06812518a722af6f98fbd8c3a5ace0cad1c6d53477972618728e64bafcbc948c

Analysis

max time kernel
118s
max time network
143s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FiddlerSetup.5.0.20242.10753-latest.exe
Size

4.4MB
MD5

78537045a5e032d4ac93514f027c7a47
SHA1

5b6e705b20652c0cf39ee890013b9b8e8ad26b07
SHA256

06812518a722af6f98fbd8c3a5ace0cad1c6d53477972618728e64bafcbc948c
SHA512

8fee84a791ae85175b7d61b54c66fc47abd4e231b7194779d2213f94c388b23e3f8e0408a1f29856b2a0404d824f17858f6b0676f6a1656428424665658c4a47
SSDEEP

98304:pNB6cDqnTgnRkidZ7C0eNGyJW3lE4RrtRmrpIZhGuul38YR7O8sOKduG8xOvC:pNRdnRkgCNGyJ/IJYR7vsOKwGYO

Score

9^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2564	netsh.exe
2072	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
2888	FiddlerSetup.exe
2300	SetupHelper

Loads dropped DLL 17 IoCs

pid	Process
2820	FiddlerSetup.5.0.20242.10753-latest.exe
2888	FiddlerSetup.exe
2888	FiddlerSetup.exe
2888	FiddlerSetup.exe
2888	FiddlerSetup.exe
1772	mscorsvw.exe
1592	mscorsvw.exe
2976	mscorsvw.exe
2780	mscorsvw.exe
2780	mscorsvw.exe
2548	mscorsvw.exe
2780	mscorsvw.exe
1736	mscorsvw.exe
2300	mscorsvw.exe
1956	mscorsvw.exe
1096	mscorsvw.exe
2492	mscorsvw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\temp\W0CD9FJL2K\Microsoft.JScript.ni.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\6c8-0\DotNetZip.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\8fc-0\Telerik.NetworkConnections.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\RQYF4YHZE1\Newtonsoft.Json.ni.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\QI8HSNM5YW\Analytics.ni.dll.aux	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Telerik.Net8bf66678#\e5f4977994d2fd10324efd51321f1c59\Telerik.NetworkConnections.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\7a4-0\Newtonsoft.Json.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\F1065MJF66\GA.Analytics.Monitor.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\FS95JZ1MSC\Telerik.NetworkConnections.ni.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\2145e325c531dd03775cc61606722965\Microsoft.JScript.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\GA.Analytics.Monitor\3bf155f5fe5c3c876614c4d82313933c\GA.Analytics.Monitor.ni.dll.aux.tmp	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\F1065MJF66\GA.Analytics.Monitor.ni.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\9bc-0\GA.Analytics.Monitor.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\QRNCRIUWT2\Microsoft.Build.Tasks.v4.0.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\W0CD9FJL2K\Microsoft.JScript.ni.dll.aux	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Analytics\d756563aa7cd4e9c00502605394ea611\Analytics.ni.dll.aux.tmp	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\RQYF4YHZE1\Newtonsoft.Json.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\DIEN73UFQQ\Microsoft.Build.Framework.ni.dll.aux	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\DotNetZip\330381c0d4a4a49e56426709e084cc48\DotNetZip.ni.dll.aux.tmp	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\QI8HSNM5YW\Analytics.ni.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\KDBPYDHIO7\DotNetZip.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\DIEN73UFQQ\Microsoft.Build.Framework.ni.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\IJGU43KZUH\Microsoft.Build.Utilities.v4.0.ni.dll.aux	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Newtonsoft.Json\1ebe746ea3a361d99ffc6ea2e12b5a66\Newtonsoft.Json.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\448-0\Analytics.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\FS95JZ1MSC\Telerik.NetworkConnections.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\KDBPYDHIO7\DotNetZip.ni.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\QRNCRIUWT2\Microsoft.Build.Tasks.v4.0.ni.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\IJGU43KZUH\Microsoft.Build.Utilities.v4.0.ni.dll	mscorsvw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupHelper
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FiddlerSetup.5.0.20242.10753-latest.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FiddlerSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Fiddler.exe = "9999"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b099c60afc1adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	FiddlerSetup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b9600000000020000000000106600000001000020000000a259c3c477e16b14e94870dd3aa12024839033498f987814d02735742149c423000000000e8000000002000020000000726555a5ab1b52980eea20bbb4c3a70cc4a87f399d8dbbf7c6b841780420e36420000000d86006c49d1432f2f15ebdacf42261f77679d4ab535155206c70956688faa217400000009834ae9407b671118a1d23b951ed8c8d4fa8c8413ac6568c16f594c60eb035e6b15c46399fdc19e0e6766de8632f332d4a691755a47b8ece708c2244d12fe4c1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F5A8D41-86EF-11EF-BA1B-C670A0C1054F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Fiddler.exe = "0"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\MAIN	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b960000000002000000000010660000000100002000000098e23e462bd1a47f366d198f4da6f8dcda221e5e9afa551f280963cbb928b8a7000000000e8000000002000020000000b3067074b0e4aa8ffc606bd1fb53cc29e50432266aae2c2cbbe40aedb96368e59000000040ab1cfa8785543c45a6545a843974bda65d87de5e3d976b9f92692d433423334665283a822c1a427757ee89f465a74d538d555bbbbc7efa67bed157381235d4a8d230fd5acc5d1773b9c98e2559b2e4d45932aedc155a2f3f39b885854fb6ab236b2ed95a2700f1d9cbb5bb656679ded003dcf441246d7ddf39d246c6eb7f4e4e0566f2116466d628d298954176304f40000000f02047e4f6d36546dde02e65ce2ab15103a0961dba1261fedeeb8fc18079626932e7007e02849edc75d4451c46bda58797321a02d5b70f8e2ccc5cbc60a17da2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434716600"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Fiddler.ArchiveZip	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.saz\ = "Fiddler.ArchiveZip"	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Fiddler.ArchiveZip\Content Type = "application/vnd.telerik-fiddler.SessionArchive"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Fiddler.ArchiveZip\DefaultIcon	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe\" -noattach \"%1\""	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open &in Viewer\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe\" -viewer \"%1\""	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.saz	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Fiddler.ArchiveZip\PerceivedType = "compressed"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Fiddler.ArchiveZip\Shell	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open &in Viewer\command	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Fiddler.ArchiveZip\ = "Fiddler Session Archive"	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Fiddler.ArchiveZip\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\SAZ.ico"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open\command	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open &in Viewer	FiddlerSetup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2000	iexplore.exe
2000	iexplore.exe
1820	IEXPLORE.EXE
1820	IEXPLORE.EXE
1820	IEXPLORE.EXE
1820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2888	2820	FiddlerSetup.5.0.20242.10753-latest.exe	30
PID 2820 wrote to memory of 2888	2820	FiddlerSetup.5.0.20242.10753-latest.exe	30
PID 2820 wrote to memory of 2888	2820	FiddlerSetup.5.0.20242.10753-latest.exe	30
PID 2820 wrote to memory of 2888	2820	FiddlerSetup.5.0.20242.10753-latest.exe	30
PID 2820 wrote to memory of 2888	2820	FiddlerSetup.5.0.20242.10753-latest.exe	30
PID 2820 wrote to memory of 2888	2820	FiddlerSetup.5.0.20242.10753-latest.exe	30
PID 2820 wrote to memory of 2888	2820	FiddlerSetup.5.0.20242.10753-latest.exe	30
PID 2888 wrote to memory of 2564	2888	FiddlerSetup.exe	31
PID 2888 wrote to memory of 2564	2888	FiddlerSetup.exe	31
PID 2888 wrote to memory of 2564	2888	FiddlerSetup.exe	31
PID 2888 wrote to memory of 2564	2888	FiddlerSetup.exe	31
PID 2888 wrote to memory of 2072	2888	FiddlerSetup.exe	32
PID 2888 wrote to memory of 2072	2888	FiddlerSetup.exe	32
PID 2888 wrote to memory of 2072	2888	FiddlerSetup.exe	32
PID 2888 wrote to memory of 2072	2888	FiddlerSetup.exe	32
PID 2888 wrote to memory of 3020	2888	FiddlerSetup.exe	34
PID 2888 wrote to memory of 3020	2888	FiddlerSetup.exe	34
PID 2888 wrote to memory of 3020	2888	FiddlerSetup.exe	34
PID 2888 wrote to memory of 3020	2888	FiddlerSetup.exe	34
PID 2888 wrote to memory of 3024	2888	FiddlerSetup.exe	37
PID 2888 wrote to memory of 3024	2888	FiddlerSetup.exe	37
PID 2888 wrote to memory of 3024	2888	FiddlerSetup.exe	37
PID 2888 wrote to memory of 3024	2888	FiddlerSetup.exe	37
PID 2888 wrote to memory of 2300	2888	FiddlerSetup.exe	39
PID 2888 wrote to memory of 2300	2888	FiddlerSetup.exe	39
PID 2888 wrote to memory of 2300	2888	FiddlerSetup.exe	39
PID 2888 wrote to memory of 2300	2888	FiddlerSetup.exe	39
PID 2888 wrote to memory of 2300	2888	FiddlerSetup.exe	39
PID 2888 wrote to memory of 2300	2888	FiddlerSetup.exe	39
PID 2888 wrote to memory of 2300	2888	FiddlerSetup.exe	39
PID 2888 wrote to memory of 2000	2888	FiddlerSetup.exe	42
PID 2888 wrote to memory of 2000	2888	FiddlerSetup.exe	42
PID 2888 wrote to memory of 2000	2888	FiddlerSetup.exe	42
PID 2888 wrote to memory of 2000	2888	FiddlerSetup.exe	42
PID 2000 wrote to memory of 1820	2000	iexplore.exe	43
PID 2000 wrote to memory of 1820	2000	iexplore.exe	43
PID 2000 wrote to memory of 1820	2000	iexplore.exe	43
PID 2000 wrote to memory of 1820	2000	iexplore.exe	43

C:\Users\Admin\AppData\Local\Temp\FiddlerSetup.5.0.20242.10753-latest.exe
"C:\Users\Admin\AppData\Local\Temp\FiddlerSetup.5.0.20242.10753-latest.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Users\Admin\AppData\Local\Temp\nsy61A1.tmp\FiddlerSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\nsy61A1.tmp\FiddlerSetup.exe" /D=
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="FiddlerProxy"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2564
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="FiddlerProxy" program="C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe" action=allow profile=any dir=in edge=deferuser protocol=tcp description="Permit inbound connections to Fiddler"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2072
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
    3⤵
    PID:3020
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 104 -InterruptEvent 0 -NGENProcess f4 -Pipe 100 -Comment "NGen Worker Process"
      4⤵
      PID:2076
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 168 -InterruptEvent 0 -NGENProcess 160 -Pipe 164 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      PID:1772
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 18c -InterruptEvent 0 -NGENProcess 17c -Pipe 184 -Comment "NGen Worker Process"
      4⤵
      PID:2120
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 0 -NGENProcess 194 -Pipe 18c -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      PID:1592
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 0 -NGENProcess 188 -Pipe 1bc -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      PID:2976
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 0 -NGENProcess 1a0 -Pipe 1c0 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      PID:2780
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1a4 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1c4 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      PID:2548
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1a8 -InterruptEvent 0 -NGENProcess 1b4 -Pipe 194 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      PID:1736
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b4 -InterruptEvent 0 -NGENProcess 17c -Pipe 1a8 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      PID:2300
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b4 -InterruptEvent 0 -NGENProcess 1d0 -Pipe 1c8 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      PID:1956
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b4 -InterruptEvent 0 -NGENProcess 188 -Pipe 1d4 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      PID:1096
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b4 -InterruptEvent 0 -NGENProcess 1ac -Pipe 1d8 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      PID:2492
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 0 -NGENProcess 1ac -Pipe 1b0 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:2396
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1a0 -InterruptEvent 0 -NGENProcess 1dc -Pipe 1d0 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:1688
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 0 -NGENProcess 1a0 -Pipe 1a4 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:2848
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 17c -InterruptEvent 0 -NGENProcess 1e4 -Pipe 1ec -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:2792
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1a0 -InterruptEvent 0 -NGENProcess 17c -Pipe 1ac -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:2924
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b4 -InterruptEvent 0 -NGENProcess 1a0 -Pipe 1cc -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:2628
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 0 -NGENProcess 1b4 -Pipe 1e0 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:1484
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 0 -NGENProcess 1f0 -Pipe 1e4 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:1036
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f8 -InterruptEvent 0 -NGENProcess 1f4 -Pipe 17c -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:2604
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\EnableLoopback.exe"
    3⤵
    PID:3024
- - C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper
    "C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper" /a "C:\Users\Admin\AppData\Local\Programs\Fiddler"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2300
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://fiddler2.com/r/?Fiddler2FirstRun
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c771e308dc498d61a68c5968cbef1d8

SHA1
aa3de009d5b6b1d1ff9ccee2cda049fa7ce7c7b1

SHA256
d777725bf05b950dbfdb491165c7acd837b89d12014686699b6e63fc0645083f

SHA512
6e636d8e4511dd4337e7b72a6bf0f12aa305eebf3215f3af774afc89daa27de84a06b50850b631ec400b4b7ade055fbf38d3ac5854d2f7a80675d95eec0180fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30e0d8b3f527f064a47147e8975b4352

SHA1
9d79af3d95aa51b173689312484aa42bc0d8d7f0

SHA256
8b7d36e9e67e027b24b8da7b8611133f6d1ca9b70df249d99de529dbf5e88dde

SHA512
a41d402b9c6a8eba107996e1b603c203fbd37758c642dd7c3a98e083c6fdf7e21dc629f94ce2bbc0885f2215f04cd7088cee5fc25786c16005282fe52a7bdf65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
873a8118dbe6f571655fb3262dda5b1b

SHA1
4ca8afcadcd95834da120e4aeb185343077998f9

SHA256
6b675a6f219e5dc47e3282a4aa31c499d807fdefd92eab2c143859ec44c3277c

SHA512
c264fd0d6e291a01b1ea365a84f78b40b98637f43950fd05c2d01c8bee31449012ad63d69262e2baeedaf2a50ac0d9cdec00a715d9e126231a047bbd9c22c590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7679d191928aa567f5eafbdf3f6b7e29

SHA1
08c66621e90a3f0532eaa3c604e9d2b39c6bf6be

SHA256
8b9fac551a48c3bbe0d078e5d094a8ef6f7cd84e1821d88a22176649a25496ea

SHA512
bd233d8844bcf4ae124177210be2cbfb2affe47746ad037a526cc4e72fc17317a92565536fda6801832fc794fa31118844ffe3b1b5c00669b7baa7ab010c35cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3122417f108661032c13c7399400379

SHA1
29672932039bd6e867e75800e5422e715cc515e1

SHA256
455deb627ae001a590bcf40e80889919578aabe9f0808b30cb419e47d5c4dd5f

SHA512
2ea95f733cd142a18eb077b57b297b1a90e7f837b3f72ee5bf2fbe62abdba9cb6ecff2ba3e14f4a4608087880c41fdba292a11467f020b85fce3d83efcd091ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
456a93972c66c49f192ee598d6c326dd

SHA1
8e9d4640ea313ccdb3bc8ceafeff0ec36c33f833

SHA256
ecdc8800b9f538783eb87f601aa0485a215f6adcb0f57c811075ceeb193bee1f

SHA512
258e067cda68cb8cadc13f59c749d17c9d5e9e80d118be13dc45178654938b7adeb2e63f2d5d53cd6846ff6ad63ed473ec5d68a1c20bddd18b9f4d2388179c10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcb833ab97549f9548e8bc0ec225afda

SHA1
5cb26a9025ac41b50443b5316eb29cf737ede6f5

SHA256
723be7723aced32bd82dfd19df11140d0de99f48230c5af4b0ae539fcceee1c2

SHA512
a2209dd2c022a3cafa95e499aecab772c349f3fa9f6600066ce3544af9150123c5703328cf0de2982260c54ce04ed563e6820b3b2b4796a7d41c69948c95600c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
526c328962455b799dfd9140eb8ae62c

SHA1
f6b0c2ed978e98dc25eab8ab3b3b0c5e64480ba7

SHA256
4c6baaa3383985c02bf9578021ce8cafa0bbb7beac1f2600e7ac6ea324c197f7

SHA512
d08900b7271e7631c5e7d3639e298e645c4254ee800aa1314124b2eb42279ce534b01695861c47f01cd89868e448dcda48962046c770eacfb5ef88f3d382680b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b432b0d314f5371594c935880171a8a4

SHA1
9f9b39ebcf3f995cf75e761e5516aa1ff0b337d3

SHA256
e48ced916ecd7240005ec86bdebf4ea78af78a8adebdb654438ca9937134d00e

SHA512
d8d41092c770087549c79fd7b40367e27ff262e4a0b1eb8badaeefc120d02f8f061317b74c62b99ee39d5f2aadf2d1abbb1e53365ade9ada35a6618bc284d63a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fdff4ef225245a8f5c4e12a5f5952b8

SHA1
895d507e50139f0ca074e2e801302acdead1ad82

SHA256
334593f2d28e7f3418eedb9a1d50586e9db8767aaaf56226c0ab0d1ed111bbb6

SHA512
9c74d558121cb8cf1e2b61de82847c6b1019bf5e1745ded25c8fca70eef5cc5bec9e73c0ad969b5261aeba6048d44b1d34173e7ef2d6203b8326cf10f4876e20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3869555187bd9467f3dd3642019905b8

SHA1
e11091487d149c796305771a6e2b2228368419b2

SHA256
3dca3b04fe0bec951808c69fc553237fae08e338e88783ed1fe975024f3e9017

SHA512
74cb8bd5cec8064a5468e11a55ea3b70c8eca6476af0c038851c3261cf8ee38b996fc7bd571e74d5baacb4560f4d36aeaae82bb314908b61087217c47c87e8fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
457b946574b936dd8d823656c2e6250f

SHA1
e93cd3b46181216bd19c14dda168334405eeb25a

SHA256
50d4039bc7e6db9faeba7673e40b9cb4a80775e7de338ca237face51a046abc7

SHA512
71c40a3a3a515655b65d8a077fcbea3423a712dc79f7086a89088be68e0dc6ac2ca3c6397bad388ea789ec3ce69abc573c17a7ffcf6dd7ce1713fddadf78951d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc58a09a0b66d2196e05b632106be70c

SHA1
cf8456189eda036a62682cb8620002f70e3d7aa3

SHA256
e182da86971de800419071200afa20284e4a4a9e1de96786d7b54990b3e689fd

SHA512
55ac12e5200ef2f4903163e3a0d7866668b558deee7ea53d579856c3a7aedad93e6e9a6e76b17868c20f1d18ab0a8021d748b28e3f81de119f3c971c5116768c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7578cbce0f6eab96b3ab2ba116e13018

SHA1
e7a18008d886856c776b00fe741bfc972ed19fa5

SHA256
afbd269329bd9d34ffe53e164e1ddb05988408185b745008790a47c89d9f885d

SHA512
ddc061f62181c3674f6c44070e97da2eb0666cd523838576a1bf1a2051694202884519c600a82ec2a7502918786c9044a5f6af9aec5e00b5f103f6d6da11fd84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91541000baef340229e4030992903fe4

SHA1
27ac567e205f578826d38728208b9687b970b6d1

SHA256
174e793b507806e32eb7e28de50b938197efad130394f826ee47b12bf28a41c8

SHA512
41e19aa9177bc097f99ca26994136a7fa1e12e5fb85308294ab86e1e90e44e2e45d13a48bfe676daa8aadea8dbe5a28593da15c723a4fbd0e8ef95e109cd4e1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da437be34e46a5e76a6548071cbabcb6

SHA1
5f2a69e65a35800d36297ed686615f9c7e44d1d9

SHA256
722fecb400d439f81eb6cac012822e7078e57ac51508b76e0b00cfcba26e6185

SHA512
7d7f1fbaa8151da10e56027c3fd4f2f0c673ad8f9615c4e1506822260d1f5170e6ad6d847e74a6fbe69447318d362e58d912b98e43df4ec4b5d2b89aea00631e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b58af906e46f697b7f373920a2ba86e

SHA1
f31244d3d1612f4e4a93582b666f61775145cbb5

SHA256
ae0810910522f75fcc959f5f354db742ce0281f94052e4b9d9e85992979d3e1a

SHA512
81d6fa30da1980ed8d2d82bc2502d852e486592b49a58a18b16e77d38cd43bdd7a7d8900932819a2fca82300617205c996bf2af4fc5f0f90933b4b8417888852

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63491b05ec68d0f7b9202934ac48198f

SHA1
f491c821907ee17d5c47344dc6e40a6663f4fc78

SHA256
f5a75a7ab0187b5b3930e1590647377e02d5c7dcb914f1a9c196218e36467d56

SHA512
81132c456bef49e2e96af3abb4c7fef4b7cce9b30d1983440ae69c1bbaa749872420380f23f40fe7998ef4c2308d1eacb4b89fd59c4953d9e5c8edaf446305c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e78c6eae0e9b3dd654e0a98cabb085e

SHA1
787c5d23fa908b5d244b059a05c68958d5b01cde

SHA256
2ebc10e20763487ef1bfe388e991b7fc2936f140a2d949b31e6c5fd94d9f9f6d

SHA512
51760a99f289957ea7b666a12e409a5a4a0fec4c19eebe1f4c6f3ef3fbb29210ce0f7f2a4315053c5d432f29a4d38559c5649afccf04362fd32c95e24ee12fff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf2d86869c38e16451a619c7205511a6

SHA1
ac328c49e68d01c7fceddf73b964217dc958e56e

SHA256
d0bd89a5ab6c676f55246d1d2be4bf4f401c36a4872d5943382cda190dd30145

SHA512
c652384fe05bb0198081a5fd353fe0d486b9b5ed2874fb1aaf4fc99f3467221ab6ce06762c09c0d856ecd36a5712f40788ca311a71240963be9ceccc372a2522

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Analytics.dll

Filesize
32KB

MD5
1c2bd080b0e972a3ee1579895ea17b42

SHA1
a09454bc976b4af549a6347618f846d4c93b769b

SHA256
166e1a6cf86b254525a03d1510fe76da574f977c012064df39dd6f4af72a4b29

SHA512
946e56d543a6d00674d8fa17ecd9589cba3211cfa52c978e0c9dab0fa45cdfc7787245d14308f5692bd99d621c0caca3c546259fcfa725fff9171b144514b6e0

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\DotNetZip.dll

Filesize
449KB

MD5
11bbdf80d756b3a877af483195c60619

SHA1
99aca4f325d559487abc51b0d2ebd4dca62c9462

SHA256
698e4beeba26363e632cbbb833fc8000cf85ab5449627bf0edc8203f05a64fa1

SHA512
ad9c16481f95c0e7cf5158d4e921ca7534f580310270fa476e9ebd15d37eee2ab43e11c12d08846eae153f0b43fba89590d60ca00551f5096076d3cf6aa4ce29

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe.config

Filesize
261B

MD5
c2edc7b631abce6db98b978995561e57

SHA1
5b1e7a3548763cb6c30145065cfa4b85ed68eb31

SHA256
e59afc2818ad61c1338197a112c936a811c5341614f4ad9ad33d35c8356c0b14

SHA512
5bef4b5487ecb4226544ef0f68d17309cf64bfe52d5c64732480a10f94259b69d2646e4c1b22aa5c80143a4057ee17b06239ec131d5fe0af6c4ab30e351faba2

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\GA.Analytics.Monitor.dll

Filesize
52KB

MD5
6f9e5c4b5662c7f8d1159edcba6e7429

SHA1
c7630476a50a953dab490931b99d2a5eca96f9f6

SHA256
e3261a13953f4bedec65957b58074c71d2e1b9926529d48c77cfb1e70ec68790

SHA512
78fd28a0b19a3dae1d0ae151ce09a42f7542de816222105d4dafe1c0932586b799b835e611ce39a9c9424e60786fbd2949cabac3f006d611078e85b345e148c8

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Newtonsoft.Json.dll

Filesize
647KB

MD5
5afda7c7d4f7085e744c2e7599279db3

SHA1
3a833eb7c6be203f16799d7b7ccd8b8c9d439261

SHA256
f58c374ffcaae4e36d740d90fbf7fe70d0abb7328cd9af3a0a7b70803e994ba4

SHA512
7cbbbef742f56af80f1012d7da86fe5375ac05813045756fb45d0691c36ef13c069361457500ba4200157d5ee7922fd118bf4c0635e5192e3f8c6183fd580944

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Common.dll

Filesize
192KB

MD5
ac80e3ca5ec3ed77ef7f1a5648fd605a

SHA1
593077c0d921df0819d48b627d4a140967a6b9e0

SHA256
93b0f5d3a2a8a82da1368309c91286ee545b9ed9dc57ad1b31c229e2c11c00b5

SHA512
3ecc0fe3107370cb5ef5003b5317e4ea0d78bd122d662525ec4912dc30b8a1849c4fa2bbb76e6552b571f156d616456724aee6cd9495ae60a7cb4aaa6cf22159

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Editor.dll

Filesize
816KB

MD5
eaa268802c633f27fcfc90fd0f986e10

SHA1
21f3a19d6958bcfe9209df40c4fd8e7c4ce7a76f

SHA256
fe26c7e4723bf81124cdcfd5211b70f5e348250ae74b6c0abc326f1084ec3d54

SHA512
c0d6559fc482350c4ed5c5a9a0c0c58eec0a1371f5a254c20ae85521f5cec4c917596bc2ec538c665c3aa8e7ee7b2d3d322b3601d69b605914280ff38315bb47

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Syntax.dll

Filesize
228KB

MD5
3be64186e6e8ad19dc3559ee3c307070

SHA1
2f9e70e04189f6c736a3b9d0642f46208c60380a

SHA256
79a2c829de00e56d75eeb81cd97b04eae96bc41d6a2dbdc0ca4e7e0b454b1b7c

SHA512
7d0e657b3a1c23d13d1a7e7d1b95b4d9280cb08a0aca641feb9a89e6b8f0c8760499d63e240fe9c62022790a4822bf4fe2c9d9b19b12bd7f0451454be471ff78

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Telerik.NetworkConnections.dll

Filesize
34KB

MD5
798d6938ceab9271cdc532c0943e19dc

SHA1
5f86b4cd45d2f1ffae1153683ce50bc1fb0cd2e3

SHA256
fb90b6e76fdc617ec4ebf3544da668b1f6b06c1debdba369641c3950cab73dd2

SHA512
644fde362f032e6e479750696f62e535f3e712540840c4ca27e10bdfb79b2e5277c82a6d8f55f678e223e45f883776e7f39264c234bc6062fc1865af088c0c31

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBCCC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBCDE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B3325a29b#\4f44abb46807a5ad0f0bf1ae5ba48323\Microsoft.Build.Framework.ni.dll.aux

Filesize
588B

MD5
90dde7396bbc17dddaa7dcdec75c2d7b

SHA1
613a143997175a531af577c3e47611d006cd585c

SHA256
a3613a9ea1e995ce43a3754b3eab8f09325f039188593a4666bba0fa56dc5c03

SHA512
3cb619a3fe00d5cff37830e080a5db2e27d122293fb15f200a6bb59ad905d32bb99c720d36d1a8f6fcd89cad5c8e2610dbf89c09db28f7ec1974041d4b026c18

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B83e9cb53#\4a58f2013ffa484c7f872e70952613ca\Microsoft.Build.Utilities.v4.0.ni.dll.aux

Filesize
888B

MD5
0c2e9bf2f96be2986d8b8449c0028067

SHA1
c41ba485bc1d847ebba609bc4bcc37b4109f7fca

SHA256
4d9d156b27b902a1265a2d36a47fb285ecba5abb97ca730df3893f3397f5da4a

SHA512
8a8eb919323d37cacad9665b671d5639bcd4f0955997f5321a486c1e3179bb6762b2ae009cc658b402dbb4dc0d873e110e58f5b67565c458eff2d16c8f1e46f1

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\2145e325c531dd03775cc61606722965\Microsoft.JScript.ni.dll.aux

Filesize
580B

MD5
0fa7a2200ae2493f05b85e85688aa663

SHA1
18ce43782b1a150948a3c80df0dd3374372cf675

SHA256
d2573a4a215ae02c70b6fac850c22931a757c18ff243c16b819b03d1dc2bf92e

SHA512
84629c719112dc1257a89bd0de5d4be7465abe6b81a25c8326a05f5001c51e6f3b921652cb81da68bbec7e975f476aed6f8606d1da6e736f456c65853072e129

Download Submit
C:\Windows\assembly\temp\F1065MJF66\GA.Analytics.Monitor.ni.dll.aux

Filesize
712B

MD5
edf737aa1f61c81d720917eb84e9fd5d

SHA1
8f6e5fd53b5c381491caa2d4a93cf81421088bce

SHA256
495b3d096ede487f9c7a7308ca15eb61b06a220089f7b9cd216013e0131bccdc

SHA512
45bb1c38ce0276730bfca53b6400db107f4854c9f9a80465e98bd98d40b69d4b2db8e2eb8e39bd26dbc16d26303ca1e21417aa67e88ef146e1254e33d39801fc

Download Submit
C:\Windows\assembly\temp\FS95JZ1MSC\Telerik.NetworkConnections.ni.dll.aux

Filesize
732B

MD5
61d90bbb5964d416b86d7ef8b9adef40

SHA1
eba684714c32c9f2939499ee896a492122da707d

SHA256
9051805012f5ce17fc5f4a71482b34f9c0c4b61bf640ee31f48719a926782ab9

SHA512
867d21199f7fd950cdf9a4f2ce5435326abd7411a137f60c406b8ec185ae7d50e211dbf98a37591aba24bdd00fbcfee974e46f6691e8589e6dae2d11e2e8f47a

Download Submit
C:\Windows\assembly\temp\KDBPYDHIO7\DotNetZip.ni.dll.aux

Filesize
532B

MD5
874863d695af07df17460e56498a47db

SHA1
c64deff1aac7d97fee51aa09a1f8a64bb3679ed6

SHA256
d8e59722d2b4881df93b9cde8d01523b73adc9a2eceb204fb7cd1963aff75c73

SHA512
864b081d61881839495a097a4eb4ea71bb6a29246968fd981bc7e7d318558bb831fd673941459329e096625e454883b7f2af2e9b2f3785fe51b672f275e38728

Download Submit
C:\Windows\assembly\temp\QI8HSNM5YW\Analytics.ni.dll.aux

Filesize
716B

MD5
17c17240ab6ab6254d5e377730f02a1a

SHA1
1d3958db4e5d2a29732e45ed2eadfa08d1d879ed

SHA256
d9923f94b9cba213ffac3e41953b9ca991a562fbfc5c1765b4fd05c25fb94b0e

SHA512
d3046376bbfd7591a34be448bc102c380816b779a3866757c39998248739c165bd724321ff63ef0114090ff37b9c4043c89b058e253fe072f42e68a3d677f101

Download Submit
C:\Windows\assembly\temp\QRNCRIUWT2\Microsoft.Build.Tasks.v4.0.ni.dll.aux

Filesize
2KB

MD5
c228a99297b86188b16cd8ae9f9e95c7

SHA1
b4603bf9196c3908a94ddff0ac2e51d1edd40777

SHA256
4bf1bad2d0aa458307845c6cfff003ad168b9af1c183d4fd44de734bf66ead97

SHA512
f6933920fa6c75bd3facbc91d8b6d594461ebfd54c5557155fbda4d6fd35c135d2438e377538540103947f7394d404d05dc7b08fd731e067cf45d94919cf474d

Download Submit
C:\Windows\assembly\temp\RQYF4YHZE1\Newtonsoft.Json.ni.dll.aux

Filesize
1KB

MD5
3297f1b9eb7bb0efd37fc3047629b6a5

SHA1
f90341c4da3b8a0cb6068aed4d670a8be7715cad

SHA256
5feba95b5210c72b8c410492e04bca011ca4bb889b248e8cd0b566d34c909d72

SHA512
4264f62f5241309988ac47fd69341fa8a2ef0be51e99eca90c26acda0dcb2a71f513ccdffff11d111e3a3cfadcb4539a1ade43b77d4ed71e7217a6603c407e5b

Download Submit
\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe

Filesize
3.5MB

MD5
32cf2e7c6ae825d5f7cb2a7d39c2ee24

SHA1
262176d879e7727375025cae4aafc90698adad26

SHA256
d7ea71114bfe70383c1ac2be6dd19676805a0afb6e20c0ad3000018afad093e5

SHA512
a72e70f1a11d4443aedc56a2453cb3ed05bd8106b0e906364f23f01098a378440d2d86ac15f6d98ceedfe18b0a60d80f6806300b390c2969c3de97cb380b82c2

Download Submit
\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\FSE2.exe

Filesize
50KB

MD5
7a8df7276257139271a09a8947da44e5

SHA1
965c788156e2e29b6d1012430afee0cad13093b0

SHA256
8b0b9859af32d467fb7031ac8164779ffdb274cdaff959d89d11a65a365c8e12

SHA512
2769f62f0de76726c33cb0eae42c933806ddceae6c1f97d16302c575a8955fe33d4388824ca2a2c1269b09755e42b82fa5dceca825bd19e3e83ed43f97ca1f79

Download Submit
\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper

Filesize
18KB

MD5
1289dc21a51fb89e685fa4c91764c00e

SHA1
b24210c4e71ace272a1984e171d50380687f73fe

SHA256
3e6f9a8b9dbd8adb521ce02a1c34e20350b3df438deb5bc4ada33c8cca6d25b9

SHA512
9cf63f042197470e622b97bf11845722c6338e69f08932b2f11eca576162235ff82c2def13bf42cea4c3b583ebd0342ca10ca6e5f2a3c53e4a6db5ae7006a0f2

Download Submit
\Users\Admin\AppData\Local\Temp\nsy61A1.tmp\FiddlerSetup.exe

Filesize
4.3MB

MD5
5d96b95b066d797c7c468d125882ddcf

SHA1
8a130db5e4f6207b70939c5007d6689c22378c7d

SHA256
7ea1a09eeab47eb4658938bf4a023c6231de726ad076fde189c3383ffb4091fe

SHA512
fd746263b0aad96e90468aac664a3f02af20c2291e03138cf201d68036bd8ce26cc36b5fdc4e97ae5f93c65a5660de91988e3ee7156359de509fea9b4308550a

Download Submit
\Users\Admin\AppData\Local\Temp\nsy96F4.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Analytics\d756563aa7cd4e9c00502605394ea611\Analytics.ni.dll

Filesize
148KB

MD5
4b962d3d8b3c91fa54e20ea48d09a990

SHA1
35468f050fb1b4a5e57a437b644d2c9e512f862f

SHA256
3e7dc77c58ae21758add41de81b649240e95707abcbd6d02fccdaa73449ab33f

SHA512
5ba87664ebadc3611523e69c9b26b6b9f4576240eb5c3a7e39a21a3a6f68f37142c9902fe4410f4e60593556d0e641a9ee82a37c1cb29e50d6247db2804ac3c5

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\DotNetZip\330381c0d4a4a49e56426709e084cc48\DotNetZip.ni.dll

Filesize
1013KB

MD5
75466b5e53a262f579d58042eb0c6fa5

SHA1
aba87382496d180a3e71c3626b617bb65308d358

SHA256
dd470f06556af0b809868b8ddcf6db70833d41fb1b7d2086de7ecde34e3085fe

SHA512
efe4fc459cdf8148792f0d43da4b5e6e5ef86f6f2ba2fde868ae6b4ad72f58ed8af6e134de72d754f5916e3570e7d1f205633321605c4f939453537cbd538bb9

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\GA.Analytics.Monitor\3bf155f5fe5c3c876614c4d82313933c\GA.Analytics.Monitor.ni.dll

Filesize
158KB

MD5
188e0e27618fc054e447005da14b39e6

SHA1
fa53f294d3f2d484b513f17ca5d21b33a52e2500

SHA256
7602634749732ab0411aebe3b5789b736c8e68d07688dd22d83f29b6e86675c9

SHA512
717e160dec70f5d647e6152ed1ce8ed1e4d64118cd68ffaa091264d8a7b947175261552a9171ebf4ddc7fe0096608a9a4f5d1b24857d1c8eb5d750b2e085670c

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B3325a29b#\4f44abb46807a5ad0f0bf1ae5ba48323\Microsoft.Build.Framework.ni.dll

Filesize
546KB

MD5
75de4db178e3310ebf8bfa83a003b8e2

SHA1
c0d05985fb9e28ede26b00143d939839cb0e3ae6

SHA256
304ae94177bcd5f8659eb5a232676c2a9857dc495c273fce2e2e65fab4ae4eb6

SHA512
4310161d72d60ef55a5ca6601bf4f5773518a9fcbeab4fda60afc18b334a1fbded3a5426795ed3587b5c51e2f6fc39176014a75e75aca2d3cfafc8a19d85b983

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B83e9cb53#\4a58f2013ffa484c7f872e70952613ca\Microsoft.Build.Utilities.v4.0.ni.dll

Filesize
1011KB

MD5
6d7e1bc098c599dc54b552531ed637ac

SHA1
ff4648a4ce473a3cbe6e3c75e1c606d593353de1

SHA256
874ece1c76a575a96e174eb846edcbeb6134ee66e71bfd025a250a7406627ef5

SHA512
1e88c80b969c0ac44e880316189ce3789f2fb0d8044e39c90ef99edfe4de83f7c21dc21adf4c51f6d88f77b92035b519794ed91d9d04c74cef971aa3424ce04a

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Baa2ca56b#\faa890702be0a0b8574aa82cb24b9da3\Microsoft.Build.Tasks.v4.0.ni.dll

Filesize
4.1MB

MD5
07de6b9bdeebae49461ef58e29953464

SHA1
5ba78e69c3d93724c6a3de013157b9350bcd6eb9

SHA256
85da41cc1f1beac3528bab39240912ecb8ac7fb313a89342e3fffd9cf0a99c74

SHA512
1b10add9a8cab2913299a03da26ad4fcb84826ff33c847d53078d18e3459b4c07a3b0ee52b67d9fe2f5b90ae7f98da502369159c2edc3e81fa569242184ab0b4

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\2145e325c531dd03775cc61606722965\Microsoft.JScript.ni.dll

Filesize
2.7MB

MD5
d1d5dd7761a0e2c31c2baeeb4442a6ba

SHA1
c681dca866baa02e7840bffdbcff349da69ba25c

SHA256
84676accc10df0f610772b5d447b058a9fd3c4d399cddc01ef6510d9832915f1

SHA512
59891b98e42635c056debe5fdd373b3d31ef1731c653c7df179c0db8544c6bfc6e4899d62a3068b76a652e71899b285e1757260ccaa805658e1e77e00cb9b263

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Newtonsoft.Json\1ebe746ea3a361d99ffc6ea2e12b5a66\Newtonsoft.Json.ni.dll

Filesize
3.7MB

MD5
03eabadb3e9fe0a8566ce36fde2ed959

SHA1
c0da077a84d61426c6de7d27b5bd3d5beb034352

SHA256
2467069bdc725532c792ab7f026bbafbbdbbd311d5ba83c502cc35a044b90860

SHA512
b60a5ac1f0b062ba3319ba93171f2d150a536fa4ce37bc7061a76949ca98c5ee08dc342f232bf47b36753c4046c23828fea8560b083778f175d5303906c9bc82

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Telerik.Net8bf66678#\e5f4977994d2fd10324efd51321f1c59\Telerik.NetworkConnections.ni.dll

Filesize
94KB

MD5
8c1196b2476c2ae2dee297e3db1cf37f

SHA1
27b4c6bc7876d7f52f34bffe2fb1f3cee88444ff

SHA256
f298ac1090234846c34b192f4683d34477f84f5eb8b844afedac9d4de246e104

SHA512
cd4bbe93c3a40035c65358ba714f39b8c6770aa44bdb87ed6dd23292f7a641c3da3977691fb1ecf83f1dbb6fe704edc6eeb817d1da48b4f2f9de62cf9c2ec591

Download Submit
memory/1096-346-0x00000000007F0000-0x0000000000800000-memory.dmp

Filesize
64KB

Download
memory/1096-347-0x00000644A0000000-0x00000644A0029000-memory.dmp

Filesize
164KB

Download
memory/1592-232-0x0000000001FA0000-0x0000000001FE4000-memory.dmp

Filesize
272KB

Download
memory/1592-233-0x0000000000450000-0x000000000046A000-memory.dmp

Filesize
104KB

Download
memory/1592-234-0x0000064438000000-0x00000644380FF000-memory.dmp

Filesize
1020KB

Download
memory/1736-294-0x00000644A0000000-0x00000644A0100000-memory.dmp

Filesize
1024KB

Download
memory/1772-217-0x000006443CC40000-0x000006443CEEC000-memory.dmp

Filesize
2.7MB

Download
memory/1772-211-0x0000000001FF0000-0x00000000020AA000-memory.dmp

Filesize
744KB

Download
memory/1956-324-0x00000644A0000000-0x00000644A03AA000-memory.dmp

Filesize
3.7MB

Download
memory/2076-207-0x0000000001F90000-0x0000000001FAA000-memory.dmp

Filesize
104KB

Download
memory/2076-210-0x00000000025C0000-0x00000000025D0000-memory.dmp

Filesize
64KB

Download
memory/2076-111-0x000000001B500000-0x000000001B882000-memory.dmp

Filesize
3.5MB

Download
memory/2076-197-0x0000000002870000-0x000000000292A000-memory.dmp

Filesize
744KB

Download
memory/2076-199-0x0000000002540000-0x00000000025B6000-memory.dmp

Filesize
472KB

Download
memory/2076-201-0x0000000001DF0000-0x0000000001DFC000-memory.dmp

Filesize
48KB

Download
memory/2076-203-0x0000000002B70000-0x0000000002C18000-memory.dmp

Filesize
672KB

Download
memory/2076-205-0x0000000001E00000-0x0000000001E0C000-memory.dmp

Filesize
48KB

Download
memory/2076-206-0x00000000020B0000-0x00000000020F4000-memory.dmp

Filesize
272KB

Download
memory/2076-208-0x000000001AF30000-0x000000001B052000-memory.dmp

Filesize
1.1MB

Download
memory/2120-214-0x00000000006A0000-0x00000000006AC000-memory.dmp

Filesize
48KB

Download
memory/2120-216-0x00000000006B0000-0x00000000006BC000-memory.dmp

Filesize
48KB

Download
memory/2120-215-0x0000000002E70000-0x0000000002F18000-memory.dmp

Filesize
672KB

Download
memory/2120-213-0x0000000002100000-0x0000000002176000-memory.dmp

Filesize
472KB

Download
memory/2120-212-0x000000001B660000-0x000000001B9E2000-memory.dmp

Filesize
3.5MB

Download
memory/2300-109-0x0000000000950000-0x0000000000958000-memory.dmp

Filesize
32KB

Download
memory/2300-309-0x00000644A0000000-0x00000644A001A000-memory.dmp

Filesize
104KB

Download
memory/2492-362-0x0000000000450000-0x0000000000460000-memory.dmp

Filesize
64KB

Download
memory/2548-276-0x0000000000480000-0x000000000048C000-memory.dmp

Filesize
48KB

Download
memory/2548-272-0x000000001B6A0000-0x000000001BA22000-memory.dmp

Filesize
3.5MB

Download
memory/2548-278-0x0000000000660000-0x000000000066C000-memory.dmp

Filesize
48KB

Download
memory/2548-277-0x0000000002AF0000-0x0000000002B98000-memory.dmp

Filesize
672KB

Download
memory/2780-265-0x000000001AFA0000-0x000000001B0C2000-memory.dmp

Filesize
1.1MB

Download
memory/2780-279-0x0000064438000000-0x0000064438429000-memory.dmp

Filesize
4.2MB

Download
memory/2976-250-0x0000064438000000-0x000006443808B000-memory.dmp

Filesize
556KB

Download
memory/2976-249-0x0000000000450000-0x000000000046A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads