28327d9e90781c714d6951c767b3fa88396048b81178e9b691ab8edef0e59cf7

Resubmissions

13-01-2025 00:18

250113-alx6gsypem 10

05-01-2025 12:00

250105-n6nz7swjek 10

Analysis

max time kernel
121s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-01-2025 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1riage Fiddler shit.zip
Size

28.9MB
MD5

7dec47dd246b6a81c9f0992091ef2d03
SHA1

c46e9addf83d24adeb036b8ed33a6dd13c024ede
SHA256

28327d9e90781c714d6951c767b3fa88396048b81178e9b691ab8edef0e59cf7
SHA512

2b2469a6535a311d8e3cc4fb4b0aac852b3e5a15306d3f53c83255867e61314ba1adb0a1ae2089160b61a48634d388efafda6813c8020b94e2046a57e68a2de6
SSDEEP

786432:CBzytd5XjMdi0R6fu29sdi0R6fu2z+2UqeESHo4t/Isp:YzyRQRd2mRd2fMf

Score

9^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1440	netsh.exe
1992	netsh.exe

Executes dropped EXE 4 IoCs

pid	Process
2700	FiddlerSetup.5.0.20245.10105-latest.exe
2852	FiddlerSetup.exe
1708	SetupHelper
828	Fiddler.exe

Loads dropped DLL 19 IoCs

pid	Process
1192	Process not Found
1192	Process not Found
2700	FiddlerSetup.5.0.20245.10105-latest.exe
2852	FiddlerSetup.exe
2852	FiddlerSetup.exe
2852	FiddlerSetup.exe
2852	FiddlerSetup.exe
2484	mscorsvw.exe
1192	Process not Found
1192	Process not Found
2708	mscorsvw.exe
1712	mscorsvw.exe
1648	mscorsvw.exe
1648	mscorsvw.exe
2564	mscorsvw.exe
1648	mscorsvw.exe
2752	mscorsvw.exe
1244	mscorsvw.exe
2904	mscorsvw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\4dc-0\Telerik.NetworkConnections.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\DN1HEYKW3Y\Newtonsoft.Json.ni.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\39JJID4VRP\Telerik.NetworkConnections.ni.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\BA4BUQ1JFB\DotNetZip.ni.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\BA4BUQ1JFB\DotNetZip.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\YAPG2J1JLF\Microsoft.Build.Framework.ni.dll.aux	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\2145e325c531dd03775cc61606722965\Microsoft.JScript.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\ac0-0\DotNetZip.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\PIPBL7ZKMN\Microsoft.JScript.ni.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Telerik.Net8bf66678#\e5f4977994d2fd10324efd51321f1c59\Telerik.NetworkConnections.ni.dll.aux.tmp	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\83RY4OLRVY\Microsoft.Build.Utilities.v4.0.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\DN1HEYKW3Y\Newtonsoft.Json.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\SZIMGP07XB\Microsoft.Build.Tasks.v4.0.ni.dll.aux	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Newtonsoft.Json\399708e37f6b243e3c60338d349dc53a\Newtonsoft.Json.ni.dll.aux.tmp	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\39JJID4VRP\Telerik.NetworkConnections.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\SZIMGP07XB\Microsoft.Build.Tasks.v4.0.ni.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\YAPG2J1JLF\Microsoft.Build.Framework.ni.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\83RY4OLRVY\Microsoft.Build.Utilities.v4.0.ni.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\PIPBL7ZKMN\Microsoft.JScript.ni.dll.aux	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\DotNetZip\5635f8414edae06a1b5d07ea0cbdc9ed\DotNetZip.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\b58-0\Newtonsoft.Json.dll	mscorsvw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupHelper
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FiddlerSetup.5.0.20245.10105-latest.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FiddlerSetup.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\MAIN	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Fiddler.exe = "0"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Fiddler.exe = "9999"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TypedURLs	Fiddler.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{EDCCEA53-CB5C-11EF-9DC4-5A85C185DB3E}.dat = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EDCCEA51-CB5C-11EF-9DC4-5A85C185DB3E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe\" -noattach \"%1\""	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open &in Viewer\command	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Fiddler.ArchiveZip\Content Type = "application/vnd.telerik-fiddler.SessionArchive"	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Fiddler.ArchiveZip\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\SAZ.ico"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open\command	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\.saz	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open &in Viewer	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\.saz\ = "Fiddler.ArchiveZip"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Fiddler.ArchiveZip	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Fiddler.ArchiveZip\DefaultIcon	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open &in Viewer\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe\" -viewer \"%1\""	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Fiddler.ArchiveZip\ = "Fiddler Session Archive"	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Fiddler.ArchiveZip\PerceivedType = "compressed"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Fiddler.ArchiveZip\Shell	FiddlerSetup.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
828	Fiddler.exe
828	Fiddler.exe
828	Fiddler.exe
828	Fiddler.exe
828	Fiddler.exe
828	Fiddler.exe
828	Fiddler.exe
828	Fiddler.exe
828	Fiddler.exe
828	Fiddler.exe
828	Fiddler.exe
828	Fiddler.exe
828	Fiddler.exe
828	Fiddler.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
828	Fiddler.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2292	7zFM.exe
Token: 35	2292	7zFM.exe
Token: SeSecurityPrivilege	2292	7zFM.exe
Token: SeDebugPrivilege	828	Fiddler.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2292	7zFM.exe
2292	7zFM.exe
2292	7zFM.exe
1732	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1732	iexplore.exe
1732	iexplore.exe
296	IEXPLORE.EXE
296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2852	2700	FiddlerSetup.5.0.20245.10105-latest.exe	33
PID 2700 wrote to memory of 2852	2700	FiddlerSetup.5.0.20245.10105-latest.exe	33
PID 2700 wrote to memory of 2852	2700	FiddlerSetup.5.0.20245.10105-latest.exe	33
PID 2700 wrote to memory of 2852	2700	FiddlerSetup.5.0.20245.10105-latest.exe	33
PID 2700 wrote to memory of 2852	2700	FiddlerSetup.5.0.20245.10105-latest.exe	33
PID 2700 wrote to memory of 2852	2700	FiddlerSetup.5.0.20245.10105-latest.exe	33
PID 2700 wrote to memory of 2852	2700	FiddlerSetup.5.0.20245.10105-latest.exe	33
PID 2852 wrote to memory of 1440	2852	FiddlerSetup.exe	34
PID 2852 wrote to memory of 1440	2852	FiddlerSetup.exe	34
PID 2852 wrote to memory of 1440	2852	FiddlerSetup.exe	34
PID 2852 wrote to memory of 1440	2852	FiddlerSetup.exe	34
PID 2852 wrote to memory of 1992	2852	FiddlerSetup.exe	36
PID 2852 wrote to memory of 1992	2852	FiddlerSetup.exe	36
PID 2852 wrote to memory of 1992	2852	FiddlerSetup.exe	36
PID 2852 wrote to memory of 1992	2852	FiddlerSetup.exe	36
PID 2852 wrote to memory of 1744	2852	FiddlerSetup.exe	38
PID 2852 wrote to memory of 1744	2852	FiddlerSetup.exe	38
PID 2852 wrote to memory of 1744	2852	FiddlerSetup.exe	38
PID 2852 wrote to memory of 1744	2852	FiddlerSetup.exe	38
PID 2852 wrote to memory of 2888	2852	FiddlerSetup.exe	40
PID 2852 wrote to memory of 2888	2852	FiddlerSetup.exe	40
PID 2852 wrote to memory of 2888	2852	FiddlerSetup.exe	40
PID 2852 wrote to memory of 2888	2852	FiddlerSetup.exe	40
PID 2852 wrote to memory of 1708	2852	FiddlerSetup.exe	42
PID 2852 wrote to memory of 1708	2852	FiddlerSetup.exe	42
PID 2852 wrote to memory of 1708	2852	FiddlerSetup.exe	42
PID 2852 wrote to memory of 1708	2852	FiddlerSetup.exe	42
PID 2852 wrote to memory of 1708	2852	FiddlerSetup.exe	42
PID 2852 wrote to memory of 1708	2852	FiddlerSetup.exe	42
PID 2852 wrote to memory of 1708	2852	FiddlerSetup.exe	42
PID 2852 wrote to memory of 1732	2852	FiddlerSetup.exe	45
PID 2852 wrote to memory of 1732	2852	FiddlerSetup.exe	45
PID 2852 wrote to memory of 1732	2852	FiddlerSetup.exe	45
PID 2852 wrote to memory of 1732	2852	FiddlerSetup.exe	45
PID 1732 wrote to memory of 296	1732	iexplore.exe	46
PID 1732 wrote to memory of 296	1732	iexplore.exe	46
PID 1732 wrote to memory of 296	1732	iexplore.exe	46
PID 1732 wrote to memory of 296	1732	iexplore.exe	46

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\1riage Fiddler shit.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2292

C:\Users\Admin\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe
"C:\Users\Admin\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\nseF4EB.tmp\FiddlerSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\nseF4EB.tmp\FiddlerSetup.exe" /D=
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="FiddlerProxy"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1440
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="FiddlerProxy" program="C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe" action=allow profile=any dir=in edge=deferuser protocol=tcp description="Permit inbound connections to Fiddler"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1992
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
    3⤵
    PID:1744
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 104 -InterruptEvent 0 -NGENProcess f4 -Pipe 100 -Comment "NGen Worker Process"
      4⤵
      PID:2196
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 168 -InterruptEvent 0 -NGENProcess f4 -Pipe 16c -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      PID:2484
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 190 -InterruptEvent 0 -NGENProcess 170 -Pipe 188 -Comment "NGen Worker Process"
      4⤵
      PID:2928
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent f4 -InterruptEvent 0 -NGENProcess 174 -Pipe 1b8 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      PID:2708
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent f4 -InterruptEvent 0 -NGENProcess 1c8 -Pipe 18c -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      PID:1712
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent f4 -InterruptEvent 0 -NGENProcess 198 -Pipe 190 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      PID:1648
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess f4 -Pipe 170 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      PID:2564
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 104 -InterruptEvent 0 -NGENProcess 1b4 -Pipe 174 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      PID:2752
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 104 -InterruptEvent 0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      PID:1244
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 104 -InterruptEvent 0 -NGENProcess 1cc -Pipe 1d4 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      PID:2904
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 0 -NGENProcess 1bc -Pipe 104 -Comment "NGen Worker Process"
      4⤵
      PID:2152
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b4 -InterruptEvent 0 -NGENProcess 1cc -Pipe 1c0 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:1528
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent f4 -InterruptEvent 0 -NGENProcess 1b4 -Pipe 1c8 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:1584
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 168 -InterruptEvent 0 -NGENProcess f4 -Pipe 1dc -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:2524
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 0 -NGENProcess 168 -Pipe 1bc -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:2148
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 0 -NGENProcess 1e0 -Pipe 1cc -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:2292
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 0 -NGENProcess 1e4 -Pipe 1b4 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:2804
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 0 -NGENProcess 1e8 -Pipe f4 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:2300
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\EnableLoopback.exe"
    3⤵
    PID:2888
- - C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper
    "C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper" /a "C:\Users\Admin\AppData\Local\Programs\Fiddler"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1708
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://fiddler2.com/r/?Fiddler2FirstRun
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:296

C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe
"C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
1⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:828

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\USERS\ADMIN\APPDATA\LOCAL\PROGRAMS\FIDDLER\PLUGINS\NETWORKCONNECTIONS\TELERIK.NETWORKCONNECTIONS.WINDOWS.DLL

Filesize
33KB

MD5
5889357424d717c8629c8bfabcd0be50

SHA1
87e7047a40e24bd5ac23f89e072ee39a14a53023

SHA256
3564b25b24569b8d8a0128f2f4bddec89c0b8986da7542d9c64aac730360a600

SHA512
1af458742cefd4730d64b19ecc05460354f0e47a79cdcd7794877aa0f6c56cfb92f37a0daf66fedaec2a579eb0187d774b7d5ba1fff65d6ab1504df4c3668fad

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Analytics.dll

Filesize
32KB

MD5
1c2bd080b0e972a3ee1579895ea17b42

SHA1
a09454bc976b4af549a6347618f846d4c93b769b

SHA256
166e1a6cf86b254525a03d1510fe76da574f977c012064df39dd6f4af72a4b29

SHA512
946e56d543a6d00674d8fa17ecd9589cba3211cfa52c978e0c9dab0fa45cdfc7787245d14308f5692bd99d621c0caca3c546259fcfa725fff9171b144514b6e0

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\DotNetZip.dll

Filesize
461KB

MD5
a999d7f3807564cc816c16f862a60bbe

SHA1
1ee724daaf70c6b0083bf589674b6f6d8427544f

SHA256
8e9c0362e9bfb3c49af59e1b4d376d3e85b13aed0fbc3f5c0e1ebc99c07345f3

SHA512
6f1f73314d86ae324cc7f55d8e6352e90d4a47f0200671f7069daa98592daaceea34cf89b47defbecdda7d3b3e4682de70e80a5275567b82aa81b002958e4414

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe.config

Filesize
261B

MD5
c2edc7b631abce6db98b978995561e57

SHA1
5b1e7a3548763cb6c30145065cfa4b85ed68eb31

SHA256
e59afc2818ad61c1338197a112c936a811c5341614f4ad9ad33d35c8356c0b14

SHA512
5bef4b5487ecb4226544ef0f68d17309cf64bfe52d5c64732480a10f94259b69d2646e4c1b22aa5c80143a4057ee17b06239ec131d5fe0af6c4ab30e351faba2

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.pdb

Filesize
1.8MB

MD5
5c43b7f1cff2f8f74d0c75721dd34797

SHA1
75acf5d64bd38a4483b8ca99ec7d89af4a13e060

SHA256
9c50823f84ce09af60ed760c95ce73da559505dbf411ef7797f4ce65fc0bf1bb

SHA512
41984c51a4fff1ec003ace3e86a26a1a0612cc86df995fea9d2183e937fc8e20ec44e796ae7178ab12df657337016a88d1fac5da55ccdd56f048ab7e7f089661

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\GA.Analytics.Monitor.dll

Filesize
52KB

MD5
6f9e5c4b5662c7f8d1159edcba6e7429

SHA1
c7630476a50a953dab490931b99d2a5eca96f9f6

SHA256
e3261a13953f4bedec65957b58074c71d2e1b9926529d48c77cfb1e70ec68790

SHA512
78fd28a0b19a3dae1d0ae151ce09a42f7542de816222105d4dafe1c0932586b799b835e611ce39a9c9424e60786fbd2949cabac3f006d611078e85b345e148c8

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Inspectors\Standard.dll

Filesize
246KB

MD5
2f2dcf9a8bea903a95abb95808066201

SHA1
98b473a015e874638d35731710b5790fe8ec9df9

SHA256
e7f653b706f4d083d089670b8862b579f888450d3184085bc970daa3ff040012

SHA512
228f56acea5ac941dcb192775f8e8e8230c0b0e24487f135bfb5025b1a1bf64ee8cc733c44f5dcdc8eb2f63a9040e9a8ec251ec3e105f81e3007d31a15608344

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Inspectors\SyntaxView.dll

Filesize
68KB

MD5
49c71e4f9141cc77798718e41ec8a0d3

SHA1
84bf7e9f3a462dbbe7ee3e627a83422cf0df4d08

SHA256
9c5178b2aab92a79be9e4b31e2214d6650961b53bbdc48d952d20725e473b2fe

SHA512
ed7d35e6929670cd181a398b4c09fdf444b7eacff147a9be3bc783944e65541ebf883629fc23d6c6b642eb6719e8e9fa8a4d1c4c9ef65ba78d1ea5539f9f4843

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Common.dll

Filesize
192KB

MD5
ac80e3ca5ec3ed77ef7f1a5648fd605a

SHA1
593077c0d921df0819d48b627d4a140967a6b9e0

SHA256
93b0f5d3a2a8a82da1368309c91286ee545b9ed9dc57ad1b31c229e2c11c00b5

SHA512
3ecc0fe3107370cb5ef5003b5317e4ea0d78bd122d662525ec4912dc30b8a1849c4fa2bbb76e6552b571f156d616456724aee6cd9495ae60a7cb4aaa6cf22159

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Editor.dll

Filesize
816KB

MD5
eaa268802c633f27fcfc90fd0f986e10

SHA1
21f3a19d6958bcfe9209df40c4fd8e7c4ce7a76f

SHA256
fe26c7e4723bf81124cdcfd5211b70f5e348250ae74b6c0abc326f1084ec3d54

SHA512
c0d6559fc482350c4ed5c5a9a0c0c58eec0a1371f5a254c20ae85521f5cec4c917596bc2ec538c665c3aa8e7ee7b2d3d322b3601d69b605914280ff38315bb47

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Syntax.dll

Filesize
228KB

MD5
3be64186e6e8ad19dc3559ee3c307070

SHA1
2f9e70e04189f6c736a3b9d0642f46208c60380a

SHA256
79a2c829de00e56d75eeb81cd97b04eae96bc41d6a2dbdc0ca4e7e0b454b1b7c

SHA512
7d0e657b3a1c23d13d1a7e7d1b95b4d9280cb08a0aca641feb9a89e6b8f0c8760499d63e240fe9c62022790a4822bf4fe2c9d9b19b12bd7f0451454be471ff78

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Addon.dll

Filesize
47KB

MD5
465761effbd26e70fb83595cb5f8a20a

SHA1
9b98750ebbc7ce144a2f8150f3b1d8201a53a2af

SHA256
38a7fa0c13d5700eec8178db2116a51c7e23d97871dbd159fb16104f91c0bfee

SHA512
063c93d8cfc0dd17d56abccb25c00c430066a117e993205ceb0161260214a104627672eaac0ea2ec6c8be488cd2056b92cf002c94c873efcf464efe35efbda7c

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Connection.dll

Filesize
1.8MB

MD5
19d00193a0df0b4d0734d209989f594c

SHA1
1adaabf30ef7350df16b7fed023bd980809f4086

SHA256
7a041deb6934864bc3c057d1440f00e2e56104018069e57201f0fc877ef78713

SHA512
6402fa43a1b0e5a96f3270751f18be7b22774fa59a1a6737a0c1549642ef4f148765eaf30776c46f371d5dff69a164454b908ad00fc371d8bdeeddc52f7c9789

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Protocol.dll

Filesize
23KB

MD5
d045d2bebb047748dcc73d2bb50ab6d1

SHA1
1a793331a1724a82d25a989006530461b2311955

SHA256
cbcbffd8cd89ddcf1e4d6a4ab6f0d3c14112cac8e03e3f8f2236bab96977ebe2

SHA512
1359f51a80204d0a8c100dc24dcf473f494f871ff430599779c20a9f747428074387dd607a3c594993179e2b46269fb97409a486f02e5f3ae9f6a36c1354df01

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Utilities.dll

Filesize
18KB

MD5
0bd9f14a40e05bdac2c6e79ae92f3081

SHA1
049c44cefb7789d93796f6ed3415476f4c3be6b9

SHA256
da9ba58734468c70efd57a7da7cf6d9f5405bc563eb2136b7a6e7b1b07fe6f3e

SHA512
d759dd46e2d47a1a18a04c8f44f91390ffd917ff76ec1d4898dec93512ef7b6f33b045f22835e8225f4f679c09210df3fca6649143fd507edf7cc3002b40be4e

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Scripts\RulesTab2.dll

Filesize
34KB

MD5
042541ff2925d654930906b654b724aa

SHA1
ece609e7b1871530473cedb77c375535ab15044a

SHA256
dac4bf7e1eb765e462a43e6567602d35f512118bab9f75a0a4da972966972941

SHA512
25879cc5ee5bfdb43ef044d449d6f636a0d330480750dd4e4b9243fb702ea978d667e7c64f5080ce95e540411bbdae34f29ae6533be81002dea7dd9cc6c9a965

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Scripts\SampleRules.js

Filesize
22KB

MD5
cb7bf8b2d0e15c0ecc290a242b9f743a

SHA1
f1215262c0729dc6700fd5158ef6e437e64a4821

SHA256
69cc5397e0fa9f99a0d21476da21147631a213f9f15652f8f182f34025abb500

SHA512
49202347079e366477ba67372b086f5064b108c0c40aa52dfd833dee821b87cc37d9929d5da4fefdd62a824ebf34c161107f08ea7b33d866d21c266ce99972fe

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Scripts\SimpleFilter.dll

Filesize
136KB

MD5
c258bdc1ade8a12029f394db00956db9

SHA1
adfabb841df1c3cfa1fb1e97a5b3f8783054baa1

SHA256
487f39724bf1e4f387e131e6d932a0900bc949153077e200ddbc1a8e80b08337

SHA512
093d3909859c7907bbf6034460a3cd0b087e4890d25c515199c612a9febad2fd9b3c1acf4d639c8e9fbb6092d183258919ba68c308e9f3e9205b0680ba89bed9

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Scripts\Timeline.dll

Filesize
39KB

MD5
10c47bca8ff64c65a0c987b29a2dc53c

SHA1
e7c2a97e4c27dc3641707f04be1de351aa96e897

SHA256
6a26c68a703720ecae24b54b4e288d7c2f486fdba18afd90fab09223d2fc1fb6

SHA512
cc7cd0b390d6b899244f9b2856b410e8486d879bf196e1c521761724fb0b0984ee33521d10c7046a06a11112e34f1222031ca266468e1c3012d42ebc09411d39

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Telerik.NetworkConnections.dll

Filesize
34KB

MD5
798d6938ceab9271cdc532c0943e19dc

SHA1
5f86b4cd45d2f1ffae1153683ce50bc1fb0cd2e3

SHA256
fb90b6e76fdc617ec4ebf3544da668b1f6b06c1debdba369641c3950cab73dd2

SHA512
644fde362f032e6e479750696f62e535f3e712540840c4ca27e10bdfb79b2e5277c82a6d8f55f678e223e45f883776e7f39264c234bc6062fc1865af088c0c31

Download Submit
C:\Users\Admin\AppData\Local\Progress_Software_Corpora\Fiddler.exe_Url_gn2suaigfhhkewccgutguryxxqm34vvg\5.0.20245.10105\user.config

Filesize
966B

MD5
f14c6ea7f67f535aa03b8fb0d992e00f

SHA1
a850fc41e231d57ebf8dd6eb1022ccb2b70c5422

SHA256
e7effea7cb349f8210bc76514e842fa6bae4aed0f8249e708d2afb47518ee02e

SHA512
f9d954262ca66c858a50bc43712bec0648f7c74b656d8c8c57768598c9d39f806ca9dbf382eb99eafd3a777107fdea35daee1a98412eeb3e95ce13c5ffbf5446

Download Submit
C:\Users\Admin\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe

Filesize
4.4MB

MD5
c1980b018489df28be8809eb32519001

SHA1
e860439703d7b6665af4507b20bbef2bbb7b73f4

SHA256
588024037b1e5929b1f2a741fff52a207bcab17f0650ec7cb0cd3cb78051998d

SHA512
f70d419e869e56700a9e23350a9779f5dd56bb78adb9a1b0d5039287a24f20004db20f842294d234d4717feaa3184a5e6d90f0ee3666208bad2ea518d37b0a35

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B3325a29b#\4f44abb46807a5ad0f0bf1ae5ba48323\Microsoft.Build.Framework.ni.dll.aux

Filesize
588B

MD5
90dde7396bbc17dddaa7dcdec75c2d7b

SHA1
613a143997175a531af577c3e47611d006cd585c

SHA256
a3613a9ea1e995ce43a3754b3eab8f09325f039188593a4666bba0fa56dc5c03

SHA512
3cb619a3fe00d5cff37830e080a5db2e27d122293fb15f200a6bb59ad905d32bb99c720d36d1a8f6fcd89cad5c8e2610dbf89c09db28f7ec1974041d4b026c18

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B83e9cb53#\4a58f2013ffa484c7f872e70952613ca\Microsoft.Build.Utilities.v4.0.ni.dll.aux

Filesize
888B

MD5
0c2e9bf2f96be2986d8b8449c0028067

SHA1
c41ba485bc1d847ebba609bc4bcc37b4109f7fca

SHA256
4d9d156b27b902a1265a2d36a47fb285ecba5abb97ca730df3893f3397f5da4a

SHA512
8a8eb919323d37cacad9665b671d5639bcd4f0955997f5321a486c1e3179bb6762b2ae009cc658b402dbb4dc0d873e110e58f5b67565c458eff2d16c8f1e46f1

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\2145e325c531dd03775cc61606722965\Microsoft.JScript.ni.dll.aux

Filesize
580B

MD5
0fa7a2200ae2493f05b85e85688aa663

SHA1
18ce43782b1a150948a3c80df0dd3374372cf675

SHA256
d2573a4a215ae02c70b6fac850c22931a757c18ff243c16b819b03d1dc2bf92e

SHA512
84629c719112dc1257a89bd0de5d4be7465abe6b81a25c8326a05f5001c51e6f3b921652cb81da68bbec7e975f476aed6f8606d1da6e736f456c65853072e129

Download Submit
C:\Windows\assembly\temp\39JJID4VRP\Telerik.NetworkConnections.ni.dll.aux

Filesize
732B

MD5
61d90bbb5964d416b86d7ef8b9adef40

SHA1
eba684714c32c9f2939499ee896a492122da707d

SHA256
9051805012f5ce17fc5f4a71482b34f9c0c4b61bf640ee31f48719a926782ab9

SHA512
867d21199f7fd950cdf9a4f2ce5435326abd7411a137f60c406b8ec185ae7d50e211dbf98a37591aba24bdd00fbcfee974e46f6691e8589e6dae2d11e2e8f47a

Download Submit
C:\Windows\assembly\temp\BA4BUQ1JFB\DotNetZip.ni.dll.aux

Filesize
532B

MD5
e9169857138b22906989cd8645579dff

SHA1
9f2f0537c6f57e9a7605c6ac8e0cf4664880cb63

SHA256
fe9553b117abc7414ed50595392bcce48f3f86cf6ef802bca0e1c0a1674ceb46

SHA512
93d1a876aae2c160d437c3a81ad593a7343958d94a02d90fd382b72ee276715c1148e2b9ff6f3a7928e3c555f252e0aa2540a24cfba433eadb6809dbf5a45fd4

Download Submit
C:\Windows\assembly\temp\DN1HEYKW3Y\Newtonsoft.Json.ni.dll.aux

Filesize
1KB

MD5
d338ba1b3d95ae9e95583db208df2174

SHA1
e160de175d1abe04983e0fbc9d652b52945a061c

SHA256
cfdb9f0cb1a77233fc2e036372ee76763de6ce37961fd323e36cdbe9fb661061

SHA512
e56ed6af3e807d20036a2dc4415f547b2e8646f41c4b68365fd9e70c0c5d01977899df229f8b222fdc60bc2789f5155048c876c95a6a1a8ec6a68eb30de52ed9

Download Submit
C:\Windows\assembly\temp\SZIMGP07XB\Microsoft.Build.Tasks.v4.0.ni.dll.aux

Filesize
2KB

MD5
c228a99297b86188b16cd8ae9f9e95c7

SHA1
b4603bf9196c3908a94ddff0ac2e51d1edd40777

SHA256
4bf1bad2d0aa458307845c6cfff003ad168b9af1c183d4fd44de734bf66ead97

SHA512
f6933920fa6c75bd3facbc91d8b6d594461ebfd54c5557155fbda4d6fd35c135d2438e377538540103947f7394d404d05dc7b08fd731e067cf45d94919cf474d

Download Submit
\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe

Filesize
3.5MB

MD5
87bc17f56e744e74408e6ae8bb28b724

SHA1
3aa572388083ff00a95405d34d1189c99c7ff5be

SHA256
ffb24fc36ade87988f9908e848d0333ce7ffb2b4e4d0ffb43f6556246069d057

SHA512
cbeee155c97b87a22b92b808f86fee25c18db51ab43a36b657d532d2d47d3a7db2f4507a699b72af904bf6d5ed851d1ae1fcfb4833a57096e6c7787211c0f35d

Download Submit
\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\FSE2.exe

Filesize
50KB

MD5
c2fe7c92a8fc763407233203b49685f9

SHA1
d2f199e71eb7531caa71f85a679e49fa400cc401

SHA256
f55d5cb9968bcb875dc39cc84153bd52375f4cf8a680e0f5eb53a57a7e532561

SHA512
f74d29f4520ae0c9aa153f3649bdf80c1ed882a61add7267eafaecb2d036f43fc44434279e3dacd763ebc42fedc78ec3ad52a11b55d14b224b01a8bebca0f6b5

Download Submit
\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper

Filesize
18KB

MD5
b1827fca38a5d49fb706a4a7eee4a778

SHA1
95e342f3b6ee3ebc34f98bbb14ca042bca3d779f

SHA256
77523d1504ab2c0a4cde6fcc2c8223ca1172841e2fd9d59d18e5fc132e808ae2

SHA512
41be41372fe3c12dd97f504ebabb70ce899473c0c502ff7bfeaddc748b223c4a78625b6481dbab9cb54c10615e62b8b2dbe9a9c08eb2f69c54ebf5933efbeb1b

Download Submit
\Users\Admin\AppData\Local\Temp\nse4C4.tmp\System.dll

Filesize
12KB

MD5
192639861e3dc2dc5c08bb8f8c7260d5

SHA1
58d30e460609e22fa0098bc27d928b689ef9af78

SHA256
23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

SHA512
6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

Download Submit
\Users\Admin\AppData\Local\Temp\nseF4EB.tmp\FiddlerSetup.exe

Filesize
4.4MB

MD5
c2a0eb6f104eacec3f39581451ee208f

SHA1
9ae7d02aeb640fbd090dfc01885b98dd5dd0b6cc

SHA256
1f926cc353301e547e76c6d2eff23fcbe85495ba0292174cc6344fac26457af8

SHA512
8b062e4f0af1dce3a12b5776646fe8c235f30de6772f579da1a6ab2bb559ed69b3bd32af95eee248c48008ddcbd40a7e49eae722a44bc9b49dd13fe38113a3ca

Download Submit
\Users\Admin\Desktop\update.exe

Filesize
6.1MB

MD5
30cfb7377d8b7806ae0e9e282583f380

SHA1
05e2ae9447d7358ae8ee6718c17b557159acf9d6

SHA256
3a10d9a84eddf651eec618f9a9b6019f33988af5cebec34aeef043182394e802

SHA512
4928f7a513455d90e42f4ccd20d85d92899191b56aada1f4c8cbb59dd30a5384c4e0f7f1e08e5ef8ecd21da7e26c7acd99689c58dcafa7c5438d998eab97b722

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\DotNetZip\5635f8414edae06a1b5d07ea0cbdc9ed\DotNetZip.ni.dll

Filesize
1.0MB

MD5
8343f1a30bcc16e7b45856ccb4e36f02

SHA1
d63a840c79ec4053e116a93a827ad1d0b147a9e1

SHA256
4bd4fb6127e136939557ecdbac8ee5200fa1056df8c7b2fc3a7e5198615502b7

SHA512
f0046c44408d87ede8b482b9240cdb1dc47662e4b3524db1f7d1e13d8b735a8509b54e95fb9deea97c2404c3c6bada86fd3501e2813237553faf33b31c424a4d

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B3325a29b#\4f44abb46807a5ad0f0bf1ae5ba48323\Microsoft.Build.Framework.ni.dll

Filesize
546KB

MD5
75de4db178e3310ebf8bfa83a003b8e2

SHA1
c0d05985fb9e28ede26b00143d939839cb0e3ae6

SHA256
304ae94177bcd5f8659eb5a232676c2a9857dc495c273fce2e2e65fab4ae4eb6

SHA512
4310161d72d60ef55a5ca6601bf4f5773518a9fcbeab4fda60afc18b334a1fbded3a5426795ed3587b5c51e2f6fc39176014a75e75aca2d3cfafc8a19d85b983

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B83e9cb53#\4a58f2013ffa484c7f872e70952613ca\Microsoft.Build.Utilities.v4.0.ni.dll

Filesize
1011KB

MD5
6d7e1bc098c599dc54b552531ed637ac

SHA1
ff4648a4ce473a3cbe6e3c75e1c606d593353de1

SHA256
874ece1c76a575a96e174eb846edcbeb6134ee66e71bfd025a250a7406627ef5

SHA512
1e88c80b969c0ac44e880316189ce3789f2fb0d8044e39c90ef99edfe4de83f7c21dc21adf4c51f6d88f77b92035b519794ed91d9d04c74cef971aa3424ce04a

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Baa2ca56b#\faa890702be0a0b8574aa82cb24b9da3\Microsoft.Build.Tasks.v4.0.ni.dll

Filesize
4.1MB

MD5
07de6b9bdeebae49461ef58e29953464

SHA1
5ba78e69c3d93724c6a3de013157b9350bcd6eb9

SHA256
85da41cc1f1beac3528bab39240912ecb8ac7fb313a89342e3fffd9cf0a99c74

SHA512
1b10add9a8cab2913299a03da26ad4fcb84826ff33c847d53078d18e3459b4c07a3b0ee52b67d9fe2f5b90ae7f98da502369159c2edc3e81fa569242184ab0b4

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\2145e325c531dd03775cc61606722965\Microsoft.JScript.ni.dll

Filesize
2.7MB

MD5
d1d5dd7761a0e2c31c2baeeb4442a6ba

SHA1
c681dca866baa02e7840bffdbcff349da69ba25c

SHA256
84676accc10df0f610772b5d447b058a9fd3c4d399cddc01ef6510d9832915f1

SHA512
59891b98e42635c056debe5fdd373b3d31ef1731c653c7df179c0db8544c6bfc6e4899d62a3068b76a652e71899b285e1757260ccaa805658e1e77e00cb9b263

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Newtonsoft.Json\399708e37f6b243e3c60338d349dc53a\Newtonsoft.Json.ni.dll

Filesize
3.6MB

MD5
248048fcedfd5cb2d51cc6ce815cc6e7

SHA1
502df74dc5c54c7400242830194029d34fb46891

SHA256
404296d3d998442262a8a413c2f1697f2ba1f2222b573a888204004afadbdfb9

SHA512
d56ad2b11ee66fe2841239cea7bbfd4d43d73ab9400e040d504cb70d2feabacfc81cdc61f4acdb46a83e16859877a5695992545d0a94299ed8677a22d1a01528

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Telerik.Net8bf66678#\e5f4977994d2fd10324efd51321f1c59\Telerik.NetworkConnections.ni.dll

Filesize
94KB

MD5
8c1196b2476c2ae2dee297e3db1cf37f

SHA1
27b4c6bc7876d7f52f34bffe2fb1f3cee88444ff

SHA256
f298ac1090234846c34b192f4683d34477f84f5eb8b844afedac9d4de246e104

SHA512
cd4bbe93c3a40035c65358ba714f39b8c6770aa44bdb87ed6dd23292f7a641c3da3977691fb1ecf83f1dbb6fe704edc6eeb817d1da48b4f2f9de62cf9c2ec591

Download Submit
memory/828-412-0x0000000020D20000-0x0000000020EFA000-memory.dmp

Filesize
1.9MB

Download
memory/828-408-0x000000001C390000-0x000000001C3A2000-memory.dmp

Filesize
72KB

Download
memory/828-423-0x000000001CDD0000-0x000000001CDDE000-memory.dmp

Filesize
56KB

Download
memory/828-406-0x000000001C000000-0x000000001C042000-memory.dmp

Filesize
264KB

Download
memory/828-421-0x000000001CDA0000-0x000000001CDC6000-memory.dmp

Filesize
152KB

Download
memory/828-410-0x000000001B2D0000-0x000000001B2E0000-memory.dmp

Filesize
64KB

Download
memory/828-428-0x000000001D020000-0x000000001D028000-memory.dmp

Filesize
32KB

Download
memory/828-404-0x000000001B190000-0x000000001B19C000-memory.dmp

Filesize
48KB

Download
memory/828-417-0x000000001C3B0000-0x000000001C3B8000-memory.dmp

Filesize
32KB

Download
memory/828-436-0x000000001F8C0000-0x000000001F972000-memory.dmp

Filesize
712KB

Download
memory/828-415-0x000000001C050000-0x000000001C05A000-memory.dmp

Filesize
40KB

Download
memory/828-403-0x000000001B190000-0x000000001B19C000-memory.dmp

Filesize
48KB

Download
memory/828-427-0x0000000021890000-0x0000000021D8E000-memory.dmp

Filesize
5.0MB

Download
memory/828-426-0x0000000021390000-0x000000002188E000-memory.dmp

Filesize
5.0MB

Download
memory/828-413-0x000000001CD70000-0x000000001CD8A000-memory.dmp

Filesize
104KB

Download
memory/828-391-0x00000000003B0000-0x0000000000734000-memory.dmp

Filesize
3.5MB

Download
memory/828-433-0x000000001B090000-0x000000001B0A0000-memory.dmp

Filesize
64KB

Download
memory/828-424-0x00000000205E0000-0x000000002069A000-memory.dmp

Filesize
744KB

Download
memory/828-429-0x000000001D030000-0x000000001D038000-memory.dmp

Filesize
32KB

Download
memory/828-419-0x000000001CD90000-0x000000001CD9C000-memory.dmp

Filesize
48KB

Download
memory/828-400-0x0000000000880000-0x000000000088C000-memory.dmp

Filesize
48KB

Download
memory/828-401-0x000000001B100000-0x000000001B10C000-memory.dmp

Filesize
48KB

Download
memory/1244-360-0x00000644A0000000-0x00000644A001A000-memory.dmp

Filesize
104KB

Download
memory/1648-330-0x0000064438000000-0x0000064438429000-memory.dmp

Filesize
4.2MB

Download
memory/1648-312-0x000000001B210000-0x000000001B332000-memory.dmp

Filesize
1.1MB

Download
memory/1708-149-0x0000000000D70000-0x0000000000D78000-memory.dmp

Filesize
32KB

Download
memory/1712-296-0x0000000000170000-0x000000000018A000-memory.dmp

Filesize
104KB

Download
memory/1712-297-0x0000064438000000-0x000006443808B000-memory.dmp

Filesize
556KB

Download
memory/2196-248-0x00000000005F0000-0x000000000060A000-memory.dmp

Filesize
104KB

Download
memory/2196-236-0x000000001B640000-0x000000001B9C4000-memory.dmp

Filesize
3.5MB

Download
memory/2196-238-0x0000000002760000-0x000000000281A000-memory.dmp

Filesize
744KB

Download
memory/2196-240-0x00000000006B0000-0x000000000072A000-memory.dmp

Filesize
488KB

Download
memory/2196-242-0x00000000003C0000-0x00000000003CC000-memory.dmp

Filesize
48KB

Download
memory/2196-244-0x0000000002930000-0x00000000029E2000-memory.dmp

Filesize
712KB

Download
memory/2196-246-0x00000000005E0000-0x00000000005EC000-memory.dmp

Filesize
48KB

Download
memory/2196-247-0x00000000022E0000-0x0000000002324000-memory.dmp

Filesize
272KB

Download
memory/2196-249-0x000000001B2B0000-0x000000001B3D2000-memory.dmp

Filesize
1.1MB

Download
memory/2196-251-0x0000000000690000-0x00000000006A0000-memory.dmp

Filesize
64KB

Download
memory/2484-252-0x0000000001EF0000-0x0000000001FAA000-memory.dmp

Filesize
744KB

Download
memory/2484-257-0x000006443CC40000-0x000006443CEEC000-memory.dmp

Filesize
2.7MB

Download
memory/2564-322-0x000000001B420000-0x000000001B7A4000-memory.dmp

Filesize
3.5MB

Download
memory/2564-327-0x0000000000590000-0x000000000059C000-memory.dmp

Filesize
48KB

Download
memory/2564-326-0x000000001B290000-0x000000001B30A000-memory.dmp

Filesize
488KB

Download
memory/2564-328-0x0000000000690000-0x000000000069C000-memory.dmp

Filesize
48KB

Download
memory/2564-329-0x000000001B310000-0x000000001B3C2000-memory.dmp

Filesize
712KB

Download
memory/2708-281-0x0000064438000000-0x00000644380FF000-memory.dmp

Filesize
1020KB

Download
memory/2708-279-0x0000000002680000-0x00000000026C4000-memory.dmp

Filesize
272KB

Download
memory/2708-280-0x00000000007D0000-0x00000000007EA000-memory.dmp

Filesize
104KB

Download
memory/2752-345-0x00000644A0000000-0x00000644A0109000-memory.dmp

Filesize
1.0MB

Download
memory/2904-375-0x00000644A0000000-0x00000644A03A2000-memory.dmp

Filesize
3.6MB

Download
memory/2928-255-0x00000000005F0000-0x00000000005FC000-memory.dmp

Filesize
48KB

Download
memory/2928-256-0x0000000002AB0000-0x0000000002B62000-memory.dmp

Filesize
712KB

Download
memory/2928-253-0x0000000002380000-0x00000000023FA000-memory.dmp

Filesize
488KB

Download
memory/2928-254-0x00000000005E0000-0x00000000005EC000-memory.dmp

Filesize
48KB

Download