28327d9e90781c714d6951c767b3fa88396048b81178e9b691ab8edef0e59cf7

Analysis

max time kernel
119s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-01-2025 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/FiddlerSetup.exe
Size

4.4MB
MD5

c2a0eb6f104eacec3f39581451ee208f
SHA1

9ae7d02aeb640fbd090dfc01885b98dd5dd0b6cc
SHA256

1f926cc353301e547e76c6d2eff23fcbe85495ba0292174cc6344fac26457af8
SHA512

8b062e4f0af1dce3a12b5776646fe8c235f30de6772f579da1a6ab2bb559ed69b3bd32af95eee248c48008ddcbd40a7e49eae722a44bc9b49dd13fe38113a3ca
SSDEEP

98304:KgxyUnSAaB1eXq8yOkLiGXv72Qomw6pvtFIAwdaRdAM:KoWvePjqHv72Qo96pvtF5wHM

Score

9^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1416	netsh.exe
864	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
2820	SetupHelper

Loads dropped DLL 16 IoCs

pid	Process
2552	FiddlerSetup.exe
2552	FiddlerSetup.exe
2552	FiddlerSetup.exe
2552	FiddlerSetup.exe
1272	mscorsvw.exe
616	mscorsvw.exe
2928	mscorsvw.exe
2824	mscorsvw.exe
2824	mscorsvw.exe
1364	mscorsvw.exe
2824	mscorsvw.exe
760	mscorsvw.exe
2292	mscorsvw.exe
1224	mscorsvw.exe
1416	mscorsvw.exe
1744	mscorsvw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\temp\CAW0AG2CGR\Analytics.ni.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\0NF3GB5NC0\DotNetZip.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\UE97YKFDIX\Microsoft.JScript.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\DO4Z73FY9B\Newtonsoft.Json.ni.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\8f4-0\Telerik.NetworkConnections.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\4c8-0\Newtonsoft.Json.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\GA.Analytics.Monitor\3bf155f5fe5c3c876614c4d82313933c\GA.Analytics.Monitor.ni.dll.aux.tmp	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\W3SU6J3SH1\Microsoft.Build.Tasks.v4.0.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\1PJPSOU8KT\Microsoft.Build.Utilities.v4.0.ni.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\588-0\Analytics.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\DO4Z73FY9B\Newtonsoft.Json.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\0NF3GB5NC0\DotNetZip.ni.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\2145e325c531dd03775cc61606722965\Microsoft.JScript.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\2f8-0\DotNetZip.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Analytics\d756563aa7cd4e9c00502605394ea611\Analytics.ni.dll.aux.tmp	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\XGMTMHNIP5\Telerik.NetworkConnections.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\W3SU6J3SH1\Microsoft.Build.Tasks.v4.0.ni.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\F9JBMRXPOM\Microsoft.Build.Framework.ni.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\1PJPSOU8KT\Microsoft.Build.Utilities.v4.0.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\UE97YKFDIX\Microsoft.JScript.ni.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Newtonsoft.Json\399708e37f6b243e3c60338d349dc53a\Newtonsoft.Json.ni.dll.aux.tmp	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\RIJVZ3W1UA\GA.Analytics.Monitor.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\XGMTMHNIP5\Telerik.NetworkConnections.ni.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\6d0-0\GA.Analytics.Monitor.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\F9JBMRXPOM\Microsoft.Build.Framework.ni.dll.aux	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\RIJVZ3W1UA\GA.Analytics.Monitor.ni.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\DotNetZip\5635f8414edae06a1b5d07ea0cbdc9ed\DotNetZip.ni.dll.aux.tmp	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Telerik.Net8bf66678#\e5f4977994d2fd10324efd51321f1c59\Telerik.NetworkConnections.ni.dll.aux.tmp	mscorsvw.exe
File opened for modification	C:\Windows\assembly\temp\CAW0AG2CGR\Analytics.ni.dll.aux	mscorsvw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FiddlerSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupHelper
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 56 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.telerik.com\ = "187"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b7a7ca6b5fdb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78c24d55fd9ad46b6b6fa705b6f4abb00000000020000000000106600000001000020000000ea21757546e0d0511cb1bde7fa974579060ff9f1adb36bcdb5457161636cc5e3000000000e80000000020000200000008f8e3601bd2626c345080e90a98b94332d305ebd45cfc843395653443ff19b309000000012374f0057a50aa9823e0483ece59bbfbedcf1243ee40dfd4ecb97b492e5250bcd0169fcedc3aabf00194c44fdf4d43d84b3ec29e57102cd402a17cc9be494920730a8bba9fe511e9989059b0a6cb5867b797351f5f6f7d8636d927931ece59432ae3a45c3cc29a13ad6a0a94c270c03166b81b5b5e707ade37b9339c2e710fd7f1df614c6b4457611f41e5de85019d64000000052e73d18f8599270102a8437f198c72b07f89d01b5dbdbc7f4dad5f63c2ff48c2979cbf8e4b7e857899a75982ba2ba1519825aa0a6addedd86b010244e3a714b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\telerik.com\Total = "5"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\telerik.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\MAIN	FiddlerSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\telerik.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78c24d55fd9ad46b6b6fa705b6f4abb000000000200000000001066000000010000200000007f7e51dd4041fedc1b4ab890d4dac57aa2d520af9a0c6701df09cff57789907b000000000e8000000002000020000000b3ffef675495a010023ea975e892348d9a24444a7917c672def8c22bb6a4194c20000000a4b1329790a88e872e2e2125538d6a1d57d7201c476c675744bb7b67ce56372840000000530dee52c1abdfe29b8b1853252544345a2f9d2b75f1aa51fe01a735a7b236addb73890d4e4d988204fdfef0659bb41c16546b52b9f88507982e04835495a21d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Fiddler.exe = "0"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\telerik.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "187"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.telerik.com\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	FiddlerSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "5"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Fiddler.exe = "9999"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.telerik.com\ = "5"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\telerik.com\Total = "187"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.telerik.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442241278"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F09A7F21-CB5E-11EF-B30A-EAF82BEC9AF0} = "0"	iexplore.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open &in Viewer\command	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open &in Viewer\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe\" -viewer \"%1\""	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\.saz\ = "Fiddler.ArchiveZip"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Fiddler.ArchiveZip\DefaultIcon	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open\command	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Fiddler.ArchiveZip\ = "Fiddler Session Archive"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Fiddler.ArchiveZip\Shell	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Fiddler.ArchiveZip\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\SAZ.ico"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open &in Viewer	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\.saz	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Fiddler.ArchiveZip	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Fiddler.ArchiveZip\Content Type = "application/vnd.telerik-fiddler.SessionArchive"	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Fiddler.ArchiveZip\PerceivedType = "compressed"	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe\" -noattach \"%1\""	FiddlerSetup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1528	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1528	iexplore.exe
1528	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 864	2552	FiddlerSetup.exe	28
PID 2552 wrote to memory of 864	2552	FiddlerSetup.exe	28
PID 2552 wrote to memory of 864	2552	FiddlerSetup.exe	28
PID 2552 wrote to memory of 864	2552	FiddlerSetup.exe	28
PID 2552 wrote to memory of 1416	2552	FiddlerSetup.exe	30
PID 2552 wrote to memory of 1416	2552	FiddlerSetup.exe	30
PID 2552 wrote to memory of 1416	2552	FiddlerSetup.exe	30
PID 2552 wrote to memory of 1416	2552	FiddlerSetup.exe	30
PID 2552 wrote to memory of 2704	2552	FiddlerSetup.exe	31
PID 2552 wrote to memory of 2704	2552	FiddlerSetup.exe	31
PID 2552 wrote to memory of 2704	2552	FiddlerSetup.exe	31
PID 2552 wrote to memory of 2704	2552	FiddlerSetup.exe	31
PID 2552 wrote to memory of 2640	2552	FiddlerSetup.exe	32
PID 2552 wrote to memory of 2640	2552	FiddlerSetup.exe	32
PID 2552 wrote to memory of 2640	2552	FiddlerSetup.exe	32
PID 2552 wrote to memory of 2640	2552	FiddlerSetup.exe	32
PID 2552 wrote to memory of 2820	2552	FiddlerSetup.exe	36
PID 2552 wrote to memory of 2820	2552	FiddlerSetup.exe	36
PID 2552 wrote to memory of 2820	2552	FiddlerSetup.exe	36
PID 2552 wrote to memory of 2820	2552	FiddlerSetup.exe	36
PID 2552 wrote to memory of 2820	2552	FiddlerSetup.exe	36
PID 2552 wrote to memory of 2820	2552	FiddlerSetup.exe	36
PID 2552 wrote to memory of 2820	2552	FiddlerSetup.exe	36
PID 2552 wrote to memory of 1528	2552	FiddlerSetup.exe	39
PID 2552 wrote to memory of 1528	2552	FiddlerSetup.exe	39
PID 2552 wrote to memory of 1528	2552	FiddlerSetup.exe	39
PID 2552 wrote to memory of 1528	2552	FiddlerSetup.exe	39
PID 1528 wrote to memory of 2360	1528	iexplore.exe	40
PID 1528 wrote to memory of 2360	1528	iexplore.exe	40
PID 1528 wrote to memory of 2360	1528	iexplore.exe	40
PID 1528 wrote to memory of 2360	1528	iexplore.exe	40

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FiddlerSetup.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FiddlerSetup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="FiddlerProxy"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:864
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="FiddlerProxy" program="C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe" action=allow profile=any dir=in edge=deferuser protocol=tcp description="Permit inbound connections to Fiddler"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1416
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
  2⤵
  PID:2704
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 104 -InterruptEvent 0 -NGENProcess f4 -Pipe 100 -Comment "NGen Worker Process"
    3⤵
    PID:1928
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 18c -InterruptEvent 0 -NGENProcess 180 -Pipe 188 -Comment "NGen Worker Process"
    3⤵
    PID:1028
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 16c -InterruptEvent 0 -NGENProcess 164 -Pipe 168 -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:1272
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 180 -InterruptEvent 0 -NGENProcess 194 -Pipe 190 -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    PID:616
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 180 -InterruptEvent 0 -NGENProcess 164 -Pipe 1c0 -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    PID:2928
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 180 -InterruptEvent 0 -NGENProcess 1bc -Pipe 1c4 -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    PID:2824
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b4 -InterruptEvent 0 -NGENProcess 180 -Pipe 1c8 -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    PID:1364
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 184 -InterruptEvent 0 -NGENProcess 198 -Pipe 194 -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:760
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 184 -InterruptEvent 0 -NGENProcess 1b4 -Pipe 1d0 -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:2292
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 184 -InterruptEvent 0 -NGENProcess 1cc -Pipe 1d4 -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:1224
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 184 -InterruptEvent 0 -NGENProcess 164 -Pipe 1d8 -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:1416
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 164 -InterruptEvent 0 -NGENProcess 1bc -Pipe 184 -Comment "NGen Worker Process"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:1744
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 0 -NGENProcess 180 -Pipe 1bc -Comment "NGen Worker Process"
    3⤵
    - Drops file in Windows directory
    PID:1308
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 198 -InterruptEvent 0 -NGENProcess 1dc -Pipe 18c -Comment "NGen Worker Process"
    3⤵
    - Drops file in Windows directory
    PID:1684
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 0 -NGENProcess 198 -Pipe 1b0 -Comment "NGen Worker Process"
    3⤵
    - Drops file in Windows directory
    PID:3004
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 0 -NGENProcess 1e4 -Pipe 164 -Comment "NGen Worker Process"
    3⤵
    - Drops file in Windows directory
    PID:2204
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 0 -NGENProcess 1e8 -Pipe 180 -Comment "NGen Worker Process"
    3⤵
    - Drops file in Windows directory
    PID:2308
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 0 -NGENProcess 1ec -Pipe 1dc -Comment "NGen Worker Process"
    3⤵
    - Drops file in Windows directory
    PID:752
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 0 -NGENProcess 1f0 -Pipe 198 -Comment "NGen Worker Process"
    3⤵
    - Drops file in Windows directory
    PID:2680
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f8 -InterruptEvent 0 -NGENProcess 1f4 -Pipe 1e4 -Comment "NGen Worker Process"
    3⤵
    - Drops file in Windows directory
    PID:2684
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1fc -InterruptEvent 0 -NGENProcess 1f8 -Pipe 1e8 -Comment "NGen Worker Process"
    3⤵
    - Drops file in Windows directory
    PID:2500
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\EnableLoopback.exe"
  2⤵
  PID:2640
- C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper
  "C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper" /a "C:\Users\Admin\AppData\Local\Programs\Fiddler"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2820
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://fiddler2.com/r/?Fiddler2FirstRun
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1528 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8

Filesize
1KB

MD5
85b0efeadbc89397ccf3414d982f623a

SHA1
9b72e0198657ccd3497c262849c64fbfd995bf4f

SHA256
af9c941f68d9b2fac90ef8196d9e1c65d15fddec16ad06e802d7477c3c1ac658

SHA512
a8a5b057d836824a18445612caede64dcdae0c48d6215290327dad245c60038fd290a2dae6bc959f24def4ce00a0529459f4ac21a847d29f9e2e15957a3e4d53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
2KB

MD5
34f1d4c2a19e3e24efe08326983ff5b0

SHA1
f6e713a73e69f79114a6816e7eb54d2652e33d80

SHA256
f0c52ef726d47e236a6df1a244e5a9663a44988f094249a69695b112ee005960

SHA512
2426e7c678c37026391e413ef03c0b54bd2fb75b4217b9518df2f647fe2882f6727d1e206dbb35b07312a9346277e440f53920d15003d72391ee80988847ca7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
1KB

MD5
a59b60139c0abca69ae678202c1b759b

SHA1
fac5827b9e016a93936b32c9ed23a5cef5fd5686

SHA256
72c8963c7e156f618678ea8b839a1b358c07559cfcc9cd7b3c0c6a96d9758aa4

SHA512
2c22bad1c3b87c46715077d43f00fc3e66198656ebe826f41f5cd61d8729a58bf2e82b499ed2595eb525d304f693e10860d5d75be295e6c207c8711f481a8105

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
10f21ed215079433552da392919c69af

SHA1
190ac8b9a603c95cfba72510d8899fe1f08b9cef

SHA256
1afb7f7858bade55cf57aa1a504bc0f45524a63a3a8a9c99eb2d99a82989ff3a

SHA512
c7d77d6c4799291e573cfa93b273dd1f188bc8eee8227d2c3d790eb6fb08381fd10155ce1ce63afeb86bacfc1850613a8dabebabe9f9c72aa4429e00e0e23e06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
270d4b501823ca8d09eec69089138132

SHA1
55b8a173c0fbb55145400a4933e0f4f46ef0b8dc

SHA256
1fe54e5a03bde2518739c513e94b7a8473c5c5e200a74036b4999ee45b214eb4

SHA512
d0f10b18199c61858f34cbfb8e81a4d25fcbf82a732801c6da44455cdb9b5a0b634b589af87f239a2cdd027a5a1546269b15a7e813c82ad2131ef18cdeae8663

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8

Filesize
438B

MD5
9b1434d3aefc06d67390312590cd72c5

SHA1
31ffeb24fb41d53f9dbec31d53a8b2c02f28b622

SHA256
6ad59a9a4e8da27ed611b4eff986ff879c65cf46cb86ed326a875c9bcb1eb775

SHA512
b288b37c99d4bf25d1b2a5a899496bfd1cad61bc1c37c79ef9ad1c00f1604cab2e0e71bdda53184ae93e981e8c37b20da55811e4893b122bebce317137fd553d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6fde0090e02e0169fb21d51d09e87b6b

SHA1
e9eda4b93ea2cbbb16dfc68ae5e4af196374b109

SHA256
b5c16583228b4251c6c54b8e016fa336255a6456f05e93c418be2a90b91a6896

SHA512
83ceb45d59b91463c0dae91bbf74fc3a41b94576fe2f9983bd233400469c91c3bc42ab95be4afe857311271a29245b16ec15c0b1b819962f071d6784348ffbf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80b2867d7d1f541ba02aa860b4a5c9c1

SHA1
e513428d1d9f7b9a8b4d89c19a02edcc70a0923f

SHA256
8020dc1f8c948745433541063bb772eb0394908ab54e37a1c73a275e4bb3c7db

SHA512
4af1a57a7f1f09cb36c126102ffc3e646f2d70e04700dd0e87d1f2d3eab7170e98de3fd0a38873ca5eecc05e88698c87f1b1f997f3331c43e4ba61a07a94e1c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
650531bf935790e7c46f9a9d54581187

SHA1
565723795dbece4c8f2e5e7f7c5e8f734b04310d

SHA256
03e39f769e22b4c6371185dd896003b99581902158b7ea7b56e8f8341a6f8e9e

SHA512
372329505ded54393d3d4f3a6e785d3b0d565e3a5ecc2aa059739e7947fc13d8d95857bfb2de0d092c5b5f987aecf386672305584a4405dba4476212d79bf4f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7e9d0736b652e5447a12572c09c6d15

SHA1
2863fb7d6289fb23202ad6bef6c788ee140e78e7

SHA256
98188ac25489683cd3d622675dc6162964f90153484261d463a75eecc7ee6d5c

SHA512
54470a158a2b5e886428d9a85b909bb214dcd767ebd45d2ff6376c06365bee5653ee8b94dddd6572655b74f90b7664754eabfc294a5f6dc19a9abc4e31b24bbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f4db3c84dae0b2ad3dcff5de86dca03

SHA1
bdd53688d7517cc2f54bcf98a4a1bde953d86651

SHA256
7d4ff5461ab87af0700840f82e8b7224bdae0cc6fed9bde840855700a2b16ba6

SHA512
6faf0732ccebbd8dea9010c071b7263e0fa0d7ef955cfbb3bf1d9bf63bde7a32c7faa019fd587a7169f6fee0548633183005567907990fb6a8bd1663e133cf7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7ec49dc09db5946a54ee77da62c19c5

SHA1
49f9a4cbb5bf9bd428d451503a1f435b22fb05d1

SHA256
ff30fc2abb4eb3a405ba5aa906df56878276d927c8796fc6ca61a3d2fffe4f1d

SHA512
99a7e3d6069403f8570dc2f34fd3ffb85c08888b305c644f2123994793fbec1af898ea5c74fba8ca3bb6e5e44392fcbb088430f6b539eb660ae18bdf837aafa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f90c111e24c4b6a1982a47814f49c48

SHA1
7b4132e5955e3e2696f44bd955a7294fa42d883b

SHA256
48ad2ca2a32545fb90089fab1dcae89a2a9722fee0ebf63b200c72faef3ba0b8

SHA512
5401851449b1066eda9289c4d401ecbe43665986fbf579f97a2d7b00f483934b6dfbd7d9d8b5dd25d918ba412100307cd09fe67a5bf299cb7e0b31dab9869b8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16fa885a17deadedde0356df9e3fd4c4

SHA1
7c73dbc621383e736b45922094de33683762c3bc

SHA256
c43a69cf4fe5f8fed5e2ddd62ae9d6111ddd509b4b63d2ee7f3da195dbe41c19

SHA512
fcbe29f606e91a2875267869d8fe5293770f5218d7b268ab27be0fd1a9710f75ced668c35f3953e00d49c5cf30b7d1b6d5496b44ff5770157177d0c2cb60d2de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a703be70cc440f8692006f6efdaf73da

SHA1
491a8480973d4d0e6030c85a94ecfb4fe8a1ea9c

SHA256
99d9f0b68c0f71d07d23303a43c39313108c34072af6915e73cda6090fefae58

SHA512
0ad9755d5857a5ad4e677fdcedab53c26bdf39737095117899fecd8bf954f6557c363936396261fdb2ea7d9ce19269489ee51deb892ab1547724951bb94c489f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99844bb159c6f1fe128110a39e917fc6

SHA1
fe20d2e351003178ab8ab82ede1980180b0f693f

SHA256
b8314a722ea7708fdb06926d979064e4c5e2b51c4211b5160e1ec80e9a826d3e

SHA512
a83154556638d5dfd733e4467944317f174f6e4cf493e452af6ee38921ade5dd9fc0201b5a5890ea8239d67325d461cfc81142b0321b6c4a91aa31ea54550bf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7e6ca5bcfeb5da9dd909acdd3163520

SHA1
1ccb431b56f4c8feeb307ffe92a54816ace73b53

SHA256
a1c4e04bd7dbf5cf3fae36e92313c34339bc9cd3cf6ec010821fa7916bc441fb

SHA512
410e895a4789b7dbce8c604c1fce9092c3b8033d4bbbc7cee4e87aed720e640839efa24ea63f78d378b0a67bb475fde60ceb39041db6bdc4c5bc6ce3d002a6f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7898e69e34a1672fbcaed6ce94433f77

SHA1
922152c791bcceda487045984b3d88e2a6a1e667

SHA256
0af23f6ec66d878db37ea0b5a97ddd856e5d4e5e2d3f89ac4e19b522230c8a64

SHA512
6147ab43d360ccbb0efc9c747c09cd100a5dcbdd392e028df98a645c17006165fdbbb14709fa7a5aca0fb5f149d85d4a8206c2e288653dbe7f8b9f7351840a32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8858576dd1650b5bcc0714700ba27f12

SHA1
c01891ff8bca212bafad2e98b9854b148f9c40d3

SHA256
e7c6acbcb2a36911834ac311ad782d2310951ee2f973ab8cae0296e20cb4866a

SHA512
e091c1354e6baa817dcef502c3a87e4a4fb57fcdebdefcfb0b1e5cdcc02db88e07ca5424aedc52f471593a9bea505f9572d8a823b6465de62f7f7e3be94948d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a89e2ec8090aa93b1c939653d5dc4ec3

SHA1
2e55cce2c98bf6a45dea95f77a95b7557b2c641e

SHA256
9ef2f9388ffb90c75b423d389866e192a61913d245a9ec13dccfc1c9b7827396

SHA512
e79737c17a203552b82411e906f8dd650d0b15a3b74f3bfea18cfd1d9442dfd5664ab59e15d67a9e8ebdd5b413051f5bd0468917fba665d4760f9ad6aa3c3235

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49af7ee9fdb6329e54abf3da9468a63f

SHA1
caa3d7fb487779b00821788ce401864597201798

SHA256
ed0471d6f1856129e1543da91c523f2b04dfa2875f15b4458e1300a67b173050

SHA512
b5c94a0a5497d84d2aabecad39418baac9b87731b853d36228f4d9599500920c446f5848caf2d295c84d36f05b934f4fca9ed6ba0b0d1ddba61f17d3f41c3ec4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57535e52bfd0c5bae3ad4f40f5832933

SHA1
8571ec04665eeaeed57e7bb7ca4b0391e5658ab0

SHA256
a58915ca173f07f326702085816f742151b947c4834b8a14ca34ac8a07bd687c

SHA512
5cbeb74ce7ffa44633073e8560412136a29dc75caee36d0803fceec138daa09f21b78ecbbba60ccf0227f3098061d33380822ac84a70891d8ded756378de6070

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee103aaf6081456752ade26817f3b071

SHA1
ae47492f3b62f6c622d428ebff94f02e6562f806

SHA256
328d2f9980ca952aba2006a75b568a742de72b174b0dbd6fb99475dda4fcb0d3

SHA512
e07a1483b4fd1393390bedc9aa51cede95c725f21816fdaf8ab09f9787839258db4f9f2259cda31f28bbdd3dcbe2e4a556dc47cf9d33a155e45fb1ed9fe9ebe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab812237f417d95e9f2d2c4df33f48bb

SHA1
0a8c8742f4feb14f5d4942e48387ce61b22d7916

SHA256
e178c6ee80e2112639fc7d1f006982fd4197b47a4bd7f66e1e05094f68a2d117

SHA512
ba650f4294af35a91d63fd13730255bc1766494a3ec391b32ef18dcb78fd0054959743f777032247ce8bc2ed121009977db9f620b982332760ff852f8379f61d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af4a1a297abc4f9fc9ea6528b0ec7a48

SHA1
b7d35aa658a646214add70217efe7cc5a7448c69

SHA256
ad84b85e591b359249933572f0c09c7a1e22c19591d96cca1aeda8224cdd1ceb

SHA512
654a7ece1883c2acef219a07896471dbd6fe85ad1faac3b616e9252c280c6c0c85592ff829041ffd3b26108a64d8d0712c5748a0b5e02705b72f7bfdaad5c6d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee05b1e01d21710a1cd103f18cea8d58

SHA1
23f81153b7867b1a71e064897015ecea205af146

SHA256
7e3a20b89798146d454237924bd2697a1a7f27b7f462f526c1f83931609dbcc1

SHA512
cd9cfc29abf6bbe9c13558735ab0b41e309fb32938140aa369be2fcf4653f880c1a4ca59e9d42acf2adb2b86530d8b8dd918cc381a4546a520193ad2cf27303d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
343cb1d2d254c8c658e8402ec776da70

SHA1
8887855f051dbd89fc27e294873aea14ee7e59d0

SHA256
ba0ba39a8141d184ae5a78930c55e05d33dfe6c100a85a902c602556e68cf0bb

SHA512
6ab772881b6444493911d685aa4b49ee52c993ad640ada2b940d2db822f17dc0cf779f758480c335932dedb68df408d6a525219840ceeaecf128145343e2ab7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6aa22ad049706ee183fa3f885136e25

SHA1
ae652afbe38b1a0ddb8d6ae3710130015384a0da

SHA256
1e1f65ae57757123c6d8034091ace3c9827278ea2cc77bc58ce07c553a13d68b

SHA512
895819f647b1dbfc42528d10ac0b91d5949ef702bf199dc283b76dc7cdba43498605be416aaf875ef7cd43d126fcf206a65aa6b3807b08ca3ac6cf08b7d31fdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd596cb29b6073d1e07a2653222e2199

SHA1
f7797ca7eb33c1763e5b68819451bce19316bfef

SHA256
3fa882ca2c004532467f8ffe2d95c5e8b21854a17b539e346fbbc537993c417c

SHA512
27e3e9b653efa4f750aa53aba515cbeda3a8efc78b5cbe7a63c6051b898ce49a85d395e0c36b7075dcf8c2755c95516cd425bc8f31c4273187e45bdcb46eef63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0cc9bc093242a2d6390a1e99fb64fe94

SHA1
15dd931a26776519f674c4930521d71eaccefc40

SHA256
32aa2db5ca172dd1d7657f54674c72f1d60aac9be4a60b5e49ce1d9827388b75

SHA512
1b1449e5a3d1b60369a6277ea02f40fa4833e943b33f89cba76e267d8823e7866ee46de006e8cee020ee54d013899eff5d6f7efa9acbb10a33271f951e8aa87c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
458B

MD5
87ee08d3538d1ffeb2e1284d1d9aee4b

SHA1
5c35bef461ddca33d21949cb70c65da3205f4f81

SHA256
89b74989d2462dd4b3e7bec482caa05bdd21a09d40b290c52ec5cbdf63f987a0

SHA512
fa392b6dd67530ad6d64a6ce11697f7b1bf20e3185ea3139e4f1f48eec4c3241491253b7b17e94bdc40e970a0b0081ed16ee454036536f91206992bf1896ba21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
5a7001a5305b3f1e77fefe8f5a197826

SHA1
4039cbc5caf5688fbe4402c5a11d96c9297c1f3a

SHA256
4d8b13fea8a582b7ea8db157d3f48c61944d76d22bb101920225733242411ce1

SHA512
03afddf7d9ea7eb4971a0f854894893429bdbaee8da71f53a4386e6667397d6980279ba41a04162623589c1c9f98d33a308445c5d2b780ba90844b868e2a11fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\66M1F8TI\www.telerik[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\yiu0yt6\imagestore.dat

Filesize
21KB

MD5
dd57622270221f20c49510237fbc9913

SHA1
806c0738cec1c4ee8d016bc16b8931150e1f9be1

SHA256
cce5cc2143d50eb18c3a686aff3c368b9f7b229d0e7b69d879a7e09c031e7928

SHA512
489729b56e4c7c7fed1f6cd7416f658b04eca4d84bb690342ed6f8af7bbaacba6607c6feba25a6c5a82496815989b4421754f9ba07ab0db0ab33f31a3a7e7024

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F91VN88R\favicon[1].ico

Filesize
20KB

MD5
12649f4e0c5a37d4a41cbca768c8e7e0

SHA1
1257dd7949f4aa81c8f791dceeedd66e486dc3a0

SHA256
7b990b226fb3e8970b750dec91d4e8b9b59b2b7b069d0243d7bf70febe8ede53

SHA512
a0f96e89664c938ed38b33a127ef56b882f2ef3a60a4e01324602905b054c50a0ab87a725a21e61c3c60b5225e8825cbeab8c5664c2e59be168071f1ce1eeed4

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Analytics.dll

Filesize
32KB

MD5
1c2bd080b0e972a3ee1579895ea17b42

SHA1
a09454bc976b4af549a6347618f846d4c93b769b

SHA256
166e1a6cf86b254525a03d1510fe76da574f977c012064df39dd6f4af72a4b29

SHA512
946e56d543a6d00674d8fa17ecd9589cba3211cfa52c978e0c9dab0fa45cdfc7787245d14308f5692bd99d621c0caca3c546259fcfa725fff9171b144514b6e0

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\DotNetZip.dll

Filesize
461KB

MD5
a999d7f3807564cc816c16f862a60bbe

SHA1
1ee724daaf70c6b0083bf589674b6f6d8427544f

SHA256
8e9c0362e9bfb3c49af59e1b4d376d3e85b13aed0fbc3f5c0e1ebc99c07345f3

SHA512
6f1f73314d86ae324cc7f55d8e6352e90d4a47f0200671f7069daa98592daaceea34cf89b47defbecdda7d3b3e4682de70e80a5275567b82aa81b002958e4414

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe.config

Filesize
261B

MD5
c2edc7b631abce6db98b978995561e57

SHA1
5b1e7a3548763cb6c30145065cfa4b85ed68eb31

SHA256
e59afc2818ad61c1338197a112c936a811c5341614f4ad9ad33d35c8356c0b14

SHA512
5bef4b5487ecb4226544ef0f68d17309cf64bfe52d5c64732480a10f94259b69d2646e4c1b22aa5c80143a4057ee17b06239ec131d5fe0af6c4ab30e351faba2

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\GA.Analytics.Monitor.dll

Filesize
52KB

MD5
6f9e5c4b5662c7f8d1159edcba6e7429

SHA1
c7630476a50a953dab490931b99d2a5eca96f9f6

SHA256
e3261a13953f4bedec65957b58074c71d2e1b9926529d48c77cfb1e70ec68790

SHA512
78fd28a0b19a3dae1d0ae151ce09a42f7542de816222105d4dafe1c0932586b799b835e611ce39a9c9424e60786fbd2949cabac3f006d611078e85b345e148c8

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Common.dll

Filesize
192KB

MD5
ac80e3ca5ec3ed77ef7f1a5648fd605a

SHA1
593077c0d921df0819d48b627d4a140967a6b9e0

SHA256
93b0f5d3a2a8a82da1368309c91286ee545b9ed9dc57ad1b31c229e2c11c00b5

SHA512
3ecc0fe3107370cb5ef5003b5317e4ea0d78bd122d662525ec4912dc30b8a1849c4fa2bbb76e6552b571f156d616456724aee6cd9495ae60a7cb4aaa6cf22159

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Editor.dll

Filesize
816KB

MD5
eaa268802c633f27fcfc90fd0f986e10

SHA1
21f3a19d6958bcfe9209df40c4fd8e7c4ce7a76f

SHA256
fe26c7e4723bf81124cdcfd5211b70f5e348250ae74b6c0abc326f1084ec3d54

SHA512
c0d6559fc482350c4ed5c5a9a0c0c58eec0a1371f5a254c20ae85521f5cec4c917596bc2ec538c665c3aa8e7ee7b2d3d322b3601d69b605914280ff38315bb47

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Syntax.dll

Filesize
228KB

MD5
3be64186e6e8ad19dc3559ee3c307070

SHA1
2f9e70e04189f6c736a3b9d0642f46208c60380a

SHA256
79a2c829de00e56d75eeb81cd97b04eae96bc41d6a2dbdc0ca4e7e0b454b1b7c

SHA512
7d0e657b3a1c23d13d1a7e7d1b95b4d9280cb08a0aca641feb9a89e6b8f0c8760499d63e240fe9c62022790a4822bf4fe2c9d9b19b12bd7f0451454be471ff78

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Telerik.NetworkConnections.dll

Filesize
34KB

MD5
798d6938ceab9271cdc532c0943e19dc

SHA1
5f86b4cd45d2f1ffae1153683ce50bc1fb0cd2e3

SHA256
fb90b6e76fdc617ec4ebf3544da668b1f6b06c1debdba369641c3950cab73dd2

SHA512
644fde362f032e6e479750696f62e535f3e712540840c4ca27e10bdfb79b2e5277c82a6d8f55f678e223e45f883776e7f39264c234bc6062fc1865af088c0c31

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9ACB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9AE2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B3325a29b#\4f44abb46807a5ad0f0bf1ae5ba48323\Microsoft.Build.Framework.ni.dll.aux

Filesize
588B

MD5
90dde7396bbc17dddaa7dcdec75c2d7b

SHA1
613a143997175a531af577c3e47611d006cd585c

SHA256
a3613a9ea1e995ce43a3754b3eab8f09325f039188593a4666bba0fa56dc5c03

SHA512
3cb619a3fe00d5cff37830e080a5db2e27d122293fb15f200a6bb59ad905d32bb99c720d36d1a8f6fcd89cad5c8e2610dbf89c09db28f7ec1974041d4b026c18

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B83e9cb53#\4a58f2013ffa484c7f872e70952613ca\Microsoft.Build.Utilities.v4.0.ni.dll.aux

Filesize
888B

MD5
0c2e9bf2f96be2986d8b8449c0028067

SHA1
c41ba485bc1d847ebba609bc4bcc37b4109f7fca

SHA256
4d9d156b27b902a1265a2d36a47fb285ecba5abb97ca730df3893f3397f5da4a

SHA512
8a8eb919323d37cacad9665b671d5639bcd4f0955997f5321a486c1e3179bb6762b2ae009cc658b402dbb4dc0d873e110e58f5b67565c458eff2d16c8f1e46f1

Download Submit
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\2145e325c531dd03775cc61606722965\Microsoft.JScript.ni.dll.aux

Filesize
580B

MD5
0fa7a2200ae2493f05b85e85688aa663

SHA1
18ce43782b1a150948a3c80df0dd3374372cf675

SHA256
d2573a4a215ae02c70b6fac850c22931a757c18ff243c16b819b03d1dc2bf92e

SHA512
84629c719112dc1257a89bd0de5d4be7465abe6b81a25c8326a05f5001c51e6f3b921652cb81da68bbec7e975f476aed6f8606d1da6e736f456c65853072e129

Download Submit
C:\Windows\assembly\temp\0NF3GB5NC0\DotNetZip.ni.dll.aux

Filesize
532B

MD5
e9169857138b22906989cd8645579dff

SHA1
9f2f0537c6f57e9a7605c6ac8e0cf4664880cb63

SHA256
fe9553b117abc7414ed50595392bcce48f3f86cf6ef802bca0e1c0a1674ceb46

SHA512
93d1a876aae2c160d437c3a81ad593a7343958d94a02d90fd382b72ee276715c1148e2b9ff6f3a7928e3c555f252e0aa2540a24cfba433eadb6809dbf5a45fd4

Download Submit
C:\Windows\assembly\temp\CAW0AG2CGR\Analytics.ni.dll.aux

Filesize
716B

MD5
17c17240ab6ab6254d5e377730f02a1a

SHA1
1d3958db4e5d2a29732e45ed2eadfa08d1d879ed

SHA256
d9923f94b9cba213ffac3e41953b9ca991a562fbfc5c1765b4fd05c25fb94b0e

SHA512
d3046376bbfd7591a34be448bc102c380816b779a3866757c39998248739c165bd724321ff63ef0114090ff37b9c4043c89b058e253fe072f42e68a3d677f101

Download Submit
C:\Windows\assembly\temp\DO4Z73FY9B\Newtonsoft.Json.ni.dll.aux

Filesize
1KB

MD5
d338ba1b3d95ae9e95583db208df2174

SHA1
e160de175d1abe04983e0fbc9d652b52945a061c

SHA256
cfdb9f0cb1a77233fc2e036372ee76763de6ce37961fd323e36cdbe9fb661061

SHA512
e56ed6af3e807d20036a2dc4415f547b2e8646f41c4b68365fd9e70c0c5d01977899df229f8b222fdc60bc2789f5155048c876c95a6a1a8ec6a68eb30de52ed9

Download Submit
C:\Windows\assembly\temp\RIJVZ3W1UA\GA.Analytics.Monitor.ni.dll.aux

Filesize
712B

MD5
edf737aa1f61c81d720917eb84e9fd5d

SHA1
8f6e5fd53b5c381491caa2d4a93cf81421088bce

SHA256
495b3d096ede487f9c7a7308ca15eb61b06a220089f7b9cd216013e0131bccdc

SHA512
45bb1c38ce0276730bfca53b6400db107f4854c9f9a80465e98bd98d40b69d4b2db8e2eb8e39bd26dbc16d26303ca1e21417aa67e88ef146e1254e33d39801fc

Download Submit
C:\Windows\assembly\temp\W3SU6J3SH1\Microsoft.Build.Tasks.v4.0.ni.dll.aux

Filesize
2KB

MD5
c228a99297b86188b16cd8ae9f9e95c7

SHA1
b4603bf9196c3908a94ddff0ac2e51d1edd40777

SHA256
4bf1bad2d0aa458307845c6cfff003ad168b9af1c183d4fd44de734bf66ead97

SHA512
f6933920fa6c75bd3facbc91d8b6d594461ebfd54c5557155fbda4d6fd35c135d2438e377538540103947f7394d404d05dc7b08fd731e067cf45d94919cf474d

Download Submit
C:\Windows\assembly\temp\XGMTMHNIP5\Telerik.NetworkConnections.ni.dll.aux

Filesize
732B

MD5
61d90bbb5964d416b86d7ef8b9adef40

SHA1
eba684714c32c9f2939499ee896a492122da707d

SHA256
9051805012f5ce17fc5f4a71482b34f9c0c4b61bf640ee31f48719a926782ab9

SHA512
867d21199f7fd950cdf9a4f2ce5435326abd7411a137f60c406b8ec185ae7d50e211dbf98a37591aba24bdd00fbcfee974e46f6691e8589e6dae2d11e2e8f47a

Download Submit
\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe

Filesize
3.5MB

MD5
87bc17f56e744e74408e6ae8bb28b724

SHA1
3aa572388083ff00a95405d34d1189c99c7ff5be

SHA256
ffb24fc36ade87988f9908e848d0333ce7ffb2b4e4d0ffb43f6556246069d057

SHA512
cbeee155c97b87a22b92b808f86fee25c18db51ab43a36b657d532d2d47d3a7db2f4507a699b72af904bf6d5ed851d1ae1fcfb4833a57096e6c7787211c0f35d

Download Submit
\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\FSE2.exe

Filesize
50KB

MD5
c2fe7c92a8fc763407233203b49685f9

SHA1
d2f199e71eb7531caa71f85a679e49fa400cc401

SHA256
f55d5cb9968bcb875dc39cc84153bd52375f4cf8a680e0f5eb53a57a7e532561

SHA512
f74d29f4520ae0c9aa153f3649bdf80c1ed882a61add7267eafaecb2d036f43fc44434279e3dacd763ebc42fedc78ec3ad52a11b55d14b224b01a8bebca0f6b5

Download Submit
\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper

Filesize
18KB

MD5
b1827fca38a5d49fb706a4a7eee4a778

SHA1
95e342f3b6ee3ebc34f98bbb14ca042bca3d779f

SHA256
77523d1504ab2c0a4cde6fcc2c8223ca1172841e2fd9d59d18e5fc132e808ae2

SHA512
41be41372fe3c12dd97f504ebabb70ce899473c0c502ff7bfeaddc748b223c4a78625b6481dbab9cb54c10615e62b8b2dbe9a9c08eb2f69c54ebf5933efbeb1b

Download Submit
\Users\Admin\AppData\Local\Temp\nsj8B9F.tmp\System.dll

Filesize
12KB

MD5
192639861e3dc2dc5c08bb8f8c7260d5

SHA1
58d30e460609e22fa0098bc27d928b689ef9af78

SHA256
23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

SHA512
6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Analytics\d756563aa7cd4e9c00502605394ea611\Analytics.ni.dll

Filesize
148KB

MD5
4b962d3d8b3c91fa54e20ea48d09a990

SHA1
35468f050fb1b4a5e57a437b644d2c9e512f862f

SHA256
3e7dc77c58ae21758add41de81b649240e95707abcbd6d02fccdaa73449ab33f

SHA512
5ba87664ebadc3611523e69c9b26b6b9f4576240eb5c3a7e39a21a3a6f68f37142c9902fe4410f4e60593556d0e641a9ee82a37c1cb29e50d6247db2804ac3c5

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\DotNetZip\5635f8414edae06a1b5d07ea0cbdc9ed\DotNetZip.ni.dll

Filesize
1.0MB

MD5
8343f1a30bcc16e7b45856ccb4e36f02

SHA1
d63a840c79ec4053e116a93a827ad1d0b147a9e1

SHA256
4bd4fb6127e136939557ecdbac8ee5200fa1056df8c7b2fc3a7e5198615502b7

SHA512
f0046c44408d87ede8b482b9240cdb1dc47662e4b3524db1f7d1e13d8b735a8509b54e95fb9deea97c2404c3c6bada86fd3501e2813237553faf33b31c424a4d

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\GA.Analytics.Monitor\3bf155f5fe5c3c876614c4d82313933c\GA.Analytics.Monitor.ni.dll

Filesize
158KB

MD5
188e0e27618fc054e447005da14b39e6

SHA1
fa53f294d3f2d484b513f17ca5d21b33a52e2500

SHA256
7602634749732ab0411aebe3b5789b736c8e68d07688dd22d83f29b6e86675c9

SHA512
717e160dec70f5d647e6152ed1ce8ed1e4d64118cd68ffaa091264d8a7b947175261552a9171ebf4ddc7fe0096608a9a4f5d1b24857d1c8eb5d750b2e085670c

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B3325a29b#\4f44abb46807a5ad0f0bf1ae5ba48323\Microsoft.Build.Framework.ni.dll

Filesize
546KB

MD5
75de4db178e3310ebf8bfa83a003b8e2

SHA1
c0d05985fb9e28ede26b00143d939839cb0e3ae6

SHA256
304ae94177bcd5f8659eb5a232676c2a9857dc495c273fce2e2e65fab4ae4eb6

SHA512
4310161d72d60ef55a5ca6601bf4f5773518a9fcbeab4fda60afc18b334a1fbded3a5426795ed3587b5c51e2f6fc39176014a75e75aca2d3cfafc8a19d85b983

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B83e9cb53#\4a58f2013ffa484c7f872e70952613ca\Microsoft.Build.Utilities.v4.0.ni.dll

Filesize
1011KB

MD5
6d7e1bc098c599dc54b552531ed637ac

SHA1
ff4648a4ce473a3cbe6e3c75e1c606d593353de1

SHA256
874ece1c76a575a96e174eb846edcbeb6134ee66e71bfd025a250a7406627ef5

SHA512
1e88c80b969c0ac44e880316189ce3789f2fb0d8044e39c90ef99edfe4de83f7c21dc21adf4c51f6d88f77b92035b519794ed91d9d04c74cef971aa3424ce04a

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Baa2ca56b#\faa890702be0a0b8574aa82cb24b9da3\Microsoft.Build.Tasks.v4.0.ni.dll

Filesize
4.1MB

MD5
07de6b9bdeebae49461ef58e29953464

SHA1
5ba78e69c3d93724c6a3de013157b9350bcd6eb9

SHA256
85da41cc1f1beac3528bab39240912ecb8ac7fb313a89342e3fffd9cf0a99c74

SHA512
1b10add9a8cab2913299a03da26ad4fcb84826ff33c847d53078d18e3459b4c07a3b0ee52b67d9fe2f5b90ae7f98da502369159c2edc3e81fa569242184ab0b4

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\2145e325c531dd03775cc61606722965\Microsoft.JScript.ni.dll

Filesize
2.7MB

MD5
d1d5dd7761a0e2c31c2baeeb4442a6ba

SHA1
c681dca866baa02e7840bffdbcff349da69ba25c

SHA256
84676accc10df0f610772b5d447b058a9fd3c4d399cddc01ef6510d9832915f1

SHA512
59891b98e42635c056debe5fdd373b3d31ef1731c653c7df179c0db8544c6bfc6e4899d62a3068b76a652e71899b285e1757260ccaa805658e1e77e00cb9b263

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Newtonsoft.Json\399708e37f6b243e3c60338d349dc53a\Newtonsoft.Json.ni.dll

Filesize
3.6MB

MD5
248048fcedfd5cb2d51cc6ce815cc6e7

SHA1
502df74dc5c54c7400242830194029d34fb46891

SHA256
404296d3d998442262a8a413c2f1697f2ba1f2222b573a888204004afadbdfb9

SHA512
d56ad2b11ee66fe2841239cea7bbfd4d43d73ab9400e040d504cb70d2feabacfc81cdc61f4acdb46a83e16859877a5695992545d0a94299ed8677a22d1a01528

Download Submit
\Windows\assembly\NativeImages_v4.0.30319_64\Telerik.Net8bf66678#\e5f4977994d2fd10324efd51321f1c59\Telerik.NetworkConnections.ni.dll

Filesize
94KB

MD5
8c1196b2476c2ae2dee297e3db1cf37f

SHA1
27b4c6bc7876d7f52f34bffe2fb1f3cee88444ff

SHA256
f298ac1090234846c34b192f4683d34477f84f5eb8b844afedac9d4de246e104

SHA512
cd4bbe93c3a40035c65358ba714f39b8c6770aa44bdb87ed6dd23292f7a641c3da3977691fb1ecf83f1dbb6fe704edc6eeb817d1da48b4f2f9de62cf9c2ec591

Download Submit
memory/616-231-0x0000000002640000-0x0000000002684000-memory.dmp

Filesize
272KB

Download
memory/616-250-0x0000064438000000-0x00000644380FF000-memory.dmp

Filesize
1020KB

Download
memory/616-232-0x00000000005D0000-0x00000000005EA000-memory.dmp

Filesize
104KB

Download
memory/760-600-0x00000644A0000000-0x00000644A0109000-memory.dmp

Filesize
1.0MB

Download
memory/1028-207-0x000000001B550000-0x000000001B8D4000-memory.dmp

Filesize
3.5MB

Download
memory/1028-208-0x0000000002050000-0x00000000020CA000-memory.dmp

Filesize
488KB

Download
memory/1028-209-0x0000000000790000-0x000000000079C000-memory.dmp

Filesize
48KB

Download
memory/1028-211-0x000000001B3C0000-0x000000001B472000-memory.dmp

Filesize
712KB

Download
memory/1028-210-0x00000000007A0000-0x00000000007AC000-memory.dmp

Filesize
48KB

Download
memory/1224-779-0x00000644A0000000-0x00000644A03A2000-memory.dmp

Filesize
3.6MB

Download
memory/1272-216-0x000006443CC40000-0x000006443CEEC000-memory.dmp

Filesize
2.7MB

Download
memory/1272-206-0x0000000002000000-0x00000000020BA000-memory.dmp

Filesize
744KB

Download
memory/1364-409-0x000000001B580000-0x000000001B904000-memory.dmp

Filesize
3.5MB

Download
memory/1364-413-0x000000001B030000-0x000000001B0E2000-memory.dmp

Filesize
712KB

Download
memory/1416-856-0x00000644A0000000-0x00000644A0029000-memory.dmp

Filesize
164KB

Download
memory/1416-846-0x0000000000470000-0x0000000000480000-memory.dmp

Filesize
64KB

Download
memory/1744-983-0x0000000000160000-0x0000000000170000-memory.dmp

Filesize
64KB

Download
memory/1928-196-0x0000000000260000-0x000000000026C000-memory.dmp

Filesize
48KB

Download
memory/1928-200-0x0000000000270000-0x000000000027C000-memory.dmp

Filesize
48KB

Download
memory/1928-105-0x000000001B530000-0x000000001B8B4000-memory.dmp

Filesize
3.5MB

Download
memory/1928-192-0x0000000002250000-0x000000000230A000-memory.dmp

Filesize
744KB

Download
memory/1928-194-0x0000000002920000-0x000000000299A000-memory.dmp

Filesize
488KB

Download
memory/1928-205-0x0000000000280000-0x0000000000290000-memory.dmp

Filesize
64KB

Download
memory/1928-202-0x0000000000490000-0x00000000004AA000-memory.dmp

Filesize
104KB

Download
memory/1928-203-0x000000001B1A0000-0x000000001B2C2000-memory.dmp

Filesize
1.1MB

Download
memory/1928-201-0x0000000002080000-0x00000000020C4000-memory.dmp

Filesize
272KB

Download
memory/1928-198-0x0000000002D00000-0x0000000002DB2000-memory.dmp

Filesize
712KB

Download
memory/2292-625-0x00000644A0000000-0x00000644A001A000-memory.dmp

Filesize
104KB

Download
memory/2820-103-0x0000000001100000-0x0000000001108000-memory.dmp

Filesize
32KB

Download
memory/2824-415-0x0000064438000000-0x0000064438429000-memory.dmp

Filesize
4.2MB

Download
memory/2824-286-0x000000001B170000-0x000000001B292000-memory.dmp

Filesize
1.1MB

Download
memory/2928-271-0x0000064438000000-0x000006443808B000-memory.dmp

Filesize
556KB

Download
memory/2928-270-0x0000000000560000-0x000000000057A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads