5c92f0738c290eac319d4ac3006b5725f1d2163fbfe68dbb2047e07920f4d5e8

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
18-10-2023 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FiddlerSetup.exe
Size

6.5MB
MD5

7fd1119b5f29e4094228dabf57e65a9d
SHA1

1a4e248bfe07f8c65ce68b4f29013442be6ef7c7
SHA256

5c92f0738c290eac319d4ac3006b5725f1d2163fbfe68dbb2047e07920f4d5e8
SHA512

20d22e16f5c285bd6ffdf3620762c340ffb97cc51c5080717b87442f29a14271644351b082392d9fb2fd1ce40a1fe56a4e6592a290d67f5c587e8e9eb2f33787
SSDEEP

196608:Q962sDwuahkk8ZaQd9NCMbw4fO0ADH6Op:Q5uAkk8ZBCuXfjADH6s

Score

9^/10

discovery evasion

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exe

pid process

2616 netsh.exe
1632 netsh.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2616	netsh.exe
1632	netsh.exe

Drops file in Windows directory 13 IoCs

Processes:

mscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exe

description	ioc	process
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\490-0\Telerik.NetworkConnections.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Fiddler\9bceff61f42640de809b19116b58c90e\Fiddler.ni.exe.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Newtonsoft.Json\1ebe746ea3a361d99ffc6ea2e12b5a66\Newtonsoft.Json.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\bd8-0\DotNetZip.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\DotNetZip\330381c0d4a4a49e56426709e084cc48\DotNetZip.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Telerik.Net8bf66678#\e5f4977994d2fd10324efd51321f1c59\Telerik.NetworkConnections.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\ba8-0\Fiddler.exe	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Analytics\d756563aa7cd4e9c00502605394ea611\Analytics.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\63c-0\GA.Analytics.Monitor.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\2145e325c531dd03775cc61606722965\Microsoft.JScript.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\b70-0\Analytics.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\634-0\Newtonsoft.Json.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\GA.Analytics.Monitor\3bf155f5fe5c3c876614c4d82313933c\GA.Analytics.Monitor.ni.dll.aux.tmp	mscorsvw.exe

Executes dropped EXE 3 IoCs

Processes:

FiddlerSetup.exeSetupHelperFiddler.exe

pid process

2816 FiddlerSetup.exe
820 SetupHelper
1784 Fiddler.exe

pid	process
2816	FiddlerSetup.exe
820	SetupHelper
1784	Fiddler.exe

Loads dropped DLL 21 IoCs

Processes:

FiddlerSetup.exeFiddlerSetup.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exeFiddler.exe

pid	process
240	FiddlerSetup.exe
2816	FiddlerSetup.exe
2816	FiddlerSetup.exe
2816	FiddlerSetup.exe
2816	FiddlerSetup.exe
812	mscorsvw.exe
3032	mscorsvw.exe
1168	mscorsvw.exe
2984	mscorsvw.exe
2928	mscorsvw.exe
1588	mscorsvw.exe
1596	mscorsvw.exe
1612	mscorsvw.exe
2964	mscorsvw.exe
1884	mscorsvw.exe
2964	mscorsvw.exe
1784	Fiddler.exe
1784	Fiddler.exe
1784	Fiddler.exe
1784	Fiddler.exe
1784	Fiddler.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\nsd3988.tmp\FiddlerSetup.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\nsd3988.tmp\FiddlerSetup.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\nsd3988.tmp\FiddlerSetup.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\nsd3988.tmp\FiddlerSetup.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\nsd3988.tmp\FiddlerSetup.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\nsd3988.tmp\FiddlerSetup.exe	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeFiddlerSetup.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\MAIN	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	FiddlerSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{77E38751-6DF1-11EE-9DA4-5A71798CFAF9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Fiddler.exe = "9999"	FiddlerSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bbd2da6efca7814e97bd67c6ea97aa8b00000000020000000000106600000001000020000000ac837bbb2f8c8459c53b1dc1e4aaa9aca0e3353d94917f226d332a5beac8e7fb000000000e8000000002000020000000d092051276b988690b48470793268cecab8f63618c509fc61a19989134507891900000007d8886d0bf7d0b37f434e9af47bddc10b115449c787951c07f7971fe62f0faf926890dbcfee7497351a9e4f98bcac507d50854a1d8cb2fde7ca4258734c261a0e838c8c9ff33479c454c74389c8af33fcdc01b0fc493864bd9f48c66f345e3e78dc96a329337eae885741fb7295515121414a2596f0e26cfd8586d85169643dace3b1d74472e243a27dc5012715561044000000029725b2a88f9dc2f12f374cc69642a6ffcb534f9161bc4c40e5aa85194d4325e2c4e57bbf816fbadb7d9ea061acc66dff48eb488483356eeaaa529c001de1d43	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bbd2da6efca7814e97bd67c6ea97aa8b00000000020000000000106600000001000020000000442b8d4a7cbbad222be3cd42d6a608ae88ef53ee0080797915c918eacceb8422000000000e800000000200002000000082629ab1b9f517f64192e1cd30837ff5cd9cb96f36fc0d5bf2dc6cae3a71f2aa20000000ec560c96843d0048e96c095f3904e101a5226c526b4fa7043531827e852ba5b640000000c460fd9385d28ef6234d20f3c6bd85cc6aa2bc15ee3998e249cc49ba8066188e62945e80b282733af22cd081073fb1af2ac5fe6bb8a1c46f1da62672550a08b6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Fiddler.exe = "0"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0a48050fe01da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Modifies registry class 15 IoCs

Processes:

FiddlerSetup.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\.saz	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\Fiddler.ArchiveZip	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe\" -noattach \"%1\""	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open &in Viewer\command	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open &in Viewer	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open &in Viewer\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe\" -viewer \"%1\""	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\.saz\ = "Fiddler.ArchiveZip"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\Fiddler.ArchiveZip\DefaultIcon	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\Fiddler.ArchiveZip\Shell	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\Fiddler.ArchiveZip\ = "Fiddler Session Archive"	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\Fiddler.ArchiveZip\PerceivedType = "compressed"	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\Fiddler.ArchiveZip\Content Type = "application/vnd.telerik-fiddler.SessionArchive"	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\Fiddler.ArchiveZip\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\SAZ.ico"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open\command	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open	FiddlerSetup.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

Fiddler.exe

pid	process
1784	Fiddler.exe
1784	Fiddler.exe
1784	Fiddler.exe
1784	Fiddler.exe
1784	Fiddler.exe
1784	Fiddler.exe
1784	Fiddler.exe
1784	Fiddler.exe
1784	Fiddler.exe
1784	Fiddler.exe
1784	Fiddler.exe
1784	Fiddler.exe
1784	Fiddler.exe
1784	Fiddler.exe
1784	Fiddler.exe
1784	Fiddler.exe
1784	Fiddler.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Fiddler.exe

description pid process

Token: SeDebugPrivilege 1784 Fiddler.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2924 iexplore.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

iexplore.exeIEXPLORE.EXEFiddler.exe

pid process

2924 iexplore.exe
2924 iexplore.exe
632 IEXPLORE.EXE
632 IEXPLORE.EXE
632 IEXPLORE.EXE
632 IEXPLORE.EXE
1784 Fiddler.exe
1784 Fiddler.exe

description	pid	process
Token: SeDebugPrivilege	1784	Fiddler.exe

pid	process
2924	iexplore.exe

pid	process
2924	iexplore.exe
2924	iexplore.exe
632	IEXPLORE.EXE
632	IEXPLORE.EXE
632	IEXPLORE.EXE
632	IEXPLORE.EXE
1784	Fiddler.exe
1784	Fiddler.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

FiddlerSetup.exeFiddlerSetup.exeiexplore.exeFiddler.exe

description	pid	process	target process
PID 240 wrote to memory of 2816	240	FiddlerSetup.exe	FiddlerSetup.exe
PID 240 wrote to memory of 2816	240	FiddlerSetup.exe	FiddlerSetup.exe
PID 240 wrote to memory of 2816	240	FiddlerSetup.exe	FiddlerSetup.exe
PID 240 wrote to memory of 2816	240	FiddlerSetup.exe	FiddlerSetup.exe
PID 240 wrote to memory of 2816	240	FiddlerSetup.exe	FiddlerSetup.exe
PID 240 wrote to memory of 2816	240	FiddlerSetup.exe	FiddlerSetup.exe
PID 240 wrote to memory of 2816	240	FiddlerSetup.exe	FiddlerSetup.exe
PID 2816 wrote to memory of 2616	2816	FiddlerSetup.exe	netsh.exe
PID 2816 wrote to memory of 2616	2816	FiddlerSetup.exe	netsh.exe
PID 2816 wrote to memory of 2616	2816	FiddlerSetup.exe	netsh.exe
PID 2816 wrote to memory of 2616	2816	FiddlerSetup.exe	netsh.exe
PID 2816 wrote to memory of 1632	2816	FiddlerSetup.exe	netsh.exe
PID 2816 wrote to memory of 1632	2816	FiddlerSetup.exe	netsh.exe
PID 2816 wrote to memory of 1632	2816	FiddlerSetup.exe	netsh.exe
PID 2816 wrote to memory of 1632	2816	FiddlerSetup.exe	netsh.exe
PID 2816 wrote to memory of 2320	2816	FiddlerSetup.exe	ngen.exe
PID 2816 wrote to memory of 2320	2816	FiddlerSetup.exe	ngen.exe
PID 2816 wrote to memory of 2320	2816	FiddlerSetup.exe	ngen.exe
PID 2816 wrote to memory of 2320	2816	FiddlerSetup.exe	ngen.exe
PID 2816 wrote to memory of 1460	2816	FiddlerSetup.exe	ngen.exe
PID 2816 wrote to memory of 1460	2816	FiddlerSetup.exe	ngen.exe
PID 2816 wrote to memory of 1460	2816	FiddlerSetup.exe	ngen.exe
PID 2816 wrote to memory of 1460	2816	FiddlerSetup.exe	ngen.exe
PID 2816 wrote to memory of 820	2816	FiddlerSetup.exe	SetupHelper
PID 2816 wrote to memory of 820	2816	FiddlerSetup.exe	SetupHelper
PID 2816 wrote to memory of 820	2816	FiddlerSetup.exe	SetupHelper
PID 2816 wrote to memory of 820	2816	FiddlerSetup.exe	SetupHelper
PID 2816 wrote to memory of 2924	2816	FiddlerSetup.exe	iexplore.exe
PID 2816 wrote to memory of 2924	2816	FiddlerSetup.exe	iexplore.exe
PID 2816 wrote to memory of 2924	2816	FiddlerSetup.exe	iexplore.exe
PID 2816 wrote to memory of 2924	2816	FiddlerSetup.exe	iexplore.exe
PID 2924 wrote to memory of 632	2924	iexplore.exe	IEXPLORE.EXE
PID 2924 wrote to memory of 632	2924	iexplore.exe	IEXPLORE.EXE
PID 2924 wrote to memory of 632	2924	iexplore.exe	IEXPLORE.EXE
PID 2924 wrote to memory of 632	2924	iexplore.exe	IEXPLORE.EXE
PID 1784 wrote to memory of 1968	1784	Fiddler.exe	WerFault.exe
PID 1784 wrote to memory of 1968	1784	Fiddler.exe	WerFault.exe
PID 1784 wrote to memory of 1968	1784	Fiddler.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\FiddlerSetup.exe
"C:\Users\Admin\AppData\Local\Temp\FiddlerSetup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:240
- C:\Users\Admin\AppData\Local\Temp\nsd3988.tmp\FiddlerSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\nsd3988.tmp\FiddlerSetup.exe" /D=
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="FiddlerProxy"
    3⤵
    - Modifies Windows Firewall
    PID:2616
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="FiddlerProxy" program="C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe" action=allow profile=any dir=in edge=deferuser protocol=tcp description="Permit inbound connections to Fiddler"
    3⤵
    - Modifies Windows Firewall
    PID:1632
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
    3⤵
    PID:2320
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 104 -InterruptEvent 0 -NGENProcess f4 -Pipe 100 -Comment "NGen Worker Process"
      4⤵
      PID:1140
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 190 -InterruptEvent 0 -NGENProcess 184 -Pipe 18c -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      Loads dropped DLL
      PID:2984
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 15c -InterruptEvent 0 -NGENProcess f4 -Pipe 160 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      Loads dropped DLL
      PID:812
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 0 -NGENProcess 188 -Pipe 198 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      Loads dropped DLL
      PID:3032
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 188 -InterruptEvent 0 -NGENProcess 15c -Pipe 1ac -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      Loads dropped DLL
      PID:1168
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 168 -InterruptEvent 0 -NGENProcess 1a4 -Pipe 188 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      Loads dropped DLL
      PID:2928
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1b8 -Pipe 1b4 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      Loads dropped DLL
      PID:1588
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1a0 -InterruptEvent 0 -NGENProcess 104 -Pipe 19c -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      Loads dropped DLL
      PID:1596
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 0 -NGENProcess 104 -Pipe 1cc -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      PID:1884
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 104 -Pipe 1d0 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      PID:1612
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 0 -NGENProcess 1d8 -Pipe 1c4 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      PID:2964
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\EnableLoopback.exe"
    3⤵
    PID:1460
- - C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper
    "C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper" /a "C:\Users\Admin\AppData\Local\Programs\Fiddler"
    3⤵
    - Executes dropped EXE
    PID:820
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://fiddler2.com/r/?Fiddler2FirstRun
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:632

C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe
"C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1784 -s 3084
  2⤵
  PID:1968

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\USERS\ADMIN\APPDATA\LOCAL\PROGRAMS\FIDDLER\PLUGINS\NETWORKCONNECTIONS\TELERIK.NETWORKCONNECTIONS.WINDOWS.DLL

Filesize
33KB

MD5
5889357424d717c8629c8bfabcd0be50

SHA1
87e7047a40e24bd5ac23f89e072ee39a14a53023

SHA256
3564b25b24569b8d8a0128f2f4bddec89c0b8986da7542d9c64aac730360a600

SHA512
1af458742cefd4730d64b19ecc05460354f0e47a79cdcd7794877aa0f6c56cfb92f37a0daf66fedaec2a579eb0187d774b7d5ba1fff65d6ab1504df4c3668fad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
093cdc6c383b010e3a4ba6d6ee1ca046

SHA1
7b588049bfec2c0b071bda37dd9588e604257646

SHA256
e77c9d7a010feb1009ffbc865c9e3d3836edbe431138579fc9bdfccaa5a1e8e6

SHA512
e0746698c55253a747e3791edcd9c2be66b19251239d7ef38a24938c3407dbf03351630b995ddd7b9f30f7a684ec65730fd6ff25a7889c71e49d54f3606fa831

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c940415894f6b722d0cd40a9a0742fab

SHA1
0cf74c40beea3a53f3879f0475551fe3f27f7a3f

SHA256
00a51689ea262e99b61b152598d582818b9e23ea175c77516acdddbd6be93bcd

SHA512
d4103ef57b7ba081f29ce86a6582e4444413d986619cdde4e75b33817cc7eb38857d3aeb192d0ee02d007742b37659535b5b54839dbe312ce610d3b091d5d00d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f806cb6dfdaeec0199299c4d8d232990

SHA1
2611d8354b9f646aa27a2052ef381cfd56dd16a2

SHA256
cfcd36945a09a2d091aeea6ed1e8bcb0768130cf37be9e9b3e817c025dbd4f73

SHA512
7e07e18d85845b178ced0eb035b0239d8bf2a7dd9552fb0799025d1d3f5f589f593d5d3542b2ea06c3e8b963bd70dda4be1e23498cf61556a377bd2c02b14220

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b9a3fe50d571748dc2e5c08c165fdc6

SHA1
f4c20ee254a32ee582aa060fce8a389bc17b8986

SHA256
0fd609434cb75d98311f8a81d510da40e925f5490d99e2f9faeb2bc5173db4b0

SHA512
cfcb8a0b134ca34a65cabaa912da19943dc1b754086993be17a106a8f79c1f52e27caccac03ed382769d34e49a92520a33fdd77d83d828f3ce48f60381693f46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5a0f8ee7bcc4b357a3d6d0ba1b9fdfc

SHA1
4d11a978ea41d74599e23efa2848d428ef8380b5

SHA256
a33707db966681ce624c04e9c381b6803e8c1090057f816b2e032aa764b7403a

SHA512
890cb4a2bd182ecfd4978d97956b1d43282ffa01f60bd411c33af4b309273e03d67acd48a941625d043135e23c9c50b5f7d7725250200566893472a6dfc2ed75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
747813e5195ba6cf40ada200c2b20ade

SHA1
9e747796365e44d8413738ab1ca54d4d970bd3fd

SHA256
b9ad5aa122ebb0d49727baf2a45911e03cab2de791d6bd476e1d343ef526a635

SHA512
f3931fcc4a1d9b1ebdba2fa48fd229e1dcffe7fb279c784db44e170875696a89ffee9a85a019b58499588211cc60438724f3c7c01f3a31030e3c2dfe5263abb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bccd02800f00b3fb6239cd9fee3f7c39

SHA1
20f2729a1c97bbc57e59bd1419cc1867f3e101ae

SHA256
b5f492c8603123e929263c526e5a95b851f44973cb3827841bea027993a55ccd

SHA512
bce3ce69c704c34f91ece2ddcd8912c2c9a6079516a1882d46b00c7c03afa944b4ebdb7b58cacb4618aa8b7e8a38b0d139532457a239b2788736d8146980c07d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d90be9aa1df4e55be16e88b9ff5e49d6

SHA1
ccfc9615904f65ca9e2c28b2b779323e9ac07c73

SHA256
9a6382f81dcaed7833746ce7d55eb5e1343227998c50efe151d88f3d3bca2df0

SHA512
96c94fa2696b85bdca486812519218123e71cab2de15d3078209a9396772b2a72c5107767674584d6b56123c5d68bc09765a99ed655874499edad317a8cad261

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da12e86a787c2e6fd8e33b32f79dd741

SHA1
29e191d91ff20d20d75f339e45ad1328bcab444a

SHA256
3b26fccf90b4e63d5824927d07c39ee4ad64532b6dce98ef2f3701e118b80c19

SHA512
20855b7bc78a0ae969586fafca24d7ae3a2903991e5f706a93e01b71b19d65a5b4f2aa26cae7b1e606f6b600cc87898edfe082c73e689758b32777cf1d413625

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5160884cc69e32bff68fc2709993c81e

SHA1
58f38a556f60520f6064324d9edb208a8406a043

SHA256
827c8221af3e031fbf02c1c14a4b6a9a96f2bc7c6ba3f32506365ed587554d87

SHA512
69832bd8514e1b771b2a8f36a8bbbcd08e627c79b7bac43601bea37a1e7caa3ecb6590c0d3ef5cd53f5a36d07d5ca42a8f9fcb6dd9fe2f770f8ab048988fd899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1608a87e5c9319e8bff2f74c88903fd0

SHA1
2a285b91cb65dc01b3ded7a37179006af03c512f

SHA256
6fba529b933d2a6cf19784c4851aac08caa303ae26006e23655ed31e9a251d54

SHA512
d7b0b43a7faa9d5409addd082182129995905f65894809cfd2e239e0e28e955ea0170c5af77ef00a4619b97da7cd7059b36a6e90c4cb5cbef6510c7b98848734

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1608a87e5c9319e8bff2f74c88903fd0

SHA1
2a285b91cb65dc01b3ded7a37179006af03c512f

SHA256
6fba529b933d2a6cf19784c4851aac08caa303ae26006e23655ed31e9a251d54

SHA512
d7b0b43a7faa9d5409addd082182129995905f65894809cfd2e239e0e28e955ea0170c5af77ef00a4619b97da7cd7059b36a6e90c4cb5cbef6510c7b98848734

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3642023aa3a70f69c9d96ac2d560e44f

SHA1
849756d2616bf1ad27f5fdb61cf34f37607dea16

SHA256
82c9037edd1d2f6c0d02cf1ee93205e1632ae6df1288ef50b3a9c891ffde61cb

SHA512
eb5c351e0d0336df176d7a8ebef89b5716bb2e2b639df83d34e6e4a470f50235650bae5a7f94857f18b4ca333c575c49f490aad6f0c780bf70685f1aa8b40f68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3642023aa3a70f69c9d96ac2d560e44f

SHA1
849756d2616bf1ad27f5fdb61cf34f37607dea16

SHA256
82c9037edd1d2f6c0d02cf1ee93205e1632ae6df1288ef50b3a9c891ffde61cb

SHA512
eb5c351e0d0336df176d7a8ebef89b5716bb2e2b639df83d34e6e4a470f50235650bae5a7f94857f18b4ca333c575c49f490aad6f0c780bf70685f1aa8b40f68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3642023aa3a70f69c9d96ac2d560e44f

SHA1
849756d2616bf1ad27f5fdb61cf34f37607dea16

SHA256
82c9037edd1d2f6c0d02cf1ee93205e1632ae6df1288ef50b3a9c891ffde61cb

SHA512
eb5c351e0d0336df176d7a8ebef89b5716bb2e2b639df83d34e6e4a470f50235650bae5a7f94857f18b4ca333c575c49f490aad6f0c780bf70685f1aa8b40f68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e474ae0ae3ee48e3927d3e684736abf9

SHA1
12a9b0042dfa0f72141e496611e12dacc7297346

SHA256
5b6e24413001e3afb9dac14ff0fe1ed5d8243c23e8062ad1824ad3887827122c

SHA512
b9f1699b98cc0ca5e2f40c72d066f90a245787fce73620f6fbb6a5197234ec3b6cc4e2c013d09d3bf5709250eb9fd4acbeb636fabc22624d57e1c2f312044462

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ee1158f4a25201c142a6eeda3a17786

SHA1
28b683093cef5c6026ee94fc177b68cdc7822564

SHA256
6baa76a6b00c0dabb4b0ec2b9665bbc11e78b38c48a7729603a7158b022d19db

SHA512
1ab4ab4d425968c55634e4b8cb9438d4e198bd9ccfa19c5477ca252c3935308760f4a6a3e79d0e245d906d8475e8d4826db1bdc05f88b6b2bfd8b711b0b36256

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
442af9168c886a1ee2bc0f8c9303f832

SHA1
f1bed24180948ee8399769b18582d4f3158372ab

SHA256
6cf1c39db228f4f09889f27625910e4bc2d4072a7cf872c97fbd1405ffa864ef

SHA512
b2f4892736dde9388c0c496d8e0478b43039f841de6d9bed23b74b0d8801339aee58521f4c996e556202079276f47594513696d2af38538736ee841a92d56490

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a65b66cdda20acaca37c01f63abe76c

SHA1
1c0c9b090d7c1844c41a22b599cc878b4faf9d2b

SHA256
6ac3c0e85049563477d26edc614d9ffb8af9cca47547e39da645530a1a4a3775

SHA512
b792f5de3070681af15d484eec47fa63b942956dbd85bc1df19a99047f9b4ffc813d374a19e859ab90139600a70780b7775e493f595925a84740fdea17456fff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
136245d2b1c4f8ee51ffdba73321c504

SHA1
58563747d891bfd09d113e1ba123feb9a854c0cb

SHA256
1735885a065904f90ed27c1ad84df19ffb7036decf1c2d079a5eb4ae6e3d88c8

SHA512
a94d016db8df76a6501800985b968d57206cd7eb4eae28b5ae9d86569aa93afcc59537e2e4a60c67817cff85f05973087ac8f2550b7548fe2200b4a0fb1b04bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffd6ebcf7fd972ba3f89ccd94b81f374

SHA1
f2ec7fb88a9e8fb172d13935aff978dd011666bb

SHA256
b6f9edc09a18a3737ddd2e0ce65e8e451cbd9cb5b9de880b107cbb03388b68fe

SHA512
f31538c71871c8f6d634db256d7dc027cc896e96738e1aaee3d94e1f34b2f119cb4319eac2a79f82e407e6b0de98a720a500de42ffb7d978d689340ef6663bc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a445348ca318d10e1bc46b7bcd65ac3b

SHA1
50fcc0bf57b4fda465a7a6d6f2b373752a36b9bd

SHA256
68138631fce3f07800cadd0b38a10f3c84dc4b7d855a71ef56f4154f815c5eef

SHA512
50af58bd5a4ae110ea138373c580b9135d34c09df2a88469d25a96663a575e432b5128e26d9bb9649cba4c7d8a7eb82c11944668369c644d475c3d728bd05fd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ae497bfa7c6b9f4d4e37ff3f5bd4930

SHA1
3c567091745fc59b3fe360ec2dfbeeb32fff7905

SHA256
ef5d53b1c27b9e0a0b55f2e438735593f8228f4e3cddeb2fe2d8bda9cbc26515

SHA512
d03d849722a3cf0784848da642788a84bb32745c5ced673a43a4bd7bc8424cdecd4e4567c787505198ecbc2b60fb3e432e676d35e75245a4101a3d4a1f4a5613

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Analytics.dll

Filesize
32KB

MD5
1c2bd080b0e972a3ee1579895ea17b42

SHA1
a09454bc976b4af549a6347618f846d4c93b769b

SHA256
166e1a6cf86b254525a03d1510fe76da574f977c012064df39dd6f4af72a4b29

SHA512
946e56d543a6d00674d8fa17ecd9589cba3211cfa52c978e0c9dab0fa45cdfc7787245d14308f5692bd99d621c0caca3c546259fcfa725fff9171b144514b6e0

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\DotNetZip.dll

Filesize
449KB

MD5
11bbdf80d756b3a877af483195c60619

SHA1
99aca4f325d559487abc51b0d2ebd4dca62c9462

SHA256
698e4beeba26363e632cbbb833fc8000cf85ab5449627bf0edc8203f05a64fa1

SHA512
ad9c16481f95c0e7cf5158d4e921ca7534f580310270fa476e9ebd15d37eee2ab43e11c12d08846eae153f0b43fba89590d60ca00551f5096076d3cf6aa4ce29

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe

Filesize
1.5MB

MD5
a5b8c0f51898e9d55e4b3aa7904adf32

SHA1
5eaff276409670f3e8ce4cbb17086f1362d18868

SHA256
5e3006a575d4acce2e5e3cec684d7e9a1fbc3efbb73f06f5c4604faebf014ad3

SHA512
6abf01f09c8c6e430118de27322f4d67bf25018633544556630c47bfa9adc2c1fd186c94119a0b9be6c2d8dead9bbb46a8b1185fe02da2085601b0e9613ad427

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe

Filesize
1.5MB

MD5
a5b8c0f51898e9d55e4b3aa7904adf32

SHA1
5eaff276409670f3e8ce4cbb17086f1362d18868

SHA256
5e3006a575d4acce2e5e3cec684d7e9a1fbc3efbb73f06f5c4604faebf014ad3

SHA512
6abf01f09c8c6e430118de27322f4d67bf25018633544556630c47bfa9adc2c1fd186c94119a0b9be6c2d8dead9bbb46a8b1185fe02da2085601b0e9613ad427

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe.config

Filesize
252B

MD5
38a7379a4b36fc661c69a3e299373a05

SHA1
1b0de45ad7fe759499c57cc1aa9c1da441d9167a

SHA256
70107440ed3e5ce934b947a85669a963ed0370d1d34c27e8f3bd2a8f5f670342

SHA512
5c91d3ebae7a1d0fc068303632cdd7f789bfc3f5158c338d253ef0ba584bde2346e86287dd56f8dd266494ecf1307fb091e548b5cb795a80e5969f09f7507f02

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\GA.Analytics.Monitor.dll

Filesize
52KB

MD5
6f9e5c4b5662c7f8d1159edcba6e7429

SHA1
c7630476a50a953dab490931b99d2a5eca96f9f6

SHA256
e3261a13953f4bedec65957b58074c71d2e1b9926529d48c77cfb1e70ec68790

SHA512
78fd28a0b19a3dae1d0ae151ce09a42f7542de816222105d4dafe1c0932586b799b835e611ce39a9c9424e60786fbd2949cabac3f006d611078e85b345e148c8

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Inspectors\Standard.dll

Filesize
259KB

MD5
d1b161426b18ecbd0116674698ab8b71

SHA1
ade77acf4ac19ec9856196facc03fd186c292dca

SHA256
5f2e4703fe3c5e02b08929e33799a25140255d1e1331f3b221982be61d25b1cc

SHA512
a3fb79d95a70c10faa4ce1a4f90990fb37ce89ebf4172f254735fa984d7fa3abbbad9c2a8404ae3d54ccde227b8c32d8465c0112f488b3c1ecfd9f268c28afab

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Inspectors\SyntaxView.dll

Filesize
81KB

MD5
1ad12fecdc040667ca8dadc56c91071e

SHA1
ad2c289752bf2f9ca90a6364b199a51e24a67290

SHA256
1783ad978758fbf36f2d63394ca1e9f3cf2e65492346971dec600848899affec

SHA512
ca183434278ddbd5b3c601f966f4483ed969e6fd7c05ec21ab7a6cb50cfae7928ce92c731d3b7e15a0aaf41d615da4d142a0c9def904a5f77405de5ed10ce6eb

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Newtonsoft.Json.dll

Filesize
647KB

MD5
5afda7c7d4f7085e744c2e7599279db3

SHA1
3a833eb7c6be203f16799d7b7ccd8b8c9d439261

SHA256
f58c374ffcaae4e36d740d90fbf7fe70d0abb7328cd9af3a0a7b70803e994ba4

SHA512
7cbbbef742f56af80f1012d7da86fe5375ac05813045756fb45d0691c36ef13c069361457500ba4200157d5ee7922fd118bf4c0635e5192e3f8c6183fd580944

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Common.dll

Filesize
192KB

MD5
ac80e3ca5ec3ed77ef7f1a5648fd605a

SHA1
593077c0d921df0819d48b627d4a140967a6b9e0

SHA256
93b0f5d3a2a8a82da1368309c91286ee545b9ed9dc57ad1b31c229e2c11c00b5

SHA512
3ecc0fe3107370cb5ef5003b5317e4ea0d78bd122d662525ec4912dc30b8a1849c4fa2bbb76e6552b571f156d616456724aee6cd9495ae60a7cb4aaa6cf22159

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Editor.dll

Filesize
816KB

MD5
eaa268802c633f27fcfc90fd0f986e10

SHA1
21f3a19d6958bcfe9209df40c4fd8e7c4ce7a76f

SHA256
fe26c7e4723bf81124cdcfd5211b70f5e348250ae74b6c0abc326f1084ec3d54

SHA512
c0d6559fc482350c4ed5c5a9a0c0c58eec0a1371f5a254c20ae85521f5cec4c917596bc2ec538c665c3aa8e7ee7b2d3d322b3601d69b605914280ff38315bb47

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Syntax.dll

Filesize
228KB

MD5
3be64186e6e8ad19dc3559ee3c307070

SHA1
2f9e70e04189f6c736a3b9d0642f46208c60380a

SHA256
79a2c829de00e56d75eeb81cd97b04eae96bc41d6a2dbdc0ca4e7e0b454b1b7c

SHA512
7d0e657b3a1c23d13d1a7e7d1b95b4d9280cb08a0aca641feb9a89e6b8f0c8760499d63e240fe9c62022790a4822bf4fe2c9d9b19b12bd7f0451454be471ff78

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Addon.dll

Filesize
51KB

MD5
3cded1ca2097f4f6ce8ded0add3b3f22

SHA1
399f8596b2a282fba64accef4af4a89d914640dc

SHA256
4e0e01a7a2fad783dffb80ca199ee0407725a73d6d4222a5e9d528b9578e1288

SHA512
74eb04e25f6b7d0082d09c6ba0848cb1dcccc98515ecfea8a0427b9fb71652ce920cf1f058d0cf1a108608d54376b27bd08044b78bd7a6b066071a1645d5e598

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Connection.dll

Filesize
1.7MB

MD5
a5d3aea3abaf461b4ad2443573cc5509

SHA1
1431a3f5ff9c5182fa22c4445686b2dbb8026272

SHA256
f63f4e524e6c3868e1fe2e660b245da25b7159b60fc9092a4f32f90d5633c775

SHA512
1662fce42fd8573ac5083dd98fd33002f3cc2bce895a9d51c76e4830196968ed6171d30cc5e293b1a75a2a138244ca07347a0f43ad3504f14a1b9af500844363

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Protocol.dll

Filesize
23KB

MD5
04b7e5ebb82798a3a07eb8f4cd658228

SHA1
855fc43c08e7d2f568ae7e8a15f24ac7d8475fde

SHA256
449effe1d5f6f5dd5819811dddf233dc1b53a9a019a80db71706b80347584425

SHA512
fab03af027e5d25399dfa66de66054a643ee9a1161422a3072e8209ad66484384cd0b791373c609ff3daf60403b02bf0411c863b145b816aae8f6fe5dac181c1

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Utilities.dll

Filesize
19KB

MD5
620585edf86bd65b252d085cf65b52ce

SHA1
5a8f55d37d965f4d102a2c47303bf0adb139b3da

SHA256
51c4b44ddf79b3d5293180d2ea29e28200b1adc077129a5812a94fa6506ade71

SHA512
ee200183adf92680f7c5c1318510960952611deddafeba38c53aac6ec379fed75864a803441c815e4dd83bbb888ada3286075cc1c477fa2e9737d9f9e51a12b9

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Scripts\RulesTab2.dll

Filesize
47KB

MD5
016a2fdb7215123dab083d0b6f6311c0

SHA1
193148aa45d3bd946c92a73c7e226db2a8512771

SHA256
617c43dbce6afbbe08892b07fedb949dc3f39415d92bdc55955fd620b18f6b0d

SHA512
641ee4c4a10411d7708c2410f590d6ce0203c547145b45484241f99139e7049120b52faf2f08c57170ad6ed21b93dbe1382c4587e881f725fc18be8d76ac0ac9

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Scripts\SimpleFilter.dll

Filesize
147KB

MD5
90cdc635a1f1f8e6e1ee68918e0fb71a

SHA1
65699920fc6fc9488c1eb8acaf5022eaeafb6815

SHA256
afee7df6255757b3251721fca42e844753a617e0aa1ed43734e32e2fdae2c0af

SHA512
720635e0e24ca06b3c400f6da201f08d174e5bef230037eeae023ca87f608b1c353ca58de1a5c99a5f3057b039704ed5e68a9e5448183527653afcaedcfc58ab

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper

Filesize
31KB

MD5
45a29924b29cd5881da857104c5554fe

SHA1
75716bfcb46aa02adc1e74369ec60f1c27e309b9

SHA256
b31d4c6a86bad9eaffaa543476261aaa95705fffaaf367a6ab67133c6af5fcfe

SHA512
0ee65dc21bfb5be949a8d96f0d5c04dba70c83988ddf460e9ce18e32eeb27fcb350e85b1ed5951ec2b5b2ad6506fa117fbe5495eabf58756fc66111f52b1b631

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper

Filesize
31KB

MD5
45a29924b29cd5881da857104c5554fe

SHA1
75716bfcb46aa02adc1e74369ec60f1c27e309b9

SHA256
b31d4c6a86bad9eaffaa543476261aaa95705fffaaf367a6ab67133c6af5fcfe

SHA512
0ee65dc21bfb5be949a8d96f0d5c04dba70c83988ddf460e9ce18e32eeb27fcb350e85b1ed5951ec2b5b2ad6506fa117fbe5495eabf58756fc66111f52b1b631

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Telerik.NetworkConnections.dll

Filesize
34KB

MD5
798d6938ceab9271cdc532c0943e19dc

SHA1
5f86b4cd45d2f1ffae1153683ce50bc1fb0cd2e3

SHA256
fb90b6e76fdc617ec4ebf3544da668b1f6b06c1debdba369641c3950cab73dd2

SHA512
644fde362f032e6e479750696f62e535f3e712540840c4ca27e10bdfb79b2e5277c82a6d8f55f678e223e45f883776e7f39264c234bc6062fc1865af088c0c31

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6E8D.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6EB0.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd3988.tmp\FiddlerSetup.exe

Filesize
3.2MB

MD5
092879b4ec0b7a59be6273035da99e27

SHA1
282f2602469017d4d8401e84e248a6c138b7de97

SHA256
87d5fd5bfadffa31f6b72923be4d4a46335b3e32a4f6e306f90d04d4aed49c50

SHA512
dde4050f6a26dc0feecb7a7f2563f33db5615c15c0dd1f3e6bf8ff8aa3a4ced68a53ae66c179f56dda5a50185b5053460e63c5a0489b141d11372aacfcea4cf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd3988.tmp\FiddlerSetup.exe

Filesize
3.2MB

MD5
092879b4ec0b7a59be6273035da99e27

SHA1
282f2602469017d4d8401e84e248a6c138b7de97

SHA256
87d5fd5bfadffa31f6b72923be4d4a46335b3e32a4f6e306f90d04d4aed49c50

SHA512
dde4050f6a26dc0feecb7a7f2563f33db5615c15c0dd1f3e6bf8ff8aa3a4ced68a53ae66c179f56dda5a50185b5053460e63c5a0489b141d11372aacfcea4cf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd58EB.tmp\System.dll

Filesize
11KB

MD5
b8992e497d57001ddf100f9c397fcef5

SHA1
e26ddf101a2ec5027975d2909306457c6f61cfbd

SHA256
98bcd1dd88642f4dd36a300c76ebb1ddfbbbc5bfc7e3b6d7435dc6d6e030c13b

SHA512
8823b1904dccfaf031068102cb1def7958a057f49ff369f0e061f1b4db2090021aa620bb8442a2a6ac9355bb74ee54371dc2599c20dc723755a46ede81533a3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFE791BF841FAAF693.TMP

Filesize
16KB

MD5
29c867a61edb9e4419c5828f5eac1dc9

SHA1
d8ed93d512b1d5bf36c3a6775b6478b7d5a471b1

SHA256
7f5c3523e0597d97a5545e73e9199f7e054e4061e2a8e60353439c8f703bc9ab

SHA512
f3b3efdddbabbc3c355fbf61af10a2c0f078ea60812603d130161b079f46c344954356c00afd9c16cf32de3d5c574e4bb388b2ec8998c60c801fcbfef08c405b

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Analytics\d756563aa7cd4e9c00502605394ea611\Analytics.ni.dll

Filesize
148KB

MD5
4b962d3d8b3c91fa54e20ea48d09a990

SHA1
35468f050fb1b4a5e57a437b644d2c9e512f862f

SHA256
3e7dc77c58ae21758add41de81b649240e95707abcbd6d02fccdaa73449ab33f

SHA512
5ba87664ebadc3611523e69c9b26b6b9f4576240eb5c3a7e39a21a3a6f68f37142c9902fe4410f4e60593556d0e641a9ee82a37c1cb29e50d6247db2804ac3c5

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Analytics\d756563aa7cd4e9c00502605394ea611\Analytics.ni.dll.aux

Filesize
716B

MD5
e2aa93c8b2d019a4a99e1831c87ceb3e

SHA1
3c54f55e71cec879c88001eb5f4e7fceb6e973d2

SHA256
d73959ac896f5b7b4fe326bbc47f5df895b8baa494e2c18df54ec36d1acc4f64

SHA512
2fad965e98ea976c3c41e3d992bb6521bd1e1b00b205e629496d8cb4fd4357a134b02aeecae3a16ac10ef6abdf99f04c82b4b8a3aff9def942c4158136be1922

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Fiddler\9bceff61f42640de809b19116b58c90e\Fiddler.ni.exe

Filesize
4.7MB

MD5
2e5e7001ac04e3a5f7e5d9efec5a1ede

SHA1
42675c88e7c7a8707415ada873d63f1ff6c22323

SHA256
beceb37a23669c867bbeecf60ad36548b51a38e29712b0e3d01566c0a496b781

SHA512
2d16c47e81c08b3cac6fb611f78c6a42c0694b80cad89e41ef04d5f8ff90e6f7d2d718545848faaac556ca59e62c53e678fc4fe515f2705f5e0567751786fc7e

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Fiddler\9bceff61f42640de809b19116b58c90e\Fiddler.ni.exe.aux

Filesize
2KB

MD5
57f274426525f35e5a6817875092bc5d

SHA1
a420318b9643f97107d03f3f679125d2092d77c8

SHA256
1752721914347c7828fd46eaf3629576723fb75dec28b433fbfbe6b0eea623a0

SHA512
6cd14ae4d22f48f1422a579c8f3c62f5c5b5cf6d0288a6c687f5d500e4d2927865d23dd992f8121ee64e30ee7ea18263b194881a8c60114dd263a5284183779a

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B3325a29b#\4f44abb46807a5ad0f0bf1ae5ba48323\Microsoft.Build.Framework.ni.dll

Filesize
546KB

MD5
75de4db178e3310ebf8bfa83a003b8e2

SHA1
c0d05985fb9e28ede26b00143d939839cb0e3ae6

SHA256
304ae94177bcd5f8659eb5a232676c2a9857dc495c273fce2e2e65fab4ae4eb6

SHA512
4310161d72d60ef55a5ca6601bf4f5773518a9fcbeab4fda60afc18b334a1fbded3a5426795ed3587b5c51e2f6fc39176014a75e75aca2d3cfafc8a19d85b983

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B3325a29b#\4f44abb46807a5ad0f0bf1ae5ba48323\Microsoft.Build.Framework.ni.dll.aux

Filesize
588B

MD5
90dde7396bbc17dddaa7dcdec75c2d7b

SHA1
613a143997175a531af577c3e47611d006cd585c

SHA256
a3613a9ea1e995ce43a3754b3eab8f09325f039188593a4666bba0fa56dc5c03

SHA512
3cb619a3fe00d5cff37830e080a5db2e27d122293fb15f200a6bb59ad905d32bb99c720d36d1a8f6fcd89cad5c8e2610dbf89c09db28f7ec1974041d4b026c18

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Telerik.Net8bf66678#\e5f4977994d2fd10324efd51321f1c59\Telerik.NetworkConnections.ni.dll

Filesize
94KB

MD5
8c1196b2476c2ae2dee297e3db1cf37f

SHA1
27b4c6bc7876d7f52f34bffe2fb1f3cee88444ff

SHA256
f298ac1090234846c34b192f4683d34477f84f5eb8b844afedac9d4de246e104

SHA512
cd4bbe93c3a40035c65358ba714f39b8c6770aa44bdb87ed6dd23292f7a641c3da3977691fb1ecf83f1dbb6fe704edc6eeb817d1da48b4f2f9de62cf9c2ec591

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Telerik.Net8bf66678#\e5f4977994d2fd10324efd51321f1c59\Telerik.NetworkConnections.ni.dll.aux

Filesize
732B

MD5
a0840f8136af934e0cf1f69338052e77

SHA1
6abe284be1d0feb3229be6a45f339cc9a793d52a

SHA256
4795a676bb16ee383954be43925d2d7fe63cddf02c01a10789d4f89295a0bdd2

SHA512
d1571f2e6e132be92a55e2ce8cf13dcbfc4b3a4f0b270eebf7483f2e79f87984d41f65ea38343e95fa52798e7b19ae6eb9e0c13d0f8d31ca7a7f948719a23e29

Download Submit
\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe

Filesize
1.5MB

MD5
a5b8c0f51898e9d55e4b3aa7904adf32

SHA1
5eaff276409670f3e8ce4cbb17086f1362d18868

SHA256
5e3006a575d4acce2e5e3cec684d7e9a1fbc3efbb73f06f5c4604faebf014ad3

SHA512
6abf01f09c8c6e430118de27322f4d67bf25018633544556630c47bfa9adc2c1fd186c94119a0b9be6c2d8dead9bbb46a8b1185fe02da2085601b0e9613ad427

Download Submit
\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\FSE2.exe

Filesize
50KB

MD5
44f37783cd2889a9eb8232c263339e68

SHA1
cd186e0bc8ecb3e063e68d5923bd5e7b165e3532

SHA256
d43b4fa2b5b61429905f707959657430fc67a2a23351757b09af15c680e6efbf

SHA512
65880a8ee81a67e866babc71988f6af31084e690b6e172cfb14c51315accef92a26a73cedac9846ba4348a01b328400d942131b5704a8f91f7c804ae1100d2fd

Download Submit
\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper

Filesize
31KB

MD5
45a29924b29cd5881da857104c5554fe

SHA1
75716bfcb46aa02adc1e74369ec60f1c27e309b9

SHA256
b31d4c6a86bad9eaffaa543476261aaa95705fffaaf367a6ab67133c6af5fcfe

SHA512
0ee65dc21bfb5be949a8d96f0d5c04dba70c83988ddf460e9ce18e32eeb27fcb350e85b1ed5951ec2b5b2ad6506fa117fbe5495eabf58756fc66111f52b1b631

Download Submit
\Users\Admin\AppData\Local\Temp\nsd3988.tmp\FiddlerSetup.exe

Filesize
3.2MB

MD5
092879b4ec0b7a59be6273035da99e27

SHA1
282f2602469017d4d8401e84e248a6c138b7de97

SHA256
87d5fd5bfadffa31f6b72923be4d4a46335b3e32a4f6e306f90d04d4aed49c50

SHA512
dde4050f6a26dc0feecb7a7f2563f33db5615c15c0dd1f3e6bf8ff8aa3a4ced68a53ae66c179f56dda5a50185b5053460e63c5a0489b141d11372aacfcea4cf9

Download Submit
\Users\Admin\AppData\Local\Temp\nsd58EB.tmp\System.dll

Filesize
11KB

MD5
b8992e497d57001ddf100f9c397fcef5

SHA1
e26ddf101a2ec5027975d2909306457c6f61cfbd

SHA256
98bcd1dd88642f4dd36a300c76ebb1ddfbbbc5bfc7e3b6d7435dc6d6e030c13b

SHA512
8823b1904dccfaf031068102cb1def7958a057f49ff369f0e061f1b4db2090021aa620bb8442a2a6ac9355bb74ee54371dc2599c20dc723755a46ede81533a3c

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Analytics\d756563aa7cd4e9c00502605394ea611\Analytics.ni.dll

Filesize
148KB

MD5
4b962d3d8b3c91fa54e20ea48d09a990

SHA1
35468f050fb1b4a5e57a437b644d2c9e512f862f

SHA256
3e7dc77c58ae21758add41de81b649240e95707abcbd6d02fccdaa73449ab33f

SHA512
5ba87664ebadc3611523e69c9b26b6b9f4576240eb5c3a7e39a21a3a6f68f37142c9902fe4410f4e60593556d0e641a9ee82a37c1cb29e50d6247db2804ac3c5

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Analytics\d756563aa7cd4e9c00502605394ea611\Analytics.ni.dll

Filesize
148KB

MD5
4b962d3d8b3c91fa54e20ea48d09a990

SHA1
35468f050fb1b4a5e57a437b644d2c9e512f862f

SHA256
3e7dc77c58ae21758add41de81b649240e95707abcbd6d02fccdaa73449ab33f

SHA512
5ba87664ebadc3611523e69c9b26b6b9f4576240eb5c3a7e39a21a3a6f68f37142c9902fe4410f4e60593556d0e641a9ee82a37c1cb29e50d6247db2804ac3c5

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\DotNetZip\330381c0d4a4a49e56426709e084cc48\DotNetZip.ni.dll

Filesize
1013KB

MD5
75466b5e53a262f579d58042eb0c6fa5

SHA1
aba87382496d180a3e71c3626b617bb65308d358

SHA256
dd470f06556af0b809868b8ddcf6db70833d41fb1b7d2086de7ecde34e3085fe

SHA512
efe4fc459cdf8148792f0d43da4b5e6e5ef86f6f2ba2fde868ae6b4ad72f58ed8af6e134de72d754f5916e3570e7d1f205633321605c4f939453537cbd538bb9

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Fiddler\9bceff61f42640de809b19116b58c90e\Fiddler.ni.exe

Filesize
4.7MB

MD5
2e5e7001ac04e3a5f7e5d9efec5a1ede

SHA1
42675c88e7c7a8707415ada873d63f1ff6c22323

SHA256
beceb37a23669c867bbeecf60ad36548b51a38e29712b0e3d01566c0a496b781

SHA512
2d16c47e81c08b3cac6fb611f78c6a42c0694b80cad89e41ef04d5f8ff90e6f7d2d718545848faaac556ca59e62c53e678fc4fe515f2705f5e0567751786fc7e

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Fiddler\9bceff61f42640de809b19116b58c90e\Fiddler.ni.exe

Filesize
4.7MB

MD5
2e5e7001ac04e3a5f7e5d9efec5a1ede

SHA1
42675c88e7c7a8707415ada873d63f1ff6c22323

SHA256
beceb37a23669c867bbeecf60ad36548b51a38e29712b0e3d01566c0a496b781

SHA512
2d16c47e81c08b3cac6fb611f78c6a42c0694b80cad89e41ef04d5f8ff90e6f7d2d718545848faaac556ca59e62c53e678fc4fe515f2705f5e0567751786fc7e

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\GA.Analytics.Monitor\3bf155f5fe5c3c876614c4d82313933c\GA.Analytics.Monitor.ni.dll

Filesize
158KB

MD5
188e0e27618fc054e447005da14b39e6

SHA1
fa53f294d3f2d484b513f17ca5d21b33a52e2500

SHA256
7602634749732ab0411aebe3b5789b736c8e68d07688dd22d83f29b6e86675c9

SHA512
717e160dec70f5d647e6152ed1ce8ed1e4d64118cd68ffaa091264d8a7b947175261552a9171ebf4ddc7fe0096608a9a4f5d1b24857d1c8eb5d750b2e085670c

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B3325a29b#\4f44abb46807a5ad0f0bf1ae5ba48323\Microsoft.Build.Framework.ni.dll

Filesize
546KB

MD5
75de4db178e3310ebf8bfa83a003b8e2

SHA1
c0d05985fb9e28ede26b00143d939839cb0e3ae6

SHA256
304ae94177bcd5f8659eb5a232676c2a9857dc495c273fce2e2e65fab4ae4eb6

SHA512
4310161d72d60ef55a5ca6601bf4f5773518a9fcbeab4fda60afc18b334a1fbded3a5426795ed3587b5c51e2f6fc39176014a75e75aca2d3cfafc8a19d85b983

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B3325a29b#\4f44abb46807a5ad0f0bf1ae5ba48323\Microsoft.Build.Framework.ni.dll

Filesize
546KB

MD5
75de4db178e3310ebf8bfa83a003b8e2

SHA1
c0d05985fb9e28ede26b00143d939839cb0e3ae6

SHA256
304ae94177bcd5f8659eb5a232676c2a9857dc495c273fce2e2e65fab4ae4eb6

SHA512
4310161d72d60ef55a5ca6601bf4f5773518a9fcbeab4fda60afc18b334a1fbded3a5426795ed3587b5c51e2f6fc39176014a75e75aca2d3cfafc8a19d85b983

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B83e9cb53#\4a58f2013ffa484c7f872e70952613ca\Microsoft.Build.Utilities.v4.0.ni.dll

Filesize
1011KB

MD5
6d7e1bc098c599dc54b552531ed637ac

SHA1
ff4648a4ce473a3cbe6e3c75e1c606d593353de1

SHA256
874ece1c76a575a96e174eb846edcbeb6134ee66e71bfd025a250a7406627ef5

SHA512
1e88c80b969c0ac44e880316189ce3789f2fb0d8044e39c90ef99edfe4de83f7c21dc21adf4c51f6d88f77b92035b519794ed91d9d04c74cef971aa3424ce04a

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Baa2ca56b#\faa890702be0a0b8574aa82cb24b9da3\Microsoft.Build.Tasks.v4.0.ni.dll

Filesize
4.1MB

MD5
07de6b9bdeebae49461ef58e29953464

SHA1
5ba78e69c3d93724c6a3de013157b9350bcd6eb9

SHA256
85da41cc1f1beac3528bab39240912ecb8ac7fb313a89342e3fffd9cf0a99c74

SHA512
1b10add9a8cab2913299a03da26ad4fcb84826ff33c847d53078d18e3459b4c07a3b0ee52b67d9fe2f5b90ae7f98da502369159c2edc3e81fa569242184ab0b4

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\2145e325c531dd03775cc61606722965\Microsoft.JScript.ni.dll

Filesize
2.7MB

MD5
d1d5dd7761a0e2c31c2baeeb4442a6ba

SHA1
c681dca866baa02e7840bffdbcff349da69ba25c

SHA256
84676accc10df0f610772b5d447b058a9fd3c4d399cddc01ef6510d9832915f1

SHA512
59891b98e42635c056debe5fdd373b3d31ef1731c653c7df179c0db8544c6bfc6e4899d62a3068b76a652e71899b285e1757260ccaa805658e1e77e00cb9b263

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Newtonsoft.Json\1ebe746ea3a361d99ffc6ea2e12b5a66\Newtonsoft.Json.ni.dll

Filesize
3.7MB

MD5
03eabadb3e9fe0a8566ce36fde2ed959

SHA1
c0da077a84d61426c6de7d27b5bd3d5beb034352

SHA256
2467069bdc725532c792ab7f026bbafbbdbbd311d5ba83c502cc35a044b90860

SHA512
b60a5ac1f0b062ba3319ba93171f2d150a536fa4ce37bc7061a76949ca98c5ee08dc342f232bf47b36753c4046c23828fea8560b083778f175d5303906c9bc82

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Telerik.Net8bf66678#\e5f4977994d2fd10324efd51321f1c59\Telerik.NetworkConnections.ni.dll

Filesize
94KB

MD5
8c1196b2476c2ae2dee297e3db1cf37f

SHA1
27b4c6bc7876d7f52f34bffe2fb1f3cee88444ff

SHA256
f298ac1090234846c34b192f4683d34477f84f5eb8b844afedac9d4de246e104

SHA512
cd4bbe93c3a40035c65358ba714f39b8c6770aa44bdb87ed6dd23292f7a641c3da3977691fb1ecf83f1dbb6fe704edc6eeb817d1da48b4f2f9de62cf9c2ec591

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Telerik.Net8bf66678#\e5f4977994d2fd10324efd51321f1c59\Telerik.NetworkConnections.ni.dll

Filesize
94KB

MD5
8c1196b2476c2ae2dee297e3db1cf37f

SHA1
27b4c6bc7876d7f52f34bffe2fb1f3cee88444ff

SHA256
f298ac1090234846c34b192f4683d34477f84f5eb8b844afedac9d4de246e104

SHA512
cd4bbe93c3a40035c65358ba714f39b8c6770aa44bdb87ed6dd23292f7a641c3da3977691fb1ecf83f1dbb6fe704edc6eeb817d1da48b4f2f9de62cf9c2ec591

Download Submit
memory/812-281-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/812-249-0x000000001B030000-0x000000001B0EA000-memory.dmp

Filesize
744KB

Download
memory/812-409-0x000006443CC40000-0x000006443CEEC000-memory.dmp

Filesize
2.7MB

Download
memory/812-424-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/820-114-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/820-108-0x00000000009E0000-0x00000000009E8000-memory.dmp

Filesize
32KB

Download
memory/820-112-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/1140-205-0x0000000000540000-0x000000000054C000-memory.dmp

Filesize
48KB

Download
memory/1140-211-0x0000000000850000-0x000000000086A000-memory.dmp

Filesize
104KB

Download
memory/1140-199-0x00000000027F0000-0x00000000028AA000-memory.dmp

Filesize
744KB

Download
memory/1140-201-0x0000000002050000-0x00000000020C6000-memory.dmp

Filesize
472KB

Download
memory/1140-203-0x0000000000530000-0x000000000053C000-memory.dmp

Filesize
48KB

Download
memory/1140-210-0x00000000006E0000-0x0000000000724000-memory.dmp

Filesize
272KB

Download
memory/1140-220-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/1140-110-0x000000001B340000-0x000000001B4BE000-memory.dmp

Filesize
1.5MB

Download
memory/1140-209-0x0000000000550000-0x0000000000560000-memory.dmp

Filesize
64KB

Download
memory/1140-113-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/1140-207-0x0000000002D40000-0x0000000002DE8000-memory.dmp

Filesize
672KB

Download
memory/1140-212-0x000000001B1C0000-0x000000001B2E2000-memory.dmp

Filesize
1.1MB

Download
memory/1168-461-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/1168-442-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/1168-443-0x00000644A0000000-0x00000644A001A000-memory.dmp

Filesize
104KB

Download
memory/1588-881-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/1588-511-0x00000000021A0000-0x0000000002248000-memory.dmp

Filesize
672KB

Download
memory/1588-532-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/1588-769-0x00000644A0000000-0x00000644A03AA000-memory.dmp

Filesize
3.7MB

Download
memory/1596-917-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/1596-494-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/1596-514-0x00000644A0000000-0x00000644A002A000-memory.dmp

Filesize
168KB

Download
memory/1596-495-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/1596-1163-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/1612-1165-0x0000064438000000-0x000006443808B000-memory.dmp

Filesize
556KB

Download
memory/1612-1393-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/1612-1164-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/1784-1448-0x0000000000600000-0x0000000000610000-memory.dmp

Filesize
64KB

Download
memory/1784-1460-0x0000000001030000-0x00000000010B0000-memory.dmp

Filesize
512KB

Download
memory/1784-1462-0x000000001B5C0000-0x000000001B602000-memory.dmp

Filesize
264KB

Download
memory/1784-1431-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmp

Filesize
9.9MB

Download
memory/1784-1432-0x00000000011D0000-0x000000000134E000-memory.dmp

Filesize
1.5MB

Download
memory/1784-1459-0x00000000002B0000-0x00000000002BC000-memory.dmp

Filesize
48KB

Download
memory/1784-1434-0x0000000000230000-0x00000000002A6000-memory.dmp

Filesize
472KB

Download
memory/1784-1436-0x00000000002C0000-0x00000000002CC000-memory.dmp

Filesize
48KB

Download
memory/1784-1437-0x0000000000C00000-0x0000000000CA8000-memory.dmp

Filesize
672KB

Download
memory/1784-1435-0x00000000002B0000-0x00000000002BC000-memory.dmp

Filesize
48KB

Download
memory/1784-1458-0x00000000002B0000-0x00000000002BC000-memory.dmp

Filesize
48KB

Download
memory/1784-1453-0x0000000001030000-0x00000000010B0000-memory.dmp

Filesize
512KB

Download
memory/1784-1452-0x0000000001030000-0x00000000010B0000-memory.dmp

Filesize
512KB

Download
memory/1784-1445-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmp

Filesize
9.9MB

Download
memory/1784-1446-0x0000000001030000-0x00000000010B0000-memory.dmp

Filesize
512KB

Download
memory/1784-1451-0x0000000001030000-0x00000000010B0000-memory.dmp

Filesize
512KB

Download
memory/1884-1160-0x0000000001ED0000-0x0000000001EEA000-memory.dmp

Filesize
104KB

Download
memory/1884-916-0x0000000001E80000-0x0000000001EC4000-memory.dmp

Filesize
272KB

Download
memory/1884-925-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/1884-1413-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/2928-474-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/2928-493-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/2928-475-0x00000644A0000000-0x00000644A0029000-memory.dmp

Filesize
164KB

Download
memory/2928-473-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/2964-1429-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/2964-1401-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/2964-1400-0x000000001AF30000-0x000000001B052000-memory.dmp

Filesize
1.1MB

Download
memory/2984-458-0x0000064488000000-0x00000644884AF000-memory.dmp

Filesize
4.7MB

Download
memory/2984-258-0x0000000002750000-0x00000000027C6000-memory.dmp

Filesize
472KB

Download
memory/2984-470-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/2984-296-0x0000000000280000-0x000000000028C000-memory.dmp

Filesize
48KB

Download
memory/2984-299-0x0000000002E00000-0x0000000002EA8000-memory.dmp

Filesize
672KB

Download
memory/2984-239-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/2984-297-0x0000000000290000-0x000000000029C000-memory.dmp

Filesize
48KB

Download
memory/2984-490-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/3032-425-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/3032-441-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/3032-426-0x00000644A0000000-0x00000644A0100000-memory.dmp

Filesize
1024KB

Download