f422d28bbfd249b233299b1e98706816d23029424646a5f7e8d8ad0e37db76b2

Analysis

max time kernel
2473s
max time network
2472s
platform
windows10_x64
resource
win10-20220223-en
submitted
05-03-2022 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Signalis/DLC/freebl3.dll
Size

326KB
MD5

ef2834ac4ee7d6724f255beaf527e635
SHA1

5be8c1e73a21b49f353c2ecfa4108e43a883cb7b
SHA256

a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba
SHA512

c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

Score

9^/10

discovery evasion spyware stealer

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Downloads MZ/PE file

Executes dropped EXE 13 IoCs

Processes:

anyrunhelper.exeFiddlerInstaller.exeFiddlerSetup.exeSetupHelperFiddlerInstaller.exeFiddlerSetup.exeFiddler.exeTrustCert.exeSignalis.exeGameSetup.exeGameSetup.exeGameSetup.exeGameSetup.exe

pid	process
3692	anyrunhelper.exe
2944	FiddlerInstaller.exe
740	FiddlerSetup.exe
2336	SetupHelper
4380	FiddlerInstaller.exe
4708	FiddlerSetup.exe
4828	Fiddler.exe
4872	TrustCert.exe
3584	Signalis.exe
2960	GameSetup.exe
4504	GameSetup.exe
4076	GameSetup.exe
4616	GameSetup.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

GameSetup.exeFiddlerSetup.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Control Panel\International\Geo\Nation	GameSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Control Panel\International\Geo\Nation	FiddlerSetup.exe

Loads dropped DLL 64 IoCs

Processes:

FiddlerSetup.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exeFiddler.exe

pid	process
740	FiddlerSetup.exe
1816	mscorsvw.exe
4496	mscorsvw.exe
4496	mscorsvw.exe
4752	mscorsvw.exe
5052	mscorsvw.exe
3096	mscorsvw.exe
5052	mscorsvw.exe
4292	mscorsvw.exe
4664	mscorsvw.exe
4196	mscorsvw.exe
2904	mscorsvw.exe
5060	mscorsvw.exe
4496	mscorsvw.exe
4484	mscorsvw.exe
4380	mscorsvw.exe
5108	mscorsvw.exe
4812	mscorsvw.exe
4500	mscorsvw.exe
4480	mscorsvw.exe
60	mscorsvw.exe
60	mscorsvw.exe
4356	mscorsvw.exe
4084	mscorsvw.exe
4084	mscorsvw.exe
4812	mscorsvw.exe
1656	mscorsvw.exe
4528	mscorsvw.exe
4528	mscorsvw.exe
4084	mscorsvw.exe
4528	mscorsvw.exe
4792	mscorsvw.exe
4792	mscorsvw.exe
4108	mscorsvw.exe
2712	mscorsvw.exe
4856	mscorsvw.exe
4084	mscorsvw.exe
2336	mscorsvw.exe
4356	mscorsvw.exe
4676	mscorsvw.exe
1844	mscorsvw.exe
1844	mscorsvw.exe
2068	mscorsvw.exe
1844	mscorsvw.exe
3412	mscorsvw.exe
3412	mscorsvw.exe
1844	mscorsvw.exe
1420	mscorsvw.exe
1420	mscorsvw.exe
1420	mscorsvw.exe
1420	mscorsvw.exe
1420	mscorsvw.exe
4028	mscorsvw.exe
4828	Fiddler.exe
4828	Fiddler.exe
4828	Fiddler.exe
4828	Fiddler.exe
4828	Fiddler.exe
4828	Fiddler.exe
4828	Fiddler.exe
4828	Fiddler.exe
4828	Fiddler.exe
4828	Fiddler.exe
4828	Fiddler.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 64 IoCs

Processes:

mscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exeMicrosoftEdge.exeMicrosoftEdgeCP.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exe

description	ioc	process
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\11b0-0\System.Design.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\12f8-0\System.ComponentModel.DataAnnotations.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Comp46f2b404#\64b3b0b1aba5ca1918056740cd4dd1f3\System.ComponentModel.DataAnnotations.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Xceed.Compre7f102f3#\6b84490a3a3d8cb205095ba35af615d2\Xceed.Compression.Formats.v5.4.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1238-0\Xceed.Zip.v5.4.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1104-0\System.EnterpriseServices.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\ff4-0\System.Web.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\920-0\System.DirectoryServices.Protocols.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\13c4-0\Microsoft.VisualC.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\678-0\System.Web.RegularExpressions.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1064-0\Microsoft.JScript.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1184-0\Telerik.NetworkConnections.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.8dc504e4#\4a5f2a8626e8af6b6f54e42a0f59f2b6\System.Web.ApplicationServices.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\d54-0\Xceed.Compression.Formats.v5.4.dll	mscorsvw.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1104-0\Microsoft.Build.Framework.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt19c51595#\c2577ffc64fd5f786d339c18f95dfae7\System.Runtime.Caching.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\5fc5747c2c5a8c9903788db8973ea28a\System.Web.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Servd1dec626#\9fab28f14be5a0da526b1ceaaa04a4c3\System.ServiceModel.Internals.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\3c-0\SMDiagnostics.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1104-0\System.EnterpriseServices.Wrapper.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\cd03f7a1d6c4031c515fb3f50c42e268\System.Data.SqlXml.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\b58-0\Xceed.FileSystem.v5.4.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\52c68307282a248618376df5db7f9cce\System.Deployment.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Xceed.Compr900e8dcd#\7605b9bd13c012050e6c360e0a781523\Xceed.Compression.v5.4.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\c18-0\Fiddler.exe	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\13bc-0\System.Deployment.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Compba577418#\dee98e5b0e1a766ada50708c26bad1aa\System.ComponentModel.Composition.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1190-0\System.Security.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Analytics\d756563aa7cd4e9c00502605394ea611\Analytics.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\13f4-0\System.ComponentModel.Composition.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data86569bbf#\98a4068512ff6a2566204bc1e759b0be\System.Data.OracleClient.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\12b8-0\System.Data.OracleClient.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1244-0\System.Runtime.Caching.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\fbc-0\EnableLoopback.exe	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Telerik.Net8bf66678#\e5f4977994d2fd10324efd51321f1c59\Telerik.NetworkConnections.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\GA.Analytics.Monitor\3bf155f5fe5c3c876614c4d82313933c\GA.Analytics.Monitor.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Newtonsoft.Json\1ebe746ea3a361d99ffc6ea2e12b5a66\Newtonsoft.Json.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1290-0\System.Numerics.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1194-0\GA.Analytics.Monitor.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Xceed.FileSf21c5040#\e34a1aa24fac441ad1fbc93aff0d50a2\Xceed.FileSystem.v5.4.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Dire5d62f0a2#\74935b58bfe4054a47e71f128e498aba\System.DirectoryServices.Protocols.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\10c4-0\System.Runtime.Serialization.Formatters.Soap.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Xceed.Zip.v5.4\445a5f98d17fb40a3610560f71f4fd48\Xceed.Zip.v5.4.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Draw0a54d252#\ef31f92d5ee5c2a437add4506830d025\System.Drawing.Design.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\a98-0\System.Web.ApplicationServices.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1180-0\System.ServiceModel.Internals.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\SMDiagnostics\c7d01590f25b87c1d82c1b48e56d5865\SMDiagnostics.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\d56e83822b7799e202533e1b84b3c134\System.Web.RegularExpressions.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Design\e54657ea70d60e1ad13dc5f818f32e90\System.Design.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\100c-0\System.Drawing.Design.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\718-0\System.Data.SqlXml.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\cccf0195b8a7b2804875769b64f41f8a\System.Security.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1190-0\Xceed.Compression.v5.4.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\12cc-0\Newtonsoft.Json.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\2145e325c531dd03775cc61606722965\Microsoft.JScript.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.VisualC\74de34cd518bf49352c8346149ddfbc1\Microsoft.VisualC.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\88bbec18c44a06edb18eb16d6775008f\System.Runtime.Serialization.Formatters.Soap.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\111c-0\Analytics.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\bcab827b24e870428fcdda58e1ebec20\System.EnterpriseServices.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\EnableLoopback\933526aad3e8bb65aab9747ddf5a1c98\EnableLoopback.ni.exe.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\9744e094346545d417a938174608d0ad\System.Numerics.ni.dll.aux.tmp	mscorsvw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 10 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\anyrunhelper.exe	nsis_installer_2
C:\Users\Admin\Downloads\anyrunhelper.exe	nsis_installer_2
C:\Users\Admin\FiddlerInstaller.exe	nsis_installer_1
C:\Users\Admin\FiddlerInstaller.exe	nsis_installer_2
C:\Users\Admin\FiddlerInstaller.exe	nsis_installer_1
C:\Users\Admin\FiddlerInstaller.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\nsyC4B1.tmp\FiddlerSetup.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\nsyC4B1.tmp\FiddlerSetup.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\nsyC4B1.tmp\FiddlerSetup.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\nsyC4B1.tmp\FiddlerSetup.exe	nsis_installer_2

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdgeCP.exeFiddler.exeFiddlerSetup.exeMicrosoftEdge.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\Internet Explorer\TypedURLs	Fiddler.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	FiddlerSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Fiddler.exe = "0"	FiddlerSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Fiddler.exe = "9999"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

Fiddler.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Fiddler.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "132909606428036461"	Fiddler.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exefirefox.exeFiddlerSetup.exesvchost.exeFiddler.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Fiddler.ArchiveZip\DefaultIcon	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11	Fiddler.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Fiddler.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Fiddler.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Fiddler.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 376d04e99430d801	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\AppExtension\com.microsoft.edge.extension\S-1-5-21-1937337463-1541593363-3360944660-1000\{F2AE4B2E-752F-4D4C-8A9A-489635FDE453}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 010000000200000000000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\AppExtension\com.microsoft.edge.extension\S-1-5-21-1937337463-1541593363-3360944660-1000\{F2AE4B2E-752F-4D4C-8A9A-489635FDE453}\Count = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202	Fiddler.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\AppExtension\com.microsoft.edge.extension\S-1-5-21-1937337463-1541593363-3360944660-1000\{F2AE4B2E-752F-4D4C-8A9A-489635FDE453}\From = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 5ff62ce99430d801	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Fiddler.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Fiddler.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 6d552de8bf28d801	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202	Fiddler.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 6d552de8bf28d801	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\.saz\ = "Fiddler.ArchiveZip"	FiddlerSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Fiddler.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Fiddler.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000b53e4765a5f61779cf4a4ed63edaa1290d88f30fa96a8918cafed676668eb0b39dfb0c76ee5fac03f12e60de858c173927a5d2a82909487c40cb	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Fiddler.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	firefox.exe

Modifies system certificate store 2 TTPs 15 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Fiddler.exeTrustCert.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\SystemCertificates\CA\Certificates\B2778529A737A4C906ED9B7F9EA1C905056214C0	Fiddler.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B2778529A737A4C906ED9B7F9EA1C905056214C0\Blob = 030000000100000014000000b2778529a737a4c906ed9b7f9ea1c905056214c02000000001000000b6030000308203b23082029aa00302010202101544d74501b700b249b8220fc7eca9c0300d06092a864886f70d01010b05003067312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31153013060355040a0c0c444f5f4e4f545f54525553543121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f74301e170d3231303330343133333034325a170d3234303630323133333034325a3067312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31153013060355040a0c0c444f5f4e4f545f54525553543121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b28639d8e33b5e19678bad798c5681cde46799110259b09a51f0100bb67d19261bbcbef8371b3ccf4ab502f0315e38af8d5a1e31628a52fe203c8252030a1014159e1597590a15bf52429e8d8a25a1302e99ad3c8b655d439671926b295ed6549320e7c0c0ceeeb51b5c9b58e5e5c35f59ac0f7062fa6f717b4ef71b5cb80baed2f3167081e0e76e1237a4d805b2cf1c05257cab3ecd39006514e4ed29bc6b39887d97ac007f6899ce9067f6e7f28961b71edb1bdbc485b56655be472344c4835bb0d9715df6a1615ee122476b2be44a50879ebee6319787a59e0937cd1cf4cd4ccd930e3ebb4da555e545e90d78deaa1ba913fe7905f4e09ac8be46d6976b310203010001a35a305830130603551d25040c300a06082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e041604140ee05dab2a2b6af280b2b10e01efcb5cbb144e05300e0603551d0f0101ff040403020106300d06092a864886f70d01010b050003820101008a78f7869d842c54d0bf89e2d0e64e0d5e64f165822efa73c6a516deda448b010eb19e7420c8f48c4e9adb8e85b920be8e11e29adf686b4d0c0cc5cc4892bd8b5a4e302b9649c9d71ae2e358a1222b164031de23e31620cb91828440370570ca37280988595886df838a79b6cdeb5ca3dddabbfd5b3441d2eb801ccd78d9988e9b4232508830b6723c2bfdece5aca652da25a72e35833d96aa936cb56ddeed997fe10681f4180ad68e3d546cb846bdb4ebc6629bfd0842a1236db99869fed1816487b97b4214b38bb4e3b358c8c6e70192f3ca521a88d22506a8468fd0e348aa299ecab394d5143873422174f85a5cb46c826485376114be8f9267d13eeddd9f	TrustCert.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\SystemCertificates\Root\Certificates\B2778529A737A4C906ED9B7F9EA1C905056214C0\Blob = 040000000100000010000000ea568df142bd194a0d0da4342ff0f0370f0000000100000020000000eb8383eaf588731ffea8fcc719a5335b24ba77c645ca601212c0f00d0f79b3d5030000000100000014000000b2778529a737a4c906ed9b7f9ea1c905056214c00b000000010000003800000044004f005f004e004f0054005f00540052005500530054005f0046006900640064006c006500720052006f006f0074002d004300450000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000020000007b00390039003900460041003500450031002d0038004400310039002d0034003100380037002d0041004600310034002d004200430041003900310044004500360030004300350046007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000001400000001000000140000000ee05dab2a2b6af280b2b10e01efcb5cbb144e052000000001000000b6030000308203b23082029aa00302010202101544d74501b700b249b8220fc7eca9c0300d06092a864886f70d01010b05003067312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31153013060355040a0c0c444f5f4e4f545f54525553543121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f74301e170d3231303330343133333034325a170d3234303630323133333034325a3067312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31153013060355040a0c0c444f5f4e4f545f54525553543121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b28639d8e33b5e19678bad798c5681cde46799110259b09a51f0100bb67d19261bbcbef8371b3ccf4ab502f0315e38af8d5a1e31628a52fe203c8252030a1014159e1597590a15bf52429e8d8a25a1302e99ad3c8b655d439671926b295ed6549320e7c0c0ceeeb51b5c9b58e5e5c35f59ac0f7062fa6f717b4ef71b5cb80baed2f3167081e0e76e1237a4d805b2cf1c05257cab3ecd39006514e4ed29bc6b39887d97ac007f6899ce9067f6e7f28961b71edb1bdbc485b56655be472344c4835bb0d9715df6a1615ee122476b2be44a50879ebee6319787a59e0937cd1cf4cd4ccd930e3ebb4da555e545e90d78deaa1ba913fe7905f4e09ac8be46d6976b310203010001a35a305830130603551d25040c300a06082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e041604140ee05dab2a2b6af280b2b10e01efcb5cbb144e05300e0603551d0f0101ff040403020106300d06092a864886f70d01010b050003820101008a78f7869d842c54d0bf89e2d0e64e0d5e64f165822efa73c6a516deda448b010eb19e7420c8f48c4e9adb8e85b920be8e11e29adf686b4d0c0cc5cc4892bd8b5a4e302b9649c9d71ae2e358a1222b164031de23e31620cb91828440370570ca37280988595886df838a79b6cdeb5ca3dddabbfd5b3441d2eb801ccd78d9988e9b4232508830b6723c2bfdece5aca652da25a72e35833d96aa936cb56ddeed997fe10681f4180ad68e3d546cb846bdb4ebc6629bfd0842a1236db99869fed1816487b97b4214b38bb4e3b358c8c6e70192f3ca521a88d22506a8468fd0e348aa299ecab394d5143873422174f85a5cb46c826485376114be8f9267d13eeddd9f	Fiddler.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B2778529A737A4C906ED9B7F9EA1C905056214C0\Blob = 190000000100000010000000a90756fa7369d918849eb7fda1f76a73030000000100000014000000b2778529a737a4c906ed9b7f9ea1c905056214c00f0000000100000020000000eb8383eaf588731ffea8fcc719a5335b24ba77c645ca601212c0f00d0f79b3d52000000001000000b6030000308203b23082029aa00302010202101544d74501b700b249b8220fc7eca9c0300d06092a864886f70d01010b05003067312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31153013060355040a0c0c444f5f4e4f545f54525553543121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f74301e170d3231303330343133333034325a170d3234303630323133333034325a3067312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31153013060355040a0c0c444f5f4e4f545f54525553543121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b28639d8e33b5e19678bad798c5681cde46799110259b09a51f0100bb67d19261bbcbef8371b3ccf4ab502f0315e38af8d5a1e31628a52fe203c8252030a1014159e1597590a15bf52429e8d8a25a1302e99ad3c8b655d439671926b295ed6549320e7c0c0ceeeb51b5c9b58e5e5c35f59ac0f7062fa6f717b4ef71b5cb80baed2f3167081e0e76e1237a4d805b2cf1c05257cab3ecd39006514e4ed29bc6b39887d97ac007f6899ce9067f6e7f28961b71edb1bdbc485b56655be472344c4835bb0d9715df6a1615ee122476b2be44a50879ebee6319787a59e0937cd1cf4cd4ccd930e3ebb4da555e545e90d78deaa1ba913fe7905f4e09ac8be46d6976b310203010001a35a305830130603551d25040c300a06082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e041604140ee05dab2a2b6af280b2b10e01efcb5cbb144e05300e0603551d0f0101ff040403020106300d06092a864886f70d01010b050003820101008a78f7869d842c54d0bf89e2d0e64e0d5e64f165822efa73c6a516deda448b010eb19e7420c8f48c4e9adb8e85b920be8e11e29adf686b4d0c0cc5cc4892bd8b5a4e302b9649c9d71ae2e358a1222b164031de23e31620cb91828440370570ca37280988595886df838a79b6cdeb5ca3dddabbfd5b3441d2eb801ccd78d9988e9b4232508830b6723c2bfdece5aca652da25a72e35833d96aa936cb56ddeed997fe10681f4180ad68e3d546cb846bdb4ebc6629bfd0842a1236db99869fed1816487b97b4214b38bb4e3b358c8c6e70192f3ca521a88d22506a8468fd0e348aa299ecab394d5143873422174f85a5cb46c826485376114be8f9267d13eeddd9f	Fiddler.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B2778529A737A4C906ED9B7F9EA1C905056214C0\Blob = 040000000100000010000000ea568df142bd194a0d0da4342ff0f0370f0000000100000020000000eb8383eaf588731ffea8fcc719a5335b24ba77c645ca601212c0f00d0f79b3d5030000000100000014000000b2778529a737a4c906ed9b7f9ea1c905056214c0190000000100000010000000a90756fa7369d918849eb7fda1f76a732000000001000000b6030000308203b23082029aa00302010202101544d74501b700b249b8220fc7eca9c0300d06092a864886f70d01010b05003067312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31153013060355040a0c0c444f5f4e4f545f54525553543121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f74301e170d3231303330343133333034325a170d3234303630323133333034325a3067312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31153013060355040a0c0c444f5f4e4f545f54525553543121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b28639d8e33b5e19678bad798c5681cde46799110259b09a51f0100bb67d19261bbcbef8371b3ccf4ab502f0315e38af8d5a1e31628a52fe203c8252030a1014159e1597590a15bf52429e8d8a25a1302e99ad3c8b655d439671926b295ed6549320e7c0c0ceeeb51b5c9b58e5e5c35f59ac0f7062fa6f717b4ef71b5cb80baed2f3167081e0e76e1237a4d805b2cf1c05257cab3ecd39006514e4ed29bc6b39887d97ac007f6899ce9067f6e7f28961b71edb1bdbc485b56655be472344c4835bb0d9715df6a1615ee122476b2be44a50879ebee6319787a59e0937cd1cf4cd4ccd930e3ebb4da555e545e90d78deaa1ba913fe7905f4e09ac8be46d6976b310203010001a35a305830130603551d25040c300a06082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e041604140ee05dab2a2b6af280b2b10e01efcb5cbb144e05300e0603551d0f0101ff040403020106300d06092a864886f70d01010b050003820101008a78f7869d842c54d0bf89e2d0e64e0d5e64f165822efa73c6a516deda448b010eb19e7420c8f48c4e9adb8e85b920be8e11e29adf686b4d0c0cc5cc4892bd8b5a4e302b9649c9d71ae2e358a1222b164031de23e31620cb91828440370570ca37280988595886df838a79b6cdeb5ca3dddabbfd5b3441d2eb801ccd78d9988e9b4232508830b6723c2bfdece5aca652da25a72e35833d96aa936cb56ddeed997fe10681f4180ad68e3d546cb846bdb4ebc6629bfd0842a1236db99869fed1816487b97b4214b38bb4e3b358c8c6e70192f3ca521a88d22506a8468fd0e348aa299ecab394d5143873422174f85a5cb46c826485376114be8f9267d13eeddd9f	Fiddler.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\SystemCertificates\REQUEST	Fiddler.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B2778529A737A4C906ED9B7F9EA1C905056214C0	Fiddler.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B2778529A737A4C906ED9B7F9EA1C905056214C0\Blob = 0f0000000100000020000000eb8383eaf588731ffea8fcc719a5335b24ba77c645ca601212c0f00d0f79b3d5030000000100000014000000b2778529a737a4c906ed9b7f9ea1c905056214c02000000001000000b6030000308203b23082029aa00302010202101544d74501b700b249b8220fc7eca9c0300d06092a864886f70d01010b05003067312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31153013060355040a0c0c444f5f4e4f545f54525553543121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f74301e170d3231303330343133333034325a170d3234303630323133333034325a3067312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31153013060355040a0c0c444f5f4e4f545f54525553543121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b28639d8e33b5e19678bad798c5681cde46799110259b09a51f0100bb67d19261bbcbef8371b3ccf4ab502f0315e38af8d5a1e31628a52fe203c8252030a1014159e1597590a15bf52429e8d8a25a1302e99ad3c8b655d439671926b295ed6549320e7c0c0ceeeb51b5c9b58e5e5c35f59ac0f7062fa6f717b4ef71b5cb80baed2f3167081e0e76e1237a4d805b2cf1c05257cab3ecd39006514e4ed29bc6b39887d97ac007f6899ce9067f6e7f28961b71edb1bdbc485b56655be472344c4835bb0d9715df6a1615ee122476b2be44a50879ebee6319787a59e0937cd1cf4cd4ccd930e3ebb4da555e545e90d78deaa1ba913fe7905f4e09ac8be46d6976b310203010001a35a305830130603551d25040c300a06082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e041604140ee05dab2a2b6af280b2b10e01efcb5cbb144e05300e0603551d0f0101ff040403020106300d06092a864886f70d01010b050003820101008a78f7869d842c54d0bf89e2d0e64e0d5e64f165822efa73c6a516deda448b010eb19e7420c8f48c4e9adb8e85b920be8e11e29adf686b4d0c0cc5cc4892bd8b5a4e302b9649c9d71ae2e358a1222b164031de23e31620cb91828440370570ca37280988595886df838a79b6cdeb5ca3dddabbfd5b3441d2eb801ccd78d9988e9b4232508830b6723c2bfdece5aca652da25a72e35833d96aa936cb56ddeed997fe10681f4180ad68e3d546cb846bdb4ebc6629bfd0842a1236db99869fed1816487b97b4214b38bb4e3b358c8c6e70192f3ca521a88d22506a8468fd0e348aa299ecab394d5143873422174f85a5cb46c826485376114be8f9267d13eeddd9f	Fiddler.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\SystemCertificates\Root\Certificates\B2778529A737A4C906ED9B7F9EA1C905056214C0\Blob = 190000000100000010000000a90756fa7369d918849eb7fda1f76a731400000001000000140000000ee05dab2a2b6af280b2b10e01efcb5cbb144e050200000001000000cc0000001c0000006c00000001000000000000000000000000000000020000007b00390039003900460041003500450031002d0038004400310039002d0034003100380037002d0041004600310034002d004200430041003900310044004500360030004300350046007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000003800000044004f005f004e004f0054005f00540052005500530054005f0046006900640064006c006500720052006f006f0074002d00430045000000030000000100000014000000b2778529a737a4c906ed9b7f9ea1c905056214c00f0000000100000020000000eb8383eaf588731ffea8fcc719a5335b24ba77c645ca601212c0f00d0f79b3d5040000000100000010000000ea568df142bd194a0d0da4342ff0f0372000000001000000b6030000308203b23082029aa00302010202101544d74501b700b249b8220fc7eca9c0300d06092a864886f70d01010b05003067312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31153013060355040a0c0c444f5f4e4f545f54525553543121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f74301e170d3231303330343133333034325a170d3234303630323133333034325a3067312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31153013060355040a0c0c444f5f4e4f545f54525553543121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b28639d8e33b5e19678bad798c5681cde46799110259b09a51f0100bb67d19261bbcbef8371b3ccf4ab502f0315e38af8d5a1e31628a52fe203c8252030a1014159e1597590a15bf52429e8d8a25a1302e99ad3c8b655d439671926b295ed6549320e7c0c0ceeeb51b5c9b58e5e5c35f59ac0f7062fa6f717b4ef71b5cb80baed2f3167081e0e76e1237a4d805b2cf1c05257cab3ecd39006514e4ed29bc6b39887d97ac007f6899ce9067f6e7f28961b71edb1bdbc485b56655be472344c4835bb0d9715df6a1615ee122476b2be44a50879ebee6319787a59e0937cd1cf4cd4ccd930e3ebb4da555e545e90d78deaa1ba913fe7905f4e09ac8be46d6976b310203010001a35a305830130603551d25040c300a06082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e041604140ee05dab2a2b6af280b2b10e01efcb5cbb144e05300e0603551d0f0101ff040403020106300d06092a864886f70d01010b050003820101008a78f7869d842c54d0bf89e2d0e64e0d5e64f165822efa73c6a516deda448b010eb19e7420c8f48c4e9adb8e85b920be8e11e29adf686b4d0c0cc5cc4892bd8b5a4e302b9649c9d71ae2e358a1222b164031de23e31620cb91828440370570ca37280988595886df838a79b6cdeb5ca3dddabbfd5b3441d2eb801ccd78d9988e9b4232508830b6723c2bfdece5aca652da25a72e35833d96aa936cb56ddeed997fe10681f4180ad68e3d546cb846bdb4ebc6629bfd0842a1236db99869fed1816487b97b4214b38bb4e3b358c8c6e70192f3ca521a88d22506a8468fd0e348aa299ecab394d5143873422174f85a5cb46c826485376114be8f9267d13eeddd9f	Fiddler.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\SystemCertificates\CA\Certificates\B2778529A737A4C906ED9B7F9EA1C905056214C0\Blob = 040000000100000010000000ea568df142bd194a0d0da4342ff0f0370f0000000100000020000000eb8383eaf588731ffea8fcc719a5335b24ba77c645ca601212c0f00d0f79b3d51400000001000000140000000ee05dab2a2b6af280b2b10e01efcb5cbb144e05190000000100000010000000a90756fa7369d918849eb7fda1f76a73030000000100000014000000b2778529a737a4c906ed9b7f9ea1c905056214c05c0000000100000004000000000800002000000001000000b6030000308203b23082029aa00302010202101544d74501b700b249b8220fc7eca9c0300d06092a864886f70d01010b05003067312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31153013060355040a0c0c444f5f4e4f545f54525553543121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f74301e170d3231303330343133333034325a170d3234303630323133333034325a3067312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31153013060355040a0c0c444f5f4e4f545f54525553543121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b28639d8e33b5e19678bad798c5681cde46799110259b09a51f0100bb67d19261bbcbef8371b3ccf4ab502f0315e38af8d5a1e31628a52fe203c8252030a1014159e1597590a15bf52429e8d8a25a1302e99ad3c8b655d439671926b295ed6549320e7c0c0ceeeb51b5c9b58e5e5c35f59ac0f7062fa6f717b4ef71b5cb80baed2f3167081e0e76e1237a4d805b2cf1c05257cab3ecd39006514e4ed29bc6b39887d97ac007f6899ce9067f6e7f28961b71edb1bdbc485b56655be472344c4835bb0d9715df6a1615ee122476b2be44a50879ebee6319787a59e0937cd1cf4cd4ccd930e3ebb4da555e545e90d78deaa1ba913fe7905f4e09ac8be46d6976b310203010001a35a305830130603551d25040c300a06082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e041604140ee05dab2a2b6af280b2b10e01efcb5cbb144e05300e0603551d0f0101ff040403020106300d06092a864886f70d01010b050003820101008a78f7869d842c54d0bf89e2d0e64e0d5e64f165822efa73c6a516deda448b010eb19e7420c8f48c4e9adb8e85b920be8e11e29adf686b4d0c0cc5cc4892bd8b5a4e302b9649c9d71ae2e358a1222b164031de23e31620cb91828440370570ca37280988595886df838a79b6cdeb5ca3dddabbfd5b3441d2eb801ccd78d9988e9b4232508830b6723c2bfdece5aca652da25a72e35833d96aa936cb56ddeed997fe10681f4180ad68e3d546cb846bdb4ebc6629bfd0842a1236db99869fed1816487b97b4214b38bb4e3b358c8c6e70192f3ca521a88d22506a8468fd0e348aa299ecab394d5143873422174f85a5cb46c826485376114be8f9267d13eeddd9f	Fiddler.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B2778529A737A4C906ED9B7F9EA1C905056214C0	TrustCert.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\SystemCertificates\Root\Certificates\B2778529A737A4C906ED9B7F9EA1C905056214C0	Fiddler.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\SystemCertificates\Root\Certificates\B2778529A737A4C906ED9B7F9EA1C905056214C0\Blob = 0f0000000100000020000000eb8383eaf588731ffea8fcc719a5335b24ba77c645ca601212c0f00d0f79b3d5030000000100000014000000b2778529a737a4c906ed9b7f9ea1c905056214c00b000000010000003800000044004f005f004e004f0054005f00540052005500530054005f0046006900640064006c006500720052006f006f0074002d004300450000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000020000007b00390039003900460041003500450031002d0038004400310039002d0034003100380037002d0041004600310034002d004200430041003900310044004500360030004300350046007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000002000000001000000b6030000308203b23082029aa00302010202101544d74501b700b249b8220fc7eca9c0300d06092a864886f70d01010b05003067312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31153013060355040a0c0c444f5f4e4f545f54525553543121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f74301e170d3231303330343133333034325a170d3234303630323133333034325a3067312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31153013060355040a0c0c444f5f4e4f545f54525553543121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b28639d8e33b5e19678bad798c5681cde46799110259b09a51f0100bb67d19261bbcbef8371b3ccf4ab502f0315e38af8d5a1e31628a52fe203c8252030a1014159e1597590a15bf52429e8d8a25a1302e99ad3c8b655d439671926b295ed6549320e7c0c0ceeeb51b5c9b58e5e5c35f59ac0f7062fa6f717b4ef71b5cb80baed2f3167081e0e76e1237a4d805b2cf1c05257cab3ecd39006514e4ed29bc6b39887d97ac007f6899ce9067f6e7f28961b71edb1bdbc485b56655be472344c4835bb0d9715df6a1615ee122476b2be44a50879ebee6319787a59e0937cd1cf4cd4ccd930e3ebb4da555e545e90d78deaa1ba913fe7905f4e09ac8be46d6976b310203010001a35a305830130603551d25040c300a06082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e041604140ee05dab2a2b6af280b2b10e01efcb5cbb144e05300e0603551d0f0101ff040403020106300d06092a864886f70d01010b050003820101008a78f7869d842c54d0bf89e2d0e64e0d5e64f165822efa73c6a516deda448b010eb19e7420c8f48c4e9adb8e85b920be8e11e29adf686b4d0c0cc5cc4892bd8b5a4e302b9649c9d71ae2e358a1222b164031de23e31620cb91828440370570ca37280988595886df838a79b6cdeb5ca3dddabbfd5b3441d2eb801ccd78d9988e9b4232508830b6723c2bfdece5aca652da25a72e35833d96aa936cb56ddeed997fe10681f4180ad68e3d546cb846bdb4ebc6629bfd0842a1236db99869fed1816487b97b4214b38bb4e3b358c8c6e70192f3ca521a88d22506a8468fd0e348aa299ecab394d5143873422174f85a5cb46c826485376114be8f9267d13eeddd9f	Fiddler.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\SystemCertificates\Root\Certificates\B2778529A737A4C906ED9B7F9EA1C905056214C0\Blob = 1400000001000000140000000ee05dab2a2b6af280b2b10e01efcb5cbb144e050200000001000000cc0000001c0000006c00000001000000000000000000000000000000020000007b00390039003900460041003500450031002d0038004400310039002d0034003100380037002d0041004600310034002d004200430041003900310044004500360030004300350046007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000003800000044004f005f004e004f0054005f00540052005500530054005f0046006900640064006c006500720052006f006f0074002d00430045000000030000000100000014000000b2778529a737a4c906ed9b7f9ea1c905056214c00f0000000100000020000000eb8383eaf588731ffea8fcc719a5335b24ba77c645ca601212c0f00d0f79b3d52000000001000000b6030000308203b23082029aa00302010202101544d74501b700b249b8220fc7eca9c0300d06092a864886f70d01010b05003067312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31153013060355040a0c0c444f5f4e4f545f54525553543121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f74301e170d3231303330343133333034325a170d3234303630323133333034325a3067312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31153013060355040a0c0c444f5f4e4f545f54525553543121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b28639d8e33b5e19678bad798c5681cde46799110259b09a51f0100bb67d19261bbcbef8371b3ccf4ab502f0315e38af8d5a1e31628a52fe203c8252030a1014159e1597590a15bf52429e8d8a25a1302e99ad3c8b655d439671926b295ed6549320e7c0c0ceeeb51b5c9b58e5e5c35f59ac0f7062fa6f717b4ef71b5cb80baed2f3167081e0e76e1237a4d805b2cf1c05257cab3ecd39006514e4ed29bc6b39887d97ac007f6899ce9067f6e7f28961b71edb1bdbc485b56655be472344c4835bb0d9715df6a1615ee122476b2be44a50879ebee6319787a59e0937cd1cf4cd4ccd930e3ebb4da555e545e90d78deaa1ba913fe7905f4e09ac8be46d6976b310203010001a35a305830130603551d25040c300a06082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e041604140ee05dab2a2b6af280b2b10e01efcb5cbb144e05300e0603551d0f0101ff040403020106300d06092a864886f70d01010b050003820101008a78f7869d842c54d0bf89e2d0e64e0d5e64f165822efa73c6a516deda448b010eb19e7420c8f48c4e9adb8e85b920be8e11e29adf686b4d0c0cc5cc4892bd8b5a4e302b9649c9d71ae2e358a1222b164031de23e31620cb91828440370570ca37280988595886df838a79b6cdeb5ca3dddabbfd5b3441d2eb801ccd78d9988e9b4232508830b6723c2bfdece5aca652da25a72e35833d96aa936cb56ddeed997fe10681f4180ad68e3d546cb846bdb4ebc6629bfd0842a1236db99869fed1816487b97b4214b38bb4e3b358c8c6e70192f3ca521a88d22506a8468fd0e348aa299ecab394d5143873422174f85a5cb46c826485376114be8f9267d13eeddd9f	Fiddler.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\SystemCertificates\Root\Certificates\B2778529A737A4C906ED9B7F9EA1C905056214C0\Blob = 5c000000010000000400000000080000040000000100000010000000ea568df142bd194a0d0da4342ff0f0370f0000000100000020000000eb8383eaf588731ffea8fcc719a5335b24ba77c645ca601212c0f00d0f79b3d5030000000100000014000000b2778529a737a4c906ed9b7f9ea1c905056214c00b000000010000003800000044004f005f004e004f0054005f00540052005500530054005f0046006900640064006c006500720052006f006f0074002d004300450000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000020000007b00390039003900460041003500450031002d0038004400310039002d0034003100380037002d0041004600310034002d004200430041003900310044004500360030004300350046007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000001400000001000000140000000ee05dab2a2b6af280b2b10e01efcb5cbb144e05190000000100000010000000a90756fa7369d918849eb7fda1f76a732000000001000000b6030000308203b23082029aa00302010202101544d74501b700b249b8220fc7eca9c0300d06092a864886f70d01010b05003067312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31153013060355040a0c0c444f5f4e4f545f54525553543121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f74301e170d3231303330343133333034325a170d3234303630323133333034325a3067312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31153013060355040a0c0c444f5f4e4f545f54525553543121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b28639d8e33b5e19678bad798c5681cde46799110259b09a51f0100bb67d19261bbcbef8371b3ccf4ab502f0315e38af8d5a1e31628a52fe203c8252030a1014159e1597590a15bf52429e8d8a25a1302e99ad3c8b655d439671926b295ed6549320e7c0c0ceeeb51b5c9b58e5e5c35f59ac0f7062fa6f717b4ef71b5cb80baed2f3167081e0e76e1237a4d805b2cf1c05257cab3ecd39006514e4ed29bc6b39887d97ac007f6899ce9067f6e7f28961b71edb1bdbc485b56655be472344c4835bb0d9715df6a1615ee122476b2be44a50879ebee6319787a59e0937cd1cf4cd4ccd930e3ebb4da555e545e90d78deaa1ba913fe7905f4e09ac8be46d6976b310203010001a35a305830130603551d25040c300a06082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e041604140ee05dab2a2b6af280b2b10e01efcb5cbb144e05300e0603551d0f0101ff040403020106300d06092a864886f70d01010b050003820101008a78f7869d842c54d0bf89e2d0e64e0d5e64f165822efa73c6a516deda448b010eb19e7420c8f48c4e9adb8e85b920be8e11e29adf686b4d0c0cc5cc4892bd8b5a4e302b9649c9d71ae2e358a1222b164031de23e31620cb91828440370570ca37280988595886df838a79b6cdeb5ca3dddabbfd5b3441d2eb801ccd78d9988e9b4232508830b6723c2bfdece5aca652da25a72e35833d96aa936cb56ddeed997fe10681f4180ad68e3d546cb846bdb4ebc6629bfd0842a1236db99869fed1816487b97b4214b38bb4e3b358c8c6e70192f3ca521a88d22506a8468fd0e348aa299ecab394d5143873422174f85a5cb46c826485376114be8f9267d13eeddd9f	Fiddler.exe

NTFS ADS 3 IoCs

Processes:

firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\SIGNALIS.rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\anyrunhelper.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Signalis.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

anyrunhelper.exe

pid	process
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe
3692	anyrunhelper.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

Fiddler.exefirefox.exe

pid process

4828 Fiddler.exe
3968 firefox.exe

pid	process
4828	Fiddler.exe
3968	firefox.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

firefox.exeanyrunhelper.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeFiddler.exe

description	pid	process
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3692	anyrunhelper.exe
Token: SeDebugPrivilege	1776	MicrosoftEdge.exe
Token: SeDebugPrivilege	1776	MicrosoftEdge.exe
Token: SeDebugPrivilege	1776	MicrosoftEdge.exe
Token: SeDebugPrivilege	1776	MicrosoftEdge.exe
Token: SeDebugPrivilege	1776	MicrosoftEdge.exe
Token: SeDebugPrivilege	4672	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4672	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4672	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4672	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	4828	Fiddler.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe
Token: SeDebugPrivilege	3968	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

firefox.exe

pid process

3968 firefox.exe
3968 firefox.exe
3968 firefox.exe
3968 firefox.exe
3968 firefox.exe
3968 firefox.exe
3968 firefox.exe
3968 firefox.exe
Suspicious use of SendNotifyMessage 7 IoCs

Processes:

firefox.exe

pid process

3968 firefox.exe
3968 firefox.exe
3968 firefox.exe
3968 firefox.exe
3968 firefox.exe
3968 firefox.exe
3968 firefox.exe

Suspicious use of SetWindowsHookEx 45 IoCs

Processes:

firefox.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeFiddler.exeOpenWith.exe

pid	process
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
1776	MicrosoftEdge.exe
4432	MicrosoftEdgeCP.exe
4432	MicrosoftEdgeCP.exe
4828	Fiddler.exe
4828	Fiddler.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
2904	OpenWith.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
4828	Fiddler.exe
4828	Fiddler.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe
3968	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exefirefox.exefirefox.exe

description	pid	process	target process
PID 3728 wrote to memory of 3692	3728	rundll32.exe	rundll32.exe
PID 3728 wrote to memory of 3692	3728	rundll32.exe	rundll32.exe
PID 3728 wrote to memory of 3692	3728	rundll32.exe	rundll32.exe
PID 3736 wrote to memory of 3968	3736	firefox.exe	firefox.exe
PID 3736 wrote to memory of 3968	3736	firefox.exe	firefox.exe
PID 3736 wrote to memory of 3968	3736	firefox.exe	firefox.exe
PID 3736 wrote to memory of 3968	3736	firefox.exe	firefox.exe
PID 3736 wrote to memory of 3968	3736	firefox.exe	firefox.exe
PID 3736 wrote to memory of 3968	3736	firefox.exe	firefox.exe
PID 3736 wrote to memory of 3968	3736	firefox.exe	firefox.exe
PID 3736 wrote to memory of 3968	3736	firefox.exe	firefox.exe
PID 3736 wrote to memory of 3968	3736	firefox.exe	firefox.exe
PID 3968 wrote to memory of 1184	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 1184	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 3152	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 620	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 620	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 620	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 620	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 620	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 620	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 620	3968	firefox.exe	firefox.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Signalis\DLC\freebl3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3728

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Signalis\DLC\freebl3.dll,#1
2⤵
PID:3692

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3736

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3968.0.2003874110\584441896" -parentBuildID 20200403170909 -prefsHandle 1540 -prefMapHandle 1532 -prefsLen 1 -prefMapSize 219631 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3968 "\\.\pipe\gecko-crash-server-pipe.3968" 1628 gpu
3⤵
PID:1184

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3968.3.1530214292\965114319" -childID 1 -isForBrowser -prefsHandle 2224 -prefMapHandle 2252 -prefsLen 122 -prefMapSize 219631 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3968 "\\.\pipe\gecko-crash-server-pipe.3968" 2244 tab
3⤵
PID:3152

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3968.13.1549686134\987453306" -childID 2 -isForBrowser -prefsHandle 3320 -prefMapHandle 3204 -prefsLen 6979 -prefMapSize 219631 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3968 "\\.\pipe\gecko-crash-server-pipe.3968" 3332 tab
3⤵
PID:620

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3968.20.565910593\1186020293" -childID 3 -isForBrowser -prefsHandle 4716 -prefMapHandle 4712 -prefsLen 8063 -prefMapSize 219631 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3968 "\\.\pipe\gecko-crash-server-pipe.3968" 4724 tab
3⤵
PID:2984

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3968.27.530136053\1431288346" -childID 4 -isForBrowser -prefsHandle 2500 -prefMapHandle 4120 -prefsLen 9759 -prefMapSize 219631 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3968 "\\.\pipe\gecko-crash-server-pipe.3968" 3672 tab
3⤵
PID:3728

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3968.34.2010589592\346430553" -childID 5 -isForBrowser -prefsHandle 3936 -prefMapHandle 3712 -prefsLen 9759 -prefMapSize 219631 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3968 "\\.\pipe\gecko-crash-server-pipe.3968" 3952 tab
3⤵
PID:4004

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3968.41.2090752011\656206686" -childID 6 -isForBrowser -prefsHandle 5124 -prefMapHandle 4248 -prefsLen 10237 -prefMapSize 219631 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3968 "\\.\pipe\gecko-crash-server-pipe.3968" 5156 tab
3⤵
PID:952

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3968.48.164363835\1188668286" -childID 7 -isForBrowser -prefsHandle 6624 -prefMapHandle 6440 -prefsLen 12424 -prefMapSize 219631 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3968 "\\.\pipe\gecko-crash-server-pipe.3968" 6432 tab
3⤵
PID:3412

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3968.55.1487915080\255203181" -childID 8 -isForBrowser -prefsHandle 3124 -prefMapHandle 3160 -prefsLen 12674 -prefMapSize 219631 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3968 "\\.\pipe\gecko-crash-server-pipe.3968" 9932 tab
3⤵
PID:3280

C:\Users\Admin\Downloads\anyrunhelper.exe
"C:\Users\Admin\Downloads\anyrunhelper.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3692

C:\Users\Admin\FiddlerInstaller.exe
"C:\Users\Admin\FiddlerInstaller.exe"
2⤵
- Executes dropped EXE
PID:2944

C:\Users\Admin\AppData\Local\Temp\nsyC4B1.tmp\FiddlerSetup.exe
"C:\Users\Admin\AppData\Local\Temp\nsyC4B1.tmp\FiddlerSetup.exe" /D=
3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
PID:740

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="FiddlerProxy"
4⤵
PID:2648

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="FiddlerProxy" program="C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe" action=allow profile=any dir=in edge=deferuser protocol=tcp description="Permit inbound connections to Fiddler"
4⤵
PID:2880

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
4⤵
PID:3820

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 170 -InterruptEvent 0 -NGENProcess 160 -Pipe 16c -Comment "NGen Worker Process"
5⤵
PID:3092

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 0 -NGENProcess 20c -Pipe 214 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:3096

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 0 -NGENProcess 228 -Pipe 22c -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1816

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 0 -NGENProcess 280 -Pipe 270 -Comment "NGen Worker Process"
5⤵
PID:4496

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 0 -NGENProcess 280 -Pipe 284 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4752

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 0 -NGENProcess 280 -Pipe 258 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:5052

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 0 -NGENProcess 168 -Pipe 288 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4292

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 0 -NGENProcess 168 -Pipe 238 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4196

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 168 -InterruptEvent 0 -NGENProcess 260 -Pipe 278 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4664

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 0 -NGENProcess 260 -Pipe 274 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2904

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 0 -NGENProcess 234 -Pipe 25c -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4496

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 0 -NGENProcess 27c -Pipe 20c -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:5060

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 0 -NGENProcess 260 -Pipe 234 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4484

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 0 -NGENProcess 28c -Pipe 2a0 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:5108

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 0 -NGENProcess 280 -Pipe 27c -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4380

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 0 -NGENProcess 280 -Pipe 290 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4500

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 0 -NGENProcess 254 -Pipe 2b0 -Comment "NGen Worker Process"
5⤵
PID:4932

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 0 -NGENProcess 254 -Pipe 2b0 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4812

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 0 -NGENProcess 298 -Pipe 280 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4480

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 0 -NGENProcess 2b8 -Pipe 254 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:60

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 0 -NGENProcess 298 -Pipe 2d8 -Comment "NGen Worker Process"
5⤵
PID:4356

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 0 -NGENProcess 2dc -Pipe 228 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4084

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 0 -NGENProcess 2c8 -Pipe 2dc -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1656

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 0 -NGENProcess 2b8 -Pipe 2cc -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4528

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 288 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4792

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 0 -NGENProcess 2a8 -Pipe 2d4 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4108

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 2ac -Pipe 2bc -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2712

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 2f0 -Pipe 2e8 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4856

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 0 -NGENProcess 2f0 -Pipe 290 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2336

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 0 -NGENProcess 168 -Pipe 2d0 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
PID:2068

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 0 -NGENProcess 29c -Pipe 2c8 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4356

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 2d0 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4676

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 168 -InterruptEvent 0 -NGENProcess 2ec -Pipe 2f4 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
PID:1844

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 0 -NGENProcess 2a8 -Pipe 168 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:3412

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\EnableLoopback.exe"
4⤵
PID:3640

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 174 -InterruptEvent 0 -NGENProcess 164 -Pipe 170 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
PID:1420

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 210 -InterruptEvent 0 -NGENProcess 20c -Pipe 214 -Comment "NGen Worker Process"
5⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4028

C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper
"C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper" /a "C:\Users\Admin\AppData\Local\Programs\Fiddler"
4⤵
- Executes dropped EXE
PID:2336

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1776

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3376

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4432

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wsappx
1⤵
- Modifies registry class
PID:4344

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4660

C:\Users\Admin\FiddlerInstaller.exe
"C:\Users\Admin\FiddlerInstaller.exe"
1⤵
- Executes dropped EXE
PID:4380

C:\Users\Admin\AppData\Local\Temp\nsg12E7.tmp\FiddlerSetup.exe
"C:\Users\Admin\AppData\Local\Temp\nsg12E7.tmp\FiddlerSetup.exe" /D=
2⤵
- Executes dropped EXE
PID:4708

C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe
"C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4828

C:\Users\Admin\AppData\Local\Programs\Fiddler\TrustCert.exe
"C:\Users\Admin\AppData\Local\Programs\Fiddler\TrustCert.exe" -noprompt -path="C:\Users\Admin\Documents\Fiddler2\FiddlerRoot.cer"
2⤵
- Executes dropped EXE
- Modifies system certificate store
PID:4872

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2904

C:\Users\Admin\Downloads\Signalis.exe
"C:\Users\Admin\Downloads\Signalis.exe"
1⤵
- Executes dropped EXE
PID:3584

C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe
2⤵
- Executes dropped EXE
PID:2960

C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe
"C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe" --type=gpu-process --field-trial-handle=1476,862681819005955366,9640600876524861043,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1484 /prefetch:2
3⤵
- Executes dropped EXE
PID:4504

C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe
"C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe" --type=utility --field-trial-handle=1476,862681819005955366,9640600876524861043,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1876 /prefetch:8
3⤵
- Executes dropped EXE
PID:4076

C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe
"C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe" --type=renderer --field-trial-handle=1476,862681819005955366,9640600876524861043,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\resources\app.asar" --node-integration --no-sandbox --no-zygote --enable-remote-module --background-color=#0c0d10 --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1976 /prefetch:1
3⤵
- Executes dropped EXE
- Checks computer location settings
PID:4616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Programs\Fiddler\Analytics.dll

MD5
1c2bd080b0e972a3ee1579895ea17b42

SHA1
a09454bc976b4af549a6347618f846d4c93b769b

SHA256
166e1a6cf86b254525a03d1510fe76da574f977c012064df39dd6f4af72a4b29

SHA512
946e56d543a6d00674d8fa17ecd9589cba3211cfa52c978e0c9dab0fa45cdfc7787245d14308f5692bd99d621c0caca3c546259fcfa725fff9171b144514b6e0

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe

MD5
908ca3fcf82dd062c5c5880845ca3457

SHA1
f588b17d247e7d6c4a25b6487ad5fd4bf34c0f33

SHA256
c44fc144a875be0b93ca720efe2e7509d360f6e7d3e28a55b00625a6c4e84b8d

SHA512
a7535aeb84e7799d67c412b9c5a6cd65ecfcc8cf975bac98b6bde12dd774a266895cff73b116395136c875e47337e76b71e27e7e1d3f93b4b3ca528e68a50f0d

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe.config

MD5
38a7379a4b36fc661c69a3e299373a05

SHA1
1b0de45ad7fe759499c57cc1aa9c1da441d9167a

SHA256
70107440ed3e5ce934b947a85669a963ed0370d1d34c27e8f3bd2a8f5f670342

SHA512
5c91d3ebae7a1d0fc068303632cdd7f789bfc3f5158c338d253ef0ba584bde2346e86287dd56f8dd266494ecf1307fb091e548b5cb795a80e5969f09f7507f02

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\GA.Analytics.Monitor.dll

MD5
6f9e5c4b5662c7f8d1159edcba6e7429

SHA1
c7630476a50a953dab490931b99d2a5eca96f9f6

SHA256
e3261a13953f4bedec65957b58074c71d2e1b9926529d48c77cfb1e70ec68790

SHA512
78fd28a0b19a3dae1d0ae151ce09a42f7542de816222105d4dafe1c0932586b799b835e611ce39a9c9424e60786fbd2949cabac3f006d611078e85b345e148c8

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Newtonsoft.Json.dll

MD5
5afda7c7d4f7085e744c2e7599279db3

SHA1
3a833eb7c6be203f16799d7b7ccd8b8c9d439261

SHA256
f58c374ffcaae4e36d740d90fbf7fe70d0abb7328cd9af3a0a7b70803e994ba4

SHA512
7cbbbef742f56af80f1012d7da86fe5375ac05813045756fb45d0691c36ef13c069361457500ba4200157d5ee7922fd118bf4c0635e5192e3f8c6183fd580944

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper

MD5
fc95e43b398d6ac6c61a4d59e769f9fa

SHA1
80a2db2d65c07d0e971fcab2d3b88b3824e410c9

SHA256
f6351598de77147baeb7c0bb678019be8700b8e52f3ef998642457f7fdf8d64d

SHA512
4c384e31e16982c1b81dcf01c3cff104439b5998c60afab0f68769b82071dd34584f8c4129dddc21ddd457b5ea3af6cc8bfa078a5e65aa4519f23dda6d975527

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper

MD5
fc95e43b398d6ac6c61a4d59e769f9fa

SHA1
80a2db2d65c07d0e971fcab2d3b88b3824e410c9

SHA256
f6351598de77147baeb7c0bb678019be8700b8e52f3ef998642457f7fdf8d64d

SHA512
4c384e31e16982c1b81dcf01c3cff104439b5998c60afab0f68769b82071dd34584f8c4129dddc21ddd457b5ea3af6cc8bfa078a5e65aa4519f23dda6d975527

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Telerik.NetworkConnections.dll

MD5
798d6938ceab9271cdc532c0943e19dc

SHA1
5f86b4cd45d2f1ffae1153683ce50bc1fb0cd2e3

SHA256
fb90b6e76fdc617ec4ebf3544da668b1f6b06c1debdba369641c3950cab73dd2

SHA512
644fde362f032e6e479750696f62e535f3e712540840c4ca27e10bdfb79b2e5277c82a6d8f55f678e223e45f883776e7f39264c234bc6062fc1865af088c0c31

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Xceed.Compression.Formats.v5.4.dll

MD5
0a18e5343f8a1f6b7c487ecfb846a0a7

SHA1
ac4160828ae8854a699062b991a661f8b210e306

SHA256
dfcc0a43517fd38ca424d3dfca4f6f573494bcfd3501a0cd7a348e25864814ab

SHA512
2c766dafeefe4f47bcfa89807beb1de6eddb2c5e2d75b5f4ee81ddb14a897d66535f341f6d15357b286eb91183c3a78a190dcdede60473e1924a17fc88af2824

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Xceed.Compression.v5.4.dll

MD5
717d0950db3e4591c1a25314e0a5d666

SHA1
b9489080e760e86b373bfc881a5f5bb31a280622

SHA256
8d2fc76da8faf96e54ea4a3f6ad602beeab539e1114c94a249df5f64a0c2fb9f

SHA512
9ea1a565e7931f15a6b7858fd7342c678aad8b6c800b3ba1014b202252eaccc8c01c4737c7490139147233ae42051930beadfa0e5d5e28968e8108ac6e6413f2

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Xceed.FileSystem.v5.4.dll

MD5
4f01f4c6ee8703230c636bbed2b68e7e

SHA1
6de4005b18fee954e7f9b8d511b5173f1fd87b06

SHA256
d7f8eb14b7f0de5d65b03bfb1fa39a39e94540642e523f2a3c33aa9b8225ea16

SHA512
bd1371da699f14100dad26bce8027b04e855ae723c3b55ea435a5038751224db5b7050062493dbdbbcdc891956791720792f1cbc4cbd3979f2c6be8eead7a8c3

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Xceed.Zip.v5.4.dll

MD5
8758599a28ed2de95c7548f0827b8ebb

SHA1
9284399757c8951392c1de27990d660a04497792

SHA256
e7b150637b29f6857fa4f048b80ad7529a09f6c7c7a7e19bfedf1689fb95c601

SHA512
6da0a682ae1d5ae4407e2c8bdbccb5d65b4559c60b0e1f1688a4706f06ee8d4c52956902d6c99d475515f65efb4e402b28e777c9fa025f602d2b20f76c05ff5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyC4B1.tmp\FiddlerSetup.exe

MD5
457790e53e39073fa6744fc2e9cfcf33

SHA1
7632bea661f1b11392d9d16df398eb0c751b287b

SHA256
22957b18fb746f1bd91d2ae5f06a25d402ecc08244a9f6489f9ebd11de98e402

SHA512
595b2d73a97585c842a8f9ac57b233bad67d02df14efadcd8065dcb2938c31da61d3950487121f9185c7bc837178b4f40b8ab46f720ccf43ba3d6a5dc5b0dfb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyC4B1.tmp\FiddlerSetup.exe

MD5
457790e53e39073fa6744fc2e9cfcf33

SHA1
7632bea661f1b11392d9d16df398eb0c751b287b

SHA256
22957b18fb746f1bd91d2ae5f06a25d402ecc08244a9f6489f9ebd11de98e402

SHA512
595b2d73a97585c842a8f9ac57b233bad67d02df14efadcd8065dcb2938c31da61d3950487121f9185c7bc837178b4f40b8ab46f720ccf43ba3d6a5dc5b0dfb8

Download Submit
C:\Users\Admin\Downloads\anyrunhelper.exe

MD5
01c688ba3c37612569e188db6f589ad5

SHA1
544189f58b91ed79a7938650aaf8c974723d4f7c

SHA256
aa42b2d38a85f13a354ce0df8d84d5dc8c1ec3b04ce321562f36eb9fa35bcd85

SHA512
abfe9aa53f4418eeef263df94a7878f17710d08bb09a00ea7f919e7d3fa0c7fdff41256d848da33ff6243c1420aa2599c2c09858c9bdb355670bff6ce5b4deea

Download Submit
C:\Users\Admin\Downloads\anyrunhelper.exe

MD5
01c688ba3c37612569e188db6f589ad5

SHA1
544189f58b91ed79a7938650aaf8c974723d4f7c

SHA256
aa42b2d38a85f13a354ce0df8d84d5dc8c1ec3b04ce321562f36eb9fa35bcd85

SHA512
abfe9aa53f4418eeef263df94a7878f17710d08bb09a00ea7f919e7d3fa0c7fdff41256d848da33ff6243c1420aa2599c2c09858c9bdb355670bff6ce5b4deea

Download Submit
C:\Users\Admin\FiddlerInstaller.exe

MD5
ff7ce5771a7d4b3b0e34a04cf776acb9

SHA1
2adab5e1704a4a6cbb45e8057cb0afda4c029c9b

SHA256
aaa4d714eeaae8f6a96a63110cd239ec44fac75ae591ab181c13ac837e0ec1a4

SHA512
0238a1b438c0fb70c5c12205c81b1bf955146276ed07408cb7513d387420598f8540b22d6efcc8e163d1aea2594ea811cf145d5bfa08d80a7c6e23003ffdb2b2

Download Submit
C:\Users\Admin\FiddlerInstaller.exe

MD5
ff7ce5771a7d4b3b0e34a04cf776acb9

SHA1
2adab5e1704a4a6cbb45e8057cb0afda4c029c9b

SHA256
aaa4d714eeaae8f6a96a63110cd239ec44fac75ae591ab181c13ac837e0ec1a4

SHA512
0238a1b438c0fb70c5c12205c81b1bf955146276ed07408cb7513d387420598f8540b22d6efcc8e163d1aea2594ea811cf145d5bfa08d80a7c6e23003ffdb2b2

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\cd03f7a1d6c4031c515fb3f50c42e268\System.Data.SqlXml.ni.dll

MD5
0bdbc8f0fb2097d58e463ab73f8c44d8

SHA1
c159252064305d27d4b6dfbfdbdc233ac331a453

SHA256
6cf016fbbee0fd57d6c44b81d913d8206fb7262413d9d15f7c62e7dfe5d5147a

SHA512
91afc6b85cbff3fbf4688c117effb8faa1268a2c16e29176a51807204529b40607cda3d6b5a83583a908c791c96073610fe7640f6a934578cc126b560f5d4803

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\cd03f7a1d6c4031c515fb3f50c42e268\System.Data.SqlXml.ni.dll.aux

MD5
d5577957acc6633ed66d740273fe50f6

SHA1
7042dd2a2a270d9efc78ce6aa21b63b46f70b2d8

SHA256
0b45589ba25d9e1f710a4b40411d3b6b2294a1c6f7c591412fd8b42411586b11

SHA512
bc9c64c1c478bc54a30d77c11cb7a0d115a525dbeae325b9397ae82e5e124c2d48895fc5dad533fe3a02038c3a1434f3470fef2c5c09da4c89e5bcff7cb67674

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\bcab827b24e870428fcdda58e1ebec20\System.EnterpriseServices.ni.dll

MD5
d65dad1e140f825dda9c7b73a6fe93fe

SHA1
8ed7ca22b3988c9cfdedadd447bc7183e82024a2

SHA256
ead52a1635188611f7474e6cc860128116f60d7c3bc0cd00cc1cd36b57a6bc73

SHA512
e073ac5fb87bdb3d41175cca1047c52f88ebca9418851b4a0e30852e93fc18ffa0c9fab0d974105aa902c03ea15427e43b97be7920561d141201462c39ebb117

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\bcab827b24e870428fcdda58e1ebec20\System.EnterpriseServices.ni.dll.aux

MD5
28fa6fe88943bec35a2ff039c39becfe

SHA1
ea24fe5a2da1d13b8f94c7418a94f3735b4d7837

SHA256
eeda22d3cce61327c60f84895febe0981e1525dd12862ac0ead63e616c08f3fc

SHA512
9272f19236ad9744f2797e4e17c01fd36f9c7217fe63610e24b522ab0cc873ca98539990b2f1849c717986add99b53596684c5bc1c8d03035d6be78c95214039

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\9744e094346545d417a938174608d0ad\System.Numerics.ni.dll

MD5
fd0f9bc0584653e7f39b55dd6e743a32

SHA1
ada958995ab3b74bcdf05ac0e6270024857fdee0

SHA256
aa8f2ae1967de8b8f1989c7e6f92d0f8828b47d80b1ba69cb7a6c6b6fc1cff9b

SHA512
38c76c107b0931b1d3cdf60207f5647cc2029dd69b6a28845bba2a792472325d3c074bb98954a60a95ed9971e179a4c2f44af95245a7b153f386d28c5b835e1f

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\9744e094346545d417a938174608d0ad\System.Numerics.ni.dll.aux

MD5
23019c306b73db16e4977abb6a5971ad

SHA1
7e7bcb2847a1053d2a8b914e2390e372ddaf628a

SHA256
db114d34a5ecdf2632aa3cb793a73d369a98fcb9532e223b082fa8197c4b9cf4

SHA512
2c2119390676d42ff0f3232a12ea4392a69882393cc6b9b4ee83b2c5981dd9dd62b7730943cd5e816022b682be59fca4b6ccd6a7c7be0b89925c784221c8926c

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\88bbec18c44a06edb18eb16d6775008f\System.Runtime.Serialization.Formatters.Soap.ni.dll

MD5
6a74608b40a2787d6fc3ba420f22e73e

SHA1
a91e0bce5d4e7b55b308ca1d01bc050a6075747d

SHA256
75a50aa3dc7b54b2ca87630807f20d7a79cca0562b6392a65fce14fd0fe8d253

SHA512
19c616bc99168cf0dcf38d6e0ea498956561d877658be992df9a5e9a996e39cc3bf60b6c3d766e940549d7c39fda1d1e3438f8812143574108dc830c52c5183c

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\88bbec18c44a06edb18eb16d6775008f\System.Runtime.Serialization.Formatters.Soap.ni.dll.aux

MD5
f78eb3ff387498f5130a2875fe726244

SHA1
5024b4a4ab2ef9fead43066c4da3c7cb916190b5

SHA256
55c50aee4af676c93e475f56588055be37bf3e60cf097e375901356073944884

SHA512
f055bfdafd567b15d6e300e4a06f7c6040484c2d3d72cfbd2b9b711aaf076d8623cea20882a03d5cd9aa14ef843723977bcc34effef53b380f6693d89fec12ba

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\cccf0195b8a7b2804875769b64f41f8a\System.Security.ni.dll

MD5
13bd4f0a19d3ea71a5b1c1b6d5330635

SHA1
12909fc81a2cb66a1435803b2c0bbc613a18b243

SHA256
3fc2a7a509f23269002e9a5ce3aca634fceb4e4ab70da6cbf56ae1e500fd6052

SHA512
400a09b0e29f170c1da464cd4e31f42b1e97de9fb24c29ed531d27014bf1513e6cc943435102e21735973e509c58ed7a099843a35cc2aa115868426047387c96

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\cccf0195b8a7b2804875769b64f41f8a\System.Security.ni.dll.aux

MD5
f47e3be6309e0fbf76238a9463c6e2fe

SHA1
5bb62de60fdb9746c59b74b527023b0a27baaf11

SHA256
1fc7ce3af48863309345c4e10cb42a8edc1e4916888e771d942b10e6433cb09f

SHA512
1a3f3175ee4d79bf84fd11b286f3bf0e830e5080dbf230aebf079df7f305d21194d816ca31e4b776f3a3147ea34f13a2b667ba7cab865d453bbb624d1fa353c7

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Servd1dec626#\9fab28f14be5a0da526b1ceaaa04a4c3\System.ServiceModel.Internals.ni.dll

MD5
cc6bd7a1d7ea753579d70fb40d7c57ad

SHA1
16e06913e1b5363ff534d33d81488d1ad5124778

SHA256
e8d98a32d6bc669edca2edf2c87dd07d42fc5e1fc72e79f0dd513fac1abacfca

SHA512
739873fb98d043be541796633a3ed5b6b589863a50d00088b1b4554f9de455e21f0f6b98cb58815f40e0f8702a821fc55df169fc8effa0f6847123ee1bba4422

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Servd1dec626#\9fab28f14be5a0da526b1ceaaa04a4c3\System.ServiceModel.Internals.ni.dll.aux

MD5
414eca6bd94629456ff3cbba8f75f9d4

SHA1
ef810a31dac8cb877dea76e8d01b7bfd995389c7

SHA256
99f62b53a4ecd859e0ebc4e3e326b0bf138e291840baa4bdf13019cf01ed21f0

SHA512
c64dbfe7f41b44067a67bf834cc1593144a5b7d59f0095e8da752c4c798a55111ad9da1283d619f101f38019183196553b4d9f865209824c463004750a587411

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\d56e83822b7799e202533e1b84b3c134\System.Web.RegularExpressions.ni.dll

MD5
656432e3e93d85cf4468ddfae2a75c1b

SHA1
f03dcca48cd68cc14e1e03e14daaaccebcd2b420

SHA256
643647116569e1099a594c459814b8817b2f33b0d261622b3b48eb9257b85692

SHA512
3b0b9b4cd686bd4f9427a9da6996850c33f1b8724baee0aba81f860a49f4b7e9dd1212360eb7d46d98212cd4195b90940d466a93907795ae093cdec124e25223

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\d56e83822b7799e202533e1b84b3c134\System.Web.RegularExpressions.ni.dll.aux

MD5
12eea015dd4eab6276a000164cef3fd5

SHA1
a8c2ea89edb3e50f7a6d08f39bfdfebb3e209a45

SHA256
9ce7b968a322fdd84670f4ebe007d5dac6a88795392f279003a4b6d0e55e90aa

SHA512
3bf47dfd8802360a55814f362ee5d8737d633858de43a5520390f81ea0987f27f225787cf490e5ae12d37614f0e08db4fdd722effb65f0cee243513a619bf841

Download Submit
\Users\Admin\AppData\Local\Temp\nsaD55C.tmp\System.dll

MD5
b8992e497d57001ddf100f9c397fcef5

SHA1
e26ddf101a2ec5027975d2909306457c6f61cfbd

SHA256
98bcd1dd88642f4dd36a300c76ebb1ddfbbbc5bfc7e3b6d7435dc6d6e030c13b

SHA512
8823b1904dccfaf031068102cb1def7958a057f49ff369f0e061f1b4db2090021aa620bb8442a2a6ac9355bb74ee54371dc2599c20dc723755a46ede81533a3c

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Analytics\d756563aa7cd4e9c00502605394ea611\Analytics.ni.dll

MD5
4b962d3d8b3c91fa54e20ea48d09a990

SHA1
35468f050fb1b4a5e57a437b644d2c9e512f862f

SHA256
3e7dc77c58ae21758add41de81b649240e95707abcbd6d02fccdaa73449ab33f

SHA512
5ba87664ebadc3611523e69c9b26b6b9f4576240eb5c3a7e39a21a3a6f68f37142c9902fe4410f4e60593556d0e641a9ee82a37c1cb29e50d6247db2804ac3c5

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Fiddler\3cd9abac0298699ce5800f9e3c3e9f50\Fiddler.ni.exe

MD5
02854fe0e722861ffb1d00d4b0c77b45

SHA1
3f94966fb5791187a7386ad9643aec792dfdb0a8

SHA256
466739f13737b9eda0a5abfbfe0f3775226a457820520691a1275b9353615782

SHA512
e2d5a860fac46f76efa059bbc4b648fad7821ceacb575ec153ab9825636deda04b249d0b691db57e87cb88f98398e47740c180565d4ef9893fa08b0af907b6d5

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\GA.Analytics.Monitor\3bf155f5fe5c3c876614c4d82313933c\GA.Analytics.Monitor.ni.dll

MD5
188e0e27618fc054e447005da14b39e6

SHA1
fa53f294d3f2d484b513f17ca5d21b33a52e2500

SHA256
7602634749732ab0411aebe3b5789b736c8e68d07688dd22d83f29b6e86675c9

SHA512
717e160dec70f5d647e6152ed1ce8ed1e4d64118cd68ffaa091264d8a7b947175261552a9171ebf4ddc7fe0096608a9a4f5d1b24857d1c8eb5d750b2e085670c

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\2145e325c531dd03775cc61606722965\Microsoft.JScript.ni.dll

MD5
d1d5dd7761a0e2c31c2baeeb4442a6ba

SHA1
c681dca866baa02e7840bffdbcff349da69ba25c

SHA256
84676accc10df0f610772b5d447b058a9fd3c4d399cddc01ef6510d9832915f1

SHA512
59891b98e42635c056debe5fdd373b3d31ef1731c653c7df179c0db8544c6bfc6e4899d62a3068b76a652e71899b285e1757260ccaa805658e1e77e00cb9b263

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.VisualC\74de34cd518bf49352c8346149ddfbc1\Microsoft.VisualC.ni.dll

MD5
fe88f5e168267de89f2f0e640f9b39bd

SHA1
599517d203a3023dc6a39d47679a0890d5e0b92a

SHA256
1321d22d96a9683c4b36896f384280a8e951f533250a6d679043711c5f81a337

SHA512
0916cda1339f24aa31f928d8c98590276715cc48e25d3ae962b3f90f711de1d9189e8bc4b4391ddcb002def0b1568a41d5e190463ac39d8efdaded649b20e205

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Newtonsoft.Json\1ebe746ea3a361d99ffc6ea2e12b5a66\Newtonsoft.Json.ni.dll

MD5
03eabadb3e9fe0a8566ce36fde2ed959

SHA1
c0da077a84d61426c6de7d27b5bd3d5beb034352

SHA256
2467069bdc725532c792ab7f026bbafbbdbbd311d5ba83c502cc35a044b90860

SHA512
b60a5ac1f0b062ba3319ba93171f2d150a536fa4ce37bc7061a76949ca98c5ee08dc342f232bf47b36753c4046c23828fea8560b083778f175d5303906c9bc82

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\SMDiagnostics\c7d01590f25b87c1d82c1b48e56d5865\SMDiagnostics.ni.dll

MD5
3a58323549cfa56e6adc67c49e23df3a

SHA1
2836bee70901ab28058f51c5564e22513645b7a7

SHA256
3ac9cf3eee053c92901ff1b24e1a866c17935f72c54571f36e9cd4bede01bf1c

SHA512
bd9d658137753f0966d8cb53675c7faff3089f989e5a074df7999f3cbd56222646193b603672cdcf62cbee94ee7e67c074e545c95b4fd46ce47bf34f879bacac

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\System.Compba577418#\dee98e5b0e1a766ada50708c26bad1aa\System.ComponentModel.Composition.ni.dll

MD5
146a01a7f6ff0034d34697d9787785ca

SHA1
b1c4bcb0b3c5cd8d1777c794492ceaf133506204

SHA256
f681e4a24d7c1844aba2b7388a73c0224c9e57e89ee30af9e0a829fad06f3104

SHA512
e14fae2ebce62de00cd6f25456118e9faa4eec14c222fe14988cf9cbf962b5f0628f6a77f8ce44d4e976779bffb11de8e935259bdd4b6c5bdbc4c635653e7f9e

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\cd03f7a1d6c4031c515fb3f50c42e268\System.Data.SqlXml.ni.dll

MD5
0bdbc8f0fb2097d58e463ab73f8c44d8

SHA1
c159252064305d27d4b6dfbfdbdc233ac331a453

SHA256
6cf016fbbee0fd57d6c44b81d913d8206fb7262413d9d15f7c62e7dfe5d5147a

SHA512
91afc6b85cbff3fbf4688c117effb8faa1268a2c16e29176a51807204529b40607cda3d6b5a83583a908c791c96073610fe7640f6a934578cc126b560f5d4803

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\cd03f7a1d6c4031c515fb3f50c42e268\System.Data.SqlXml.ni.dll

MD5
0bdbc8f0fb2097d58e463ab73f8c44d8

SHA1
c159252064305d27d4b6dfbfdbdc233ac331a453

SHA256
6cf016fbbee0fd57d6c44b81d913d8206fb7262413d9d15f7c62e7dfe5d5147a

SHA512
91afc6b85cbff3fbf4688c117effb8faa1268a2c16e29176a51807204529b40607cda3d6b5a83583a908c791c96073610fe7640f6a934578cc126b560f5d4803

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\cd03f7a1d6c4031c515fb3f50c42e268\System.Data.SqlXml.ni.dll

MD5
0bdbc8f0fb2097d58e463ab73f8c44d8

SHA1
c159252064305d27d4b6dfbfdbdc233ac331a453

SHA256
6cf016fbbee0fd57d6c44b81d913d8206fb7262413d9d15f7c62e7dfe5d5147a

SHA512
91afc6b85cbff3fbf4688c117effb8faa1268a2c16e29176a51807204529b40607cda3d6b5a83583a908c791c96073610fe7640f6a934578cc126b560f5d4803

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\52c68307282a248618376df5db7f9cce\System.Deployment.ni.dll

MD5
ccdd9605e7bb07b8b0b3b19d8e938615

SHA1
49c99a4dba7ea3b3fcd49afc124cb81b14f4cd84

SHA256
6a90f268b1848ab002406a929e0c8868838370ccfb4fd747c0b213d62da93572

SHA512
dfed841d9b210e9d8eed60c79f1f9ea513b0fe5b00c10002baf3f81ee686c52ea3bf39c612ba69fc1b747c37bba3de25b645f702cc4329f149a28ac036d8bc8b

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\System.Design\e54657ea70d60e1ad13dc5f818f32e90\System.Design.ni.dll

MD5
90850f355510bac4d8e8f60054c077ba

SHA1
0b502683c0a49878715a5aa0cfb8a67e1852abea

SHA256
993960a4b0a46a7422250b75a91cfb2291d8c4dc8704a6513dd29d91d69042df

SHA512
b9c83dbe5a2791ba2308651ef1e3af98a8d1ae2ff631e682f6333a6683f13b7f601182729ad62759a982da4edc68cb0dcf9988bf23414df7cfdc623dd1b69299

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\bcab827b24e870428fcdda58e1ebec20\System.EnterpriseServices.ni.dll

MD5
d65dad1e140f825dda9c7b73a6fe93fe

SHA1
8ed7ca22b3988c9cfdedadd447bc7183e82024a2

SHA256
ead52a1635188611f7474e6cc860128116f60d7c3bc0cd00cc1cd36b57a6bc73

SHA512
e073ac5fb87bdb3d41175cca1047c52f88ebca9418851b4a0e30852e93fc18ffa0c9fab0d974105aa902c03ea15427e43b97be7920561d141201462c39ebb117

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\bcab827b24e870428fcdda58e1ebec20\System.EnterpriseServices.ni.dll

MD5
d65dad1e140f825dda9c7b73a6fe93fe

SHA1
8ed7ca22b3988c9cfdedadd447bc7183e82024a2

SHA256
ead52a1635188611f7474e6cc860128116f60d7c3bc0cd00cc1cd36b57a6bc73

SHA512
e073ac5fb87bdb3d41175cca1047c52f88ebca9418851b4a0e30852e93fc18ffa0c9fab0d974105aa902c03ea15427e43b97be7920561d141201462c39ebb117

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\9744e094346545d417a938174608d0ad\System.Numerics.ni.dll

MD5
fd0f9bc0584653e7f39b55dd6e743a32

SHA1
ada958995ab3b74bcdf05ac0e6270024857fdee0

SHA256
aa8f2ae1967de8b8f1989c7e6f92d0f8828b47d80b1ba69cb7a6c6b6fc1cff9b

SHA512
38c76c107b0931b1d3cdf60207f5647cc2029dd69b6a28845bba2a792472325d3c074bb98954a60a95ed9971e179a4c2f44af95245a7b153f386d28c5b835e1f

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\9744e094346545d417a938174608d0ad\System.Numerics.ni.dll

MD5
fd0f9bc0584653e7f39b55dd6e743a32

SHA1
ada958995ab3b74bcdf05ac0e6270024857fdee0

SHA256
aa8f2ae1967de8b8f1989c7e6f92d0f8828b47d80b1ba69cb7a6c6b6fc1cff9b

SHA512
38c76c107b0931b1d3cdf60207f5647cc2029dd69b6a28845bba2a792472325d3c074bb98954a60a95ed9971e179a4c2f44af95245a7b153f386d28c5b835e1f

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\88bbec18c44a06edb18eb16d6775008f\System.Runtime.Serialization.Formatters.Soap.ni.dll

MD5
6a74608b40a2787d6fc3ba420f22e73e

SHA1
a91e0bce5d4e7b55b308ca1d01bc050a6075747d

SHA256
75a50aa3dc7b54b2ca87630807f20d7a79cca0562b6392a65fce14fd0fe8d253

SHA512
19c616bc99168cf0dcf38d6e0ea498956561d877658be992df9a5e9a996e39cc3bf60b6c3d766e940549d7c39fda1d1e3438f8812143574108dc830c52c5183c

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\88bbec18c44a06edb18eb16d6775008f\System.Runtime.Serialization.Formatters.Soap.ni.dll

MD5
6a74608b40a2787d6fc3ba420f22e73e

SHA1
a91e0bce5d4e7b55b308ca1d01bc050a6075747d

SHA256
75a50aa3dc7b54b2ca87630807f20d7a79cca0562b6392a65fce14fd0fe8d253

SHA512
19c616bc99168cf0dcf38d6e0ea498956561d877658be992df9a5e9a996e39cc3bf60b6c3d766e940549d7c39fda1d1e3438f8812143574108dc830c52c5183c

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\cccf0195b8a7b2804875769b64f41f8a\System.Security.ni.dll

MD5
13bd4f0a19d3ea71a5b1c1b6d5330635

SHA1
12909fc81a2cb66a1435803b2c0bbc613a18b243

SHA256
3fc2a7a509f23269002e9a5ce3aca634fceb4e4ab70da6cbf56ae1e500fd6052

SHA512
400a09b0e29f170c1da464cd4e31f42b1e97de9fb24c29ed531d27014bf1513e6cc943435102e21735973e509c58ed7a099843a35cc2aa115868426047387c96

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\cccf0195b8a7b2804875769b64f41f8a\System.Security.ni.dll

MD5
13bd4f0a19d3ea71a5b1c1b6d5330635

SHA1
12909fc81a2cb66a1435803b2c0bbc613a18b243

SHA256
3fc2a7a509f23269002e9a5ce3aca634fceb4e4ab70da6cbf56ae1e500fd6052

SHA512
400a09b0e29f170c1da464cd4e31f42b1e97de9fb24c29ed531d27014bf1513e6cc943435102e21735973e509c58ed7a099843a35cc2aa115868426047387c96

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\cccf0195b8a7b2804875769b64f41f8a\System.Security.ni.dll

MD5
13bd4f0a19d3ea71a5b1c1b6d5330635

SHA1
12909fc81a2cb66a1435803b2c0bbc613a18b243

SHA256
3fc2a7a509f23269002e9a5ce3aca634fceb4e4ab70da6cbf56ae1e500fd6052

SHA512
400a09b0e29f170c1da464cd4e31f42b1e97de9fb24c29ed531d27014bf1513e6cc943435102e21735973e509c58ed7a099843a35cc2aa115868426047387c96

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\System.Servd1dec626#\9fab28f14be5a0da526b1ceaaa04a4c3\System.ServiceModel.Internals.ni.dll

MD5
cc6bd7a1d7ea753579d70fb40d7c57ad

SHA1
16e06913e1b5363ff534d33d81488d1ad5124778

SHA256
e8d98a32d6bc669edca2edf2c87dd07d42fc5e1fc72e79f0dd513fac1abacfca

SHA512
739873fb98d043be541796633a3ed5b6b589863a50d00088b1b4554f9de455e21f0f6b98cb58815f40e0f8702a821fc55df169fc8effa0f6847123ee1bba4422

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\System.Servd1dec626#\9fab28f14be5a0da526b1ceaaa04a4c3\System.ServiceModel.Internals.ni.dll

MD5
cc6bd7a1d7ea753579d70fb40d7c57ad

SHA1
16e06913e1b5363ff534d33d81488d1ad5124778

SHA256
e8d98a32d6bc669edca2edf2c87dd07d42fc5e1fc72e79f0dd513fac1abacfca

SHA512
739873fb98d043be541796633a3ed5b6b589863a50d00088b1b4554f9de455e21f0f6b98cb58815f40e0f8702a821fc55df169fc8effa0f6847123ee1bba4422

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\d56e83822b7799e202533e1b84b3c134\System.Web.RegularExpressions.ni.dll

MD5
656432e3e93d85cf4468ddfae2a75c1b

SHA1
f03dcca48cd68cc14e1e03e14daaaccebcd2b420

SHA256
643647116569e1099a594c459814b8817b2f33b0d261622b3b48eb9257b85692

SHA512
3b0b9b4cd686bd4f9427a9da6996850c33f1b8724baee0aba81f860a49f4b7e9dd1212360eb7d46d98212cd4195b90940d466a93907795ae093cdec124e25223

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\d56e83822b7799e202533e1b84b3c134\System.Web.RegularExpressions.ni.dll

MD5
656432e3e93d85cf4468ddfae2a75c1b

SHA1
f03dcca48cd68cc14e1e03e14daaaccebcd2b420

SHA256
643647116569e1099a594c459814b8817b2f33b0d261622b3b48eb9257b85692

SHA512
3b0b9b4cd686bd4f9427a9da6996850c33f1b8724baee0aba81f860a49f4b7e9dd1212360eb7d46d98212cd4195b90940d466a93907795ae093cdec124e25223

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Telerik.Net8bf66678#\e5f4977994d2fd10324efd51321f1c59\Telerik.NetworkConnections.ni.dll

MD5
8c1196b2476c2ae2dee297e3db1cf37f

SHA1
27b4c6bc7876d7f52f34bffe2fb1f3cee88444ff

SHA256
f298ac1090234846c34b192f4683d34477f84f5eb8b844afedac9d4de246e104

SHA512
cd4bbe93c3a40035c65358ba714f39b8c6770aa44bdb87ed6dd23292f7a641c3da3977691fb1ecf83f1dbb6fe704edc6eeb817d1da48b4f2f9de62cf9c2ec591

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Xceed.Compr900e8dcd#\7605b9bd13c012050e6c360e0a781523\Xceed.Compression.v5.4.ni.dll

MD5
dfce053123ea054938dad4c69d5c6032

SHA1
57ae2ec252d8a98462752efa1e58faa27023201a

SHA256
218ac3ebfa7935be4e3f8e95753e995501d65c03898825379190b6d4cb5bb72f

SHA512
6076ed0f8daa59ed9119f272b1ce054b7740d683e9a3d67aa831659436ed0253a97c4c9ca3c26166084d4b89b79ac0c2b07eec0129ebc0e4c5ca915b7f0cc66b

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Xceed.FileSf21c5040#\e34a1aa24fac441ad1fbc93aff0d50a2\Xceed.FileSystem.v5.4.ni.dll

MD5
be0232620bdbb15ef084485c42532ca5

SHA1
fe629cbd592523dd7eaacb1bd3e97279d11f9a6b

SHA256
116649136665cf465ad5b175ced683adf06bac2e33e4f00d63bb72114fe56808

SHA512
a44119b4f87af5a767c04f56c46f627b3f4f9010e9ec2a65d61797e411404cdd37c1de063f4ae622b3359f30ecf75f964f6d3adfdf29a2cae358fa77c75297d1

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Xceed.Zip.v5.4\445a5f98d17fb40a3610560f71f4fd48\Xceed.Zip.v5.4.ni.dll

MD5
1de1ff493392657aa65fb06d675498b5

SHA1
4fae4fec3fc7535f71c355435cb72850ee35ea85

SHA256
2097dc7fbbd792179db993ddc880c69d06b88f444716d73a0f6a887f4eacc56b

SHA512
939955e156958a73c769dd72b4aea49c6a2a8e9c21765e8373d7435be15889128c100e786aac9562cdc2b210fad82a79ed4282aba43565bc59567f4c6194a948

Download Submit
memory/60-512-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/1656-855-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/1816-190-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/2336-131-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/2336-125-0x0000000000F10000-0x0000000000F18000-memory.dmp

Filesize
32KB

Download
memory/2904-363-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/3092-148-0x00000260EB980000-0x00000260EB996000-memory.dmp

Filesize
88KB

Download
memory/3092-160-0x00000260EBAE0000-0x00000260EBAF2000-memory.dmp

Filesize
72KB

Download
memory/3092-130-0x00000260EBCA0000-0x00000260EBE16000-memory.dmp

Filesize
1.5MB

Download
memory/3092-133-0x00000260EBB20000-0x00000260EBBDA000-memory.dmp

Filesize
744KB

Download
memory/3092-135-0x00000260EB930000-0x00000260EB980000-memory.dmp

Filesize
320KB

Download
memory/3092-172-0x00000260EC520000-0x00000260EC59E000-memory.dmp

Filesize
504KB

Download
memory/3092-171-0x00000260ECFD0000-0x00000260ED0F2000-memory.dmp

Filesize
1.1MB

Download
memory/3092-137-0x00000260EB8E0000-0x00000260EB904000-memory.dmp

Filesize
144KB

Download
memory/3092-139-0x00000260E9CC0000-0x00000260E9CCC000-memory.dmp

Filesize
48KB

Download
memory/3092-170-0x00000260EC130000-0x00000260EC14A000-memory.dmp

Filesize
104KB

Download
memory/3092-140-0x00000260EBC30000-0x00000260EBC7A000-memory.dmp

Filesize
296KB

Download
memory/3092-145-0x00000260EBFD0000-0x00000260EC078000-memory.dmp

Filesize
672KB

Download
memory/3092-143-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/3092-142-0x00000260E9CD0000-0x00000260E9CDC000-memory.dmp

Filesize
48KB

Download
memory/3092-169-0x00000260ECE50000-0x00000260ECE94000-memory.dmp

Filesize
272KB

Download
memory/3092-168-0x00000260EC4E0000-0x00000260EC512000-memory.dmp

Filesize
200KB

Download
memory/3092-146-0x00000260EC5B0000-0x00000260ECAD6000-memory.dmp

Filesize
5.1MB

Download
memory/3092-150-0x00000260EBF20000-0x00000260EBF68000-memory.dmp

Filesize
288KB

Download
memory/3092-167-0x00000260EC0D0000-0x00000260EC0F0000-memory.dmp

Filesize
128KB

Download
memory/3092-151-0x00000260EBF70000-0x00000260EBFC0000-memory.dmp

Filesize
320KB

Download
memory/3092-166-0x00000260EC0B0000-0x00000260EC0C2000-memory.dmp

Filesize
72KB

Download
memory/3092-165-0x00000260ED320000-0x00000260ED7EA000-memory.dmp

Filesize
4.8MB

Download
memory/3092-164-0x00000260EBC80000-0x00000260EBC9C000-memory.dmp

Filesize
112KB

Download
memory/3092-152-0x00000260EC160000-0x00000260EC236000-memory.dmp

Filesize
856KB

Download
memory/3092-162-0x00000260EC300000-0x00000260EC33A000-memory.dmp

Filesize
232KB

Download
memory/3092-161-0x00000260EBC10000-0x00000260EBC2E000-memory.dmp

Filesize
120KB

Download
memory/3092-153-0x00000260EBBE0000-0x00000260EBC02000-memory.dmp

Filesize
136KB

Download
memory/3092-154-0x00000260EC240000-0x00000260EC2F2000-memory.dmp

Filesize
712KB

Download
memory/3092-159-0x00000260EC0F0000-0x00000260EC12E000-memory.dmp

Filesize
248KB

Download
memory/3092-173-0x00000260EC4A0000-0x00000260EC4BE000-memory.dmp

Filesize
120KB

Download
memory/3092-158-0x00000260EB910000-0x00000260EB920000-memory.dmp

Filesize
64KB

Download
memory/3092-156-0x00000260E9CE0000-0x00000260E9CE8000-memory.dmp

Filesize
32KB

Download
memory/3092-155-0x00000260EC080000-0x00000260EC0A2000-memory.dmp

Filesize
136KB

Download
memory/3096-191-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/3692-116-0x0000000000530000-0x0000000000BB0000-memory.dmp

Filesize
6.5MB

Download
memory/3692-117-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download
memory/4084-779-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/4084-907-0x00000268F2940000-0x00000268F2965000-memory.dmp

Filesize
148KB

Download
memory/4108-1109-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/4196-333-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/4292-313-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/4356-534-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/4356-533-0x0000028A344C0000-0x0000028A344E5000-memory.dmp

Filesize
148KB

Download
memory/4380-457-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/4480-500-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/4484-425-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/4496-366-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/4496-209-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/4500-481-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/4504-1486-0x0000000077CF2000-0x0000000077CF3000-memory.dmp

Filesize
4KB

Download
memory/4528-870-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/4528-871-0x0000027F27C80000-0x0000027F27CFE000-memory.dmp

Filesize
504KB

Download
memory/4664-334-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/4752-258-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/4792-1067-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/4812-487-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/5052-285-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/5060-398-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download
memory/5108-427-0x00007FFAF3F50000-0x00007FFAF493C000-memory.dmp

Filesize
9.9MB

Download