2c8df0f7d5a84fcd1a07f4954a91933f8479e7d3ac664c908ac75830d54a6116

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2025 11:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

43KB
MD5

1338caec1542e6c1b0fa016f314000f0
SHA1

73054fa59e6161761080189b9475a4bc81736967
SHA256

2c8df0f7d5a84fcd1a07f4954a91933f8479e7d3ac664c908ac75830d54a6116
SHA512

ebfb3e489c9d13231e29e8dfd8347ceb056a39dfa8e3940208d5e8456a32a9d3acfcfdb4a98154901e443bdba7ffd4128f5021f2621d0ea7cb27d630f42d7628
SSDEEP

768:2dBpqhYGMpevT3x8gAts0+L7G9TFXWt7aXfsW9l+X9hJYFnzOMD5QBdxaXfsW9lA:aB8hYGMpevT3x8gAts0+L7G9RC7aXfsp

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
2888	msedge.exe
2888	msedge.exe
3704	identity_helper.exe
3704	identity_helper.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 4580	2888	msedge.exe	82
PID 2888 wrote to memory of 4580	2888	msedge.exe	82
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 3452	2888	msedge.exe	83
PID 2888 wrote to memory of 1856	2888	msedge.exe	84
PID 2888 wrote to memory of 1856	2888	msedge.exe	84
PID 2888 wrote to memory of 3832	2888	msedge.exe	85
PID 2888 wrote to memory of 3832	2888	msedge.exe	85
PID 2888 wrote to memory of 3832	2888	msedge.exe	85
PID 2888 wrote to memory of 3832	2888	msedge.exe	85
PID 2888 wrote to memory of 3832	2888	msedge.exe	85
PID 2888 wrote to memory of 3832	2888	msedge.exe	85
PID 2888 wrote to memory of 3832	2888	msedge.exe	85
PID 2888 wrote to memory of 3832	2888	msedge.exe	85
PID 2888 wrote to memory of 3832	2888	msedge.exe	85
PID 2888 wrote to memory of 3832	2888	msedge.exe	85
PID 2888 wrote to memory of 3832	2888	msedge.exe	85
PID 2888 wrote to memory of 3832	2888	msedge.exe	85
PID 2888 wrote to memory of 3832	2888	msedge.exe	85
PID 2888 wrote to memory of 3832	2888	msedge.exe	85
PID 2888 wrote to memory of 3832	2888	msedge.exe	85
PID 2888 wrote to memory of 3832	2888	msedge.exe	85
PID 2888 wrote to memory of 3832	2888	msedge.exe	85
PID 2888 wrote to memory of 3832	2888	msedge.exe	85
PID 2888 wrote to memory of 3832	2888	msedge.exe	85
PID 2888 wrote to memory of 3832	2888	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc45246f8,0x7ffdc4524708,0x7ffdc4524718
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,11306317555342791147,391408596306855600,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,11306317555342791147,391408596306855600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,11306317555342791147,391408596306855600,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11306317555342791147,391408596306855600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11306317555342791147,391408596306855600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,11306317555342791147,391408596306855600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,11306317555342791147,391408596306855600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11306317555342791147,391408596306855600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11306317555342791147,391408596306855600,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11306317555342791147,391408596306855600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11306317555342791147,391408596306855600,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11306317555342791147,391408596306855600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11306317555342791147,391408596306855600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,11306317555342791147,391408596306855600,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
2f269c776da76a033a4384520c15cebc

SHA1
726f50d09b37e5e81f83c7a5e750d5ade029e9a8

SHA256
d68fb99b3c7b445c5f4a5ad16a6e0598f0c0fd6dcd7b0560eb45b5585a232a48

SHA512
f6acf8973b8d8fc6928781bd8bb55b0aea9eb1464c3dd4b3c92f787ee4c3ce94942f8fc08d44db9cfc18691e02d7af57c1bd2977cb3582ec5f7428648c122260

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
16e16fad787f78ca3cf7f67512142a1a

SHA1
367d12bc8aadae5fff295533f01bcaab5591f9e4

SHA256
6cbe68e87baa4daff51654486fb10cd860c457d30efae30f0365822680c748a5

SHA512
270b2f7710e09e97a09a3179e9f8c781f9eb31ddf67bdff04f22a9b89168b9aa6eec98c952fefc24b693f90200fda63d426f1900a5d5822165ae9ef6d570caca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7c8758d7a34f5565cd8362e3d960b2c7

SHA1
d4704b028595a1e7fa388343423818e293c4737a

SHA256
b156a3dc57652a2a602d96ad2b92eb8f4b0f4d0ca008a0f04da9158fa64919ec

SHA512
a69563f65a56c899eef34a71bb51e3909f5c74214e3c4fe3fe5263179360e5f9beaa0d8db4503a55761934dbf5c85bc22176462deb96eb05bd8f32b08f7cf645

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
41631e7fec1f46c63de76fa38b11d2cd

SHA1
b4e196049d76f8423ab810d8f905c7ea1f553a37

SHA256
b4c2ec88abe00a4705d956f2389ba7538228684d2394508533e08e7caacaafea

SHA512
ec15d81700613c10c6b471f6b8e488d6d4e2e6bfa25d7c226ef29a1e084a02735f873ef735d0afd3e8c0a4f03d2b36263bb878ca7226a15c142b602f007949aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cb2136f4-7f51-424c-9230-66d3f50fab7b.tmp

Filesize
523B

MD5
c85db21ec14cb25e7f38c2202117dcf1

SHA1
c3a172605d4aaf6fab8137791c2e48ff1033eae2

SHA256
0628a4e0abb5f041cdca6df31b8a7bdd964987bd11035bde80479f1b24ae7bf4

SHA512
c30093cb2d44f940a6d3b3d96dbdf2992d9c0358056cfd27260fa4588a54a3a25c8e092aadc1f3434e28cfdbd76a6a97dcde45d1e239191afeae2f535be4977b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d67d7763c41a54100426f89a2872158d

SHA1
38ca0c058fb62713e90f1c50299f70273fd20e03

SHA256
cd9d5608d4ff22200da8fa6d9e68df454e1ac57faaa5e90a4fce54224e18cb29

SHA512
0fbac43dd9a8a864640805f225fb6ca85735c29c26adbaffa09ea0cb1720c14142489ed0177b19f00790576377aab8a0be28d540b00a46dc54a18baa027723f9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit