hxxp://google[.]com

Analysis

max time kernel
263s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
16-11-2023 09:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

8^/10

discovery upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 13 IoCs

pid	Process
6100	devcpp-4.9.9.2_setup.exe
3820	packman.exe
5984	packman.exe
6020	packman.exe
5720	packman.exe
5776	packman.exe
5388	packman.exe
5588	packman.exe
4980	packman.exe
5460	devcpp.exe
5916	make.exe
1472	devcpp.exe
400	make.exe

Loads dropped DLL 11 IoCs

pid	Process
6100	devcpp-4.9.9.2_setup.exe
6100	devcpp-4.9.9.2_setup.exe
6100	devcpp-4.9.9.2_setup.exe
6100	devcpp-4.9.9.2_setup.exe
6100	devcpp-4.9.9.2_setup.exe
6100	devcpp-4.9.9.2_setup.exe
6100	devcpp-4.9.9.2_setup.exe
6100	devcpp-4.9.9.2_setup.exe
6100	devcpp-4.9.9.2_setup.exe
6100	devcpp-4.9.9.2_setup.exe
6100	devcpp-4.9.9.2_setup.exe

UPX packed file 34 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000022ef6-691.dat	upx
behavioral1/memory/3820-694-0x0000000000400000-0x000000000050C000-memory.dmp	upx
behavioral1/files/0x0007000000022ef6-693.dat	upx
behavioral1/memory/3820-696-0x0000000000400000-0x000000000050C000-memory.dmp	upx
behavioral1/files/0x0007000000022ef6-697.dat	upx
behavioral1/memory/5984-698-0x0000000000400000-0x000000000050C000-memory.dmp	upx
behavioral1/memory/5984-700-0x0000000000400000-0x000000000050C000-memory.dmp	upx
behavioral1/files/0x0007000000022ef6-701.dat	upx
behavioral1/memory/6020-703-0x0000000000400000-0x000000000050C000-memory.dmp	upx
behavioral1/files/0x0007000000022ef6-704.dat	upx
behavioral1/memory/5720-705-0x0000000000400000-0x000000000050C000-memory.dmp	upx
behavioral1/memory/5720-707-0x0000000000400000-0x000000000050C000-memory.dmp	upx
behavioral1/files/0x0007000000022ef6-708.dat	upx
behavioral1/memory/5776-710-0x0000000000400000-0x000000000050C000-memory.dmp	upx
behavioral1/files/0x0007000000022ef6-711.dat	upx
behavioral1/memory/5388-713-0x0000000000400000-0x000000000050C000-memory.dmp	upx
behavioral1/files/0x0007000000022ef6-714.dat	upx
behavioral1/memory/5588-716-0x0000000000400000-0x000000000050C000-memory.dmp	upx
behavioral1/files/0x0007000000022ef6-717.dat	upx
behavioral1/memory/4980-719-0x0000000000400000-0x000000000050C000-memory.dmp	upx
behavioral1/files/0x0007000000022ef2-1611.dat	upx
behavioral1/files/0x0007000000022ef2-1713.dat	upx
behavioral1/files/0x0007000000022ef2-1714.dat	upx
behavioral1/memory/5460-1716-0x0000000000400000-0x000000000078E000-memory.dmp	upx
behavioral1/memory/5460-1929-0x0000000000400000-0x000000000078E000-memory.dmp	upx
behavioral1/memory/5460-2124-0x0000000000400000-0x000000000078E000-memory.dmp	upx
behavioral1/memory/1472-2284-0x0000000000400000-0x000000000078E000-memory.dmp	upx
behavioral1/memory/1472-2486-0x0000000000400000-0x000000000078E000-memory.dmp	upx
behavioral1/memory/1472-2487-0x0000000000400000-0x000000000078E000-memory.dmp	upx
behavioral1/memory/1472-2489-0x0000000000400000-0x000000000078E000-memory.dmp	upx
behavioral1/memory/1472-2490-0x0000000000400000-0x000000000078E000-memory.dmp	upx
behavioral1/memory/1472-2491-0x0000000000400000-0x000000000078E000-memory.dmp	upx
behavioral1/memory/1472-2493-0x0000000000400000-0x000000000078E000-memory.dmp	upx
behavioral1/memory/1472-2714-0x0000000000400000-0x000000000078E000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral1/files/0x0007000000022e8d-302.dat	nsis_installer_1
behavioral1/files/0x0007000000022e8d-324.dat	nsis_installer_1
behavioral1/files/0x0007000000022e8d-325.dat	nsis_installer_1

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "85"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.h\shell\open\ddeexec\topic	devcpp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.c\Shell	devcpp-4.9.9.2_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.devpak\ = "Dev-C++ Package File"	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.template\Shell\Open\Command	devcpp-4.9.9.2_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.h\Shell\Open\ddeexec\Application\ = "DEVCPP"	devcpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cpp\ = "DevCpp.cpp"	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.h\Shell	devcpp-4.9.9.2_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.h\Shell\Open\Command\ = "C:\\Dev-Cpp\\DevCpp.exe \"%1\""	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.rc\Shell\Open	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.template	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.dev\Shell\Open	devcpp-4.9.9.2_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.c\Shell\Open\Command\ = "C:\\Dev-Cpp\\DevCpp.exe \"%1\""	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.cpp\Shell\Open	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.devpackage\DefaultIcon	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.h\DefaultIcon	devcpp-4.9.9.2_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.hpp\DefaultIcon\ = "C:\\Dev-Cpp\\DevCpp.exe,7"	devcpp-4.9.9.2_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.devpackage\ = "Dev-C++ Package File"	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.hpp\Shell\Open	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.cpp\shell\open\ddeexec	devcpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.c\DefaultIcon\ = "C:\\Dev-Cpp\\DevCpp.exe,4"	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.cpp	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.h\Shell\Open\Command	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.template\Shell	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.template\shell\open\ddeexec	devcpp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.devpak\Shell\Open\Command	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.cpp\shell\open\ddeexec\topic	devcpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.devpackage\ = "DevCpp.devpackage"	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.hpp\shell\open\ddeexec\topic	devcpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.rc\Shell\Open\ddeexec\topic\ = "DevCppDDEServer"	devcpp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.c	devcpp-4.9.9.2_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.h\DefaultIcon\ = "C:\\Dev-Cpp\\DevCpp.exe,6"	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.hpp	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.hpp\DefaultIcon	devcpp-4.9.9.2_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.h\Shell\Open\ddeexec\topic\ = "DevCppDDEServer"	devcpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.rc\Shell\Open\ddeexec\Application\ = "DEVCPP"	devcpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.template\Shell\Open\ddeexec\ = "[Open(\"%1\")]"	devcpp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.dev	devcpp-4.9.9.2_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.dev\ = "Dev-C++ Project File"	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.hpp	devcpp-4.9.9.2_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.cpp\Shell\Open\ddeexec\Application\ = "DEVCPP"	devcpp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.c\DefaultIcon	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.devpackage	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.devpackage\Shell	devcpp-4.9.9.2_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.c\Shell\Open\ddeexec\ = "[Open(\"%1\")]"	devcpp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.dev\DefaultIcon	devcpp-4.9.9.2_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.h\ = "DevCpp.h"	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rc	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.devpak\DefaultIcon	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.h\shell\open\ddeexec\Application	devcpp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.rc\shell\open\ddeexec\topic	devcpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.c\ = "C Source File"	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.cpp\Shell\Open\Command	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.hpp\Shell	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.devpackage	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.c\Shell\Open	devcpp-4.9.9.2_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.hpp\ = "C++ Header File"	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.rc\Shell	devcpp-4.9.9.2_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.devpak\Shell	devcpp-4.9.9.2_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.devpackage\DefaultIcon\ = "C:\\Dev-Cpp\\DevCpp.exe,10"	devcpp-4.9.9.2_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.rc\Shell\Open\Command\ = "C:\\Dev-Cpp\\DevCpp.exe \"%1\""	devcpp-4.9.9.2_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.devpak\ = "DevCpp.devpak"	devcpp-4.9.9.2_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.c\Shell\Open\ddeexec\topic\ = "DevCppDDEServer"	devcpp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DevCpp.template\shell\open\ddeexec\Application	devcpp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dev	devcpp-4.9.9.2_setup.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 849122.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
3644	msedge.exe
3644	msedge.exe
5020	identity_helper.exe
5020	identity_helper.exe
6008	msedge.exe
6008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5536	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 4268	3644	msedge.exe	21
PID 3644 wrote to memory of 4268	3644	msedge.exe	21
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 1296	3644	msedge.exe	87
PID 3644 wrote to memory of 5028	3644	msedge.exe	88
PID 3644 wrote to memory of 5028	3644	msedge.exe	88
PID 3644 wrote to memory of 1192	3644	msedge.exe	89
PID 3644 wrote to memory of 1192	3644	msedge.exe	89
PID 3644 wrote to memory of 1192	3644	msedge.exe	89
PID 3644 wrote to memory of 1192	3644	msedge.exe	89
PID 3644 wrote to memory of 1192	3644	msedge.exe	89
PID 3644 wrote to memory of 1192	3644	msedge.exe	89
PID 3644 wrote to memory of 1192	3644	msedge.exe	89
PID 3644 wrote to memory of 1192	3644	msedge.exe	89
PID 3644 wrote to memory of 1192	3644	msedge.exe	89
PID 3644 wrote to memory of 1192	3644	msedge.exe	89
PID 3644 wrote to memory of 1192	3644	msedge.exe	89
PID 3644 wrote to memory of 1192	3644	msedge.exe	89
PID 3644 wrote to memory of 1192	3644	msedge.exe	89
PID 3644 wrote to memory of 1192	3644	msedge.exe	89
PID 3644 wrote to memory of 1192	3644	msedge.exe	89
PID 3644 wrote to memory of 1192	3644	msedge.exe	89
PID 3644 wrote to memory of 1192	3644	msedge.exe	89
PID 3644 wrote to memory of 1192	3644	msedge.exe	89
PID 3644 wrote to memory of 1192	3644	msedge.exe	89
PID 3644 wrote to memory of 1192	3644	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc160246f8,0x7ffc16024708,0x7ffc16024718
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2940 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7064 /prefetch:8
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6008
- C:\Users\Admin\Downloads\devcpp-4.9.9.2_setup.exe
  "C:\Users\Admin\Downloads\devcpp-4.9.9.2_setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  PID:6100
- - C:\Dev-Cpp\packman.exe
    "C:\Dev-Cpp\packman.exe" /auto /quiet /uninstall "C:\Dev-Cpp\Packages\binutils.entry"
    3⤵
    - Executes dropped EXE
    PID:3820
- - C:\Dev-Cpp\packman.exe
    "C:\Dev-Cpp\packman.exe" /auto /quiet /uninstall "C:\Dev-Cpp\Packages\gcc-core.entry"
    3⤵
    - Executes dropped EXE
    PID:5984
- - C:\Dev-Cpp\packman.exe
    "C:\Dev-Cpp\packman.exe" /auto /quiet /uninstall "C:\Dev-Cpp\Packages\gcc-g++.entry"
    3⤵
    - Executes dropped EXE
    PID:6020
- - C:\Dev-Cpp\packman.exe
    "C:\Dev-Cpp\packman.exe" /auto /quiet /uninstall "C:\Dev-Cpp\Packages\gcc-objc.entry"
    3⤵
    - Executes dropped EXE
    PID:5720
- - C:\Dev-Cpp\packman.exe
    "C:\Dev-Cpp\packman.exe" /auto /quiet /uninstall "C:\Dev-Cpp\Packages\gdb.entry"
    3⤵
    - Executes dropped EXE
    PID:5776
- - C:\Dev-Cpp\packman.exe
    "C:\Dev-Cpp\packman.exe" /auto /quiet /uninstall "C:\Dev-Cpp\Packages\make.entry"
    3⤵
    - Executes dropped EXE
    PID:5388
- - C:\Dev-Cpp\packman.exe
    "C:\Dev-Cpp\packman.exe" /auto /quiet /uninstall "C:\Dev-Cpp\Packages\mingw-runtime.entry"
    3⤵
    - Executes dropped EXE
    PID:5588
- - C:\Dev-Cpp\packman.exe
    "C:\Dev-Cpp\packman.exe" /auto /quiet /uninstall "C:\Dev-Cpp\Packages\w32api.entry"
    3⤵
    - Executes dropped EXE
    PID:4980
- - C:\Dev-Cpp\devcpp.exe
    "C:\Dev-Cpp\devcpp.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:5460
  - - C:\Dev-Cpp\Bin\make.exe
      make.exe --v
      4⤵
      Executes dropped EXE
      PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16908666565482541178,547404872453580343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:5992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3816

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\ebe630bb88344ba0b56e8d27ef98f030 /t 5452 /p 5460
1⤵
PID:2840

C:\Dev-Cpp\devcpp.exe
"C:\Dev-Cpp\devcpp.exe"
1⤵
- Executes dropped EXE
PID:1472
- C:\Dev-Cpp\Bin\make.exe
  make.exe --v
  2⤵
  - Executes dropped EXE
  PID:400

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38d9055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Dev-Cpp\Lang\Bulgarian.lng

Filesize
21KB

MD5
d23c82db609bbf9dc0b709da7b22111b

SHA1
d32cf2410ebf028039bc88373df041683d98354f

SHA256
b491e3dedb2e1320c7707b721d318205430d5de7f42ff5dd44ba575b7699d38a

SHA512
a19514af264a6e07db413cf3d4a4b7d996f14e18e3ec29859c6e4262bcf1ed4e331c95f2c8dce7619597d36bd6471aa79d573354577822f2576bf4cb55261365

Download Submit
C:\Dev-Cpp\Lang\Catalan.lng

Filesize
24KB

MD5
ef39e64d67c13b7daec488ebefffa0c5

SHA1
b5d9efb5c1249f5b1b5559f8598bdf3cea95465c

SHA256
ebe0ed31547f2a6705b172fb4a5e39c925749dc3953bc942cd099e7561a8f3d4

SHA512
7c67c746a978cf4bd3f28e0dba09373db70a0175f4395546ffb0aed6e339e127571569f461a6edeab6546113dd0e148532a591318b70cfb25185a9f7925124ec

Download Submit
C:\Dev-Cpp\Lang\Chinese.lng

Filesize
16KB

MD5
3d1198a60bbbc9d8446463475e1e3d40

SHA1
1026a059f2f1d4728c5a9938de7c3dffff552a2a

SHA256
f6c9cf5302b93f9a5faa85c673e7409166f57c2581dccb6554418ee4bad5a709

SHA512
ea23a1f0ed5b95acc6f566643d6523ab098eddbd3d2d3266e371d6ef8e7d91bf0623ec19dcd5c2029c777ea19dfb9966911b200efa4a979e9dddea2643bbf56b

Download Submit
C:\Dev-Cpp\Lang\Chinese_TC.lng

Filesize
19KB

MD5
edde8a9410a218ddc99fa07f8abcee04

SHA1
e972ea0f5b898b6f304735bd97997bcdeaa93e5a

SHA256
2abd5403f891b5c148111ddef30364e3c0acd200951afa0bb6f1bb78cf35d40a

SHA512
d44c8ed3469b36688099424f4dc59bab3f54c067c7c9d1797a1d57d4105721dfcf60a24cfa333cf4719a2b6575b0eede2e579b7adaf6566b1ba731cc4321e852

Download Submit
C:\Dev-Cpp\Lang\Croatian.lng

Filesize
16KB

MD5
76a03dfe5a0d61f4f0bea7638a21ad29

SHA1
e21398b6113e20f4ad2cbe1df47702982d18952b

SHA256
e83a60c0ae68db58c377e1d3c2c41098cab0e573ddb46921e9352b3a27554758

SHA512
611a43f81b568b1b5cec5bf8ebc4570cfbfaab64281f3ebb23d0f74fdd726ee801fea0f4d9d11f43bf33960ecf2135ef7232328674423aac78c562ee72dd3d9c

Download Submit
C:\Dev-Cpp\Lang\Czech.lng

Filesize
21KB

MD5
0a877a01c9effbc09df4dfc8bdc79058

SHA1
8228c9517107c9479b611208188696ede9488c3b

SHA256
88d63afa95a261c7104e3f2c7ec4960f54e99109e31475b483829c2b863f72cb

SHA512
933562bb92efcc944fc5a5210fab8de5f2fbc9e5d785967ad6afb059d248b55085c5d2be67973f21dbd7f19ecb07dc9bac1a63f2f5fb441da8aa78a1a407f74c

Download Submit
C:\Dev-Cpp\Lang\Danish.lng

Filesize
20KB

MD5
da722ee91b61ed3699b651efd78d9d58

SHA1
2393fb540a306cb066db916c267e7a7c4e4f349d

SHA256
a5e81dfab800f1c49fadfa00e645239ca1dfd79f1cb3b20c258f1cb5bd0ca5ec

SHA512
f307a0bb69a14b9086af956a540392884ca2fe20d00e10bf9dd05051dfab9ae6cf052e4234b1f1018c3441be49c5402042d47adbf3093247243be9cb50158a86

Download Submit
C:\Dev-Cpp\Lang\Dutch.lng

Filesize
23KB

MD5
6694b326d019d4a5611b671d5d21700a

SHA1
a75cfe30dd7ffe7df9011ddef5538ecb06ae254e

SHA256
2d6c5cdced8f5dd460b1e389ec03166d8221854870798afe5d95e94118e97333

SHA512
07dfa6d0f7b39ba5c8e161577557688aaef636d2183c5049ed545d35298c628260484892df765c9377dcfa22c91ae3d150f8f971f7fbd5efd87703ab4050ad72

Download Submit
C:\Dev-Cpp\Lang\English.lng

Filesize
21KB

MD5
1b5ed983c2c7a7f6521f006089a74236

SHA1
b300c1f052c84cb42f02d99eae251d363815297b

SHA256
8c110d6f2da05343f5d725282fe4788807bc4085711d503a422da15ed42b6e57

SHA512
8d9e5d380ae2ad9f72e00125e2107a6091b9d0ee4ed421457c822d709116c13d84d722b355724c12f1ad87e65a76649e56099d75345db0eff1da48c0e2d8b51a

Download Submit
C:\Dev-Cpp\Lang\Estonian.lng

Filesize
21KB

MD5
a481bd43f7eb190ccda5fedfdd410d12

SHA1
03537541b3955e4d0bb04dd612b0f43d9d6a0cf4

SHA256
dff639e482ad3b0f05771269a387fe8e77df42124f5a85915122747fcc66bfbd

SHA512
b48c86c9343186f45a84dca3abd2ade348ce978a883fe0991982f5b172dfb7cd31ca83d667e648f6fd488f22cfe925fd78dd7c19bf6d08002b8276cb9ceec47e

Download Submit
C:\Dev-Cpp\Lang\French.lng

Filesize
24KB

MD5
1fcf7e695eb92c6354693df9ed63a1ce

SHA1
8608c7def6f96bd2ef962d7f833f8240e674a58c

SHA256
a287ba3ad23ae2265600f9a122cb923eb52f27979f64fa04bab0c9c5c8fbf807

SHA512
1d51bc1f0afccceaf52362040c4c25310bd7060fd2560d95536d4bf21edcd927167069cac02c1a4b55dc96c3470d19e40ef480bd28008033e1c0bb45bdb6e122

Download Submit
C:\Dev-Cpp\Lang\Galego.lng

Filesize
24KB

MD5
35aaff28636d45fe933b26871bc26e78

SHA1
178dcef15947f8367e5bf52940aacddf4d6cf895

SHA256
09b0281857fb4bffe7ad72e894973abbbf7d71c2837069777f41677f71d43d49

SHA512
efd575860551f0fdef0fccbd14ee7b227d3083331af74d64c6d6fdcb922d3b1a47358b54f5b841ed9ff4e3eaf56b391bd9dcd01c40b1df89b77c09ff6e103089

Download Submit
C:\Dev-Cpp\Lang\German.lng

Filesize
22KB

MD5
8b428e859da80f8578d1600aa48bcdf7

SHA1
627b9af85ed0bbf12a08cb55b66734abce0a3dfa

SHA256
5bf192cf216cf10a4779bd70903de6f4511233b89645fa1925f269acc2b87b36

SHA512
5b6df43e43e71da37fc25a6328a756fad573e482ce95c40311f6b03738728551d5ca57a2d53557dfe3ffa48c78392e68ae0afac2c76e44979904a0f5e7d4866b

Download Submit
C:\Dev-Cpp\Packman.exe

Filesize
372KB

MD5
9a33684b8e270ffe321c5cd6d562fc72

SHA1
e7cd1099a1f36f833a1349ab2e6f34ec1afeb476

SHA256
d624881357ad773ebeb617be6697e7bf3144d9484f6d8ee870a5d2aa9348e904

SHA512
ea48f3a4bb7c73adc57f0094ea04448697d4085246a517e9db85e633daf2dfa8138ea1a48336287ae7e6b2473f2ed2dc5ca9faf6da3939e9686fc596f3002fad

Download Submit
C:\Dev-Cpp\Packman.exe

Filesize
372KB

MD5
9a33684b8e270ffe321c5cd6d562fc72

SHA1
e7cd1099a1f36f833a1349ab2e6f34ec1afeb476

SHA256
d624881357ad773ebeb617be6697e7bf3144d9484f6d8ee870a5d2aa9348e904

SHA512
ea48f3a4bb7c73adc57f0094ea04448697d4085246a517e9db85e633daf2dfa8138ea1a48336287ae7e6b2473f2ed2dc5ca9faf6da3939e9686fc596f3002fad

Download Submit
C:\Dev-Cpp\Packman.exe

Filesize
372KB

MD5
9a33684b8e270ffe321c5cd6d562fc72

SHA1
e7cd1099a1f36f833a1349ab2e6f34ec1afeb476

SHA256
d624881357ad773ebeb617be6697e7bf3144d9484f6d8ee870a5d2aa9348e904

SHA512
ea48f3a4bb7c73adc57f0094ea04448697d4085246a517e9db85e633daf2dfa8138ea1a48336287ae7e6b2473f2ed2dc5ca9faf6da3939e9686fc596f3002fad

Download Submit
C:\Dev-Cpp\Packman.exe

Filesize
372KB

MD5
9a33684b8e270ffe321c5cd6d562fc72

SHA1
e7cd1099a1f36f833a1349ab2e6f34ec1afeb476

SHA256
d624881357ad773ebeb617be6697e7bf3144d9484f6d8ee870a5d2aa9348e904

SHA512
ea48f3a4bb7c73adc57f0094ea04448697d4085246a517e9db85e633daf2dfa8138ea1a48336287ae7e6b2473f2ed2dc5ca9faf6da3939e9686fc596f3002fad

Download Submit
C:\Dev-Cpp\Packman.exe

Filesize
372KB

MD5
9a33684b8e270ffe321c5cd6d562fc72

SHA1
e7cd1099a1f36f833a1349ab2e6f34ec1afeb476

SHA256
d624881357ad773ebeb617be6697e7bf3144d9484f6d8ee870a5d2aa9348e904

SHA512
ea48f3a4bb7c73adc57f0094ea04448697d4085246a517e9db85e633daf2dfa8138ea1a48336287ae7e6b2473f2ed2dc5ca9faf6da3939e9686fc596f3002fad

Download Submit
C:\Dev-Cpp\Packman.exe

Filesize
372KB

MD5
9a33684b8e270ffe321c5cd6d562fc72

SHA1
e7cd1099a1f36f833a1349ab2e6f34ec1afeb476

SHA256
d624881357ad773ebeb617be6697e7bf3144d9484f6d8ee870a5d2aa9348e904

SHA512
ea48f3a4bb7c73adc57f0094ea04448697d4085246a517e9db85e633daf2dfa8138ea1a48336287ae7e6b2473f2ed2dc5ca9faf6da3939e9686fc596f3002fad

Download Submit
C:\Dev-Cpp\Packman.exe

Filesize
372KB

MD5
9a33684b8e270ffe321c5cd6d562fc72

SHA1
e7cd1099a1f36f833a1349ab2e6f34ec1afeb476

SHA256
d624881357ad773ebeb617be6697e7bf3144d9484f6d8ee870a5d2aa9348e904

SHA512
ea48f3a4bb7c73adc57f0094ea04448697d4085246a517e9db85e633daf2dfa8138ea1a48336287ae7e6b2473f2ed2dc5ca9faf6da3939e9686fc596f3002fad

Download Submit
C:\Dev-Cpp\Packman.exe

Filesize
372KB

MD5
9a33684b8e270ffe321c5cd6d562fc72

SHA1
e7cd1099a1f36f833a1349ab2e6f34ec1afeb476

SHA256
d624881357ad773ebeb617be6697e7bf3144d9484f6d8ee870a5d2aa9348e904

SHA512
ea48f3a4bb7c73adc57f0094ea04448697d4085246a517e9db85e633daf2dfa8138ea1a48336287ae7e6b2473f2ed2dc5ca9faf6da3939e9686fc596f3002fad

Download Submit
C:\Dev-Cpp\devcpp.exe

Filesize
941KB

MD5
33b356ddbcee822411ebea7b2eea14b4

SHA1
1d5da7e501a60c173b489e961fd50a1358377731

SHA256
f31375b1cbba860ed4014038bdb8c4c816ff3cf24ed6d1f37ac756a10fd3898c

SHA512
ca0b4109964b9526719a911a35110bdd36cf5e6a4f359d07aa3ffc920ba53113b20661d3cc815c31381dd6a93362649ef3dcbc3fb2444b723af240dbb85fd2d7

Download Submit
C:\Dev-Cpp\devcpp.exe

Filesize
941KB

MD5
33b356ddbcee822411ebea7b2eea14b4

SHA1
1d5da7e501a60c173b489e961fd50a1358377731

SHA256
f31375b1cbba860ed4014038bdb8c4c816ff3cf24ed6d1f37ac756a10fd3898c

SHA512
ca0b4109964b9526719a911a35110bdd36cf5e6a4f359d07aa3ffc920ba53113b20661d3cc815c31381dd6a93362649ef3dcbc3fb2444b723af240dbb85fd2d7

Download Submit
C:\Dev-Cpp\devcpp.exe

Filesize
941KB

MD5
33b356ddbcee822411ebea7b2eea14b4

SHA1
1d5da7e501a60c173b489e961fd50a1358377731

SHA256
f31375b1cbba860ed4014038bdb8c4c816ff3cf24ed6d1f37ac756a10fd3898c

SHA512
ca0b4109964b9526719a911a35110bdd36cf5e6a4f359d07aa3ffc920ba53113b20661d3cc815c31381dd6a93362649ef3dcbc3fb2444b723af240dbb85fd2d7

Download Submit
C:\Dev-Cpp\devcpp.map

Filesize
1.7MB

MD5
8c6f84079c003814b35348b11a5d31e1

SHA1
80b1350ed11ff6674f1e7c0fe3723956a3e40aaf

SHA256
d0491df9ac8fcae6079a02947f342ffe0f3fa64d2cd6fbda820751cb0deeab6a

SHA512
ba9546b4bb89948e097308b106e6222d94258b536e9b585fe4bc90d06dd220ad70b3b9ed633b8d9755ad688f478dacc4981b73bbe671aaed539c6a1dcaba1090

Download Submit
C:\Dev-Cpp\packman.exe

Filesize
372KB

MD5
9a33684b8e270ffe321c5cd6d562fc72

SHA1
e7cd1099a1f36f833a1349ab2e6f34ec1afeb476

SHA256
d624881357ad773ebeb617be6697e7bf3144d9484f6d8ee870a5d2aa9348e904

SHA512
ea48f3a4bb7c73adc57f0094ea04448697d4085246a517e9db85e633daf2dfa8138ea1a48336287ae7e6b2473f2ed2dc5ca9faf6da3939e9686fc596f3002fad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
483924abaaa7ce1345acd8547cfe77f4

SHA1
4190d880b95d9506385087d6c2f5434f0e9f63e8

SHA256
9a111c2b76c1b5f6d4f702502b9ff4326b7b5682921c2760286dd073824cb684

SHA512
e4ac0a0d5f06e056901c68488e34358a32a5bc7aeffcd82af7eba6043d0fa35eaa67a67c3716dcb661aaca441677819bcba7d35bc4efc6103f3ce32f78e32310

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b03b7c0552c38fc1abc9501392e79369

SHA1
16b74cc57c92b5a09733b3314be785a253e2c0a8

SHA256
20aab407a27c93341d0650a297801058a1bc890c1f4f6908407ae0f26945c3f0

SHA512
2af0162debf8c97b13486c3544cb8dc00e2f9ee17cb057ff429516317b8cb71d484cc98471b5ef06447db10ea4c1ac4b1b17d01b162b52a0b3635d247a7c8368

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
653b92c9566702514a09d1b933d91a09

SHA1
eac0c7f6ad3ea846289937eca7894d785b5b8577

SHA256
c6a74b1c3fcae34812429b1c34da870fe4f636a1c1baedd7d5759306bc9e1e33

SHA512
7ee85ed04254e72a2289d3b701eb42cf6ca8fdf511964c2105fb6490b6610ff69fa79a3ba9e0d6ccf624f35edbe51a7726a257386d9a30a120eab586e5b40ce3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
fa1f6ae04a7317acf78bc8fc8854fc6d

SHA1
23661db9a51131f16a4ac99978ae482a856828ba

SHA256
4a1394b8cb5c74983950b6072bd74ca47d006d8f9626e65a12bafa394c458991

SHA512
38eada0862296489fceba751d7f1b7722d7d12e970227c714980f7e138a51615ea0df1a372be9ba865214aab721922d1a144730c7332fe39f8f2533b3c031836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0fa6b76c6a8362cc2024c3475c8b140d

SHA1
d9052984cdc2c03c4c71e560fd1a293a3faf7ce6

SHA256
af4678ec3d729f4e96d22786a014891f084708dbeec223b43c43aed3855749e1

SHA512
83d1fdb3e946b25ccd8bc5d0dfd90944a1bc27acd7696df2318311633fe5cbad820468f79696d7e9e3725c888456690eda2f81efc5c200663a4db1bbf2d29ad5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
989175611665dbe8415c9f6f6ff83bd3

SHA1
4311f5a53c3b8dca86d602ed06acf4f78086aa5e

SHA256
a27367312f2d411d446b14affc967de8d02ee910e0dbd074327dd88ba22307d2

SHA512
08cb25b47e96a32917d097bf217ab889e95d342ac48764f18dec059104a1ae00a50b9e73e1a825097aa54a74975eb200a8f4aab2736676c69f250627786ad8de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
74e3468f0be02ae61e7bc82ea9ffe7a2

SHA1
21ddec2b13911e22a0ec78b5fa6438b47f801084

SHA256
ed8ae19066aff986cbac94e222d9a5af7e84225aca17d3e4993f7ca552351244

SHA512
6566d27624baa038dfa55b15cd7a478dafa185870777f99026bd2f0731af5a18555559b379a83aa7f878b313dd777828a4a5b10af17695d78bb948288dc53b79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
e219afa5eb07289ad0372e9920d52864

SHA1
848851aafc4fdd0396cc293d59af85576611e872

SHA256
3becf8bfc8d2a04b3631577af70b29a0d0b679859af891903aa5f438d88b5a18

SHA512
8ff70e514c9e2fff7eea745101674251d53db0a34ba442bcba46be58974218020edc782c360eaf9476d0b86b580a5e4b7b0561f4736a1d55a20b9277e7681215

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
1e505e7d0fd18e3f0d8a24d2d9fcfdf4

SHA1
21a47929ea75f6998cc9b8a21591fd87b055b0f3

SHA256
ef2861fb8917a4c131462d1e7f51b635806ae1545c4984cccdcfb0e32bcaa020

SHA512
833f8ac78f9b6b5a6c49c0a68768f685e72cbcf56fb0cf4fa556640a24b793f6d45a96f2e437164126c7c234d0bbcaeb3d586b129a2b40b0cbcbe867da67af1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
c2cf8afd3c51cec0029674e2192f64e1

SHA1
208c70d8ce9a108188735db7f843fbdbf8fe4577

SHA256
cb05db3e940f517d56e45f65f8dfb824f6b8969acc8fc6da9e7e1062a7ea5532

SHA512
d895cc3ed698a38a0aca1f28a3793461b00fdf8b05113c1f9893e0e12d32d5ce5c28e813b9e203f0bc657f0668802199230132dc7be31accf5eda4267d231b5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aaa78bb9c16fb5dd0a53033fbdcd56b2

SHA1
9e666b4d7786b508eaa8d358346dde37ee50bf6c

SHA256
8211cdfcb30db0bb367917ad17c9d001da46a440b02595890b5f4a22e2cf21a3

SHA512
511913869dcc085f127e0a72e271205f8819f39c08676859ee931e3b3abaf2909b3d894b0e18bb715125c3cbfdb583b9e865a181844ce7d4ebf017808a0d2bf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1c706d53e85fb5321a8396d197051531

SHA1
0d92aa8524fb1d47e7ee5d614e58a398c06141a4

SHA256
80c44553381f37e930f1c82a1dc2e77acd7b955ec0dc99d090d5bd6b32c3c932

SHA512
d43867392c553d4afffa45a1b87a74e819964011fb1226ee54e23a98fc63ca80e266730cec6796a2afa435b1ea28aed72c55eae1ae5d31ec778f53be3e2162fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fc0a15758f93820a5cbff80fd1891608

SHA1
1f5adf13b7e442113dc38b56e12c01dbc6128e7b

SHA256
06d2d9d2075979e10e3bb80aa764e9a334d8679382dabf64352bf585e9124c58

SHA512
56b186de734511635b8834eca9d0196b4be8bd13f2894187a093f0730ffec2930b4ed70a5a1c0ac9e76a46fa071db4fe6aeb76fe1e6f5d37840a51d3244ee781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
78deea120b6f53e1661e10280ec55d93

SHA1
faa025f158ee1619b6251c620554d6b422d75b86

SHA256
d71395f6cb14cc494fffee676a7fc8bf5bc758004952d66e9bc25c5fb5c77b21

SHA512
652200516052723f94f89a30b5e1870e67b2a50cacb87c5be1134e5b512046342ebb2e7c77b9dc67138cdbae36921010ede39012a01c7ba5abcc2588e2c7ff7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
be0e0f6a5011bf7eb9a6567e53f04d78

SHA1
2cc83e6ed537a4e5b30633dbe9084ef4f2dce0fe

SHA256
8ef10ba5021943af7660c20fef5a1156b6eb4d47e1ac285a8959f23d5681c9eb

SHA512
f86f4d233f95059768a611489817207b8ebbffd9c56d2d8d1b74d595a5f1873b4df0c2f9adc904e7ca52286421e13a1a7b095fd491ce9fd0a88cfc08035ba569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d4c5.TMP

Filesize
372B

MD5
d1d790ef14b9acd19eaa1266a8c3bd92

SHA1
960c0ca5f0e2466a73f447d79a281e5aabc4834c

SHA256
a8bd7c2e30c1b7c1b199484bf02647c64e782a8bf235748a345fc46efd2d9ca6

SHA512
202cb52a5a922629c34d3c130b63d9cee81a4db5e3d815a10865ebd2eceba9b3c06116c818bac2f24e8b64067e700331a7de279d01faa39fad69e647243cd075

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1bb1a53959c43bb75d08bec1cb3e2049

SHA1
dd5a11ffdc6e964c415188c8700fbdbf31569be7

SHA256
493da236ed542b0fc985ffa684e9a32c57274b4d9c8635b17c2062cc8e2e6a13

SHA512
10497562cd012cedac82f8b431a91eb8b7659c08c1e5f92cb423c210e214a1425bce5efdf71d2f93af689536675d7f7044dc42364db684b962cc3142abd9bd2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0856de4bd1d4bf79a556bf7a47f92f9e

SHA1
cae5cae9549976abb3acf7c6c74a8d481b614ff3

SHA256
2ea9bdd78c85faf2dbffbad088395f218f7a2c1109cd5206c498123d6889b0b1

SHA512
74d672a1da45c447ade06ac73d59916fb35246704d69bd74623c31ca88c6e1eeca2897d349aa27da838df6056ff20f542dd951186d96eb7a84a5dbe44a4756b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
93a6b027a6d4e8834f1a8ab19b5705ca

SHA1
e70a34c925d2ba2f15fdae84e3a00b118fb79b59

SHA256
5e8561782ee6a645fbf67a144895e9daf03d2b90ed06dd7833e017d819c82470

SHA512
67767ef363aa0769217bb22a20e8aee183cd54cfb7d82668f22bd96a5bb748445c81d98dffe6a47eefffd717195e3ce7c087aeb9ca35c40a326416c281847676

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB19A.tmp\InstallOptions.dll

Filesize
12KB

MD5
4c7d97d0786ff08b20d0e8315b5fc3cb

SHA1
bb6f475e867b2bf55e4cd214bd4ef68e26d70f6c

SHA256
75e20f4c5eb00e9e5cb610273023e9d2c36392fa3b664c264b736c7cc2d1ac84

SHA512
f37093fd5cdda74d8f7376c60a05b442f884e9d370347c7c39d84eca88f23fbea6221da2e57197acd78c817a74703c49fb28b89d41c3e34817cc9301b0b6485a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB19A.tmp\InstallOptions.dll

Filesize
12KB

MD5
4c7d97d0786ff08b20d0e8315b5fc3cb

SHA1
bb6f475e867b2bf55e4cd214bd4ef68e26d70f6c

SHA256
75e20f4c5eb00e9e5cb610273023e9d2c36392fa3b664c264b736c7cc2d1ac84

SHA512
f37093fd5cdda74d8f7376c60a05b442f884e9d370347c7c39d84eca88f23fbea6221da2e57197acd78c817a74703c49fb28b89d41c3e34817cc9301b0b6485a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB19A.tmp\LangDLL.dll

Filesize
5KB

MD5
2c3c8976d729d28478a789217a882291

SHA1
10c18b23fac957419547ef0f8ec3bc1b10e91e79

SHA256
799f91bdd59f2133bf195c5b4ca685ee91666d981a6bcd8a6c45b7c8ecc96eef

SHA512
749c650974f94cc5009124d3fa3d9bb1ee5824a3fa0a76b81733e08379678a2a1b7c54b77d1709fb6de24c81c68c03c0ec3e9ec5ccad0d30d9237300794f1213

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB19A.tmp\LangDLL.dll

Filesize
5KB

MD5
2c3c8976d729d28478a789217a882291

SHA1
10c18b23fac957419547ef0f8ec3bc1b10e91e79

SHA256
799f91bdd59f2133bf195c5b4ca685ee91666d981a6bcd8a6c45b7c8ecc96eef

SHA512
749c650974f94cc5009124d3fa3d9bb1ee5824a3fa0a76b81733e08379678a2a1b7c54b77d1709fb6de24c81c68c03c0ec3e9ec5ccad0d30d9237300794f1213

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB19A.tmp\System.dll

Filesize
9KB

MD5
e085476805e8f5ef1c7ed635c5309017

SHA1
609e79fdc29d6dee40cc5dd333094db5f9f63eec

SHA256
4eb689e2db8d683afcfffe6dee1985fbd458d2770093547331d563acece80c67

SHA512
082932aea8d993de8ca1eeb60f7bb4e56cc7eab4a683c59822b2c544223febab5915bb2b7c2e2dad79472bbd8ad400770dd7c1f112cef24d18ebd0f1ad63fe9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB19A.tmp\System.dll

Filesize
9KB

MD5
e085476805e8f5ef1c7ed635c5309017

SHA1
609e79fdc29d6dee40cc5dd333094db5f9f63eec

SHA256
4eb689e2db8d683afcfffe6dee1985fbd458d2770093547331d563acece80c67

SHA512
082932aea8d993de8ca1eeb60f7bb4e56cc7eab4a683c59822b2c544223febab5915bb2b7c2e2dad79472bbd8ad400770dd7c1f112cef24d18ebd0f1ad63fe9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB19A.tmp\System.dll

Filesize
9KB

MD5
e085476805e8f5ef1c7ed635c5309017

SHA1
609e79fdc29d6dee40cc5dd333094db5f9f63eec

SHA256
4eb689e2db8d683afcfffe6dee1985fbd458d2770093547331d563acece80c67

SHA512
082932aea8d993de8ca1eeb60f7bb4e56cc7eab4a683c59822b2c544223febab5915bb2b7c2e2dad79472bbd8ad400770dd7c1f112cef24d18ebd0f1ad63fe9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB19A.tmp\System.dll

Filesize
9KB

MD5
e085476805e8f5ef1c7ed635c5309017

SHA1
609e79fdc29d6dee40cc5dd333094db5f9f63eec

SHA256
4eb689e2db8d683afcfffe6dee1985fbd458d2770093547331d563acece80c67

SHA512
082932aea8d993de8ca1eeb60f7bb4e56cc7eab4a683c59822b2c544223febab5915bb2b7c2e2dad79472bbd8ad400770dd7c1f112cef24d18ebd0f1ad63fe9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB19A.tmp\System.dll

Filesize
9KB

MD5
e085476805e8f5ef1c7ed635c5309017

SHA1
609e79fdc29d6dee40cc5dd333094db5f9f63eec

SHA256
4eb689e2db8d683afcfffe6dee1985fbd458d2770093547331d563acece80c67

SHA512
082932aea8d993de8ca1eeb60f7bb4e56cc7eab4a683c59822b2c544223febab5915bb2b7c2e2dad79472bbd8ad400770dd7c1f112cef24d18ebd0f1ad63fe9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB19A.tmp\System.dll

Filesize
9KB

MD5
e085476805e8f5ef1c7ed635c5309017

SHA1
609e79fdc29d6dee40cc5dd333094db5f9f63eec

SHA256
4eb689e2db8d683afcfffe6dee1985fbd458d2770093547331d563acece80c67

SHA512
082932aea8d993de8ca1eeb60f7bb4e56cc7eab4a683c59822b2c544223febab5915bb2b7c2e2dad79472bbd8ad400770dd7c1f112cef24d18ebd0f1ad63fe9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB19A.tmp\System.dll

Filesize
9KB

MD5
e085476805e8f5ef1c7ed635c5309017

SHA1
609e79fdc29d6dee40cc5dd333094db5f9f63eec

SHA256
4eb689e2db8d683afcfffe6dee1985fbd458d2770093547331d563acece80c67

SHA512
082932aea8d993de8ca1eeb60f7bb4e56cc7eab4a683c59822b2c544223febab5915bb2b7c2e2dad79472bbd8ad400770dd7c1f112cef24d18ebd0f1ad63fe9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB19A.tmp\System.dll

Filesize
9KB

MD5
e085476805e8f5ef1c7ed635c5309017

SHA1
609e79fdc29d6dee40cc5dd333094db5f9f63eec

SHA256
4eb689e2db8d683afcfffe6dee1985fbd458d2770093547331d563acece80c67

SHA512
082932aea8d993de8ca1eeb60f7bb4e56cc7eab4a683c59822b2c544223febab5915bb2b7c2e2dad79472bbd8ad400770dd7c1f112cef24d18ebd0f1ad63fe9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB19A.tmp\System.dll

Filesize
9KB

MD5
e085476805e8f5ef1c7ed635c5309017

SHA1
609e79fdc29d6dee40cc5dd333094db5f9f63eec

SHA256
4eb689e2db8d683afcfffe6dee1985fbd458d2770093547331d563acece80c67

SHA512
082932aea8d993de8ca1eeb60f7bb4e56cc7eab4a683c59822b2c544223febab5915bb2b7c2e2dad79472bbd8ad400770dd7c1f112cef24d18ebd0f1ad63fe9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB19A.tmp\System.dll

Filesize
9KB

MD5
e085476805e8f5ef1c7ed635c5309017

SHA1
609e79fdc29d6dee40cc5dd333094db5f9f63eec

SHA256
4eb689e2db8d683afcfffe6dee1985fbd458d2770093547331d563acece80c67

SHA512
082932aea8d993de8ca1eeb60f7bb4e56cc7eab4a683c59822b2c544223febab5915bb2b7c2e2dad79472bbd8ad400770dd7c1f112cef24d18ebd0f1ad63fe9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB19A.tmp\ioSpecial.ini

Filesize
672B

MD5
514df982a07d59c4c182c75c2901ee4a

SHA1
013157221d04c3cd66d13ab2a3ea0d5881edca3c

SHA256
d1ce019e15b331a8ba8e694f654662f993cc98f6345672ee8725577929d2c0f4

SHA512
11b0d1da6874d04534a5a49f02514d7e687ce6a85c75c3f2deec2469838dda6dea4fc3ef73a57dc2c3955ccb5f1a17fdf5770f6b4d65c834853f23132300834e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB19A.tmp\ioSpecial.ini

Filesize
681B

MD5
2a1fc1b0288ce4881c5f6f45e2960130

SHA1
4eaf6db7ff8e1f6c336380be043d40d6246d6655

SHA256
5b6efc4e6d495e6b6cae616539ef2678a9551f5f55750c510c0f0fd035b0fd0a

SHA512
942e57d7bc934da3d3d8dc3d9cc75cbd1115c551f80cfbc41ef75e530afd1be1758e655902d7008f02b86e2e608dffcbb6ffc71ff79a2aa0a382c2545563a993

Download Submit
C:\Users\Admin\AppData\Roaming\Dev-Cpp\devcpp.ini

Filesize
480B

MD5
664900eb556734accda30bd89f91345b

SHA1
2cc98b307a4ea54a41efbf7ccc956b7fbbfa2684

SHA256
30c179ae0cd104bc2a3c564c8602303e0856f40995f3030e3f41d1feada276d6

SHA512
9aea7566f35465dd2a44744f5751f6be92626378cfdbdbfdf421fa42b6fe8653b7abbefb71e3efb995c8de543fd079b147bfe9bea10733307609b1f14d70c9b6

Download Submit
C:\Users\Admin\AppData\Roaming\Dev-Cpp\devcpp.ini

Filesize
4KB

MD5
bab1b261e87bdef5ba6f582bbaec3db3

SHA1
467f449cf9d2f7fdb379821f428c0eda94e7da09

SHA256
4638f182f3adf3f038354f2ed342f84754de704e5129d5e2cd82005c481cbf8b

SHA512
945d2177dc5f93ab9033201591737e64c65f1c9a1ed696b09e64b2b6e591f27b4c0bac3b260cb3524781d6185c5dec687b79b909fa1906d9505a4a117bc52f1f

Download Submit
C:\Users\Admin\AppData\Roaming\Dev-Cpp\devcpp.ini

Filesize
4KB

MD5
bab1b261e87bdef5ba6f582bbaec3db3

SHA1
467f449cf9d2f7fdb379821f428c0eda94e7da09

SHA256
4638f182f3adf3f038354f2ed342f84754de704e5129d5e2cd82005c481cbf8b

SHA512
945d2177dc5f93ab9033201591737e64c65f1c9a1ed696b09e64b2b6e591f27b4c0bac3b260cb3524781d6185c5dec687b79b909fa1906d9505a4a117bc52f1f

Download Submit
C:\Users\Admin\AppData\Roaming\Dev-Cpp\devcpp.ini

Filesize
3KB

MD5
8f510de0c25e3d4968a3c3f03ea72d62

SHA1
5c1816b4cae92e742d80bf09d91a79e2ac48f09b

SHA256
870173f4d08715949d1e973e900692d195bb36fafcc1fe0262cc3ce09b620ff6

SHA512
70d0f5123b213d4011d1797a37240cb4989089e5fc29583e7fce94166fb96ff1484d57d3e387a031e8d1127b107ce646481672658773d43ebe68ef9f7b4eaf1c

Download Submit
C:\Users\Admin\AppData\Roaming\Dev-Cpp\devcpp.ini

Filesize
3KB

MD5
1d4fd1e3a5093d31370a144c5ebb49ce

SHA1
e312d225cca1348987fd9e8b20ce34e915d7b3da

SHA256
03758af0f5a01c4925ad9ef5c107a9d9de6f89c8ba7b510a3b5587d4b63b1342

SHA512
af8651d71ab93d19235c63e4cb9b6dc5b905f1df4faecda8a14c293a04c7e15d485afd9a07e80a4ba0ca58289912403cc5d86047073576a1c3b608be9dc21654

Download Submit
C:\Users\Admin\AppData\Roaming\Dev-Cpp\devcpp.ini

Filesize
4KB

MD5
88d2a6e92124fc594161727f7ab7895c

SHA1
eeb5b7f66c183226bbe19ae1d5e1216df35b76bc

SHA256
fee3d592c287f9b988ffb2b0daa4f0b546a425a953578f53d0adaa8450f09420

SHA512
e9de1b14cc795c4005aab064d08c5c6792639a8a0e09fea1c9bb4bdd5576ac415765de533d4aa97ae7c4c747658197adda752d5c0cbc4417f480b5d48689dea1

Download Submit
C:\Users\Admin\AppData\Roaming\Dev-Cpp\devcpp.ini

Filesize
4KB

MD5
ded1bf38678fbcd9352a81168e784523

SHA1
ec3fe077d854b1daec13ef02373e916759f06023

SHA256
234b5bf66d2313f3b00247345431e17e41718b5b96f84819876a5b4899b4b209

SHA512
06d93e03ecbe58f18e38a168ff38e656959ae76ecc90f472e2ecee4463646629b5f137a7a2f5e7f23b7e2d40c0c1716a5eaf7e12741233b85ac8abb1b2d3f5a2

Download Submit
C:\Users\Admin\AppData\Roaming\Dev-Cpp\devcpp.ini

Filesize
4KB

MD5
491e28ec0c0101e9898fb787b3e57702

SHA1
8b33f368b7245512662b69f92f6c8f795acfde5f

SHA256
91e08b909947b877a27084383cbc7159c6476ce0ec060efa7f26767c96bc0bc0

SHA512
4017c73695e7efc361c4246e07ba4a94516fd639f29dd330a0f39d7d578c8f8165179d724aee39c72d57c02ef174e43e279300bfc88c32fc1e2d51e17e1a544a

Download Submit
C:\Users\Admin\AppData\Roaming\Dev-Cpp\devcpp.ini

Filesize
3KB

MD5
0e27dc864a562cc781b08fd8e5ca8c1d

SHA1
495d2a521c7f76fd0a093a34e6449effac7dc479

SHA256
58f6f8d0bb7ccf6db5f350343c46a20b6dfca37f2ed4ea6346445ca5546f1e92

SHA512
6f6d29e84b1b9be08d3e6342a4fcd591a166ac7396fab54bede79b1b311f6d2bbf678de323dc65e5ac1f13e107e6429c23e0a1ac9d54835afe88dbebef303893

Download Submit
C:\Users\Admin\AppData\Roaming\Dev-Cpp\devcpp.ini

Filesize
3KB

MD5
0e27dc864a562cc781b08fd8e5ca8c1d

SHA1
495d2a521c7f76fd0a093a34e6449effac7dc479

SHA256
58f6f8d0bb7ccf6db5f350343c46a20b6dfca37f2ed4ea6346445ca5546f1e92

SHA512
6f6d29e84b1b9be08d3e6342a4fcd591a166ac7396fab54bede79b1b311f6d2bbf678de323dc65e5ac1f13e107e6429c23e0a1ac9d54835afe88dbebef303893

Download Submit
C:\Users\Admin\AppData\Roaming\Dev-Cpp\devcpp.ini

Filesize
4KB

MD5
2230aa1dacd9fb55b721032db3f89aa6

SHA1
681c2d260f0309fee86158799daf832859ed8e50

SHA256
48e1e0dd673db16ef1459e3304c8e86008ea9a6c2728a8d575deb732c111ad98

SHA512
31b22707ad3f35d5368d0f25008b280c50ca0a6d84fc098157e9fc3ed7ae8a349348deabc3fdcad89b341e50e782be352e91a60b2c0464b59551ace015e68c25

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 849122.crdownload

Filesize
8.9MB

MD5
a0fa0a34a842dbfd9d3b0ca834311926

SHA1
e22007d1b1587cb4eaadf90e7076c3bee61954ec

SHA256
98ca778d39ce72d1d8dd8c362a19ff5c63d8b827cd02dfbf139d4d0fd6328c40

SHA512
ea587338df88b0f492c7296f7c378171ae4123c9086b32c88e7a016e384de5e57b6809bbe7fe0a5a4aa1bbac1c5765e1b3b78e20fe4813c25c90267647200bb7

Download Submit
C:\Users\Admin\Downloads\devcpp-4.9.9.2_setup.exe

Filesize
8.9MB

MD5
a0fa0a34a842dbfd9d3b0ca834311926

SHA1
e22007d1b1587cb4eaadf90e7076c3bee61954ec

SHA256
98ca778d39ce72d1d8dd8c362a19ff5c63d8b827cd02dfbf139d4d0fd6328c40

SHA512
ea587338df88b0f492c7296f7c378171ae4123c9086b32c88e7a016e384de5e57b6809bbe7fe0a5a4aa1bbac1c5765e1b3b78e20fe4813c25c90267647200bb7

Download Submit
C:\Users\Admin\Downloads\devcpp-4.9.9.2_setup.exe

Filesize
8.9MB

MD5
a0fa0a34a842dbfd9d3b0ca834311926

SHA1
e22007d1b1587cb4eaadf90e7076c3bee61954ec

SHA256
98ca778d39ce72d1d8dd8c362a19ff5c63d8b827cd02dfbf139d4d0fd6328c40

SHA512
ea587338df88b0f492c7296f7c378171ae4123c9086b32c88e7a016e384de5e57b6809bbe7fe0a5a4aa1bbac1c5765e1b3b78e20fe4813c25c90267647200bb7

Download Submit
memory/400-2126-0x0000000000400000-0x0000000000509000-memory.dmp

Filesize
1.0MB

Download
memory/1472-2491-0x0000000000400000-0x000000000078E000-memory.dmp

Filesize
3.6MB

Download
memory/1472-2493-0x0000000000400000-0x000000000078E000-memory.dmp

Filesize
3.6MB

Download
memory/1472-2487-0x0000000000400000-0x000000000078E000-memory.dmp

Filesize
3.6MB

Download
memory/1472-2714-0x0000000000400000-0x000000000078E000-memory.dmp

Filesize
3.6MB

Download
memory/1472-2488-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/1472-2284-0x0000000000400000-0x000000000078E000-memory.dmp

Filesize
3.6MB

Download
memory/1472-2489-0x0000000000400000-0x000000000078E000-memory.dmp

Filesize
3.6MB

Download
memory/1472-2125-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/1472-2490-0x0000000000400000-0x000000000078E000-memory.dmp

Filesize
3.6MB

Download
memory/1472-2486-0x0000000000400000-0x000000000078E000-memory.dmp

Filesize
3.6MB

Download
memory/3820-694-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/3820-696-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/3820-695-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/4980-718-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/4980-719-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/5388-712-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/5388-713-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/5460-1716-0x0000000000400000-0x000000000078E000-memory.dmp

Filesize
3.6MB

Download
memory/5460-1717-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/5460-2124-0x0000000000400000-0x000000000078E000-memory.dmp

Filesize
3.6MB

Download
memory/5460-1929-0x0000000000400000-0x000000000078E000-memory.dmp

Filesize
3.6MB

Download
memory/5588-716-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/5588-715-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/5720-705-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/5720-707-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/5720-706-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/5776-710-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/5776-709-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/5916-1769-0x0000000000400000-0x0000000000509000-memory.dmp

Filesize
1.0MB

Download
memory/5984-699-0x00000000009A0000-0x00000000009A1000-memory.dmp

Filesize
4KB

Download
memory/5984-698-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/5984-700-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/6020-702-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/6020-703-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download