28327d9e90781c714d6951c767b3fa88396048b81178e9b691ab8edef0e59cf7

Analysis

max time kernel
117s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-01-2025 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FiddlerSetup.5.0.20245.10105-latest.exe
Size

4.4MB
MD5

c1980b018489df28be8809eb32519001
SHA1

e860439703d7b6665af4507b20bbef2bbb7b73f4
SHA256

588024037b1e5929b1f2a741fff52a207bcab17f0650ec7cb0cd3cb78051998d
SHA512

f70d419e869e56700a9e23350a9779f5dd56bb78adb9a1b0d5039287a24f20004db20f842294d234d4717feaa3184a5e6d90f0ee3666208bad2ea518d37b0a35
SSDEEP

98304:qMgxyUnSAaB1eXq8yOkLiGXv72Qomw6pvtFIAwdaRdA:qMoWvePjqHv72Qo96pvtF5wH

Score

9^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2032	netsh.exe
1108	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
1732	FiddlerSetup.exe
2340	SetupHelper

Loads dropped DLL 18 IoCs

pid	Process
3020	FiddlerSetup.5.0.20245.10105-latest.exe
1732	FiddlerSetup.exe
1732	FiddlerSetup.exe
1732	FiddlerSetup.exe
1732	FiddlerSetup.exe
2992	mscorsvw.exe
2092	mscorsvw.exe
2792	mscorsvw.exe
2272	mscorsvw.exe
2272	mscorsvw.exe
2272	mscorsvw.exe
1036	mscorsvw.exe
2480	mscorsvw.exe
2480	mscorsvw.exe
2440	mscorsvw.exe
1888	mscorsvw.exe
2608	mscorsvw.exe
2224	mscorsvw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 27 IoCs

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\GA.Analytics.Monitor\3bf155f5fe5c3c876614c4d82313933c\GA.Analytics.Monitor.ni.dll.aux.tmp	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\SBYGW4ONJO\Microsoft.Build.Framework.ni.dll.aux	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\988-0\Telerik.NetworkConnections.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Newtonsoft.Json\399708e37f6b243e3c60338d349dc53a\Newtonsoft.Json.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Analytics\d756563aa7cd4e9c00502605394ea611\Analytics.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\8b0-0\GA.Analytics.Monitor.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\410BXYB1ED\DotNetZip.ni.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\MYUELBAUW1\Microsoft.Build.Tasks.v4.0.ni.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\a30-0\Analytics.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\41DMN5NVAO\Microsoft.JScript.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\44AZMKE5TO\GA.Analytics.Monitor.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\ZANVKFCTJN\Newtonsoft.Json.ni.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\410BXYB1ED\DotNetZip.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\SBYGW4ONJO\Microsoft.Build.Framework.ni.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\2145e325c531dd03775cc61606722965\Microsoft.JScript.ni.dll.aux.tmp	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\44AZMKE5TO\GA.Analytics.Monitor.ni.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\JREQYKJ962\Microsoft.Build.Utilities.v4.0.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\JREQYKJ962\Microsoft.Build.Utilities.v4.0.ni.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Telerik.Net8bf66678#\e5f4977994d2fd10324efd51321f1c59\Telerik.NetworkConnections.ni.dll.aux.tmp	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\W63DLZQ267\Telerik.NetworkConnections.ni.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\760-0\Newtonsoft.Json.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\40c-0\DotNetZip.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\DotNetZip\5635f8414edae06a1b5d07ea0cbdc9ed\DotNetZip.ni.dll.aux.tmp	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\MYUELBAUW1\Microsoft.Build.Tasks.v4.0.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\ZANVKFCTJN\Newtonsoft.Json.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\W63DLZQ267\Telerik.NetworkConnections.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\41DMN5NVAO\Microsoft.JScript.ni.dll	mscorsvw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FiddlerSetup.5.0.20245.10105-latest.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FiddlerSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupHelper
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 56 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001377e3ca675de34b99eff7a3a4288a98000000000200000000001066000000010000200000001060a8a2b7a42f1400ea12c721c380f4a7482ab43fb756c2810d73deb34606c1000000000e8000000002000020000000ef03cfbfc8328dc1efcef8b288ab67daae7e66d27603ddf0f6f4648014479f14900000003179c5a88380acd7eb38dac5e1d88fbe3d4a2de18ad0293e7a81108fae231234d80b1418bb559a619610f2a94d0d4074e1ac50c17beb59cdcc349bc3a5a2e9b3561218aed5fc9234523b8221fb2d9b0e9fac6184da73d59897a1f954a1ddb898a50076de9907820d89b946b806113f767579a6cdec0e3e87afe07b86aefa774bfe280bf8c77aa2ce0a91fefa555d79544000000073e09af6133563e1f52a12b298eb00bca8723a3b705dadc369722548af66af71242b4670108df4c707c97692e96c9e0928cdf79fd6bbe1305f150de1771ae1c1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Fiddler.exe = "9999"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.telerik.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage\telerik.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage\telerik.com\Total = "5"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage\telerik.com\Total = "187"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506431cc6b5fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Fiddler.exe = "0"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.telerik.com\ = "5"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001377e3ca675de34b99eff7a3a4288a9800000000020000000000106600000001000020000000b2e042982d32c21f6a1f66af1141e2454560c65aced5db95150d31d8b234497c000000000e80000000020000200000008d232c6a899ba884e8e7cc60f77f0fa645f111711c425e61bdf62816208aaefd200000002edf5e5ac0c0964602a6535c7ff77591a4073792cb0ea2be2cee92799e581109400000004035ffd42e7d3feec41e1a8a36a5be82cc8de03cb85377539f76318edd6a727d7afa914f50a74a85991ee113d60d83ae2f2ddb54e46bf116fb50a8446ad261c0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage\telerik.com\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage\telerik.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "187"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.telerik.com\ = "187"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\MAIN	FiddlerSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442241278"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	FiddlerSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F1876F61-CB5E-11EF-B38B-EAF82BEC9AF0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	FiddlerSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "5"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.telerik.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Fiddler.ArchiveZip\Content Type = "application/vnd.telerik-fiddler.SessionArchive"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open\command	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open &in Viewer\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe\" -viewer \"%1\""	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\.saz	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\.saz\ = "Fiddler.ArchiveZip"	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Fiddler.ArchiveZip\PerceivedType = "compressed"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Fiddler.ArchiveZip\DefaultIcon	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Fiddler.ArchiveZip\Shell	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe\" -noattach \"%1\""	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Fiddler.ArchiveZip	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Fiddler.ArchiveZip\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\SAZ.ico"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open &in Viewer	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Fiddler.ArchiveZip\ = "Fiddler Session Archive"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open &in Viewer\command	FiddlerSetup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1536	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1536	iexplore.exe
1536	iexplore.exe
744	IEXPLORE.EXE
744	IEXPLORE.EXE
744	IEXPLORE.EXE
744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1732	3020	FiddlerSetup.5.0.20245.10105-latest.exe	30
PID 3020 wrote to memory of 1732	3020	FiddlerSetup.5.0.20245.10105-latest.exe	30
PID 3020 wrote to memory of 1732	3020	FiddlerSetup.5.0.20245.10105-latest.exe	30
PID 3020 wrote to memory of 1732	3020	FiddlerSetup.5.0.20245.10105-latest.exe	30
PID 3020 wrote to memory of 1732	3020	FiddlerSetup.5.0.20245.10105-latest.exe	30
PID 3020 wrote to memory of 1732	3020	FiddlerSetup.5.0.20245.10105-latest.exe	30
PID 3020 wrote to memory of 1732	3020	FiddlerSetup.5.0.20245.10105-latest.exe	30
PID 1732 wrote to memory of 2032	1732	FiddlerSetup.exe	32
PID 1732 wrote to memory of 2032	1732	FiddlerSetup.exe	32
PID 1732 wrote to memory of 2032	1732	FiddlerSetup.exe	32
PID 1732 wrote to memory of 2032	1732	FiddlerSetup.exe	32
PID 1732 wrote to memory of 1108	1732	FiddlerSetup.exe	33
PID 1732 wrote to memory of 1108	1732	FiddlerSetup.exe	33
PID 1732 wrote to memory of 1108	1732	FiddlerSetup.exe	33
PID 1732 wrote to memory of 1108	1732	FiddlerSetup.exe	33
PID 1732 wrote to memory of 704	1732	FiddlerSetup.exe	36
PID 1732 wrote to memory of 704	1732	FiddlerSetup.exe	36
PID 1732 wrote to memory of 704	1732	FiddlerSetup.exe	36
PID 1732 wrote to memory of 704	1732	FiddlerSetup.exe	36
PID 1732 wrote to memory of 1956	1732	FiddlerSetup.exe	38
PID 1732 wrote to memory of 1956	1732	FiddlerSetup.exe	38
PID 1732 wrote to memory of 1956	1732	FiddlerSetup.exe	38
PID 1732 wrote to memory of 1956	1732	FiddlerSetup.exe	38
PID 1732 wrote to memory of 2340	1732	FiddlerSetup.exe	40
PID 1732 wrote to memory of 2340	1732	FiddlerSetup.exe	40
PID 1732 wrote to memory of 2340	1732	FiddlerSetup.exe	40
PID 1732 wrote to memory of 2340	1732	FiddlerSetup.exe	40
PID 1732 wrote to memory of 2340	1732	FiddlerSetup.exe	40
PID 1732 wrote to memory of 2340	1732	FiddlerSetup.exe	40
PID 1732 wrote to memory of 2340	1732	FiddlerSetup.exe	40
PID 1732 wrote to memory of 1536	1732	FiddlerSetup.exe	43
PID 1732 wrote to memory of 1536	1732	FiddlerSetup.exe	43
PID 1732 wrote to memory of 1536	1732	FiddlerSetup.exe	43
PID 1732 wrote to memory of 1536	1732	FiddlerSetup.exe	43
PID 1536 wrote to memory of 744	1536	iexplore.exe	44
PID 1536 wrote to memory of 744	1536	iexplore.exe	44
PID 1536 wrote to memory of 744	1536	iexplore.exe	44
PID 1536 wrote to memory of 744	1536	iexplore.exe	44

C:\Users\Admin\AppData\Local\Temp\FiddlerSetup.5.0.20245.10105-latest.exe
"C:\Users\Admin\AppData\Local\Temp\FiddlerSetup.5.0.20245.10105-latest.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\nsjB81A.tmp\FiddlerSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\nsjB81A.tmp\FiddlerSetup.exe" /D=
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="FiddlerProxy"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2032
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="FiddlerProxy" program="C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe" action=allow profile=any dir=in edge=deferuser protocol=tcp description="Permit inbound connections to Fiddler"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1108
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
    3⤵
    PID:704
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 104 -InterruptEvent 0 -NGENProcess f4 -Pipe 100 -Comment "NGen Worker Process"
      4⤵
      PID:1592
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 168 -InterruptEvent 0 -NGENProcess 160 -Pipe 164 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      PID:2992
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 18c -InterruptEvent 0 -NGENProcess 17c -Pipe 184 -Comment "NGen Worker Process"
      4⤵
      PID:1528
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 15c -InterruptEvent 0 -NGENProcess 160 -Pipe 188 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      PID:2092
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 15c -InterruptEvent 0 -NGENProcess 1c0 -Pipe 1b0 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      PID:2792
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 15c -InterruptEvent 0 -NGENProcess 1b4 -Pipe 1b8 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      PID:2272
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 15c -InterruptEvent 0 -NGENProcess 17c -Pipe 1bc -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      PID:1036
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 0 -NGENProcess 18c -Pipe 17c -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      PID:2480
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 160 -InterruptEvent 0 -NGENProcess 1c8 -Pipe 1c4 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      PID:2440
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 0 -NGENProcess 15c -Pipe 1c0 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      PID:1888
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 0 -NGENProcess 160 -Pipe 1e4 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      PID:2608
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 0 -NGENProcess 1dc -Pipe 160 -Comment "NGen Worker Process"
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      PID:2224
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 0 -NGENProcess 1dc -Pipe 1d0 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:2952
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 194 -InterruptEvent 0 -NGENProcess 1cc -Pipe 1e8 -Comment "NGen Worker Process"
      4⤵
      PID:2176
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 18c -InterruptEvent 0 -NGENProcess 194 -Pipe 15c -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:1316
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 0 -NGENProcess 18c -Pipe 180 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:1788
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 0 -NGENProcess 1d8 -Pipe 1dc -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:980
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 0 -NGENProcess 1e0 -Pipe 1cc -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:1420
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 0 -NGENProcess 1ec -Pipe 194 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:2588
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 0 -NGENProcess 1f0 -Pipe 18c -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:1976
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f8 -InterruptEvent 0 -NGENProcess 1f4 -Pipe 1ec -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:2864
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\EnableLoopback.exe"
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper
    "C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper" /a "C:\Users\Admin\AppData\Local\Programs\Fiddler"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2340
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://fiddler2.com/r/?Fiddler2FirstRun
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1536 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8

Filesize
1KB

MD5
85b0efeadbc89397ccf3414d982f623a

SHA1
9b72e0198657ccd3497c262849c64fbfd995bf4f

SHA256
af9c941f68d9b2fac90ef8196d9e1c65d15fddec16ad06e802d7477c3c1ac658

SHA512
a8a5b057d836824a18445612caede64dcdae0c48d6215290327dad245c60038fd290a2dae6bc959f24def4ce00a0529459f4ac21a847d29f9e2e15957a3e4d53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
2KB

MD5
34f1d4c2a19e3e24efe08326983ff5b0

SHA1
f6e713a73e69f79114a6816e7eb54d2652e33d80

SHA256
f0c52ef726d47e236a6df1a244e5a9663a44988f094249a69695b112ee005960

SHA512
2426e7c678c37026391e413ef03c0b54bd2fb75b4217b9518df2f647fe2882f6727d1e206dbb35b07312a9346277e440f53920d15003d72391ee80988847ca7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
1KB

MD5
a59b60139c0abca69ae678202c1b759b

SHA1
fac5827b9e016a93936b32c9ed23a5cef5fd5686

SHA256
72c8963c7e156f618678ea8b839a1b358c07559cfcc9cd7b3c0c6a96d9758aa4

SHA512
2c22bad1c3b87c46715077d43f00fc3e66198656ebe826f41f5cd61d8729a58bf2e82b499ed2595eb525d304f693e10860d5d75be295e6c207c8711f481a8105

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
65b0c89f43eb806ee4253df82d0f5cca

SHA1
8ee956a0c9acbc955b76d1371a6cfa94892bd269

SHA256
162fecf817a83c2515bf5e0c61ae6b5f78e335c6d054f3a2bf044a457c8aacf2

SHA512
9711c48c43aeb42944cf5500a4a889c2340e706b9f49d540e42be8f72f6ca3e68fbba58d62f3fcd5832545c97dab81cf93b2432a4bf7dccee910b50796159fc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
075b405ff64dbb1b92f95c202b269eda

SHA1
aeb020e804fc08e4e027e7bf5d696ad73352d767

SHA256
2b77ddda383cc25ba12283eed7fd3ee6f1d0982482f76d822cf8dee142fbed29

SHA512
05d30547d863d92483ee22143fcfc75aa279ba71b39282d4deaed66394c5f4e613ca94b3c6ba32de206e40b2f2bb824d996ddb0f1e8fa4350ecdb10d4d84dea5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
64e73710859e9294c19644096bb07138

SHA1
abe144b306eaee0d8a418548f239106540a419e5

SHA256
13ece3abb80a98f8cae4f4d41eb15833ac13626e6a244c2ea5147fe33e98dbdc

SHA512
56c07616c60f5c0e8faad41798c3b28c7837dfb77b2f5e7e6fe9b6f940bb3e5906e9b4614c97688f2f1d5a1a0b0cd59005c4237ac595737a12d02007a75a583e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8

Filesize
438B

MD5
b4d4257f35d611372e1a56d3a8cc708f

SHA1
520c54ddb972b010736a56188c999eb9a3cc6868

SHA256
1ea8087d80e3a3d3c5604919bd2c8de64a9df59495c617624de462d50b0f00fd

SHA512
7250a5feadfe0f28b4f9f02ee52d73fa274d55919a691a9292ee55b22cde7462ad58b73e4b05efc652a63b73b468fe3a8a99f6326f8140f8ecf4cada776cee20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddc17936f540abb61aaf3ea501317fb9

SHA1
995ad0fac8f49ab27347929f75fc17f7cc4d77cd

SHA256
2d6168601862225c9ccb05a9fb3240b6284c4607900eb899ed50a99d8a539d33

SHA512
819df8e8365471b8619590690fdd0c9ff55c55b9aa42e8a3e130e8a6ad9470a634bf21251ecbecd461fd301fe0b35c9f45b6ca6338865ed97a9e3dc2fbbf187d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5346732782db3ed5063ec1954d108ae0

SHA1
09d52f3ffecea475f158209cc361c5f0f37ed6df

SHA256
96fbb451769a6ecf9c64e10f88c393228c58e5810bb191daf03f94704e14ff1f

SHA512
039f5567bdffe092ddc23ab65942a4805ef9895a5ac0dc2602f3281e4760ebb5094a09ff51894dcaec75665eda308a7ea4795c809707484d44bcba230fc741f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c43de6ac88317b62fffc7cd7a85991e

SHA1
abd3963b95f936c7d31e49cd5499c4981a0ab84e

SHA256
748474708466a8d0649f6ee47c74359245810f3fc680a0fd57eee00245fb3404

SHA512
851c2795650a340a363feb9db06345e677af4afac10fe780eea1794819d5755c67e064c6ad359b5bf6359829a91bc3fa90e4eee2700667d52f359238df324692

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19969456d2f57e82d094f84043127a2a

SHA1
3d953a1ca6f0d621b4ba65448e03f8602c8d0b3e

SHA256
c0114edaa6d8c9e915898188614b8473450f02985cfdb5dff27761fa4149d473

SHA512
0e2ee66e215f31e05c50ead158c9382c35bfe068996a5717fa18b89d538bbb2e96fdbfa60965af73633ecf83d22cea34c87200518a4136cb2424f6fc1988008b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ba67338ecba455f398ab674011921b5

SHA1
645a510cde9418170b8cf02ee6975b526fcd61ab

SHA256
a27cae770d1ba3e8bc03ab8372ed158204fb27e11c7b7b48505c5f4b6a061928

SHA512
2b50da74869f9e51919cd7dd6f3b9fe4347f4dc750ae9ac2b52258556fee8851553f6408149ce77ea9328c176ab88bcdc67bf7c456a471aa353b3f116e90cad8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eed3630a874a6619214db771e90cceda

SHA1
d386f24e37a7a7e062ada42a871de3ed610fe619

SHA256
cf7ce623336d44b39d45f152f5efec2eb3ecd3e71ce31101ffa53c699f4d7e31

SHA512
637921a28915a10376046602477f613bbe436096abefcba599cace09913b4ebf9b8085f675f87cd685a8ed540dccf3acdb4c47695984d46b5e42b2b95f63bd01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bfdc04538f91aeff368f188302bd6e1

SHA1
f92a3ad23ae8f15e1fbb54050e45cdebc3c918fe

SHA256
9e95db14052ac055a1fa4603fe4c76b0a41def058d76f35a167927649499cf47

SHA512
2210ce07c5cb2c9d5b209a03d0d9a6515a0630634f68c8e71738f68c232809b3c1aca3c48fc4fc8169f40051b73c3041bb05c81596481315044c572a20e14a6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d41fa8132766ee69236ec1d11245b0b6

SHA1
9034487916945c2afc8ca7760cba5d3d7945108f

SHA256
4a281bce4dd9a95b462fb80697afd4353d211903732a0504a4b07771df16199b

SHA512
935d8c23d6f76832bee73069bbfd21d1cfb391ff441c2400f9ffa79320de27989a2666ffe027286dfca8755305d128ad55df97d0677c4f56dc25ac1d14f6cfb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b26f66055b6a63d5857a6d1a966e9237

SHA1
801a99a50720f2705acb1fc98304920f80e9d7e0

SHA256
1e834fcc4a9eda7be56a584014b2f8803891184ed77c13d1b0c8359ff3f2dcf9

SHA512
0faa8a25820fdde3fbee6d8461fbe2cbc0b369efbede85ecdd28805d23ef137fcb4dd5bff4072f0ef97069889ebdae21ba307129d13098ece7922b139169ccf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84364392b0be1c935d5e9cabaad9d9d4

SHA1
609b3911ccad24c795ede825bcee14e8843dbd69

SHA256
340b77d835d31c926ec868e7683d1f0a9490a5a32414966cfbfc1fe3d71e6776

SHA512
4eee2208a8e7f2add91e4c3b812d4bc05663a8f401c3f11082cbf498f696bb01435d34f70479704d5fe1394253d46059f201bc400036a69a7fabde990cb01671

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a401cdfa7cce5c38f29035a57bef5d86

SHA1
60ab53e7f3c8a6e8b20579a8b9fdb3b5ca3aeb98

SHA256
ca7a70ed6ac8dd3972d999d0aee2e06bfd73f7cbf26ddd407d3cd2ccd62df04e

SHA512
d1c42f5f2746f9ef0213bd35b940b2f055eafed08f64fb206a78696159b93ee3d3efcb769c94e0a2f57b35e2ac22d261bedfebfe3d133dc52e265728a41c9430

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3173642a575c20b609857f07788df40

SHA1
7a53a7a1819aeb6d5c876074462bc624cea03b84

SHA256
aa12fa9a2c8ec175090f3e1089bbcfb7ddd826153dcccfe3e9a84aae2701bc01

SHA512
04385f0969e72f4dcbc10d0a8248f1a42307f3c6e9a6f0adc5a31cdaada95c5b0b3affc68844ef1265d0bb20ed43855d56709e5bedc3fc163af83b45b3221971

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76b831c9c5699f651dc5283bdfd5979f

SHA1
18a94c42929b106e2c9d384f9872b14e1f00bc91

SHA256
4e8d53d1b1e63bbc3335f28a8fe87f358f856efaa024b7e8cafaf4c0d0e2366b

SHA512
f50b73627e5a0b203411ffda5cea6dec4f7ef4f385b8a768e13f172969ba1f17bc72dfc38b2ecc739dfaebc868279005c511cffe3ca53f467456f96c6f8a37bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dde8eca698ac5d8f0335fc7721f1ccc

SHA1
b8d2d46392f3c3bc824be5160409bd1d4e5c50e2

SHA256
024c45eff801e4c5a59b5e3edef57508933a29d7b8baf3d9f39bf35c3672ca4c

SHA512
1ec977acadbd28924d8e050802b483e0c4bec0b63de637a7a921c035c642c17c2569bcde7c6c7356f2b2b42446bee8a10cc313eec345e15862d4c3d7bf17b11e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fe3aeab2fe133975e7bd74f08396dd0

SHA1
9aeb88b941226182848878b60f345d5966908378

SHA256
b094550f739c3b3d8d2d28257b7545bb063c3c3adacfebbbffa902a30d916365

SHA512
c808ed9b5d67cc91bd1cbe516a7042344ade445a8d7fee5c98b47d2f3f910f76bd645c905b42743749cf895d2d2daf9f06ce4d362921059bd25230a5a4a3d225

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab3ae4e579acb18e2f15b09659b41439

SHA1
3f4cab30e2df6799251cac1169a959d0cf763224

SHA256
bf7b8e4b6bb935fbe337740a4dc6503de00990fd2578d85193847a291f7b6669

SHA512
0eb638e0eae3015568813f78ea343d6385759b06601e75c3cb09953331e1245e2fcb10e5708324df55eb3034d9ede832bf39fac883c96eaa1cca14b0d392dfa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
107180c3650e3053efcf7dac5b1c9c71

SHA1
45d9ad2bd9c350fc3ce6115d8cb783eec4aaf0a6

SHA256
b075c75badf741ca1a19bdf113c63699712bd04b3bbe3b891e6817ec75f51048

SHA512
be3609f8891eaf51be668a50d1a246413d3f2e4539d69b63048bd6ad78ee7f8c00b9f452eb93fe5b6acb192cc08adfd77c1cb619a7899e0cd908a90ec0caf7c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d7f90195175a5822d8ef4687450bd2e

SHA1
8b0ca818910b221c6957c6096b8808badb372e78

SHA256
eb9c94fba1ef90300101dc882ab4bf166a6abf0da4893dfa8f0401fcd5ad20eb

SHA512
3b4ce06a208bfec089a982403e2e37cc32519a3d0adfd264943cc21346f05ad3edbe206c982eceefb6e07468290c84efd97a8dc0cc1c3b5b9d9fffc56ca10610

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ae07ac69780c8ecf0a9d813c4c44895

SHA1
ad63ddd4e9e720d07a24b456867980e650fd428a

SHA256
3cae96149071a742443efb80592509e2293eba3a1d6d4dcf4310c8e3d75cf372

SHA512
c8381194c36222886356d36de0160d0b2d166aae2fa0858ee9299641a96495d5e6c2b1cda4858c5c3e7c01df9133c1f031f56a5e2b25a37ddfbcf8f685ba91a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd55d7b42bbcd7312eefe98ee472ce0e

SHA1
91294ed6edfedc3697546bc31a97b311eca8576f

SHA256
1f992f730459292ffe9491ebc8194aaa50b88f31ff7fca568fdcd8312382e0c3

SHA512
b4c9f254139ae40f3d75e89ba633e62affa25ba59a3b4f41095e1f011329012f0fde3ab856902ca489541a41713e8cfa0734cde70e63abb07096ee4e1ed3ee88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2dba0dad0507adf05996491514f05fc2

SHA1
847ea23ecf44098b499a4375ca1d2a6de2f05d1b

SHA256
7556f6b210f08a6acff2f40a5dc556d963b8b5f5741d0ecef69f79abd9e3051d

SHA512
f9aa6459aae385c89e68017dcdd6194922070a6d78ae1cc8981d78cc9b0b3ebb6fc6c25c2f033f5c2c6c00de50a579a95929c07a6030e5cbcc3bf01d32017243

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b6852b49c6ef0209ceec49317834e9b

SHA1
04e9d0c71289d401c2c8ccc0722c443ea4284bfa

SHA256
6080aa6b8e60bee162528958a894df75d76debbd0606d9fc74712d5d1ac1b419

SHA512
ba900b148e6fbefde5a5d08dc8c94c59eb9b64fc0fd5a886dac8ddac1aef2d23eafee90b82e046fe4ce172cb3b9df23cd48346b675bd0aa35eddba8f51b6dea0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8debb2e53230e4b7eb08936aca2d2be2

SHA1
46063b303f385006af790046c506ec4a4c8fccf1

SHA256
28ec34212a41706d5fbb369829910a2af6b4724d9258bad329c7528da26ab73b

SHA512
4e6e85a6a437400a233773fa33522e230387c9c3066f44046aa09a7a07ba54869f6ba24c1a7a3be624da2055a9d2458843deeb1412ec3a4e875506aacaa48dbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88334f8811d1b4622c03f042f3218cfe

SHA1
5a8e3167ea046d7ab1954c5690793af241ff7a38

SHA256
cacd131493ad1d57bfb2815a58d45fc6658b634480f3b18c0782a244cfcf69c2

SHA512
9542b363e41ea30d8d5dcb03b451ac1adc92a859777b51d06e411bcf08a49601df5d7647ba7eebb75ac024af6b983942ee973621a7a9325806c50ae26e651e19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b732b2c2c192c88797d1e1848631ee6

SHA1
a2bba6ffbbf49df3813c3ccab2335d3fb37ea237

SHA256
27ba6be98e4d1ab416bb9cbb94979e5e50ac65503f8f1b3589f3711c3c06374a

SHA512
d0c8cba86111c9b2598975486850206754cd31f6366ed778c4dead71dac4a8ede378c531abcea34e178cde474bb1b3e3459d34c5d1ab725d615e1ee420a3182e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fafb765e54e2ba7433396d438505eb1b

SHA1
05d12097b919af1a2421afc45da8c32bfe054eb7

SHA256
0a897154d4e99e9262de67f48d54ac199fc134caffb897ccb61cf8a8c2d4032a

SHA512
b3641b5126d8adcd98cf7bddad7fe2faa6c433bd1fcebf540de4e67d6c4ce8280c7a810b5ec719f2d45c63e853d59fc8e7ef386d825e9e39678ed308c2281e12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3891ea17359aee67733371f6a83e1ad0

SHA1
35d8192604b85f0f2ccf04d65d60fe96ae7a079e

SHA256
a74c2ca575eb0ef9fc86d7f53fb733f2ebd60f06211aa7f4a87398c6472a8d4f

SHA512
40ad602952dbf67eabe4451b3e05191416d13d7fa8aaa16f70e99ecbe4cf9642882a66fd11f930dc0071b1d78c31a6b418fa57c5f824a9ea6cf8b40ad65b9410

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
458B

MD5
921145a1e0645e9fb54d3e9617b0e9c8

SHA1
7c278361e5c9f5acad23a7b6bdd9ba16dda74f77

SHA256
6d8b04acfe1304394e560825f20e006fd15ed7e42531927f615909ab6cdb07a8

SHA512
0b6f70dc8af10a436e9a8a5f16b5c19a2208fe94035b1649414755ed2b3223a2a0a04f263a3f0e03d3d181bc5cde7363efdfb7ce4861058a54a06fcdfa7d73ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
432B

MD5
a6b6d6cf4dd74339514828adbbee7063

SHA1
2c1e8549204a4b4e055d375b08ea9044189f2b8b

SHA256
f1fa48ac6438ec301ecd1e92c8b5ec26ccb0ff5a0b6384dab49c342c00833027

SHA512
7ac0f1ec156ac196b113fdc750860c1eca04866b9bbfa0af967d0d348b74ee63c1b77cfd586f7a6d7e70036c207d7bb0c04d9513a36eeaf4f9c8e945a1328aa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
3588a92b1f8266fc6730b8e4f1704c68

SHA1
f64597def3dc830bfd2e7a6042bedfa40c53b4d0

SHA256
9fecbc4ecba1bb0a8eccd2b0a7e137ea87de058832d10fbeccb4cf6f9b270304

SHA512
72736dc8a8fb289db634cc0de5d13f42464b3829e655d65437ac5d5621fa549876a5e16d41746b83ddf79961c06bcac380fa69adcaf2e6ce76de9022e5f3bdf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\KW4VD3O0\www.telerik[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\bl977i7\imagestore.dat

Filesize
21KB

MD5
d4c251802a3dc86c734ba22aacbfc405

SHA1
ebab98c020c3c40c5898256ed015a0b14d570392

SHA256
2377d2c001973574319fee41ca84879d6468ed1da73d19bb342e9f98e08fcf29

SHA512
09b130749b540b8f9b9f69b7c942fd87b92e9cb1e38ba89448351a96b278dd1b07d86117078dd7d5500e3a98715521454f52aafc294d4293af59303bb742c1c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y1738IZL\favicon[1].ico

Filesize
20KB

MD5
12649f4e0c5a37d4a41cbca768c8e7e0

SHA1
1257dd7949f4aa81c8f791dceeedd66e486dc3a0

SHA256
7b990b226fb3e8970b750dec91d4e8b9b59b2b7b069d0243d7bf70febe8ede53

SHA512
a0f96e89664c938ed38b33a127ef56b882f2ef3a60a4e01324602905b054c50a0ab87a725a21e61c3c60b5225e8825cbeab8c5664c2e59be168071f1ce1eeed4

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Analytics.dll

Filesize
32KB

MD5
1c2bd080b0e972a3ee1579895ea17b42

SHA1
a09454bc976b4af549a6347618f846d4c93b769b

SHA256
166e1a6cf86b254525a03d1510fe76da574f977c012064df39dd6f4af72a4b29

SHA512
946e56d543a6d00674d8fa17ecd9589cba3211cfa52c978e0c9dab0fa45cdfc7787245d14308f5692bd99d621c0caca3c546259fcfa725fff9171b144514b6e0

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\DotNetZip.dll

Filesize
461KB

MD5
a999d7f3807564cc816c16f862a60bbe

SHA1
1ee724daaf70c6b0083bf589674b6f6d8427544f

SHA256
8e9c0362e9bfb3c49af59e1b4d376d3e85b13aed0fbc3f5c0e1ebc99c07345f3

SHA512
6f1f73314d86ae324cc7f55d8e6352e90d4a47f0200671f7069daa98592daaceea34cf89b47defbecdda7d3b3e4682de70e80a5275567b82aa81b002958e4414

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe.config

Filesize
261B

MD5
c2edc7b631abce6db98b978995561e57

SHA1
5b1e7a3548763cb6c30145065cfa4b85ed68eb31

SHA256
e59afc2818ad61c1338197a112c936a811c5341614f4ad9ad33d35c8356c0b14

SHA512
5bef4b5487ecb4226544ef0f68d17309cf64bfe52d5c64732480a10f94259b69d2646e4c1b22aa5c80143a4057ee17b06239ec131d5fe0af6c4ab30e351faba2

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\GA.Analytics.Monitor.dll

Filesize
52KB

MD5
6f9e5c4b5662c7f8d1159edcba6e7429

SHA1
c7630476a50a953dab490931b99d2a5eca96f9f6

SHA256
e3261a13953f4bedec65957b58074c71d2e1b9926529d48c77cfb1e70ec68790

SHA512
78fd28a0b19a3dae1d0ae151ce09a42f7542de816222105d4dafe1c0932586b799b835e611ce39a9c9424e60786fbd2949cabac3f006d611078e85b345e148c8

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Common.dll

Filesize
192KB

MD5
ac80e3ca5ec3ed77ef7f1a5648fd605a

SHA1
593077c0d921df0819d48b627d4a140967a6b9e0

SHA256
93b0f5d3a2a8a82da1368309c91286ee545b9ed9dc57ad1b31c229e2c11c00b5

SHA512
3ecc0fe3107370cb5ef5003b5317e4ea0d78bd122d662525ec4912dc30b8a1849c4fa2bbb76e6552b571f156d616456724aee6cd9495ae60a7cb4aaa6cf22159

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Editor.dll

Filesize
816KB

MD5
eaa268802c633f27fcfc90fd0f986e10

SHA1
21f3a19d6958bcfe9209df40c4fd8e7c4ce7a76f

SHA256
fe26c7e4723bf81124cdcfd5211b70f5e348250ae74b6c0abc326f1084ec3d54

SHA512
c0d6559fc482350c4ed5c5a9a0c0c58eec0a1371f5a254c20ae85521f5cec4c917596bc2ec538c665c3aa8e7ee7b2d3d322b3601d69b605914280ff38315bb47

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Syntax.dll

Filesize
228KB

MD5
3be64186e6e8ad19dc3559ee3c307070

SHA1
2f9e70e04189f6c736a3b9d0642f46208c60380a

SHA256
79a2c829de00e56d75eeb81cd97b04eae96bc41d6a2dbdc0ca4e7e0b454b1b7c

SHA512
7d0e657b3a1c23d13d1a7e7d1b95b4d9280cb08a0aca641feb9a89e6b8f0c8760499d63e240fe9c62022790a4822bf4fe2c9d9b19b12bd7f0451454be471ff78

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Telerik.NetworkConnections.dll

Filesize
34KB

MD5
798d6938ceab9271cdc532c0943e19dc

SHA1
5f86b4cd45d2f1ffae1153683ce50bc1fb0cd2e3

SHA256
fb90b6e76fdc617ec4ebf3544da668b1f6b06c1debdba369641c3950cab73dd2

SHA512
644fde362f032e6e479750696f62e535f3e712540840c4ca27e10bdfb79b2e5277c82a6d8f55f678e223e45f883776e7f39264c234bc6062fc1865af088c0c31

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8AA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8AD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\DotNetZip\5635f8414edae06a1b5d07ea0cbdc9ed\DotNetZip.ni.dll.aux

Filesize
532B

MD5
e9169857138b22906989cd8645579dff

SHA1
9f2f0537c6f57e9a7605c6ac8e0cf4664880cb63

SHA256
fe9553b117abc7414ed50595392bcce48f3f86cf6ef802bca0e1c0a1674ceb46

SHA512
93d1a876aae2c160d437c3a81ad593a7343958d94a02d90fd382b72ee276715c1148e2b9ff6f3a7928e3c555f252e0aa2540a24cfba433eadb6809dbf5a45fd4

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B3325a29b#\4f44abb46807a5ad0f0bf1ae5ba48323\Microsoft.Build.Framework.ni.dll.aux

Filesize
588B

MD5
90dde7396bbc17dddaa7dcdec75c2d7b

SHA1
613a143997175a531af577c3e47611d006cd585c

SHA256
a3613a9ea1e995ce43a3754b3eab8f09325f039188593a4666bba0fa56dc5c03

SHA512
3cb619a3fe00d5cff37830e080a5db2e27d122293fb15f200a6bb59ad905d32bb99c720d36d1a8f6fcd89cad5c8e2610dbf89c09db28f7ec1974041d4b026c18

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B83e9cb53#\4a58f2013ffa484c7f872e70952613ca\Microsoft.Build.Utilities.v4.0.ni.dll.aux

Filesize
888B

MD5
0c2e9bf2f96be2986d8b8449c0028067

SHA1
c41ba485bc1d847ebba609bc4bcc37b4109f7fca

SHA256
4d9d156b27b902a1265a2d36a47fb285ecba5abb97ca730df3893f3397f5da4a

SHA512
8a8eb919323d37cacad9665b671d5639bcd4f0955997f5321a486c1e3179bb6762b2ae009cc658b402dbb4dc0d873e110e58f5b67565c458eff2d16c8f1e46f1

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\2145e325c531dd03775cc61606722965\Microsoft.JScript.ni.dll.aux

Filesize
580B

MD5
0fa7a2200ae2493f05b85e85688aa663

SHA1
18ce43782b1a150948a3c80df0dd3374372cf675

SHA256
d2573a4a215ae02c70b6fac850c22931a757c18ff243c16b819b03d1dc2bf92e

SHA512
84629c719112dc1257a89bd0de5d4be7465abe6b81a25c8326a05f5001c51e6f3b921652cb81da68bbec7e975f476aed6f8606d1da6e736f456c65853072e129

Download Submit
C:\Windows\assembly\temp\44AZMKE5TO\GA.Analytics.Monitor.ni.dll.aux

Filesize
712B

MD5
edf737aa1f61c81d720917eb84e9fd5d

SHA1
8f6e5fd53b5c381491caa2d4a93cf81421088bce

SHA256
495b3d096ede487f9c7a7308ca15eb61b06a220089f7b9cd216013e0131bccdc

SHA512
45bb1c38ce0276730bfca53b6400db107f4854c9f9a80465e98bd98d40b69d4b2db8e2eb8e39bd26dbc16d26303ca1e21417aa67e88ef146e1254e33d39801fc

Download Submit
C:\Windows\assembly\temp\MYUELBAUW1\Microsoft.Build.Tasks.v4.0.ni.dll.aux

Filesize
2KB

MD5
c228a99297b86188b16cd8ae9f9e95c7

SHA1
b4603bf9196c3908a94ddff0ac2e51d1edd40777

SHA256
4bf1bad2d0aa458307845c6cfff003ad168b9af1c183d4fd44de734bf66ead97

SHA512
f6933920fa6c75bd3facbc91d8b6d594461ebfd54c5557155fbda4d6fd35c135d2438e377538540103947f7394d404d05dc7b08fd731e067cf45d94919cf474d

Download Submit
C:\Windows\assembly\temp\W63DLZQ267\Telerik.NetworkConnections.ni.dll.aux

Filesize
732B

MD5
61d90bbb5964d416b86d7ef8b9adef40

SHA1
eba684714c32c9f2939499ee896a492122da707d

SHA256
9051805012f5ce17fc5f4a71482b34f9c0c4b61bf640ee31f48719a926782ab9

SHA512
867d21199f7fd950cdf9a4f2ce5435326abd7411a137f60c406b8ec185ae7d50e211dbf98a37591aba24bdd00fbcfee974e46f6691e8589e6dae2d11e2e8f47a

Download Submit
C:\Windows\assembly\temp\ZANVKFCTJN\Newtonsoft.Json.ni.dll.aux

Filesize
1KB

MD5
d338ba1b3d95ae9e95583db208df2174

SHA1
e160de175d1abe04983e0fbc9d652b52945a061c

SHA256
cfdb9f0cb1a77233fc2e036372ee76763de6ce37961fd323e36cdbe9fb661061

SHA512
e56ed6af3e807d20036a2dc4415f547b2e8646f41c4b68365fd9e70c0c5d01977899df229f8b222fdc60bc2789f5155048c876c95a6a1a8ec6a68eb30de52ed9

Download Submit
\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe

Filesize
3.5MB

MD5
87bc17f56e744e74408e6ae8bb28b724

SHA1
3aa572388083ff00a95405d34d1189c99c7ff5be

SHA256
ffb24fc36ade87988f9908e848d0333ce7ffb2b4e4d0ffb43f6556246069d057

SHA512
cbeee155c97b87a22b92b808f86fee25c18db51ab43a36b657d532d2d47d3a7db2f4507a699b72af904bf6d5ed851d1ae1fcfb4833a57096e6c7787211c0f35d

Download Submit
\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\FSE2.exe

Filesize
50KB

MD5
c2fe7c92a8fc763407233203b49685f9

SHA1
d2f199e71eb7531caa71f85a679e49fa400cc401

SHA256
f55d5cb9968bcb875dc39cc84153bd52375f4cf8a680e0f5eb53a57a7e532561

SHA512
f74d29f4520ae0c9aa153f3649bdf80c1ed882a61add7267eafaecb2d036f43fc44434279e3dacd763ebc42fedc78ec3ad52a11b55d14b224b01a8bebca0f6b5

Download Submit
\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper

Filesize
18KB

MD5
b1827fca38a5d49fb706a4a7eee4a778

SHA1
95e342f3b6ee3ebc34f98bbb14ca042bca3d779f

SHA256
77523d1504ab2c0a4cde6fcc2c8223ca1172841e2fd9d59d18e5fc132e808ae2

SHA512
41be41372fe3c12dd97f504ebabb70ce899473c0c502ff7bfeaddc748b223c4a78625b6481dbab9cb54c10615e62b8b2dbe9a9c08eb2f69c54ebf5933efbeb1b

Download Submit
\Users\Admin\AppData\Local\Temp\nsjB81A.tmp\FiddlerSetup.exe

Filesize
4.4MB

MD5
c2a0eb6f104eacec3f39581451ee208f

SHA1
9ae7d02aeb640fbd090dfc01885b98dd5dd0b6cc

SHA256
1f926cc353301e547e76c6d2eff23fcbe85495ba0292174cc6344fac26457af8

SHA512
8b062e4f0af1dce3a12b5776646fe8c235f30de6772f579da1a6ab2bb559ed69b3bd32af95eee248c48008ddcbd40a7e49eae722a44bc9b49dd13fe38113a3ca

Download Submit
\Users\Admin\AppData\Local\Temp\nsyED7C.tmp\System.dll

Filesize
12KB

MD5
192639861e3dc2dc5c08bb8f8c7260d5

SHA1
58d30e460609e22fa0098bc27d928b689ef9af78

SHA256
23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

SHA512
6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Analytics\d756563aa7cd4e9c00502605394ea611\Analytics.ni.dll

Filesize
148KB

MD5
4b962d3d8b3c91fa54e20ea48d09a990

SHA1
35468f050fb1b4a5e57a437b644d2c9e512f862f

SHA256
3e7dc77c58ae21758add41de81b649240e95707abcbd6d02fccdaa73449ab33f

SHA512
5ba87664ebadc3611523e69c9b26b6b9f4576240eb5c3a7e39a21a3a6f68f37142c9902fe4410f4e60593556d0e641a9ee82a37c1cb29e50d6247db2804ac3c5

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\DotNetZip\5635f8414edae06a1b5d07ea0cbdc9ed\DotNetZip.ni.dll

Filesize
1.0MB

MD5
8343f1a30bcc16e7b45856ccb4e36f02

SHA1
d63a840c79ec4053e116a93a827ad1d0b147a9e1

SHA256
4bd4fb6127e136939557ecdbac8ee5200fa1056df8c7b2fc3a7e5198615502b7

SHA512
f0046c44408d87ede8b482b9240cdb1dc47662e4b3524db1f7d1e13d8b735a8509b54e95fb9deea97c2404c3c6bada86fd3501e2813237553faf33b31c424a4d

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\GA.Analytics.Monitor\3bf155f5fe5c3c876614c4d82313933c\GA.Analytics.Monitor.ni.dll

Filesize
158KB

MD5
188e0e27618fc054e447005da14b39e6

SHA1
fa53f294d3f2d484b513f17ca5d21b33a52e2500

SHA256
7602634749732ab0411aebe3b5789b736c8e68d07688dd22d83f29b6e86675c9

SHA512
717e160dec70f5d647e6152ed1ce8ed1e4d64118cd68ffaa091264d8a7b947175261552a9171ebf4ddc7fe0096608a9a4f5d1b24857d1c8eb5d750b2e085670c

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B3325a29b#\4f44abb46807a5ad0f0bf1ae5ba48323\Microsoft.Build.Framework.ni.dll

Filesize
546KB

MD5
75de4db178e3310ebf8bfa83a003b8e2

SHA1
c0d05985fb9e28ede26b00143d939839cb0e3ae6

SHA256
304ae94177bcd5f8659eb5a232676c2a9857dc495c273fce2e2e65fab4ae4eb6

SHA512
4310161d72d60ef55a5ca6601bf4f5773518a9fcbeab4fda60afc18b334a1fbded3a5426795ed3587b5c51e2f6fc39176014a75e75aca2d3cfafc8a19d85b983

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B83e9cb53#\4a58f2013ffa484c7f872e70952613ca\Microsoft.Build.Utilities.v4.0.ni.dll

Filesize
1011KB

MD5
6d7e1bc098c599dc54b552531ed637ac

SHA1
ff4648a4ce473a3cbe6e3c75e1c606d593353de1

SHA256
874ece1c76a575a96e174eb846edcbeb6134ee66e71bfd025a250a7406627ef5

SHA512
1e88c80b969c0ac44e880316189ce3789f2fb0d8044e39c90ef99edfe4de83f7c21dc21adf4c51f6d88f77b92035b519794ed91d9d04c74cef971aa3424ce04a

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Baa2ca56b#\faa890702be0a0b8574aa82cb24b9da3\Microsoft.Build.Tasks.v4.0.ni.dll

Filesize
4.1MB

MD5
07de6b9bdeebae49461ef58e29953464

SHA1
5ba78e69c3d93724c6a3de013157b9350bcd6eb9

SHA256
85da41cc1f1beac3528bab39240912ecb8ac7fb313a89342e3fffd9cf0a99c74

SHA512
1b10add9a8cab2913299a03da26ad4fcb84826ff33c847d53078d18e3459b4c07a3b0ee52b67d9fe2f5b90ae7f98da502369159c2edc3e81fa569242184ab0b4

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\2145e325c531dd03775cc61606722965\Microsoft.JScript.ni.dll

Filesize
2.7MB

MD5
d1d5dd7761a0e2c31c2baeeb4442a6ba

SHA1
c681dca866baa02e7840bffdbcff349da69ba25c

SHA256
84676accc10df0f610772b5d447b058a9fd3c4d399cddc01ef6510d9832915f1

SHA512
59891b98e42635c056debe5fdd373b3d31ef1731c653c7df179c0db8544c6bfc6e4899d62a3068b76a652e71899b285e1757260ccaa805658e1e77e00cb9b263

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Newtonsoft.Json\399708e37f6b243e3c60338d349dc53a\Newtonsoft.Json.ni.dll

Filesize
3.6MB

MD5
248048fcedfd5cb2d51cc6ce815cc6e7

SHA1
502df74dc5c54c7400242830194029d34fb46891

SHA256
404296d3d998442262a8a413c2f1697f2ba1f2222b573a888204004afadbdfb9

SHA512
d56ad2b11ee66fe2841239cea7bbfd4d43d73ab9400e040d504cb70d2feabacfc81cdc61f4acdb46a83e16859877a5695992545d0a94299ed8677a22d1a01528

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Telerik.Net8bf66678#\e5f4977994d2fd10324efd51321f1c59\Telerik.NetworkConnections.ni.dll

Filesize
94KB

MD5
8c1196b2476c2ae2dee297e3db1cf37f

SHA1
27b4c6bc7876d7f52f34bffe2fb1f3cee88444ff

SHA256
f298ac1090234846c34b192f4683d34477f84f5eb8b844afedac9d4de246e104

SHA512
cd4bbe93c3a40035c65358ba714f39b8c6770aa44bdb87ed6dd23292f7a641c3da3977691fb1ecf83f1dbb6fe704edc6eeb817d1da48b4f2f9de62cf9c2ec591

Download Submit
memory/1036-292-0x00000644A0000000-0x00000644A0109000-memory.dmp

Filesize
1.0MB

Download
memory/1528-217-0x000000001B000000-0x000000001B0B2000-memory.dmp

Filesize
712KB

Download
memory/1528-216-0x00000000003D0000-0x00000000003DC000-memory.dmp

Filesize
48KB

Download
memory/1528-215-0x00000000003C0000-0x00000000003CC000-memory.dmp

Filesize
48KB

Download
memory/1528-214-0x00000000020C0000-0x000000000213A000-memory.dmp

Filesize
488KB

Download
memory/1528-212-0x000000001B5F0000-0x000000001B974000-memory.dmp

Filesize
3.5MB

Download
memory/1592-207-0x0000000002270000-0x00000000022B4000-memory.dmp

Filesize
272KB

Download
memory/1592-206-0x0000000000450000-0x000000000045C000-memory.dmp

Filesize
48KB

Download
memory/1592-204-0x0000000002AD0000-0x0000000002B82000-memory.dmp

Filesize
712KB

Download
memory/1592-208-0x0000000002150000-0x000000000216A000-memory.dmp

Filesize
104KB

Download
memory/1592-209-0x000000001B470000-0x000000001B592000-memory.dmp

Filesize
1.1MB

Download
memory/1592-202-0x0000000000440000-0x000000000044C000-memory.dmp

Filesize
48KB

Download
memory/1592-211-0x0000000001F00000-0x0000000001F10000-memory.dmp

Filesize
64KB

Download
memory/1592-200-0x0000000001E80000-0x0000000001EFA000-memory.dmp

Filesize
488KB

Download
memory/1592-198-0x0000000002090000-0x000000000214A000-memory.dmp

Filesize
744KB

Download
memory/1592-111-0x000000001B800000-0x000000001BB84000-memory.dmp

Filesize
3.5MB

Download
memory/1888-445-0x00000644A0000000-0x00000644A03A2000-memory.dmp

Filesize
3.6MB

Download
memory/2092-234-0x00000000007C0000-0x00000000007DA000-memory.dmp

Filesize
104KB

Download
memory/2092-233-0x0000000002030000-0x0000000002074000-memory.dmp

Filesize
272KB

Download
memory/2092-235-0x0000064438000000-0x00000644380FF000-memory.dmp

Filesize
1020KB

Download
memory/2224-614-0x0000000000150000-0x0000000000160000-memory.dmp

Filesize
64KB

Download
memory/2272-266-0x0000000002ED0000-0x0000000002FF2000-memory.dmp

Filesize
1.1MB

Download
memory/2272-274-0x0000064438000000-0x0000064438429000-memory.dmp

Filesize
4.2MB

Download
memory/2340-109-0x0000000000D70000-0x0000000000D78000-memory.dmp

Filesize
32KB

Download
memory/2440-329-0x00000644A0000000-0x00000644A001A000-memory.dmp

Filesize
104KB

Download
memory/2480-325-0x0000000002990000-0x0000000002A0A000-memory.dmp

Filesize
488KB

Download
memory/2480-328-0x000000001B030000-0x000000001B0E2000-memory.dmp

Filesize
712KB

Download
memory/2480-327-0x0000000001EA0000-0x0000000001EAC000-memory.dmp

Filesize
48KB

Download
memory/2480-326-0x0000000000730000-0x000000000073C000-memory.dmp

Filesize
48KB

Download
memory/2480-321-0x0000000002990000-0x0000000002A0A000-memory.dmp

Filesize
488KB

Download
memory/2480-317-0x000000001B660000-0x000000001B9E4000-memory.dmp

Filesize
3.5MB

Download
memory/2608-523-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/2608-533-0x00000644A0000000-0x00000644A0029000-memory.dmp

Filesize
164KB

Download
memory/2792-251-0x0000064438000000-0x000006443808B000-memory.dmp

Filesize
556KB

Download
memory/2792-250-0x00000000005D0000-0x00000000005EA000-memory.dmp

Filesize
104KB

Download
memory/2992-213-0x000000001AF50000-0x000000001B00A000-memory.dmp

Filesize
744KB

Download
memory/2992-218-0x000006443CC40000-0x000006443CEEC000-memory.dmp

Filesize
2.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads