Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14-12-2024 09:06

General

  • Target

    https://rebrand.ly/phoelkere30

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://rebrand.ly/phoelkere30
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4680
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8f42c3cb8,0x7ff8f42c3cc8,0x7ff8f42c3cd8
      2⤵
        PID:2012
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,2797623884527361398,15990807204812722000,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1884 /prefetch:2
        2⤵
          PID:4128
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,2797623884527361398,15990807204812722000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3556
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,2797623884527361398,15990807204812722000,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2508 /prefetch:8
          2⤵
            PID:3936
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,2797623884527361398,15990807204812722000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
            2⤵
              PID:3836
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,2797623884527361398,15990807204812722000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
              2⤵
                PID:1508
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,2797623884527361398,15990807204812722000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
                2⤵
                  PID:1656
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,2797623884527361398,15990807204812722000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:72
                • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,2797623884527361398,15990807204812722000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3884
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,2797623884527361398,15990807204812722000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
                  2⤵
                    PID:1600
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,2797623884527361398,15990807204812722000,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
                    2⤵
                      PID:2096
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,2797623884527361398,15990807204812722000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
                      2⤵
                        PID:3632
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,2797623884527361398,15990807204812722000,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4520 /prefetch:1
                        2⤵
                          PID:5052
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,2797623884527361398,15990807204812722000,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5324 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2108
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:2040
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:2856

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DABA17F5E36CBE65640DD2FE24F104E7

                            Filesize

                            1KB

                            MD5

                            c6150925cfea5941ddc7ff2a0a506692

                            SHA1

                            9e99a48a9960b14926bb7f3b02e22da2b0ab7280

                            SHA256

                            28689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac996

                            SHA512

                            b3bd41385d72148e03f453e76a45fcd2111a22eff3c7f1e78e41f6744735444e058144ed68af88654ee62b0f117949f35739daad6ad765b8cde1cff92ed2d00c

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DABA17F5E36CBE65640DD2FE24F104E7

                            Filesize

                            276B

                            MD5

                            166031975f64adc104c46176f51b5857

                            SHA1

                            0026c294089497649b694ad3ffb69c6053fd520c

                            SHA256

                            db45c6c44e94130d49ff1525ff282920cf418beb3dc2cff69820d2d4242e8500

                            SHA512

                            44133ff2a999425d154d885f43f60626d354bdfe6173db99bb72d7be070650970f842160836701c5278c0fca8dd9d5e98f4215edc0c42510f2774cbf3a4425fa

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            c0a1774f8079fe496e694f35dfdcf8bc

                            SHA1

                            da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

                            SHA256

                            c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

                            SHA512

                            60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            e11c77d0fa99af6b1b282a22dcb1cf4a

                            SHA1

                            2593a41a6a63143d837700d01aa27b1817d17a4d

                            SHA256

                            d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

                            SHA512

                            c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\983b052d-d117-425f-8173-c2b368718d8d.tmp

                            Filesize

                            1KB

                            MD5

                            3e415fbd23912f4b75baea2f0c85663b

                            SHA1

                            21d3751898f5d44e3a155cc12bf2a031bd409257

                            SHA256

                            fdd724703cdbbe6ab00727acfd40d7aea000c87ae0eae32f133f8439903e3ae6

                            SHA512

                            8881d174d520d97facad54b5502a317a592593170d30b045f4f372f0d33c3bdca79af6973d3b8702e2cfd1b0f05cb1c01cde7922a55f6dbccc81a212fe098d80

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            2KB

                            MD5

                            8a61ff4354f99b0e315c1f510c067587

                            SHA1

                            7c6daea8d9db0501f74cd878bce7f33785b3fe42

                            SHA256

                            2ecd93ab4bfdc2d45b46ff53321903caa6669da611afc26f8f9b90202ec42910

                            SHA512

                            b5c9cc130596fa74942e4d74d22e22d948cf1439536e1409fcce6ef4c7b1545dfbec15e233276e0cb7d49a6b211ba0642fbf2d2c7f5081c4b4e2447988a02bef

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            2KB

                            MD5

                            3a4a2baa13e31d31be04cb690bba6b7f

                            SHA1

                            9e0c0eeb0cbb39372e4278044003719571e36a90

                            SHA256

                            24b0835bfb4f3231a323fcde275ffa3fe559e0252af4f45e910f5fabfa33acf9

                            SHA512

                            b60ba4b97624f57b665cca0040c5a96eda7481f6d05179689f5e085a2bb69b9e21ebba822b821e04ead8112365108115a113f6e0a3421d17ee027e90d6bd3de8

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                            Filesize

                            967B

                            MD5

                            cbf2ed94a4796730ce177e567ced2834

                            SHA1

                            d56e92167565ac10a65046624c3bd7cafb9c24ae

                            SHA256

                            8c507b86ba9e5c13be3169878e3c9da82f4d25df2d4b6c5d2f11928dff475061

                            SHA512

                            8e18062f920b0e28360b8f32817dcd28a3e723335fc9a0c89206b6af0c86b4557d20a675bd6317577adfabbd166a5feae2b0a6cddd6facfe64426b6ba6ce1faa

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            466a6f2f58ad716ed3c65490c603c806

                            SHA1

                            2f1c0c3435e8c8af079cd68af0127e82c44fd993

                            SHA256

                            ba6faf70d4ddc91766f0910436c4d467c733d9549ca3ff65eb3bfec2d8b74f57

                            SHA512

                            397e2db8a8143f028d189df33e9a45e9e024a2c16c87d66e7dec76cd4751dca3860c900003bfe38bd2e7d2a689941dc2337e60254de7280d6723d214fd4a58d4

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            2f488f0a168902353795b46834d00e17

                            SHA1

                            fec63a55de8b53bdee6662a0fdea284d51efb167

                            SHA256

                            a2f3550ef7bdc9cad6e11519b5e97df8c8b3b52fa7e78b10aca71e1ed20fbc13

                            SHA512

                            9041b20774cf437c891aa60a193673b6fe7f4bb9850ed78a90c315c1df6a38926f643567379d06579443c5434ee8691cbd4e3125cd41623c86257540353e817f

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            b1bd6b7501b98b8eea996ebb5184c201

                            SHA1

                            202e2adba23cd1d89573551d3276c72acfb6d3e8

                            SHA256

                            ed16db8d139b300b6e2c4c01029de6fecf7b94a04f636873641b58cf8c848dbf

                            SHA512

                            2f42d76c231b76e061fd4cc78d80dc4198baad1406ce95e9ce93b17452a744817f06a94fbba2093a8a00dadd4a39d920fc632223249117274c9d279c8cb94512

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            687b41c69ece50d8488d053f8ccf6e93

                            SHA1

                            197f4a63a74e8d53c736be400f42fb903aac9605

                            SHA256

                            102a51e18443f27b72a553126a33db3d22647bffaa898d58cd84559a3e4f2ff9

                            SHA512

                            a397b5c21c30e4a6119bc7d79bc6684a8fbe75e298c8a1737fe168bad184868daf707964b0b2d20979288245ca428493e3fb3c7371ecd3afce8988e0abd4f9c6

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            550222b15a4ca88ac90018ab4140d64e

                            SHA1

                            cb898b4207485b801613c8ca3bed3181daea88e9

                            SHA256

                            559c49c2815bdabf93afff7b57831c846d6b93e85191329317b5d4a04821f571

                            SHA512

                            36849fceb78455f68cc1cb2fb92e3b85dbc47a9f2230e1dbc7f7c5ea76683565a0cd1a6d9edc2456a1a95ed008a7f06e093863bea292d4136453f5668a1287b6

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            9d40873d68df5f60c6ba3c15cff95ad4

                            SHA1

                            dca8e6ef3724910a2b1defccf645e86cdd872d8c

                            SHA256

                            31da50d1d784c608202ac86b6e5f642369bf6d513447c1d1bb0a31726a16cec8

                            SHA512

                            743062e2f37b39e07a58ef996df60d7217ef90bbb11548ef8a46f50e939573a01abe69232fd6a409d504a677ad260dd8b4dc6c81e9f3c638f02a489f362ff3f7

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            8d4709afe2ff3d395466d689249d4321

                            SHA1

                            7b65b961db0084fd7c8ac15e80f90c808d69199f

                            SHA256

                            255055fbab7962f1c1ee540cb6c19bfd712c64a39e64373369156d27968af14f

                            SHA512

                            202ca9c59dc469c21466c1b1e62eecf1bb4f0dad09d918e2660a0ef4962e543c70447f3b8bf49db03b9c3f8fe4ef78d34b9133c1247518907e083ddaab32db2d

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            0e6c01ab9f6e1496a8b9f099c36e95b6

                            SHA1

                            74524e376edb4e4a63b37ccfdd17c55783e8b33e

                            SHA256

                            066c70393b1bafb00ce90fa2310c4179310c0c1ae5c8d738f54a934cf02c2575

                            SHA512

                            b6a13e3b553b78e40fb045857313855a5334821f6bb841c8b7606bbcce8a07374764fcd267681f99e1730354b8c988b635505baedc3788c1a55f5a1884e9a9dc

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f770.TMP

                            Filesize

                            1KB

                            MD5

                            49be7a5c3d3c61db8aed8fc459cd3cfd

                            SHA1

                            3dee2335c0113ccc44839c906e5b11c1660d677d

                            SHA256

                            a54c2acbd5ed4bd0669fd8b3d01d10fe3c1449f44b6826196d4dc5d54d0e97b1

                            SHA512

                            ccb31565920722ee942f4f7ff30727b4d59e3cfd44a3f9c42f7a74ed18627ed8bf89a1c68598e2ee65fe2922ec7f318611cb239436d9019ccda508d09fe73cbe

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            46295cac801e5d4857d09837238a6394

                            SHA1

                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                            SHA256

                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                            SHA512

                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            206702161f94c5cd39fadd03f4014d98

                            SHA1

                            bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                            SHA256

                            1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                            SHA512

                            0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            10KB

                            MD5

                            22b6606b41892e45f9a4a7952135a596

                            SHA1

                            fe02d3e0d64e5acffa30dd3b377ab4495bc1c327

                            SHA256

                            ebb99dd53d774e05d6bf6ca9510f5d174d004a3eecb2be9d17103dc28ff59248

                            SHA512

                            998f52a6a093aa1e3b46f9da8f29b06d7528f88fdac3919ba13a71d00d1d4a51f207e862144b5e6fbb45df5b87142e73a23722022c893055a7e14d9e5e5cf7ac

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            10KB

                            MD5

                            b15760756862bdc9fa47e8ee9f9157cc

                            SHA1

                            0b1bf3ff95142d10c61287e057ced2c1991db508

                            SHA256

                            bf6b78e546d86bb9c8f1fde936cfaf3b6b42689a8afe108f05453f5e9e7fe97a

                            SHA512

                            09c99098ee6a72fbbbb6d19865d3c07e8be8561b76cdb46f1e7b9453f0652d4f1a107fcc8fdb1bc25d85ab6e826783657e5290c8d511be62fd771fe100d663e6

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                            Filesize

                            2B

                            MD5

                            f3b25701fe362ec84616a93a45ce9998

                            SHA1

                            d62636d8caec13f04e28442a0a6fa1afeb024bbb

                            SHA256

                            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                            SHA512

                            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84