hxxps://view[.]storydoc[.]com/rBTL4jRP

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://view.storydoc.com/rBTL4jRP

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
65	cloudflare-ipfs.com
66	cloudflare-ipfs.com
67	cloudflare-ipfs.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
216	msedge.exe
216	msedge.exe
2116	msedge.exe
2116	msedge.exe
1876	identity_helper.exe
1876	identity_helper.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 4572	2116	msedge.exe	81
PID 2116 wrote to memory of 4572	2116	msedge.exe	81
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 1528	2116	msedge.exe	83
PID 2116 wrote to memory of 216	2116	msedge.exe	85
PID 2116 wrote to memory of 216	2116	msedge.exe	85
PID 2116 wrote to memory of 1748	2116	msedge.exe	84
PID 2116 wrote to memory of 1748	2116	msedge.exe	84
PID 2116 wrote to memory of 1748	2116	msedge.exe	84
PID 2116 wrote to memory of 1748	2116	msedge.exe	84
PID 2116 wrote to memory of 1748	2116	msedge.exe	84
PID 2116 wrote to memory of 1748	2116	msedge.exe	84
PID 2116 wrote to memory of 1748	2116	msedge.exe	84
PID 2116 wrote to memory of 1748	2116	msedge.exe	84
PID 2116 wrote to memory of 1748	2116	msedge.exe	84
PID 2116 wrote to memory of 1748	2116	msedge.exe	84
PID 2116 wrote to memory of 1748	2116	msedge.exe	84
PID 2116 wrote to memory of 1748	2116	msedge.exe	84
PID 2116 wrote to memory of 1748	2116	msedge.exe	84
PID 2116 wrote to memory of 1748	2116	msedge.exe	84
PID 2116 wrote to memory of 1748	2116	msedge.exe	84
PID 2116 wrote to memory of 1748	2116	msedge.exe	84
PID 2116 wrote to memory of 1748	2116	msedge.exe	84
PID 2116 wrote to memory of 1748	2116	msedge.exe	84
PID 2116 wrote to memory of 1748	2116	msedge.exe	84
PID 2116 wrote to memory of 1748	2116	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://view.storydoc.com/rBTL4jRP
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd84346f8,0x7ffdd8434708,0x7ffdd8434718
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,3561322854712222946,13183716779002884020,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,3561322854712222946,13183716779002884020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,3561322854712222946,13183716779002884020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3561322854712222946,13183716779002884020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3561322854712222946,13183716779002884020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,3561322854712222946,13183716779002884020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,3561322854712222946,13183716779002884020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3561322854712222946,13183716779002884020,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3561322854712222946,13183716779002884020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3561322854712222946,13183716779002884020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3561322854712222946,13183716779002884020,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3561322854712222946,13183716779002884020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,3561322854712222946,13183716779002884020,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5960 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
360dd5debf8bf7b89c4d88d29e38446c

SHA1
65afff8c78aeb12c577a523cb77cd58d401b0f82

SHA256
3d9debe659077c04b288107244a22f1b315bcf7495bee75151a9077e71b41eef

SHA512
0ee5b81f0acc82befa24a4438f2ca417ae6fac43fa8c7f264b83b4c792b1bb8d4cecb94c6cbd6facc120dc10d7e4d67e014cdb6b4db83b1a1b60144bb78f7542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fbbaffc5a50295d007ab405b0885ab5

SHA1
518e87df81db1dded184c3e4e3f129cca15baba1

SHA256
b9cde79357b550b171f70630fa94754ca2dcd6228b94f311aefe2a7f1ccfc7b6

SHA512
011c69bf56eb40e7ac5d201c1a0542878d9b32495e94d28c2f3b480772aa541bfd492a9959957d71e66f27b3e8b1a3c13b91f4a21756a9b8263281fd509c007b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
578b668c6421075056507e480e2433e7

SHA1
674d384310aa44be39b8ef694a58990174c9d91e

SHA256
477996f89aefb22680a15020174431cac9daf2b6580e23733de10326b30eee78

SHA512
80d1dbe48c31f9c4d3e0b2a3af4a92b9b59c53ca22f1590914c5df1375a4fa4148651a75b816b4504ac1195d16f49753d1f092cfad84792fd81a224b5f0839e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3024734a47fe2bd0863d19ce70c33644

SHA1
2f2cd70220c757b77794c699216d5b0732f1f3ec

SHA256
12afdcefc30c18b94f727350caeeb08b286a692a5fc7449eb24cbdd6eae9ac23

SHA512
6b9eca8e574e5338837d7ae1e3811660a1899a9c199da5196fcb891ffc2f9e5dc9ba498a161a24ab5c5993f333455568890d922363fd59e04894fe108924528c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
068ea39a026e26046d9dec68d1199fef

SHA1
670512d44d4b7a53df450fd465d1865a2f7c0c53

SHA256
60b40059fd6186618159f35a938f6c6b091c7dcca96a4626dd0b54b541eb7791

SHA512
8afd8cfe8df17f27e61e4b200ab7966a496ee6018598ff935e8ad3c4ac422b31591547661a36c4e84f72bd903551d36a11208cf8989556420c3aac5a2fa3b8b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3abc8099144ba44633d4be6310541f68

SHA1
f9de6b7c8359f4e37d5318cfa92885420b84f95a

SHA256
4b628354127a0d2a00de3c490ae4e3be4d0e996396efff9297823af7a7c0ff47

SHA512
819730f763f600f303e5e535dddb825409ae46647f12585e9b67cd783af33e12e6042f76fb2ae452758d521a976947a33eadbd1de2c3692b858a2218f594f7b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1c8cec5c731f778ddb53264ab28c25d9

SHA1
e9ec2c57ddca5186d3264430d8b0b5cfe4c4f020

SHA256
a74508b4e7b893b5780c01d90450b00ddba0696720812bc0008c95d0fd5cfff1

SHA512
cd22b5ebecfb4a8c554f8b64322e07c0ae4fca4be698792e4608b7c61ee4b8d386bb5873fde984a900557e51d919ea52496f81007c2ceefb172c5d913428199c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ba0af42d637aa16b47e901e758aa41ac

SHA1
4684aaa2221dc2e7b52a55d4288297b4b98ab3dd

SHA256
e63bc8bba5b83403cc198d5c8ff0dc9d5d80b657afcc1538505850d9aaaa5e12

SHA512
f0564b6995683c5e5b9881cd2149bc7dd4d9aa697902cb6ce7ae094408bd381f9f7c0be279fbc0dd78f9ef12593936909b022818a9970ebe9810cd2f37c052f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5849a6.TMP

Filesize
1KB

MD5
118e910e5c9dc3a1bf1b8c18a4a58a49

SHA1
36518ff9ee9867c3bdcc74545ae7f6b63aa40078

SHA256
fd9a35dba76f748eebe4f601907f330e36b739bb697a584f98b1362726b90489

SHA512
02b10744608481d43eeecb480cdaf8bb5acbead7b77187d4c24e8ef4713dc4eb0f88296058c74db2e1a2db1883fd2adca8b9fc1b255d456bf91fa38ddbe286f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ef6ac9606aa39cc74ae247bd50c617aa

SHA1
9cd1a82f608934eeb0625d4fb8c2e30a20ef1b16

SHA256
a2c62457193436b76076278ea7e6ad2433d7cee384e13f8f6868673b37ba4bc1

SHA512
c109c71bfd21b563784b908fa5266f9e1a54fe04c85194fb625bf0287d58820ba180742686d892d86bf4ec77b3c543b878d8a197ecbcc9574d9c1f7b39745606

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit