9ddd2984852b80fb41546e96a1c3414a55415050761a47633d28a4faeef7a3d1

Analysis

max time kernel
1783s
max time network
1702s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
11-12-2024 16:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/FiddlerSetup.exe
Size

4.4MB
MD5

c2a0eb6f104eacec3f39581451ee208f
SHA1

9ae7d02aeb640fbd090dfc01885b98dd5dd0b6cc
SHA256

1f926cc353301e547e76c6d2eff23fcbe85495ba0292174cc6344fac26457af8
SHA512

8b062e4f0af1dce3a12b5776646fe8c235f30de6772f579da1a6ab2bb559ed69b3bd32af95eee248c48008ddcbd40a7e49eae722a44bc9b49dd13fe38113a3ca
SSDEEP

98304:KgxyUnSAaB1eXq8yOkLiGXv72Qomw6pvtFIAwdaRdAM:KoWvePjqHv72Qo96pvtF5wHM

Score

9^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2980	netsh.exe
4172	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	FiddlerSetup.exe

Executes dropped EXE 1 IoCs

pid	Process
2892	SetupHelper

Loads dropped DLL 27 IoCs

pid	Process
240	FiddlerSetup.exe
3256	mscorsvw.exe
4656	mscorsvw.exe
1228	mscorsvw.exe
4484	mscorsvw.exe
3252	mscorsvw.exe
4768	mscorsvw.exe
4484	mscorsvw.exe
4896	mscorsvw.exe
4896	mscorsvw.exe
4896	mscorsvw.exe
4896	mscorsvw.exe
4896	mscorsvw.exe
1980	mscorsvw.exe
1636	mscorsvw.exe
3532	mscorsvw.exe
3532	mscorsvw.exe
5376	mscorsvw.exe
5376	mscorsvw.exe
3532	mscorsvw.exe
5612	mscorsvw.exe
5736	mscorsvw.exe
5848	mscorsvw.exe
5984	mscorsvw.exe
5984	mscorsvw.exe
5984	mscorsvw.exe
5984	mscorsvw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\c8448ed3-f41e-47be-9e29-f6299c7b188a.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241211164135.pma	setup.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\12a0-0\System.Runtime.Serialization.Formatters.Soap.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\ab300698ff0e6328a779058c8a6abc9a\System.Runtime.Serialization.Formatters.Soap.ni.dll.aux.tmp	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\YNO21I1DZO\System.EnterpriseServices.Wrapper.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\SM868LT07S\Microsoft.JScript.ni.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\4cc-0\System.Numerics.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\0c073f42cf7c0b89bd4ceb4244060ceb\System.Numerics.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\debe458f6197408829bf76c18c262527\System.Web.ni.dll.aux.tmp	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\LRWAFX8MMJ\System.Web.ni.dll.aux	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\cb4-0\System.Data.SqlXml.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\dcc-0\System.Web.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\6c172340af3f46e7e45d3cea5ee80a56\System.Data.SqlXml.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\88b596885c6a2aecfe43892d03c5ba6b\System.Deployment.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\180d439c36f3cf6ec5649e1360f67487\Microsoft.JScript.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\15ec-0\System.EnterpriseServices.Wrapper.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1668-0\System.Runtime.Caching.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Design\4bef87a1b98b5533efa4f11b37cdd644\System.Design.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\cb8-0\EnableLoopback.exe	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1230-0\System.Security.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\YNO21I1DZO\System.EnterpriseServices.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\VPP7BFUATG\System.Runtime.Caching.ni.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\YNO21I1DZO\System.EnterpriseServices.ni.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\VPP7BFUATG\System.Runtime.Caching.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\LRWAFX8MMJ\System.Web.ni.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\SM868LT07S\Microsoft.JScript.ni.dll.aux	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1184-0\System.Deployment.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\3951a32a1f9c2a58922ccf04395c0db4\System.Web.RegularExpressions.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\42c7a19a453afb14fda2fe8479e4d8b2\System.Security.ni.dll.aux.tmp	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\W54WA2G7KN\System.Web.RegularExpressions.ni.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\1d73b6e28a6154a6194c12bcb15f7e62\System.EnterpriseServices.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt19c51595#\b8452ea2b87e2c798d586738cbd5ad6d\System.Runtime.Caching.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1760-0\System.Design.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\W54WA2G7KN\System.Web.RegularExpressions.ni.dll.aux	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\EnableLoopback\a8e9750dcec3b7be6005a908fe2c2d8f\EnableLoopback.ni.exe.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\15ec-0\System.EnterpriseServices.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\16d8-0\System.Web.RegularExpressions.dll	mscorsvw.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FiddlerSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupHelper

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	FiddlerSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Fiddler.exe = "0"	FiddlerSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Fiddler.exe = "9999"	FiddlerSetup.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Fiddler.ArchiveZip\DefaultIcon	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Fiddler.ArchiveZip\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\SAZ.ico"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Fiddler.ArchiveZip\Shell\Open	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\.saz	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\.saz\ = "Fiddler.ArchiveZip"	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Fiddler.ArchiveZip\Shell\Open &in Viewer\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe\" -viewer \"%1\""	FiddlerSetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-584106483-899802418-1877852863-1000\{0226219B-2003-47B5-9801-8EB45D2CA5E2}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Fiddler.ArchiveZip\PerceivedType = "compressed"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Fiddler.ArchiveZip\Shell	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Fiddler.ArchiveZip\Shell\Open\command	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Fiddler.ArchiveZip\Shell\Open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe\" -noattach \"%1\""	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Fiddler.ArchiveZip\Shell\Open &in Viewer\command	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Fiddler.ArchiveZip\Shell\Open &in Viewer	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Fiddler.ArchiveZip\ = "Fiddler Session Archive"	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Fiddler.ArchiveZip\Content Type = "application/vnd.telerik-fiddler.SessionArchive"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Fiddler.ArchiveZip	FiddlerSetup.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
240	FiddlerSetup.exe
240	FiddlerSetup.exe
1944	msedge.exe
1944	msedge.exe
1784	msedge.exe
1784	msedge.exe
2684	msedge.exe
2684	msedge.exe
5512	identity_helper.exe
5512	identity_helper.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 2980	240	FiddlerSetup.exe	88
PID 240 wrote to memory of 2980	240	FiddlerSetup.exe	88
PID 240 wrote to memory of 2980	240	FiddlerSetup.exe	88
PID 240 wrote to memory of 4172	240	FiddlerSetup.exe	90
PID 240 wrote to memory of 4172	240	FiddlerSetup.exe	90
PID 240 wrote to memory of 4172	240	FiddlerSetup.exe	90
PID 240 wrote to memory of 4408	240	FiddlerSetup.exe	92
PID 240 wrote to memory of 4408	240	FiddlerSetup.exe	92
PID 240 wrote to memory of 4776	240	FiddlerSetup.exe	94
PID 240 wrote to memory of 4776	240	FiddlerSetup.exe	94
PID 240 wrote to memory of 2892	240	FiddlerSetup.exe	95
PID 240 wrote to memory of 2892	240	FiddlerSetup.exe	95
PID 240 wrote to memory of 2892	240	FiddlerSetup.exe	95
PID 240 wrote to memory of 1784	240	FiddlerSetup.exe	102
PID 240 wrote to memory of 1784	240	FiddlerSetup.exe	102
PID 1784 wrote to memory of 4028	1784	msedge.exe	105
PID 1784 wrote to memory of 4028	1784	msedge.exe	105
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 2172	1784	msedge.exe	109
PID 1784 wrote to memory of 1944	1784	msedge.exe	110
PID 1784 wrote to memory of 1944	1784	msedge.exe	110
PID 1784 wrote to memory of 1536	1784	msedge.exe	111
PID 1784 wrote to memory of 1536	1784	msedge.exe	111
PID 1784 wrote to memory of 1536	1784	msedge.exe	111
PID 1784 wrote to memory of 1536	1784	msedge.exe	111
PID 1784 wrote to memory of 1536	1784	msedge.exe	111

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FiddlerSetup.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FiddlerSetup.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:240
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="FiddlerProxy"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2980
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="FiddlerProxy" program="C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe" action=allow profile=any dir=in edge=deferuser protocol=tcp description="Permit inbound connections to Fiddler"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4172
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
  2⤵
  PID:4408
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 0 -NGENProcess 1e4 -Pipe 1f0 -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    PID:4896
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 0 -NGENProcess 28c -Pipe 1ec -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    PID:1980
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 0 -NGENProcess 2a4 -Pipe 2ac -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:1636
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 0 -NGENProcess 2ec -Pipe 2f4 -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:3532
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 314 -Pipe 318 -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    PID:5376
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 0 -NGENProcess 308 -Pipe 31c -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:5612
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 0 -NGENProcess 2b8 -Pipe 2e4 -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:5736
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 0 -NGENProcess 2d8 -Pipe 2f8 -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:5848
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 0 -NGENProcess 314 -Pipe 2d8 -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:5984
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 0 -NGENProcess 308 -Pipe 330 -Comment "NGen Worker Process"
    3⤵
    - Drops file in Windows directory
    PID:5676
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 0 -NGENProcess 2fc -Pipe 2cc -Comment "NGen Worker Process"
    3⤵
    - Drops file in Windows directory
    PID:1816
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 0 -NGENProcess 310 -Pipe 2d4 -Comment "NGen Worker Process"
    3⤵
    - Drops file in Windows directory
    PID:5624
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 0 -NGENProcess 2a8 -Pipe 320 -Comment "NGen Worker Process"
    3⤵
    - Drops file in Windows directory
    PID:5784
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 0 -NGENProcess 2b8 -Pipe 2fc -Comment "NGen Worker Process"
    3⤵
    - Drops file in Windows directory
    PID:5736
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\EnableLoopback.exe"
  2⤵
  PID:4776
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 194 -InterruptEvent 0 -NGENProcess 1f0 -Pipe 1f4 -Comment "NGen Worker Process"
    3⤵
    PID:2636
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 0 -NGENProcess 27c -Pipe 1f0 -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:3256
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 0 -NGENProcess 28c -Pipe 294 -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:3252
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 0 -NGENProcess 2a8 -Pipe 2c4 -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:4656
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1fc -InterruptEvent 0 -NGENProcess 298 -Pipe 2cc -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:1228
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 0 -NGENProcess 2c0 -Pipe 298 -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:4484
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 0 -NGENProcess 28c -Pipe 2d4 -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:4768
- C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper
  "C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper" /a "C:\Users\Admin\AppData\Local\Programs\Fiddler"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://fiddler2.com/r/?Fiddler2FirstRun
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7ffcc60c46f8,0x7ffcc60c4708,0x7ffcc60c4718
    3⤵
    PID:4028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,17387954213098558185,10146515445596613040,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
    3⤵
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,17387954213098558185,10146515445596613040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,17387954213098558185,10146515445596613040,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
    3⤵
    PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17387954213098558185,10146515445596613040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:3740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17387954213098558185,10146515445596613040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17387954213098558185,10146515445596613040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
    3⤵
    PID:3284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17387954213098558185,10146515445596613040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
    3⤵
    PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17387954213098558185,10146515445596613040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
    3⤵
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17387954213098558185,10146515445596613040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
    3⤵
    PID:3524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2216,17387954213098558185,10146515445596613040,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5848 /prefetch:8
    3⤵
    PID:1172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2216,17387954213098558185,10146515445596613040,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5808 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:2684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17387954213098558185,10146515445596613040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17387954213098558185,10146515445596613040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1
    3⤵
    PID:5304
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,17387954213098558185,10146515445596613040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6820 /prefetch:8
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,17387954213098558185,10146515445596613040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6820 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:5152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff783b45460,0x7ff783b45470,0x7ff783b45480
      4⤵
      PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,17387954213098558185,10146515445596613040,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c29339188732b78d10f11d3fb23063cb

SHA1
2db38f26fbc92417888251d9e31be37c9380136f

SHA256
0a61fa9e17b9ae7812cdeda5e890b22b14e53fa14a90db334f721252a9c874c2

SHA512
77f1f5f78e73f4fc01151e7e2a553dc4ed9bf35dd3a9565501f698be373640f153c6d7fc83450b9d2f29aeaa72387dd627d56f287a46635c2da07c60bc3d6e2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ccff51f965f8f4176e4ad112c34c86a7

SHA1
eab249ca0f58ed7a8afbca30bdae123136463cd8

SHA256
3eb00cf1bd645d308d0385a95a30737679be58dcc5433bc66216aac762d9da33

SHA512
8c68f146152045c2a78c9e52198b8180b261edf61a8c28364728eafb1cba1df0fa29906e5ede69b3c1e0b67cfcbeb7fde65b8d2edbc397c9a4b99ecfe8dea2dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
1e0e45343a5582d04b765aa67aee79b7

SHA1
43af4d9aef1f4bcdf436325897c8b70f83fd22e4

SHA256
d30d29a6c74d5edfd7fd91a4b3b23647aed9f79e11c4e50d8c101216246aae3d

SHA512
d9e4deb04704e6e2aff5e1b2f8b8857d0c1eb8371f88d5b6ea8d3f60b1bd440d2eb575660f82211e236416b250e65f78e378ffb1dc9a5ba021402c97698bdfd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
823f670726f2c4771edca613ba81adf5

SHA1
d180ae09f84f5aaf1721a968593129ff5cd96c84

SHA256
83b3d01af14b6a6d07786ab4f258b59f27b1aff9e296e327d431a906a2cb09e8

SHA512
bab197168e631433b56d035cd5ecdb42b3d99aef280bc329b2d5950eaff418b44849e38ce8c346c1723fd6149d36a2f6f256673692172aae86c491b7dff5bfd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4c7c73ee83e31ff2504c6a7e6f57626a

SHA1
42c6a626a83840fc40e143b543bf228e836f418e

SHA256
e47f11af33c39ee8d9535cd88c18dc6211f13951a8651ca4aa157ba2bfe3ee64

SHA512
c74df4ac8b228b84ba67db26b60a2cbb5247111de5faec7e4a2dad9968b0efd39b8d98899f85e0625decaf3ad61dbb1d688463cdc3612908bbeded1f1871faed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58fa78.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f50b6db562d8c247d218afc5d0598e97

SHA1
55d3e9b979df83ad7d73db62d3b0f94271082504

SHA256
bb20c728edb539b77500fd4e07ed462d6b265ed36a7fe14457cc27d82ae7ad88

SHA512
ef741394909caf75c6e51acae749fd8d5806f92ad886d54c3c1f0e3af9d77c34780d6a2c4f040ec242dc87e21d88a3ce641bc289b6e6c58343053b57ee6b5e1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
008358c8f4c35b35bfdee455f69fe52e

SHA1
9d8e236a80adb58fb9d5eca36f6c489dba1d909c

SHA256
a81d24d00dcac2442eb347c27da6988071cbf128088bf05440fd2937ac4a35c0

SHA512
fc83d882fa4963f110abb7ee9be016c624c76171b131ca7d0353f3f0e086f183d5c37e2db760af903432a104ff2e7fc9ebed33b0a081224c5a9c8c44a8d18f8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9f6dbc32072daa599bb15813addc6cc7

SHA1
040c239c1a743a981bc411467f6586048187ba26

SHA256
4927667f9559acce1988cd4a9ad3e4ba29c15cc8bb41efbc59d357d0c14b8802

SHA512
af4b323742b6373d769c0c1f1899d62fab87dd47c89993cf9a3a3196732c80492931a1e38cbd96de0d479d64bdb63916f6454c3156615d162a480629b29d999d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
86aa28ffd286b08415aa197216684874

SHA1
d99924976c73e3220108817ad6bc1d8b1795ca2d

SHA256
a6dc4bc6ade3039e57b538f2620b91602199f1908b23c4a2beb3fd3aa721579d

SHA512
a51fbd1af778d32f2f95a9a863a59f42a7eb804dbb8ce85459297959eea21fbfe9625d74c3f91ad65016031d4b3e26eeb748c1c59e09ac68778fc670d408d0fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
26978f38b0bce48572b90b762b7d937c

SHA1
8b8b88012fab1d37fca79575a5db81674b424867

SHA256
b38f05e2e63a1f87026aed06f5b85354570c6f91d28947466f0555276bab6afa

SHA512
501e0de5f46bfaac901cde5c39a321edc411426fd91c83427f36710fa56d20b5f6ab8f2219d963f7ab495c2df7def879652381db3876b7e2a7080921cce78379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
b7d1f687a7d5f0f80a76e048d5edad14

SHA1
3b56e41a3508dd170bbeda3b231a978423bdf520

SHA256
821629f64fadc813fc2decda537eae488a7f9d0307b119465c49a253c9e07455

SHA512
c31335e96060a12c2f8e7ddf0bf1bfd531224ee448db74980db546c1f0f8b9a9a09863b2dadd68cf2f074af69811bf6e95352ef519c25cfa22ce079a5709eca5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586750.TMP

Filesize
48B

MD5
29ff6e65c653932d24a2c0d961278aff

SHA1
a13cb8d85a32f88cfd511dcbbf6e4412761368fd

SHA256
f623072f0e488c7459e827a4c23c3862a62d320e5c653deaf1d0a8b8f003d09c

SHA512
b4ddd919f6506ccee0a1713a4312d9229bed9aa3d5237f87bd861f45b314fd46e0df7595fcbe0ecbe75601b753ee085fb1c7ceb2861586185128a6b90b9d4869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
a185dcb75cf54daea3d9c0a0f3977a7e

SHA1
744c39bb2ea6beac51fd729595009c8a565b225f

SHA256
5dac9ef06af2aac24177a77960b162b0f4b15a1e78f22d126ba8045498be9b81

SHA512
f61574e4f161cca954bca92aa80913ee6527c3b4286903f9a539cd28bf13f57342be9e24ca39f16c4c4a0a549757fded84ea5fa4b7b0c0ba28dfea555fb08c03

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Analytics.dll

Filesize
32KB

MD5
1c2bd080b0e972a3ee1579895ea17b42

SHA1
a09454bc976b4af549a6347618f846d4c93b769b

SHA256
166e1a6cf86b254525a03d1510fe76da574f977c012064df39dd6f4af72a4b29

SHA512
946e56d543a6d00674d8fa17ecd9589cba3211cfa52c978e0c9dab0fa45cdfc7787245d14308f5692bd99d621c0caca3c546259fcfa725fff9171b144514b6e0

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\DotNetZip.dll

Filesize
461KB

MD5
a999d7f3807564cc816c16f862a60bbe

SHA1
1ee724daaf70c6b0083bf589674b6f6d8427544f

SHA256
8e9c0362e9bfb3c49af59e1b4d376d3e85b13aed0fbc3f5c0e1ebc99c07345f3

SHA512
6f1f73314d86ae324cc7f55d8e6352e90d4a47f0200671f7069daa98592daaceea34cf89b47defbecdda7d3b3e4682de70e80a5275567b82aa81b002958e4414

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\EnableLoopback.exe

Filesize
82KB

MD5
81564947d42846910eec2d08310e0d25

SHA1
b7a167dcd3afb29c8a0e18c943d634e3fc58a44c

SHA256
543f16b73f7d40177585332f433ce76dddc1526e12bcd62cb73edd11eb002341

SHA512
8f06409517697b022787bc9e2ed7e73100018422177aa3f63ecb406c3bdb6b021624f909a16fca0430002bfa7d35a461b38750c79c0273a154f63316b4e13037

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe

Filesize
3.5MB

MD5
87bc17f56e744e74408e6ae8bb28b724

SHA1
3aa572388083ff00a95405d34d1189c99c7ff5be

SHA256
ffb24fc36ade87988f9908e848d0333ce7ffb2b4e4d0ffb43f6556246069d057

SHA512
cbeee155c97b87a22b92b808f86fee25c18db51ab43a36b657d532d2d47d3a7db2f4507a699b72af904bf6d5ed851d1ae1fcfb4833a57096e6c7787211c0f35d

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe.config

Filesize
261B

MD5
c2edc7b631abce6db98b978995561e57

SHA1
5b1e7a3548763cb6c30145065cfa4b85ed68eb31

SHA256
e59afc2818ad61c1338197a112c936a811c5341614f4ad9ad33d35c8356c0b14

SHA512
5bef4b5487ecb4226544ef0f68d17309cf64bfe52d5c64732480a10f94259b69d2646e4c1b22aa5c80143a4057ee17b06239ec131d5fe0af6c4ab30e351faba2

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\GA.Analytics.Monitor.dll

Filesize
52KB

MD5
6f9e5c4b5662c7f8d1159edcba6e7429

SHA1
c7630476a50a953dab490931b99d2a5eca96f9f6

SHA256
e3261a13953f4bedec65957b58074c71d2e1b9926529d48c77cfb1e70ec68790

SHA512
78fd28a0b19a3dae1d0ae151ce09a42f7542de816222105d4dafe1c0932586b799b835e611ce39a9c9424e60786fbd2949cabac3f006d611078e85b345e148c8

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Common.dll

Filesize
192KB

MD5
ac80e3ca5ec3ed77ef7f1a5648fd605a

SHA1
593077c0d921df0819d48b627d4a140967a6b9e0

SHA256
93b0f5d3a2a8a82da1368309c91286ee545b9ed9dc57ad1b31c229e2c11c00b5

SHA512
3ecc0fe3107370cb5ef5003b5317e4ea0d78bd122d662525ec4912dc30b8a1849c4fa2bbb76e6552b571f156d616456724aee6cd9495ae60a7cb4aaa6cf22159

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Editor.dll

Filesize
816KB

MD5
eaa268802c633f27fcfc90fd0f986e10

SHA1
21f3a19d6958bcfe9209df40c4fd8e7c4ce7a76f

SHA256
fe26c7e4723bf81124cdcfd5211b70f5e348250ae74b6c0abc326f1084ec3d54

SHA512
c0d6559fc482350c4ed5c5a9a0c0c58eec0a1371f5a254c20ae85521f5cec4c917596bc2ec538c665c3aa8e7ee7b2d3d322b3601d69b605914280ff38315bb47

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Syntax.dll

Filesize
228KB

MD5
3be64186e6e8ad19dc3559ee3c307070

SHA1
2f9e70e04189f6c736a3b9d0642f46208c60380a

SHA256
79a2c829de00e56d75eeb81cd97b04eae96bc41d6a2dbdc0ca4e7e0b454b1b7c

SHA512
7d0e657b3a1c23d13d1a7e7d1b95b4d9280cb08a0aca641feb9a89e6b8f0c8760499d63e240fe9c62022790a4822bf4fe2c9d9b19b12bd7f0451454be471ff78

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper

Filesize
18KB

MD5
b1827fca38a5d49fb706a4a7eee4a778

SHA1
95e342f3b6ee3ebc34f98bbb14ca042bca3d779f

SHA256
77523d1504ab2c0a4cde6fcc2c8223ca1172841e2fd9d59d18e5fc132e808ae2

SHA512
41be41372fe3c12dd97f504ebabb70ce899473c0c502ff7bfeaddc748b223c4a78625b6481dbab9cb54c10615e62b8b2dbe9a9c08eb2f69c54ebf5933efbeb1b

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Telerik.NetworkConnections.dll

Filesize
34KB

MD5
798d6938ceab9271cdc532c0943e19dc

SHA1
5f86b4cd45d2f1ffae1153683ce50bc1fb0cd2e3

SHA256
fb90b6e76fdc617ec4ebf3544da668b1f6b06c1debdba369641c3950cab73dd2

SHA512
644fde362f032e6e479750696f62e535f3e712540840c4ca27e10bdfb79b2e5277c82a6d8f55f678e223e45f883776e7f39264c234bc6062fc1865af088c0c31

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslD5EF.tmp\System.dll

Filesize
12KB

MD5
192639861e3dc2dc5c08bb8f8c7260d5

SHA1
58d30e460609e22fa0098bc27d928b689ef9af78

SHA256
23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

SHA512
6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
575924856239f063726681a01293dbd0

SHA1
94815ac4c1024f78bcf684918a10d40dfadc2f4f

SHA256
4569b4733bf9ce9eed7c525b4ebf8a116ff878b5a7226b8df20c37b2fc6f47fe

SHA512
a732a511d0004cc6ec29f383e697fe45c166aae75faa537d9e95889672a1b1904e0c0eb07850eb95cd039c9c735415d72fbcedf6c0ff617a9662437e108e810b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
6fa5276e931c288f7e0875c2da438b04

SHA1
e001afa29e0df877cb38aa8a8de843fe72005422

SHA256
7d5698eb0c595477cdb910fc06d19d9ab378fd837bcfe07273283b2218bb3ee7

SHA512
0f049dee51270fcd639dbb6c2d2daf88d29da55e82c33ea6d7e8c75f9ab5610ab880330cfb058e63800b7052f12f0570005ec60ed94533528dd2b1aa8eeb8999

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\EnableLoopback\a8e9750dcec3b7be6005a908fe2c2d8f\EnableLoopback.ni.exe

Filesize
160KB

MD5
0965e5069f4a44a943dd21af16ebea50

SHA1
4a6866a29d58672a05cdbf764a45c2b682e0cd5f

SHA256
2bf8d3166b4b3725564dfdf44072a6fe10c3a08574d7f5ac17aa80d7d3edc29b

SHA512
394c6c71bea21aebbc9f625a360e33fbb7512e919988db106c7e4120afd6c8d0b945d3238ae2a7d5f0af2c71122d57bfd8d56133f70ad00e78b65ea9ee7e84db

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\180d439c36f3cf6ec5649e1360f67487\Microsoft.JScript.ni.dll

Filesize
2.7MB

MD5
a2ef1f6d5df4e7b6447b54190a3b6ccc

SHA1
cbeb2b07942b3d9b95d3a7263629bcbec6b25ce1

SHA256
2b14dbd9d9c8050100f813b1e51942520d49ab51ef8ffde16414ac8b35765dd4

SHA512
f089315b0435d8f0cfd8523698a36205cbc493cb2ea1c561d811e9141423df20640107ad3507abba44575b970dc010d380fee6e6f3880fc8f91f63f66e000f77

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\180d439c36f3cf6ec5649e1360f67487\Microsoft.JScript.ni.dll.aux

Filesize
580B

MD5
b094143c78c988ef07a1bf541fccf4e6

SHA1
978ba20e486e74fba9cf306a7450240a96cc314c

SHA256
e6a53272d081895d24999b96ab02509ef5ac6a30a1ef901dad3f9e62252d8f80

SHA512
88eb0924df8c56a1e711b87f1a548b73aa18c90a197a3733c601e90793a4e74a0c771bd764e45111832196b2f81ebd90393c21053b3a93c7d85deee5eb536f5e

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\6c172340af3f46e7e45d3cea5ee80a56\System.Data.SqlXml.ni.dll

Filesize
3.0MB

MD5
942af167f631f760c83a8ada0592cb82

SHA1
73c08eec36472b200554465ee5d6e3f7792704ed

SHA256
c662e6d62258cfc15fb0fbb98fc3b428955ba2d7bbceced1e4f87a66d16b173b

SHA512
55944b185f4799fa81cd03d4131d6f24506d3b8329c7a0800aae486d9e75d2dcbbef2e564e4d86cfe7bc880a2bf6bac083ccb995429061666333dc56fef68418

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\6c172340af3f46e7e45d3cea5ee80a56\System.Data.SqlXml.ni.dll.aux

Filesize
708B

MD5
3c3231d300935c65976ed0ca2d93f346

SHA1
70611f15414423d2cb6db3d8bbb384e98df4996f

SHA256
96ae9bed2a9512ea7858cc3b28dc28d172cd1c3c15f60fa04ee20b8063a1b1a3

SHA512
28f2c7dd019085cd18995232f2a87ea45b834f08d1d4923b799917eceea6d3dfc8b1c1caf7c0a2fb215df79defd095e1d70eda12c2c75475a57e84225da9d666

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\88b596885c6a2aecfe43892d03c5ba6b\System.Deployment.ni.dll

Filesize
3.0MB

MD5
2ad389cde81c8ddc7056e7eba382c92d

SHA1
99eebd8f5e3471efd5e13555426c279eb1051a17

SHA256
de3a8589468a14dc7a61d19be614081d4b5000ae1604d81894f3399611e4e328

SHA512
692e35cf3f0c2351eca65f139975c8c621e60b9a7a88ab12f5d60517e6f3ead20a2b04b47c5f360090d05527e9435ba620776712474829110e67fae25619e7bd

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\88b596885c6a2aecfe43892d03c5ba6b\System.Deployment.ni.dll.aux

Filesize
1KB

MD5
218a0ba6f4d67451c5de690e2d79a50b

SHA1
2d88b63c563de1335f76678a7736d16ad0107f77

SHA256
5b3d423230067b3cd4270224ff23c0f65c4f0309525f3f0e8a9ecd4b05f633f5

SHA512
98043423bbfa6d92ce2b1077639a53ebbbe4af7fb24553e22f34ae68cc5b49d79df7d3ae6a6035567978787bbf467f7ebedc55ff3c8add1c3a20f19cf2f5acf3

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\1d73b6e28a6154a6194c12bcb15f7e62\System.EnterpriseServices.ni.dll

Filesize
993KB

MD5
f3359b0522f101ef413c20bd1063079c

SHA1
9ddac2d75148d00f4f1788ff955726f99661fd26

SHA256
8ba666e515d60118ee4d78e776292e22348cc7b8a8febf15930a500117ce34a7

SHA512
0588d7754aea9dd85bb2621adaad2cdd8dceeb6c2b0bcd2abb4b22d9e70e4158f494f78d1f7cb4270763023d8c7ddb8dd3fcb61483562d6c99200a5f45b7554e

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\0c073f42cf7c0b89bd4ceb4244060ceb\System.Numerics.ni.dll

Filesize
314KB

MD5
73699d2573263453632fe45cff1dc094

SHA1
b3df4e2af5e7520eca101c52e7145a85d29ee5df

SHA256
cc1326839110e27d2cbf5cf72d74e36ebe6346f65993353cf7c8ea5afd4be381

SHA512
489630de5b13fc1cc0ac6c93baa76b9a31da0fa48b9f53fe40d55606d3b5b344fb5bd10e549194a4187f90bb605c39b9d46ba34d93e9436862984b6688f5a71a

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\0c073f42cf7c0b89bd4ceb4244060ceb\System.Numerics.ni.dll.aux

Filesize
300B

MD5
905fbaf34d730796e231f38c60feffeb

SHA1
a8f995d3b27f6ea0feb485870832560025b50e4e

SHA256
b04b3113d61b1756e9b8087df88533276adaab7ece3d4e18cba1e956f662f21e

SHA512
4716d2ea8f71362bb5264a69abd252276fda352712ef89a7433c66366907a47b96ce3c50925a9036f9f378e5e67de2f94a2a74a4c99ca97930ef6b274c60f6f2

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt19c51595#\b8452ea2b87e2c798d586738cbd5ad6d\System.Runtime.Caching.ni.dll

Filesize
298KB

MD5
903e346ae9c438f526d0bb063cab1845

SHA1
fff27f49270d605ea4c16fd71f19ed8a5bd68177

SHA256
087562a9136a603fab70c98cff6d1f4827c6bd2041f3a5906edcd9771fb7459d

SHA512
0a7be3de049ce980b1c8f2ecfe475847892dc4196ca073de4f2342d277f823a14f0f312a42fbb01eb6f856c5234416a1def3791a84bb2f598d4e0740cd665b66

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\ab300698ff0e6328a779058c8a6abc9a\System.Runtime.Serialization.Formatters.Soap.ni.dll

Filesize
345KB

MD5
fa423347a2e17ce6ad208963bcccea75

SHA1
bfbe02326cbc38d16fcb7c18ae93cd5b19ef1bf4

SHA256
36182d6b01a0529c83f20732a1a62430d3f446bed2a8094b4a5b57423228973d

SHA512
3d99f29b8c16fe568d1f2771faad856446da626f7dc368944b4d315d1a6f603c900c70f44346febecc3f709871c3efa37afaf227ac10de81eb30ea0268f54cd0

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\ab300698ff0e6328a779058c8a6abc9a\System.Runtime.Serialization.Formatters.Soap.ni.dll.aux

Filesize
644B

MD5
659b7690365e7746edfe6e96c3f11d6d

SHA1
fdcd84bb30c5c8adeb6c9341dcba873ad3994c07

SHA256
95129a62658451e9a013e7f482bebbd2fd48c2925dca596ade2b5b9bcaa23309

SHA512
fc52c330aa042ab816e739f117e1fc0208ea8855ec6a9e19b8e3ab42b18af61794429ae85d1b8b9d902c06ae64897215e721c66674b64b31f7ca6c91034af985

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\42c7a19a453afb14fda2fe8479e4d8b2\System.Security.ni.dll

Filesize
986KB

MD5
898474cba76cf084b5d914c0f2f8f07c

SHA1
8a93edb2b46038c0e4b916f8d48c96abe0cfc241

SHA256
f2fd3ae74d836a4f971b4d8eccb109e27cd9e9f8d62ae8a4dd248828d4c936e0

SHA512
d1fae5172a4fed48fefc78954390ce356936a3bfb2331640355bc9c3659585b2f1aeda897a2c490586934682083522839b691b45fb2205c87c4cab926d5d5640

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\42c7a19a453afb14fda2fe8479e4d8b2\System.Security.ni.dll.aux

Filesize
912B

MD5
2919ee7ce3a32fb9281b48b99fb0b92c

SHA1
6aab45597d8a120a9373bac86fe3cbb19ff8e470

SHA256
d00cbd723a0870bc12e155e0edd51defcec623bb0c8fe0e927ea196da545e6a2

SHA512
b6fdbc82671af88a79e1ea6e0942a493e13a3c2527f3512079dd48b62ca704d988311ce33a944556766cea64d1b4be5460920de938c2e0ac6975e4ec55c714c1

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\3951a32a1f9c2a58922ccf04395c0db4\System.Web.RegularExpressions.ni.dll

Filesize
302KB

MD5
4c835d2d9880c333e0e35bde04a3561e

SHA1
8fcfc3b35feea63bc70cafff46ea5065b9c073e6

SHA256
4826026e8b5dd2c44f9e22c5db11dff39a680d1998ff34c19004d433660b969b

SHA512
c6ba115310e4cd6e9f904f8d3cfa4ef7cecf86f091a7a7a7dbcfcd7bdb77c09e807742b8713a7e38aae0f59761442fe81064ed5f14a9369a9c6d5fde8692f202

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\3951a32a1f9c2a58922ccf04395c0db4\System.Web.RegularExpressions.ni.dll.aux

Filesize
432B

MD5
bcfcb0dd75b706b28cb48a14c5cb38b0

SHA1
2037f7865b832efa19a85acb47ac93c306666c32

SHA256
4eec353cf49ceae3eb503b1158e1a0ed13d8dcdeabba5506e2eeae6ac55310fd

SHA512
8f4871b151da717f74b97a2423d7fd92b40d1fdc0aec79b837d96329e10902629d5b2434600a2b5e207fba6b7382a63b47c08642179d7113f94ad460819bc57a

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\debe458f6197408829bf76c18c262527\System.Web.ni.dll

Filesize
16.2MB

MD5
6ec78f886589d95ea7f788af3923deb5

SHA1
d5247883bfc4f7bf92cc1d3e062eccf89a31f3c1

SHA256
4e01f30dcb3ee4cde2ba0d9cebe4958c7ed16b55d549b29559989104c2e8ebba

SHA512
9a5375a435f1d11903a7964fe89c31df168ab96ab1c23835705b46fe5c162aebef2df7b2594caad97868dbb97015ee1c0b6241d687034267cdd2d1fad5e7bb8c

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\debe458f6197408829bf76c18c262527\System.Web.ni.dll.aux

Filesize
3KB

MD5
ce54db457bd281f7613bbbea294182a2

SHA1
7b3928359497a024795ac23943c189a14380b328

SHA256
037ab52492a546b4edf419711d56df27f81244cb2d12e4b70204578f1696986e

SHA512
d9efa87343ce6be80b5558ac39489339a1cf7a28bed996a44b322a870bf5f6a6028b96e8dc6b49d74c382d681ffc1a60ae757bccc5f856481bcaa1181693a4b0

Download Submit
memory/1228-227-0x0000064443EC0000-0x0000064443F11000-memory.dmp

Filesize
324KB

Download
memory/1636-495-0x000006443CC40000-0x000006443CEF8000-memory.dmp

Filesize
2.7MB

Download
memory/2636-106-0x0000020EC9BE0000-0x0000020EC9C92000-memory.dmp

Filesize
712KB

Download
memory/2636-107-0x0000020EC9B20000-0x0000020EC9B42000-memory.dmp

Filesize
136KB

Download
memory/2636-101-0x0000020EAFB60000-0x0000020EAFB78000-memory.dmp

Filesize
96KB

Download
memory/2636-105-0x0000020EB19D0000-0x0000020EB19F2000-memory.dmp

Filesize
136KB

Download
memory/2636-104-0x0000020EC9CB0000-0x0000020EC9E38000-memory.dmp

Filesize
1.5MB

Download
memory/2636-102-0x0000020EB1840000-0x0000020EB1890000-memory.dmp

Filesize
320KB

Download
memory/2892-103-0x0000000000FA0000-0x0000000000FA8000-memory.dmp

Filesize
32KB

Download
memory/3252-247-0x00000644451A0000-0x00000644454A4000-memory.dmp

Filesize
3.0MB

Download
memory/3256-196-0x0000064488000000-0x000006448802B000-memory.dmp

Filesize
172KB

Download
memory/3532-574-0x0000018C9B7E0000-0x0000018C9B806000-memory.dmp

Filesize
152KB

Download
memory/3532-594-0x00000644C00C0000-0x00000644C10EA000-memory.dmp

Filesize
16.2MB

Download
memory/4484-317-0x0000064445320000-0x000006444561E000-memory.dmp

Filesize
3.0MB

Download
memory/4656-211-0x0000064449A20000-0x0000064449B18000-memory.dmp

Filesize
992KB

Download
memory/4768-265-0x0000064449980000-0x00000644499D8000-memory.dmp

Filesize
352KB

Download
memory/4896-452-0x0000013080890000-0x00000130809B2000-memory.dmp

Filesize
1.1MB

Download
memory/4896-402-0x0000013080280000-0x0000013080332000-memory.dmp

Filesize
712KB

Download
memory/4896-384-0x00000130800B0000-0x000001308016A000-memory.dmp

Filesize
744KB

Download
memory/4896-486-0x000001307FBD0000-0x000001307FBE0000-memory.dmp

Filesize
64KB

Download
memory/4896-480-0x0000013080220000-0x0000013080232000-memory.dmp

Filesize
72KB

Download
memory/4896-479-0x0000013080340000-0x000001308037C000-memory.dmp

Filesize
240KB

Download
memory/4896-476-0x0000013080200000-0x0000013080220000-memory.dmp

Filesize
128KB

Download
memory/4896-475-0x0000013019CB0000-0x0000013019D2E000-memory.dmp

Filesize
504KB

Download
memory/4896-404-0x000001307FBC0000-0x000001307FBCC000-memory.dmp

Filesize
48KB

Download
memory/4896-446-0x000001307FC10000-0x000001307FC22000-memory.dmp

Filesize
72KB

Download
memory/4896-447-0x000001307FC30000-0x000001307FC50000-memory.dmp

Filesize
128KB

Download
memory/4896-449-0x0000013080710000-0x0000013080754000-memory.dmp

Filesize
272KB

Download
memory/4896-451-0x0000013080090000-0x00000130800AA000-memory.dmp

Filesize
104KB

Download
memory/4896-382-0x0000013080380000-0x0000013080704000-memory.dmp

Filesize
3.5MB

Download
memory/4896-387-0x000001307FFF0000-0x000001308006A000-memory.dmp

Filesize
488KB

Download
memory/4896-450-0x0000013080070000-0x000001308008E000-memory.dmp

Filesize
120KB

Download
memory/4896-448-0x00000130801C0000-0x00000130801F2000-memory.dmp

Filesize
200KB

Download
memory/4896-445-0x0000013080BE0000-0x00000130810AC000-memory.dmp

Filesize
4.8MB

Download
memory/4896-385-0x000001301A1E0000-0x000001301A708000-memory.dmp

Filesize
5.2MB

Download
memory/4896-389-0x000001307FBB0000-0x000001307FBBC000-memory.dmp

Filesize
48KB

Download
memory/4896-390-0x0000013080170000-0x00000130801BA000-memory.dmp

Filesize
296KB

Download
memory/4896-428-0x0000013001980000-0x00000130019BA000-memory.dmp

Filesize
232KB

Download
memory/4896-429-0x000001307FBF0000-0x000001307FC0C000-memory.dmp

Filesize
112KB

Download
memory/5612-610-0x000001AFF5920000-0x000001AFF5946000-memory.dmp

Filesize
152KB

Download
memory/5984-661-0x0000022E00000000-0x0000022E0007E000-memory.dmp

Filesize
504KB

Download