SHA256 6a7f0d3a175bc0977e7ac5b590bd2f9f74f26db6f79f2d9b4967ae2479abcf3c
SHA512 db93df677680079df45c72d18bb2b1f4dd428bfaf83263805aae31a0df5f6c3b5042407d6c2a7468735c7749ff9ff0bd20ad9d6fa104b5273d42460067f56b95

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\VisualElements\SmallLogoCanary.png.avos2

MD5 e13aae39471100c35424b5ca25b64a76
SHA1 1cd7d31011c3d650eef89d62466cc9980c8cc162
SHA256 71ff266ef8ccacb98f481d42c9a772e5263aa00293ec1dd7fa920b440e7af12b
SHA512 bc9afd02b136b4f4a408c91ed9f2e87c241c57f8ee1242394ddb1b2bb218fa1d4b9b97b875006d4066437aa2e5d869b732755557d4c03b2f9d5bd5c39af03230

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\EdgeWebView.dat.avos2

MD5 ac3a4f9d079650f2a886c57b02086d42
SHA1 e27dc657a922376cfa6ba10280f6fa613b97cf6c
SHA256 b4e948e61a66773ebc53133134900ea3cbcca7a7bb52b5c6c357c4f8dde4fcd5
SHA512 1f7637bc0272af5dec39f070a63ec2680a9ee5b6d91e43325228e676a282fcfa17aa8488ae80b872ecaff4b74c1e53d571a9de399c19bb1c4c4563ff76c01085

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5559a2871aa84d144ffd7380138b19d3
SHA1 2ccaafe0bdee1809a1d27184cc1b072d9822f12e
SHA256 d55c8e44e720a9489ba078b921b710fbe78404970d3070d0d01e96dda2cab61d
SHA512 0d11893ee58ea22ddb35117a738fc6d17b84db4e866a1e83d6ce9b8a5866d1be41665311d5f3eaa027c55e5ca986c5bc0130f2414df2e37b24ef3d1a7f0a686c

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-17 02:23

Reported

2024-09-17 02:24

Platform

win7-20240903-en

Max time kernel

10s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe"

Signatures

Avoslocker Ransomware

ransomware avoslocker

Deletes shadow copies

ransomware defense_evasion impact execution

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (5318) files with added filename extension

ransomware

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL.DEV_K_COL.HXK C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198372.WMF C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02092_.WMF C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\BREEZE.WAV C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0234000.WMF C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_07.MID C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_right.png C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Issues.accdt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGACCBOX.XML C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\utilityfunctions.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBrowserUpgrade.html C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\16-on-black.gif C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\de-DE\wmplayer.exe.mui C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02369_.WMF C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\weather.css C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianMergeLetter.Dotx C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0234376.WMF C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\weather.js C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana\TAB_OFF.GIF C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\MLA.XSL C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18246_.WMF C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0157167.WMF C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200611.WMF C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0290548.WMF C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00734_.WMF C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ClassicPhotoAlbum.potx C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUTL.OLB C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBHD.XML C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_LightSpirit.gif C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099203.GIF C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\fr-FR\wmlaunch.exe.mui C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excel.exe.manifest C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21520_.GIF C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0174635.WMF C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285808.WMF C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02412K.JPG C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate.css C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Common Files\System\ado\ja-JP\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\cpu.html C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT.DEV_COL.HXC C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107490.WMF C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387337.JPG C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\1.png C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\GET_YOUR_FILES_BACK.txt C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck.css C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CRANINST.WMF C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285782.WMF C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent_partly-cloudy.png C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\settings.html C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_rest.png C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\ja-JP\WMPDMCCore.dll.mui C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR25F.GIF C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl.css C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2948 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\system32\cmd.exe
PID 2948 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\system32\cmd.exe
PID 2948 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\system32\cmd.exe
PID 2948 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\system32\cmd.exe
PID 2948 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\system32\cmd.exe
PID 2948 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\system32\cmd.exe
PID 2948 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\system32\cmd.exe
PID 2948 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\system32\cmd.exe
PID 2948 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\system32\cmd.exe
PID 2948 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\system32\cmd.exe
PID 2948 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\system32\cmd.exe
PID 2948 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\system32\cmd.exe
PID 2948 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\system32\cmd.exe
PID 2948 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\system32\cmd.exe
PID 2948 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\system32\cmd.exe
PID 2948 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\system32\cmd.exe
PID 2948 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\system32\cmd.exe
PID 2948 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\system32\cmd.exe
PID 2948 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\system32\cmd.exe
PID 2948 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe C:\Windows\system32\cmd.exe
PID 2960 wrote to memory of 1732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2960 wrote to memory of 1732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2960 wrote to memory of 1732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1636 wrote to memory of 2300 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1636 wrote to memory of 2300 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1636 wrote to memory of 2300 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1976 wrote to memory of 3216 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1976 wrote to memory of 3216 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1976 wrote to memory of 3216 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2952 wrote to memory of 3328 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2952 wrote to memory of 3328 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2952 wrote to memory of 3328 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2972 wrote to memory of 3320 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2972 wrote to memory of 3320 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2972 wrote to memory of 3320 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe

"C:\Users\Admin\AppData\Local\Temp\AvosLocker.exe"

C:\Windows\system32\cmd.exe

cmd /c wmic shadowcopy delete /nointeractive

C:\Windows\system32\cmd.exe

cmd /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\cmd.exe

cmd /c bcdedit /set {default} recoveryenabled No

C:\Windows\system32\cmd.exe

cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\cmd.exe

cmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete /nointeractive

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled No

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

Network

N/A

Files

\Device\HarddiskVolume1\GET_YOUR_FILES_BACK.txt

MD5 01188d22b1675e3437b1418e14f4ffab
SHA1 6e7127f3bbfce49485ed8f1acf8f697bcb952818
SHA256 e4b3ac00a0b2eb195b26abffbc4368077384e73393e51605edda17dae05ab7f2
SHA512 6903ae3247f32ad79c60a2062cd6a7bdbf5a7c9db1bdc43bdbef4da3396945014d30968ea4c8531a2d0c7b695f1ea36e2b8c51bb39cc6157c4096ac04a6e187d

memory/3320-1820-0x000000001B7D0000-0x000000001BAB2000-memory.dmp

memory/3320-1915-0x0000000001E80000-0x0000000001E88000-memory.dmp