Analysis
- user interaction
yes - max time kernel
583s - max time network
585s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/08/2026, 12:29
General
- Target tgWsproxy.exe
- Size 37.7MB
- Sample260809-pn6b7seq51
- SHA256 3ae9f263c7a093592db83592768848686292828e0bdf80706f85f3e882b8c818
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 43 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file 2 IoCs
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Checks computer location settings 2 TTPs 11 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 31 IoCs
- Loads dropped DLL 64 IoCs
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory 2 IoCs
- UPX packed file 50 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 33 IoCs
- Drops file in Windows directory 22 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 6 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies trusted root certificate store through registry 1 TTPs 4 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- System Location Discovery: System Language Discovery 1 TTPs 29 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 34 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 12 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies data under HKEY_USERS 6 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 33 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tgWsproxy.exe"C:\Users\Admin\AppData\Local\Temp\tgWsproxy.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\zapretdriver.exe"C:\Users\Admin\AppData\Local\Temp\zapretdriver.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\PeerDistRepub\StartMenuExperienceHost.exeC:\Users\Admin\AppData\Local\PeerDistRepub\StartMenuExperienceHost.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
- UAC bypass
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ReAgentc.exe"C:\Windows\system32\ReAgentc.exe" /disable5⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Google\Chrome\Application\StartMenuExperienceHost.exe"C:\Program Files\Google\Chrome\Application\StartMenuExperienceHost.exe" -4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\StartMenuExperienceHost.exe"C:\Program Files (x86)\Microsoft\Edge\Application\StartMenuExperienceHost.exe" -4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
- Executes a command shell one-liner
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Flowseal/tg-ws-proxy/blob/main/docs/Funding.md4⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x218,0x7ff802d7c188,0x7ff802d7c194,0x7ff802d7c1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,14059576267055899876,909234955521099784,524288 --field-trial-handle=2260,i,13194027539340871601,10629302903883081825,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1900,i,2616465371265922609,11974935637460886680,262144 --field-trial-handle=2260,i,13194027539340871601,10629302903883081825,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,17310909457948738943,4136807720466262439,524288 --field-trial-handle=2260,i,13194027539340871601,10629302903883081825,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,10090792277488794634,6091925911455435628,2097152 --field-trial-handle=2260,i,13194027539340871601,10629302903883081825,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,6326799956524328962,14583082938904855628,2097152 --field-trial-handle=2260,i,13194027539340871601,10629302903883081825,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,9663820622984479769,4792117739128185622,524288 --field-trial-handle=2260,i,13194027539340871601,10629302903883081825,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,11163223430585982856,6047350707743157018,524288 --field-trial-handle=2260,i,13194027539340871601,10629302903883081825,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,2934857874235505751,2721720092935770389,524288 --field-trial-handle=2260,i,13194027539340871601,10629302903883081825,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,8793603138431596049,3812190974528469720,524288 --field-trial-handle=2260,i,13194027539340871601,10629302903883081825,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,17525984388291222577,15282740872226293667,524288 --field-trial-handle=2260,i,13194027539340871601,10629302903883081825,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,17525984388291222577,15282740872226293667,524288 --field-trial-handle=2260,i,13194027539340871601,10629302903883081825,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,592314206777009292,6485037674534214177,524288 --field-trial-handle=2260,i,13194027539340871601,10629302903883081825,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,3457760873326588064,6928371558232416247,524288 --field-trial-handle=2260,i,13194027539340871601,10629302903883081825,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,5065632055881296706,12768790261177683836,524288 --field-trial-handle=2260,i,13194027539340871601,10629302903883081825,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,17416118832929016729,5269805024712722835,524288 --field-trial-handle=2260,i,13194027539340871601,10629302903883081825,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,16369442722426781115,3663437040534212373,524288 --field-trial-handle=2260,i,13194027539340871601,10629302903883081825,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window5⤵
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff807dfc728,0x7ff807dfc734,0x7ff807dfc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1600,i,4782646531924155257,13410738248294794815,524288 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,4170436539677574165,9978490118984396404,262144 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2096 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2448,i,3365431581634296719,11745957957708661256,524288 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2560 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,1603116473089830009,2689024524382983665,2097152 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3352 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3284,i,12991933138805530785,14208040021564634307,2097152 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4632,i,11628246485179605859,2305049669933328501,2097152 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4692 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5308,i,2975210474772856681,9528054583007761094,2097152 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5316 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,13138587354409400374,10698647836259597523,524288 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5400 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5912,i,10995999820059193835,4136136974222699517,524288 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5952 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5960,i,11664359254717900612,15931518106138291286,524288 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5416 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,12211363186418837654,16515795623014031000,524288 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5904 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5976,i,3126751173579827514,17804309471444454561,2097152 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5788,i,1346052033510676418,16119339382052673383,2097152 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4684 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4076,i,7804504197656725412,12207855893930543702,2097152 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=860 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,17645365363825091693,15335220345227206538,524288 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6080,i,14581165217700241279,14400618500985799710,2097152 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3564 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5924,i,8488436521284697439,11625021999058832555,2097152 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6056 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3308,i,8869216355384830643,14999457132958702619,524288 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5312 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Fiddler Everywhere 8.0.2.exe"C:\Users\Admin\Downloads\Fiddler Everywhere 8.0.2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy30F5.tmp\tempfile.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uvogkrs0\uvogkrs0.cmdline"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES37EA.tmp" "c:\Users\Admin\AppData\Local\Temp\uvogkrs0\CSC463AE4B9DA2F4637BDF2456A71C98F5.TMP"5⤵
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy30F5.tmp\tempfile.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\a1surbbj\a1surbbj.cmdline"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES499D.tmp" "c:\Users\Admin\AppData\Local\Temp\a1surbbj\CSC78D0388E7AE14E528363BD92F2F54B57.TMP"5⤵
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"3⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6276,i,16584267602937725211,17294064557279358571,262144 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5316 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,7451434945062102028,1804737862973897877,524288 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3528 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6432,i,14069185462970617475,15350427260695930763,2097152 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6416 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6444,i,7136346281682640256,17882086045043618130,2097152 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6532 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6112,i,17827675043057665843,6529365159955852725,2097152 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6132 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6552,i,5049950868998200573,17143315348771204520,524288 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6548 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\FiddlerSetup.6.0.20261.7291-latest.exe"C:\Users\Admin\Downloads\FiddlerSetup.6.0.20261.7291-latest.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\nsaA34D.tmp\FiddlerSetup.exe"C:\Users\Admin\AppData\Local\Temp\nsaA34D.tmp\FiddlerSetup.exe" /D=3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="FiddlerProxy"4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="FiddlerProxy" program="C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe" action=allow profile=any dir=in edge=deferuser protocol=tcp description="Permit inbound connections to Fiddler"4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 0 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"5⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 0 -NGENProcess 29c -Pipe 2a4 -Comment "NGen Worker Process"5⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 0 -NGENProcess 2bc -Pipe 2c4 -Comment "NGen Worker Process"5⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 0 -NGENProcess 2e0 -Pipe 2d8 -Comment "NGen Worker Process"5⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 0 -NGENProcess 2a8 -Pipe 29c -Comment "NGen Worker Process"5⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 0 -NGENProcess 2f0 -Pipe 2b0 -Comment "NGen Worker Process"5⤵
- Drops file in Windows directory
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\EnableLoopback.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 0 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"5⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 0 -NGENProcess 274 -Pipe 27c -Comment "NGen Worker Process"5⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 0 -NGENProcess 290 -Pipe 298 -Comment "NGen Worker Process"5⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 0 -NGENProcess 2a8 -Pipe 2d0 -Comment "NGen Worker Process"5⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 0 -NGENProcess 2bc -Pipe 29c -Comment "NGen Worker Process"5⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 0 -NGENProcess 290 -Pipe 2d8 -Comment "NGen Worker Process"5⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 0 -NGENProcess 2b4 -Pipe 2ec -Comment "NGen Worker Process"5⤵
- Drops file in Windows directory
-
-
-
C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper"C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper" /a "C:\Users\Admin\AppData\Local\Programs\Fiddler"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://api.getfiddler.com/r/?Fiddler2FirstRun4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://api.getfiddler.com/r/?Fiddler2FirstRun5⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2f0,0x7ff802d7c188,0x7ff802d7c194,0x7ff802d7c1a06⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,13903210571531487470,11759045497764872807,524288 --field-trial-handle=2872,i,8787480976963467914,17754061171728706558,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:36⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,9490569624250138142,8289761865482651849,262144 --field-trial-handle=2872,i,8787480976963467914,17754061171728706558,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,18404169589868464718,2867994009154881656,524288 --field-trial-handle=2872,i,8787480976963467914,17754061171728706558,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,14854545702210110566,2364350014172992353,2097152 --field-trial-handle=2872,i,8787480976963467914,17754061171728706558,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,13984787422038694934,8386769372005341192,2097152 --field-trial-handle=2872,i,8787480976963467914,17754061171728706558,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,11464270022814129352,4886834730150853627,2097152 --field-trial-handle=2872,i,8787480976963467914,17754061171728706558,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,11244543755780338227,3321550869757379282,2097152 --field-trial-handle=2872,i,8787480976963467914,17754061171728706558,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,9781820694905643582,18430048791007329011,524288 --field-trial-handle=2872,i,8787480976963467914,17754061171728706558,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,16294506756139006734,13458571618044306691,524288 --field-trial-handle=2872,i,8787480976963467914,17754061171728706558,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5352,i,17822692555615273441,2556474937477966194,2097152 --field-trial-handle=2872,i,8787480976963467914,17754061171728706558,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,2172627345662169496,4010930127061571677,524288 --field-trial-handle=2872,i,8787480976963467914,17754061171728706558,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,10937169778506574683,8857189839979120374,524288 --field-trial-handle=2872,i,8787480976963467914,17754061171728706558,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,16536551681759386033,9965549931272942485,524288 --field-trial-handle=2872,i,8787480976963467914,17754061171728706558,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,16536551681759386033,9965549931272942485,524288 --field-trial-handle=2872,i,8787480976963467914,17754061171728706558,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,16944198499560046721,4415999350708686892,524288 --field-trial-handle=2872,i,8787480976963467914,17754061171728706558,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,3929745069086285110,18257446242523117864,524288 --field-trial-handle=2872,i,8787480976963467914,17754061171728706558,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:86⤵
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6564,i,5861219110354698371,3822955994860580032,2097152 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6716 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6696,i,13771238445267885730,908833574516091350,2097152 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5992 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6112,i,6778373441241464166,855843346273158806,524288 --field-trial-handle=2100,i,564294939121735355,16474810046640890540,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6620 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\resources\app.asar.unpacked\out\WebServer\FiddlerEverywhere.CleanUp.exe"C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\resources\app.asar.unpacked\out\WebServer\FiddlerEverywhere.CleanUp.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\Fiddler Everywhere.exe"C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\Fiddler Everywhere.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\Fiddler Everywhere.exe"C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\Fiddler Everywhere.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Fiddler Everywhere" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1820,i,337397285350360011,15006850590955893384,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1816 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\Fiddler Everywhere.exe"C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\Fiddler Everywhere.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Fiddler Everywhere" --field-trial-handle=1820,i,337397285350360011,15006850590955893384,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2196 /prefetch:32⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\Fiddler Everywhere.exe"C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\Fiddler Everywhere.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Fiddler Everywhere" --app-user-model-id=ProgressTelerik.Fiddler --app-path="C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\resources\app.asar" --no-sandbox --no-zygote --force-color-profile=srgb --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1786278063415309 --launch-time-ticks=709668592 --field-trial-handle=1820,i,337397285350360011,15006850590955893384,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2728 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe /c "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\Fiddler Everywhere.exe"C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\Fiddler Everywhere.exe" "C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\resources\app.asar.unpacked\out\fe-cleanup-process-entry" "C:\Users\Admin\AppData\Roaming\Fiddler Everywhere" 4194304 ""2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe /c "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\resources\app.asar.unpacked\out\WebServer\Fiddler.WebUi.exe"C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\resources\app.asar.unpacked\out\WebServer\Fiddler.WebUi.exe" --port=58701 --mcpPort=8868 --assistantApiKey=e628eea6-89ec-4bf4-a94c-0cc34b20bf9a "--logDirectory=C:\Users\Admin\AppData\Roaming\Fiddler Everywhere\Logs" --verboseLogging=false --logMaxSize=41943042⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "PowerShell -Command "$processesWithTypes = Get-WmiObject Win32_Process | Where-Object {$_.Name -like 'Fiddler Everywhere*'} | Select-Object -Property ProcessId, @{Name='Type'; Expression={If ($_.CommandLine -Match '--type=(\S+)') {$Matches[1]} Else {'browser'}}};Get-WmiObject Win32_PerfFormattedData_PerfProc_Process | Where-Object {$_.Name -like 'Fiddler*'} | Select-Object -Property @{Name='type'; Expression={$id = $_.IDProcess; ($processesWithTypes | Where-Object {$_.ProcessId -eq $id}).Type}}, @{Name='processName'; Expression={$_.Name}}, @{Name='pid'; Expression={$_.IDProcess}}, @{Name='cpuUsage'; Expression={$_.PercentProcessorTime}}, @{Name='memoryUsage'; Expression={$_.WorkingSet / 1MB}} | ConvertTo-Json""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -Command "$processesWithTypes = Get-WmiObject Win32_Process | Where-Object {$_.Name -like 'Fiddler Everywhere*'} | Select-Object -Property ProcessId, @{Name='Type'; Expression={If ($_.CommandLine -Match '--type=(\S+)') {$Matches[1]} Else {'browser'}}};Get-WmiObject Win32_PerfFormattedData_PerfProc_Process | Where-Object {$_.Name -like 'Fiddler*'} | Select-Object -Property @{Name='type'; Expression={$id = $_.IDProcess; ($processesWithTypes | Where-Object {$_.ProcessId -eq $id}).Type}}, @{Name='processName'; Expression={$_.Name}}, @{Name='pid'; Expression={$_.IDProcess}}, @{Name='cpuUsage'; Expression={$_.PercentProcessorTime}}, @{Name='memoryUsage'; Expression={$_.WorkingSet / 1MB}} | ConvertTo-Json"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\Fiddler Everywhere.exe"C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\Fiddler Everywhere.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Fiddler Everywhere" --app-user-model-id=ProgressTelerik.Fiddler --app-path="C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\resources\app.asar" --enable-sandbox --force-color-profile=srgb --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1786278063415309 --launch-time-ticks=714321288 --field-trial-handle=1820,i,337397285350360011,15006850590955893384,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3848 --fiddler-zoom-factor=1 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\Fiddler Everywhere.exe"C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\Fiddler Everywhere.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Fiddler Everywhere" --app-user-model-id=ProgressTelerik.Fiddler --app-path="C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\resources\app.asar" --enable-sandbox --force-color-profile=srgb --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1786278063415309 --launch-time-ticks=714349762 --field-trial-handle=1820,i,337397285350360011,15006850590955893384,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4016 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exeC:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -nologo -Command "$BIOS = @(Get-WmiObject Win32_BIOS | Select-Object -Property Manufacturer, SerialNumber, Name);$DiskDrive = @(Get-WmiObject Win32_DiskDrive | Select-Object -Property SerialNumber, Model, InterfaceType);$Processor = @(Get-WmiObject Win32_Processor | Select-Object -Property UniqueId, ProcessorId, Name, Manufacturer);New-Object -TypeName PSObject -Property @{ 'BIOS' = $BIOS; 'DiskDrive' = $DiskDrive; 'Processor' = $Processor} | ConvertTo-JSON"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\Fiddler Everywhere.exe"C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\Fiddler Everywhere.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Fiddler Everywhere" --app-user-model-id=ProgressTelerik.Fiddler --app-path="C:\Users\Admin\AppData\Local\Programs\Fiddler Everywhere\resources\app.asar" --enable-sandbox --force-color-profile=srgb --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1786278063415309 --launch-time-ticks=718188045 --field-trial-handle=1820,i,337397285350360011,15006850590955893384,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=2300 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "PowerShell -Command "$processesWithTypes = Get-WmiObject Win32_Process | Where-Object {$_.Name -like 'Fiddler Everywhere*'} | Select-Object -Property ProcessId, @{Name='Type'; Expression={If ($_.CommandLine -Match '--type=(\S+)') {$Matches[1]} Else {'browser'}}};Get-WmiObject Win32_PerfFormattedData_PerfProc_Process | Where-Object {$_.Name -like 'Fiddler*'} | Select-Object -Property @{Name='type'; Expression={$id = $_.IDProcess; ($processesWithTypes | Where-Object {$_.ProcessId -eq $id}).Type}}, @{Name='processName'; Expression={$_.Name}}, @{Name='pid'; Expression={$_.IDProcess}}, @{Name='cpuUsage'; Expression={$_.PercentProcessorTime}}, @{Name='memoryUsage'; Expression={$_.WorkingSet / 1MB}} | ConvertTo-Json""2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -Command "$processesWithTypes = Get-WmiObject Win32_Process | Where-Object {$_.Name -like 'Fiddler Everywhere*'} | Select-Object -Property ProcessId, @{Name='Type'; Expression={If ($_.CommandLine -Match '--type=(\S+)') {$Matches[1]} Else {'browser'}}};Get-WmiObject Win32_PerfFormattedData_PerfProc_Process | Where-Object {$_.Name -like 'Fiddler*'} | Select-Object -Property @{Name='type'; Expression={$id = $_.IDProcess; ($processesWithTypes | Where-Object {$_.ProcessId -eq $id}).Type}}, @{Name='processName'; Expression={$_.Name}}, @{Name='pid'; Expression={$_.IDProcess}}, @{Name='cpuUsage'; Expression={$_.PercentProcessorTime}}, @{Name='memoryUsage'; Expression={$_.WorkingSet / 1MB}} | ConvertTo-Json"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "PowerShell -Command "$processesWithTypes = Get-WmiObject Win32_Process | Where-Object {$_.Name -like 'Fiddler Everywhere*'} | Select-Object -Property ProcessId, @{Name='Type'; Expression={If ($_.CommandLine -Match '--type=(\S+)') {$Matches[1]} Else {'browser'}}};Get-WmiObject Win32_PerfFormattedData_PerfProc_Process | Where-Object {$_.Name -like 'Fiddler*'} | Select-Object -Property @{Name='type'; Expression={$id = $_.IDProcess; ($processesWithTypes | Where-Object {$_.ProcessId -eq $id}).Type}}, @{Name='processName'; Expression={$_.Name}}, @{Name='pid'; Expression={$_.IDProcess}}, @{Name='cpuUsage'; Expression={$_.PercentProcessorTime}}, @{Name='memoryUsage'; Expression={$_.WorkingSet / 1MB}} | ConvertTo-Json""2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -Command "$processesWithTypes = Get-WmiObject Win32_Process | Where-Object {$_.Name -like 'Fiddler Everywhere*'} | Select-Object -Property ProcessId, @{Name='Type'; Expression={If ($_.CommandLine -Match '--type=(\S+)') {$Matches[1]} Else {'browser'}}};Get-WmiObject Win32_PerfFormattedData_PerfProc_Process | Where-Object {$_.Name -like 'Fiddler*'} | Select-Object -Property @{Name='type'; Expression={$id = $_.IDProcess; ($processesWithTypes | Where-Object {$_.ProcessId -eq $id}).Type}}, @{Name='processName'; Expression={$_.Name}}, @{Name='pid'; Expression={$_.IDProcess}}, @{Name='cpuUsage'; Expression={$_.PercentProcessorTime}}, @{Name='memoryUsage'; Expression={$_.WorkingSet / 1MB}} | ConvertTo-Json"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Program Files (x86)\Microsoft\RuntimeBroker.exe"C:\Program Files (x86)\Microsoft\RuntimeBroker.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\PeerDistRepub\StartMenuExperienceHost.exeC:\Users\Admin\AppData\Local\PeerDistRepub\StartMenuExperienceHost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff802d7c188,0x7ff802d7c194,0x7ff802d7c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,15452566123814994299,4379704652025637073,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,6176932426205856031,7718080877415062180,262144 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2664,i,10313875994400725322,12510565818458998178,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,2930513621448381337,17282143621553039051,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,2930513621448381337,17282143621553039051,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,15866354526437723915,9299670049560243370,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4616,i,5047128985244500021,2844831101975921580,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,9242177534353767502,3367350975805861325,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,9166006876451136955,4907872737587898801,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,14922353911053673179,3729951947751402937,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,9375541716440793796,6308011804859611767,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,16399722177611350935,13362369785555784520,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,17444458395406326738,10102461013642170416,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,14054343666231033623,9802392873318127149,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,13501969920639994720,14910880042234821715,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2036,i,10144403426597868074,4150712273851246666,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5188,i,6037849274329547804,18129269909472898545,262144 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,15421782351235064651,3570875334063573160,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,15709910026434109529,8071035501236937115,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,7503482777403911553,10328830195786618636,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,4307668082687625650,16057950068699029126,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,12617339117892484255,5642169631964304631,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=1336 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,4293997358126844345,6052669886367883163,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,6826652058582640296,1744281199097967944,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,15088661002221170236,16075893922095553854,524288 --field-trial-handle=2320,i,1074941513193017501,1738769353625713317,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies trusted root certificate store through registry
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Programs\Fiddler\TrustCert.exe"C:\Users\Admin\AppData\Local\Programs\Fiddler\TrustCert.exe" -noprompt -path="C:\Users\Admin\Documents\Fiddler2\FiddlerRoot.cer"2⤵
- Executes dropped EXE
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\RuntimeBroker.exe"C:\Program Files (x86)\Microsoft\RuntimeBroker.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\PeerDistRepub\StartMenuExperienceHost.exeC:\Users\Admin\AppData\Local\PeerDistRepub\StartMenuExperienceHost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tgWsproxy.exe"C:\Users\Admin\AppData\Local\Temp\tgWsproxy.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\zapretdriver.exe"C:\Users\Admin\AppData\Local\Temp\zapretdriver.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows.exe"3⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
- Executes a command shell one-liner
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files (x86)\Microsoft\RuntimeBroker.exe"C:\Program Files (x86)\Microsoft\RuntimeBroker.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\PeerDistRepub\StartMenuExperienceHost.exeC:\Users\Admin\AppData\Local\PeerDistRepub\StartMenuExperienceHost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Ignore Process Interrupts
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
4Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
LICENSE
manifest.json
svc_e0f0fff2.log
svc_e0f0fff2.log
svc_e0f0fff2.log
svc_e0f0fff2.log
svc_e0f0fff2.log
svc_e0f0fff2.log
svc_e0f0fff2.log
svc_e0f0fff2.log
svc_e0f0fff2.log
electron-settings.json
D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000007
f_00004c
the-real-index
the-real-index
the-real-index
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe58ed49.TMP
Local State
Local State
Local State
Local State
Local State
Local State
a9e026bb-8ebb-4feb-acd6-68d04103257c.tmp
blocklist
protocols.json
crl-set
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
16cbeedf-b923-49dc-8b09-924694f9cbae.tmp
485b567e-86fa-4c55-be0b-738c7d6094ff.tmp
the-real-index
the-real-index
the-real-index~RFe5ce6be.TMP
SiteList-Enterprise.json
Edge Profile.ico
dasherSettingSchema.json
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
c23a0516-87dc-43dc-ad06-c5641360c7bb.tmp
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
keys.json
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
d3c0ef41-b5de-4877-bb6c-1b52bf471aa8.tmp
chrome_100_percent.pak
System.Linq.AsyncEnumerable.dll
QWhale.Common.dll
QWhale.Editor.dll
QWhale.Syntax.dll
user.config
1639970958
9b45025c-21d9-4548-b3b8-52cc96adcbfa.tmp
TgWsProxy_windows.exe
Tmp3DDC.tmp
Tmp3FD2.tmp
Tmp4061.tmp
Tmp439F.tmp
Tmp4D26.tmp
Tmp4F0D.tmp
Tmp9FB4.tmp
TmpF1CD.tmp
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-fibers-l1-1-1.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-kernel32-legacy-l1-1-1.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-sysinfo-l1-2-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
base_library.zip
libffi-8.dll
python3.dll
python311.dll
ucrtbase.dll
__PSScriptPolicyTest_juqgz4qu.jmi.ps1
d764cadb-2178-48ad-862c-b9615642077e.tmp
System.dll
LICENSE.electron.txt
LICENSES.chromium.html
chrome_200_percent.pak
d3dcompiler_47.dll
dxcompiler.dll
dxil.dll
ffmpeg.dll
fiddler.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
app-update.yml
app.asar
NOTICES.txt
BasicFormatsForCore.dll
BouncyCastle.Cryptography.dll
3rdpartylicenses.txt
ninja-digits-static.svg
ninja-digits.svg
Fiddler-Logo.png
feather-mail.svg
fiddler-logo-splash.svg
google-hangouts.svg
google-logo.svg
header.svg
background_browser.svg
background_error.svg
background_success.svg
prompt-darwin-monterey-dark.png
prompt-darwin-monterey-light.png
prompt-darwin.png
prompt-win32.png
home-ninja-banner.svg
fiddler-logo-splash.svg
fiddler-logo.svg
progress-logo.svg
telerik-logo-splash.svg
mascot_attack.svg
mascot_attack2.svg
mascot_attack3.svg
mascot_attack4.svg
mascot_dev.svg
mascot_downloaded_update.svg
mascot_eula.svg
mascot_flag.svg
mascot_ground.svg
mascot_head.svg
mascot_head_front.svg
mascot_non_dev.svg
mascot_parry.svg
mascot_pose.svg
mascot_sword_front.svg
mascot_sword_ground.svg
mascot_sword_sheathed.svg
mascot_with_logo.svg
product-logo.png
preconfigured-browser_dark-blue.png
preconfigured-browser_default-dark.png
preconfigured-browser_default-light.png
preconfigured-browser_light-blue.png
system-traffic_dark-blue.png
system-traffic_default-dark.png
system-traffic_default-light.png
system-traffic_light-blue.png
allow-remote-devices-to-connect-dark.png
allow-remote-devices-to-connect-light.png
android-install-fiddler-ca-dark.png
android-install-fiddler-ca-light.png
android-set-proxy-dark.png
android-set-proxy-light.png
browser-dark.png
browser-light.png
browser-linux-dark.png
browser-linux-light.png
composer-dark.png
composer-light.png
edit-in-composer-dark.png
edit-in-composer-light.png
fc-to-fe-autoresponder-to-rules-dark.png
fc-to-fe-autoresponder-to-rules-light.png
fc-to-fe-filters-to-rules-dark.png
fc-to-fe-filters-to-rules-light.png
fc-to-fe-quick-filters-to-saved-filters-dark.png
fc-to-fe-quick-filters-to-saved-filters-light.png
filters-button-dark.png
filters-button-light.png
filters-button-linux-dark.png
filters-button-linux-light.png
filters-dialog-dark.png
filters-dialog-light.png
ios-install-fiddler-ca-dark.png
ios-install-fiddler-ca-light.png
ios-set-proxy-dark.png
ios-set-proxy-light.png
ios-trust-ca-dark.png
ios-trust-ca-light.png
macos-install-ca-dark.png
macos-install-ca-light.png
macos-set-proxy-dark.png
macos-set-proxy-light.png
rule-builder-dark.png
rule-builder-light.png
rules-add-rule-dark.png
rules-add-rule-light.png
rules-groups-dark.png
rules-groups-light.png
rules-tab-dark.png
rules-tab-light.png
saved-filters-dark.png
saved-filters-light.png
saved-requests-dark.png
saved-requests-light.png
system-proxy-dark.png
system-proxy-light.png
system-proxy-linux-dark.png
system-proxy-linux-light.png
terminal-dark.png
terminal-light.png
terminal-linux-dark.png
terminal-linux-light.png
windows-install-ca.png
windows-set-proxy-dark.png
windows-set-proxy-light.png
codicon.ttf
workerMain.js
abap.js
apex.js
azcli.js
bat.js
bicep.js
cameligo.js
clojure.js
coffee.js
cpp.js
csharp.js
csp.js
css.js
cypher.js
dart.js
dockerfile.js
ecl.js
elixir.js
flow9.js
freemarker2.js
fsharp.js
go.js
graphql.js
handlebars.js
hcl.js
html.js
ini.js
java.js
javascript.js
julia.js
kotlin.js
less.js
lexon.js
liquid.js
lua.js
m3.js
markdown.js
mdx.js
mips.js
msdax.js
mysql.js
objective-c.js
pascal.js
pascaligo.js
perl.js
pgsql.js
php.js
pla.js
postiats.js
powerquery.js
powershell.js
protobuf.js
pug.js
python.js
qsharp.js
r.js
razor.js
redis.js
redshift.js
restructuredtext.js
ruby.js
rust.js
sb.js
scala.js
scheme.js
scss.js
shell.js
solidity.js
sophia.js
sparql.js
sql.js
st.js
swift.js
systemverilog.js
tcl.js
twig.js
typescript.js
typespec.js
vb.js
wgsl.js
xml.js
yaml.js
editor.main.css
editor.main.js
cssMode.js
cssWorker.js
htmlMode.js
htmlWorker.js
jsonMode.js
jsonWorker.js
tsMode.js
tsWorker.js
loader.js
nls.messages.de.js
nls.messages.es.js
nls.messages.fr.js
nls.messages.it.js
nls.messages.ja.js
nls.messages.ko.js
nls.messages.ru.js
nls.messages.zh-cn.js
nls.messages.zh-tw.js
extra.svg
fa-light.svg
fa-regular.svg
fa-solid.svg
myResources-left.svg
myResources-right.svg
product-logo.svg
aborted-dark.svg
audio-dark.svg
css-dark.svg
error-dark.svg
flash-dark.svg
font-dark.svg
generic-document-dark.svg
grpc-dark.svg
html-dark.svg
https-tunnel-dark.svg
image-dark.svg
javascript-dark.svg
json-dark.svg
no-content-dark.svg
not-modified-dark.svg
partial-dark.svg
post-dark.svg
redirect-dark.svg
rpc-dark.svg
silverlight-dark.svg
unauthorized-dark.svg
video-dark.svg
websocket-dark.svg
xml-dark.svg
aborted-light.svg
audio-light.svg
css-light.svg
error-light.svg
flash-light.svg
font-light.svg
generic-document-light.svg
grpc-light.svg
html-light.svg
https-tunnel-light.svg
image-light.svg
javascript-light.svg
json-light.svg
no-content-light.svg
not-modified-light.svg
partial-light.svg
post-light.svg
redirect-light.svg
rpc-light.svg
silverlight-light.svg
unauthorized-light.svg
video-light.svg
websocket-light.svg
xml-light.svg
upgrade.svg
index.html
main-PENIRHCM.js
Inter-Bold-L5G7OHVK.ttf
Inter-BoldItalic-NOAFESD7.ttf
Inter-ExtraLight-GMCSOSTH.ttf
Inter-Italic-QRRQ5DD2.ttf
Inter-Light-KRRRAFRL.ttf
Inter-LightItalic-NBH6FZQA.ttf
Inter-Medium-7PU6GIHQ.ttf
Inter-MediumItalic-3BPJ2JFC.ttf
Inter-Regular-2AQF7RLO.ttf
Inter-SemiBold-U7YDJ3FL.ttf
Inter-SemiBoldItalic-SUYLWQHY.ttf
Inter-Thin-FRUMBTW4.ttf
InterVariable-45CMC36E.ttf
InterVariable-Italic-V4ZVAWKF.ttf
background-EAHV3HE5.svg
download-paused-dark-A6SWMGVV.svg
downloading-dark-2VH3AVNH.svg
error-inverted-dark-3GJFEHXB.svg
upload-paused-dark-USMAOQRP.svg
uploading-dark-QRXEELM6.svg
warning-inverted-dark-P7O2TJYH.svg
polyfills-OOCZAXRF.js
prerendered-routes.json
styles-J7N65Y5V.css
Fiddler.ProxyServices.dll
Fiddler.WebUi.SettingsConversion.dll
Fiddler.WebUi.deps.json
Fiddler.WebUi.dll
Fiddler.WebUi.exe
Fiddler.WebUi.runtimeconfig.json
Fiddler.WebUi.staticwebassets.endpoints.json
FiddlerBackend.Contracts.dll
FiddlerBackendSDK.dll
FiddlerCore.dll
FiddlerCore.xml
FiddlerEverywhere.CleanUp.deps.json
FiddlerEverywhere.CleanUp.dll
FiddlerEverywhere.CleanUp.exe
FiddlerEverywhere.CleanUp.runtimeconfig.json
Google.Protobuf.dll
Grpc.Core.Api.dll
Grpc.Net.Client.dll
Grpc.Net.Common.dll
Grpc.Reflection.dll
Hpack.dll
Http2.dll
Humanizer.dll
ICSharpCode.SharpZipLib.dll
Kendo.Mvc.dll
Mapster.Core.dll
Mapster.DependencyInjection.dll
Mapster.dll
MessagePack.Annotations.dll
MessagePack.dll
Microsoft.AspNetCore.Antiforgery.dll
Microsoft.AspNetCore.Authentication.Abstractions.dll
Microsoft.AspNetCore.Authentication.BearerToken.dll
Microsoft.AspNetCore.Authentication.Cookies.dll
Microsoft.AspNetCore.Authentication.Core.dll
Microsoft.AspNetCore.Authentication.OAuth.dll
Microsoft.AspNetCore.Authentication.dll
Microsoft.AspNetCore.Authorization.Policy.dll
Microsoft.AspNetCore.Authorization.dll
Microsoft.AspNetCore.Components.Authorization.dll
Microsoft.AspNetCore.Components.Endpoints.dll
Microsoft.AspNetCore.Components.Forms.dll
Microsoft.AspNetCore.Components.Server.dll
Microsoft.AspNetCore.Components.Web.dll
Microsoft.AspNetCore.Components.dll
Microsoft.AspNetCore.Connections.Abstractions.dll
Microsoft.AspNetCore.CookiePolicy.dll
Microsoft.AspNetCore.Cors.dll
Microsoft.AspNetCore.Cryptography.Internal.dll
Microsoft.AspNetCore.Cryptography.KeyDerivation.dll
Microsoft.AspNetCore.DataProtection.Abstractions.dll
Microsoft.AspNetCore.DataProtection.Extensions.dll
Microsoft.AspNetCore.DataProtection.dll
Microsoft.AspNetCore.Diagnostics.Abstractions.dll
Microsoft.AspNetCore.Diagnostics.HealthChecks.dll
Microsoft.AspNetCore.Diagnostics.dll
Microsoft.AspNetCore.HostFiltering.dll
Microsoft.AspNetCore.Hosting.Abstractions.dll
Microsoft.AspNetCore.Hosting.Server.Abstractions.dll
Microsoft.AspNetCore.Hosting.dll
Microsoft.AspNetCore.Html.Abstractions.dll
Microsoft.AspNetCore.Http.Abstractions.dll
Microsoft.AspNetCore.Http.Connections.Common.dll
Microsoft.AspNetCore.Http.Connections.dll
Microsoft.AspNetCore.Http.Extensions.dll
Microsoft.AspNetCore.Http.Features.dll
Microsoft.AspNetCore.Http.Results.dll
Microsoft.AspNetCore.Http.dll
Microsoft.AspNetCore.HttpLogging.dll
Microsoft.AspNetCore.HttpOverrides.dll
Microsoft.AspNetCore.HttpsPolicy.dll
Microsoft.AspNetCore.Identity.dll
Microsoft.AspNetCore.JsonPatch.dll
Microsoft.AspNetCore.Localization.Routing.dll
Microsoft.AspNetCore.Localization.dll
Microsoft.AspNetCore.Metadata.dll
Microsoft.AspNetCore.Mvc.Abstractions.dll
Microsoft.AspNetCore.Mvc.ApiExplorer.dll
Microsoft.AspNetCore.Mvc.Core.dll
Microsoft.AspNetCore.Mvc.Cors.dll
Microsoft.AspNetCore.Mvc.DataAnnotations.dll
Microsoft.AspNetCore.Mvc.Formatters.Json.dll
Microsoft.AspNetCore.Mvc.Formatters.Xml.dll
Microsoft.AspNetCore.Mvc.Localization.dll
Microsoft.AspNetCore.Mvc.NewtonsoftJson.dll
Microsoft.AspNetCore.Mvc.Razor.dll
Microsoft.AspNetCore.Mvc.RazorPages.dll
Microsoft.AspNetCore.Mvc.TagHelpers.dll
Microsoft.AspNetCore.Mvc.ViewFeatures.dll
Microsoft.AspNetCore.Mvc.dll
Microsoft.AspNetCore.OutputCaching.dll
Microsoft.AspNetCore.RateLimiting.dll
Microsoft.AspNetCore.Razor.Runtime.dll
Microsoft.AspNetCore.Razor.dll
Microsoft.AspNetCore.RequestDecompression.dll
Microsoft.AspNetCore.ResponseCaching.Abstractions.dll
Microsoft.AspNetCore.ResponseCaching.dll
Microsoft.AspNetCore.ResponseCompression.dll
Microsoft.AspNetCore.Rewrite.dll
Microsoft.AspNetCore.Routing.Abstractions.dll
Microsoft.AspNetCore.Routing.dll
Microsoft.AspNetCore.Server.HttpSys.dll
Microsoft.AspNetCore.Server.IIS.dll
Microsoft.AspNetCore.Server.IISIntegration.dll
Microsoft.AspNetCore.Server.Kestrel.Core.dll
Microsoft.AspNetCore.Server.Kestrel.Transport.NamedPipes.dll
Microsoft.AspNetCore.Server.Kestrel.Transport.Quic.dll
Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.dll
Microsoft.AspNetCore.Server.Kestrel.dll
Microsoft.AspNetCore.Session.dll
Microsoft.AspNetCore.SignalR.Common.dll
Microsoft.AspNetCore.SignalR.Core.dll
Microsoft.AspNetCore.SignalR.Protocols.Json.dll
Microsoft.AspNetCore.SignalR.Protocols.MessagePack.dll
Microsoft.AspNetCore.SignalR.dll
Microsoft.AspNetCore.StaticAssets.dll
Microsoft.AspNetCore.StaticFiles.dll
Microsoft.AspNetCore.WebSockets.dll
Microsoft.AspNetCore.WebUtilities.dll
Microsoft.AspNetCore.dll
Microsoft.Bcl.AsyncInterfaces.dll
Microsoft.CSharp.dll
Microsoft.CodeAnalysis.CSharp.Workspaces.dll
Microsoft.CodeAnalysis.CSharp.dll
Microsoft.CodeAnalysis.VisualBasic.Workspaces.dll
Microsoft.CodeAnalysis.VisualBasic.dll
Microsoft.CodeAnalysis.Workspaces.dll
Microsoft.CodeAnalysis.dll
Microsoft.DiaSymReader.Native.amd64.dll
Microsoft.Extensions.AI.Abstractions.dll
Microsoft.Extensions.Caching.Abstractions.dll
Microsoft.Extensions.Caching.Memory.dll
Microsoft.Extensions.Configuration.Abstractions.dll
Microsoft.Extensions.Configuration.Binder.dll
Microsoft.Extensions.Configuration.CommandLine.dll
Microsoft.Extensions.Configuration.EnvironmentVariables.dll
Microsoft.Extensions.Configuration.FileExtensions.dll
Microsoft.Extensions.Configuration.Ini.dll
Microsoft.Extensions.Configuration.Json.dll
Microsoft.Extensions.Configuration.KeyPerFile.dll
Microsoft.Extensions.Configuration.UserSecrets.dll
Microsoft.Extensions.Configuration.Xml.dll
Microsoft.Extensions.Configuration.dll
Microsoft.Extensions.DependencyInjection.Abstractions.dll
Microsoft.Extensions.DependencyInjection.dll
Microsoft.Extensions.Diagnostics.Abstractions.dll
Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions.dll
Microsoft.Extensions.Diagnostics.HealthChecks.dll
Microsoft.Extensions.Diagnostics.dll
Microsoft.Extensions.Features.dll
Microsoft.Extensions.FileProviders.Abstractions.dll
Microsoft.Extensions.FileProviders.Composite.dll
Microsoft.Extensions.FileProviders.Embedded.dll
Microsoft.Extensions.FileProviders.Physical.dll
Microsoft.Extensions.FileSystemGlobbing.dll
Microsoft.Extensions.Hosting.Abstractions.dll
Microsoft.Extensions.Hosting.dll
Microsoft.Extensions.Http.Polly.dll
Microsoft.Extensions.Http.dll
Microsoft.Extensions.Identity.Core.dll
Microsoft.Extensions.Identity.Stores.dll
Microsoft.Extensions.Localization.Abstractions.dll
Microsoft.Extensions.Localization.dll
Microsoft.Extensions.Logging.Abstractions.dll
Microsoft.Extensions.Logging.Configuration.dll
Microsoft.Extensions.Logging.Console.dll
Microsoft.Extensions.Logging.Debug.dll
Microsoft.Extensions.Logging.EventLog.dll
Microsoft.Extensions.Logging.EventSource.dll
Microsoft.Extensions.Logging.TraceSource.dll
Microsoft.Extensions.Logging.dll
Microsoft.Extensions.ObjectPool.dll
Microsoft.Extensions.Options.ConfigurationExtensions.dll
Microsoft.Extensions.Options.DataAnnotations.dll
Microsoft.Extensions.Options.dll
Microsoft.Extensions.Primitives.dll
Microsoft.Extensions.Validation.dll
Microsoft.Extensions.WebEncoders.dll
Microsoft.IdentityModel.Abstractions.dll
Microsoft.IdentityModel.Logging.dll
Microsoft.IdentityModel.Tokens.dll
Microsoft.JSInterop.dll
Microsoft.NET.StringTools.dll
Microsoft.Net.Http.Headers.dll
Microsoft.VisualBasic.Core.dll
Microsoft.VisualBasic.dll
Microsoft.Win32.Primitives.dll
Microsoft.Win32.Registry.dll
ModelContextProtocol.AspNetCore.dll
ModelContextProtocol.Core.dll
ModelContextProtocol.dll
Newtonsoft.Json.Bson.dll
Newtonsoft.Json.dll
Polly.Extensions.Http.dll
Polly.dll
PubnubPCL.dll
200_FiddlerGif.dat
200_SimpleHTML.dat
200_TransPixel.dat
204_NoContent.dat
302_Redirect.dat
303_RedirectWithGet.dat
304_NotModified.dat
307_RedirectWithMethod.dat
401_AuthBasic.dat
401_AuthDigest.dat
403_AuthDeny.dat
404_Plain.dat
407_ProxyAuthBasic.dat
502_Unreachable.dat
System.AppContext.dll
System.Buffers.dll
System.Collections.Concurrent.dll
System.Collections.Immutable.dll
System.Collections.NonGeneric.dll
System.Collections.Specialized.dll
System.Collections.dll
System.ComponentModel.Annotations.dll
System.ComponentModel.Composition.dll
System.ComponentModel.DataAnnotations.dll
System.ComponentModel.EventBasedAsync.dll
System.ComponentModel.Primitives.dll
System.ComponentModel.TypeConverter.dll
System.ComponentModel.dll
System.Composition.AttributedModel.dll
System.Composition.Convention.dll
System.Composition.Hosting.dll
System.Composition.Runtime.dll
System.Composition.TypedParts.dll
System.Configuration.ConfigurationManager.dll
System.Configuration.dll
System.Console.dll
System.Core.dll
System.Data.Common.dll
System.Data.DataSetExtensions.dll
System.Data.dll
System.Diagnostics.Contracts.dll
System.Diagnostics.Debug.dll
System.Diagnostics.DiagnosticSource.dll
System.Diagnostics.EventLog.Messages.dll
System.Diagnostics.EventLog.dll
System.Diagnostics.FileVersionInfo.dll
System.Diagnostics.Process.dll
System.Diagnostics.StackTrace.dll
System.Diagnostics.TextWriterTraceListener.dll
System.Diagnostics.Tools.dll
System.Diagnostics.TraceSource.dll
System.Diagnostics.Tracing.dll
System.DirectoryServices.AccountManagement.dll
System.DirectoryServices.Protocols.dll
System.DirectoryServices.dll
System.Drawing.Primitives.dll
System.Drawing.dll
System.Dynamic.Runtime.dll
System.Formats.Asn1.dll
System.Formats.Cbor.dll
System.Formats.Tar.dll
System.Globalization.Calendars.dll
System.Globalization.Extensions.dll
System.Globalization.dll
System.IO.Compression.Brotli.dll
System.IO.Compression.FileSystem.dll
System.IO.Compression.Native.dll
System.IO.Compression.ZipFile.dll
System.IO.Compression.dll
System.IO.FileSystem.AccessControl.dll
System.IO.FileSystem.DriveInfo.dll
System.IO.FileSystem.Primitives.dll
System.IO.FileSystem.Watcher.dll
System.IO.FileSystem.dll
System.IO.IsolatedStorage.dll
System.IO.MemoryMappedFiles.dll
System.IO.Pipelines.dll
System.IO.Pipes.AccessControl.dll
System.IO.Pipes.dll
System.IO.UnmanagedMemoryStream.dll
System.IO.dll
System.Linq.Async.dll
System.Linq.Expressions.dll
System.Linq.Parallel.dll
System.Linq.Queryable.dll
System.Linq.dll
System.Memory.dll
System.Net.Http.Json.dll
System.Net.Http.dll
System.Net.HttpListener.dll
System.Net.Mail.dll
System.Net.NameResolution.dll
System.Net.NetworkInformation.dll
System.Net.Ping.dll
System.Net.Primitives.dll
System.Net.Quic.dll
System.Net.Requests.dll
System.Net.Security.dll
System.Net.ServerSentEvents.dll
System.Net.ServicePoint.dll
System.Net.Sockets.dll
System.Net.WebClient.dll
System.Net.WebHeaderCollection.dll
System.Net.WebProxy.dll
System.Net.WebSockets.Client.dll
System.Net.WebSockets.dll
System.Net.dll
System.Numerics.Vectors.dll
System.Numerics.dll
System.ObjectModel.dll
System.Private.CoreLib.dll
System.Private.DataContractSerialization.dll
System.Private.Uri.dll
System.Private.Xml.Linq.dll
System.Private.Xml.dll
System.Reactive.dll
System.Reflection.DispatchProxy.dll
System.Reflection.Emit.ILGeneration.dll
System.Reflection.Emit.Lightweight.dll
System.Reflection.Emit.dll
System.Reflection.Extensions.dll
System.Reflection.Metadata.dll
System.Reflection.Primitives.dll
System.Reflection.TypeExtensions.dll
System.Reflection.dll
System.Resources.Reader.dll
System.Resources.ResourceManager.dll
System.Resources.Writer.dll
System.Runtime.CompilerServices.Unsafe.dll
System.Runtime.CompilerServices.VisualC.dll
System.Runtime.Extensions.dll
System.Runtime.Handles.dll
System.Runtime.InteropServices.JavaScript.dll
System.Runtime.InteropServices.RuntimeInformation.dll
System.Runtime.InteropServices.dll
System.Runtime.Intrinsics.dll
System.Runtime.Loader.dll
System.Runtime.Numerics.dll
System.Runtime.Serialization.Formatters.dll
System.Runtime.Serialization.Json.dll
System.Runtime.Serialization.Primitives.dll
System.Runtime.Serialization.Xml.dll
System.Runtime.Serialization.dll
System.Runtime.dll
System.Security.AccessControl.dll
System.Security.Claims.dll
System.Security.Cryptography.Algorithms.dll
System.Security.Cryptography.Cng.dll
System.Security.Cryptography.Csp.dll
System.Security.Cryptography.Encoding.dll
System.Security.Cryptography.OpenSsl.dll
System.Security.Cryptography.Pkcs.dll
System.Security.Cryptography.Primitives.dll
System.Security.Cryptography.ProtectedData.dll
System.Security.Cryptography.X509Certificates.dll
System.Security.Cryptography.Xml.dll
System.Security.Cryptography.dll
System.Security.Principal.Windows.dll
System.Security.Principal.dll
System.Security.SecureString.dll
System.Security.dll
System.ServiceModel.Web.dll
System.ServiceProcess.dll
System.Text.Encoding.CodePages.dll
System.Text.Encoding.Extensions.dll
System.Text.Encoding.dll
System.Text.Encodings.Web.dll
System.Text.Json.dll
System.Text.RegularExpressions.dll
System.Threading.AccessControl.dll
System.Threading.Channels.dll
System.Threading.Overlapped.dll
System.Threading.RateLimiting.dll
System.Threading.Tasks.Dataflow.dll
System.Threading.Tasks.Extensions.dll
System.Threading.Tasks.Parallel.dll
System.Threading.Tasks.dll
System.Threading.Thread.dll
System.Threading.ThreadPool.dll
System.Threading.Timer.dll
System.Threading.dll
System.Transactions.Local.dll
System.Transactions.dll
System.ValueTuple.dll
System.Web.HttpUtility.dll
System.Web.dll
System.Windows.dll
System.Xml.Linq.dll
System.Xml.ReaderWriter.dll
System.Xml.Serialization.dll
System.Xml.XDocument.dll
System.Xml.XPath.XDocument.dll
System.Xml.XPath.dll
System.Xml.XmlDocument.dll
System.Xml.XmlSerializer.dll
System.Xml.dll
System.dll
THIRD-PARTY-NOTICES.txt
Telerik.FontIcons.dll
Telerik.Licensing.Runtime.dll
Telerik.NetworkConnections.dll
Telerik.NetworkConnections.xml
Telerik.SvgIcons.dll
RuleTemplates.farx
RuleTemplatesPatch.farx
WindowsBase.dll
ZstdSharp.dll
appsettings.json
aspnetcorev2_inprocess.dll
clretwrc.dll
clrgc.dll
clrgcexp.dll
clrjit.dll
coreclr.dll
createdump.exe
hostfxr.dll
hostpolicy.dll
mscordaccore.dll
mscordbi.dll
mscorlib.dll
mscorrc.dll
msquic.dll
netstandard.dll
web.config
favicon.ico
favicon.ico.br
favicon.ico.gz
node-preload.js
fiddlerutils.py
__init__.py
client.py
httplib2.py
urllib3.py
startup-cmd.bat
startup-linux.sh
startup-mac.sh
startup-powershell.ps1
startup-unix.sh
f-styles.css
splash-screen.css
splash-screen.html
splash-screen.js
version.js
year.js
256x256.png
fiddler-logo-monochrome-dark.ico
fiddler-logo-monochrome-proxy-enabled-dark.ico
fiddler-logo-monochrome-proxy-enabled.ico
fiddler-logo-monochrome.ico
icon.ico
fe-cleanup-process-dev-entry.js
fid_kernel.sys
main.js
ne.node
policies.node
regdrv.exe
package.json
elevate.exe
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
StdUtils.dll
System.dll
UAC.dll
WinShell.dll
nsDialogs.dll
nsExec.dll
nsis7z.dll
content_new.js
manifest.json
23efd41f-f671-48aa-908e-14ffcfcd6552.tmp
messages.json
manifest.json
zapretdriver.exe
the-real-index
the-real-index
data_3
data_0
data_1
data_2
Network Persistent State
Network Persistent State~RFe5b9ebd.TMP
Preferences
Preferences~RFe5b6166.TMP
CURRENT
MANIFEST-000001
cleanup.log
cleanup.log
electron.log
3e42e99b221241102b06e20576642a79_b9e6d1be-5eff-4596-940c-57922ad6c7c4
a95838ae9183fc8ab20577ae951b4311_b9e6d1be-5eff-4596-940c-57922ad6c7c4
default.dic
390B10BC9C6FEABDCBB0B81F94266F4A752557FD
A9E75A2AE8DED48C3D907E035ED8B2F3F7F4F6F9
AD5ACC243D7199B7CADED0FC74A804EDCA2C35FD
B299364861EA119B4D298CCD1F5BAD731E54F3C0
CDC5D017B0921607A751D02271EA5FBD008A865A
DF09ECD7CD006E27CD0DD5E8D18BCE5A5EB71EE5
FF46757AA53A085C782CD3A8B33159DA4D84D25D
proxy.log
proxy.log
proxy.log
proxy.log
Unconfirmed 650069.crdownload
memory/1344-1546-0x0000000000C50000-0x0000000000C86000-memory.dmp
memory/1344-1774-0x0000000007230000-0x00000000078AA000-memory.dmp
memory/1344-1894-0x0000000007180000-0x000000000718E000-memory.dmp
memory/1344-1586-0x0000000005A30000-0x0000000005A4E000-memory.dmp
memory/1344-1587-0x0000000006020000-0x000000000606C000-memory.dmp
memory/1344-1857-0x0000000007150000-0x0000000007161000-memory.dmp
memory/1344-1896-0x0000000007190000-0x00000000071A4000-memory.dmp
memory/1344-1908-0x00000000071F0000-0x000000000720A000-memory.dmp
memory/1344-1918-0x00000000071C0000-0x00000000071C8000-memory.dmp
memory/1344-1671-0x0000000005F40000-0x0000000005F84000-memory.dmp
memory/1344-1856-0x00000000078B0000-0x0000000007946000-memory.dmp
memory/1344-1734-0x0000000006B30000-0x0000000006BA6000-memory.dmp
memory/1344-1777-0x0000000006BD0000-0x0000000006BEA000-memory.dmp
memory/1344-1848-0x0000000007000000-0x00000000070A3000-memory.dmp
memory/1344-1573-0x0000000005570000-0x00000000058C4000-memory.dmp
memory/1344-1563-0x0000000005390000-0x00000000053F6000-memory.dmp
memory/1344-1564-0x0000000005400000-0x0000000005466000-memory.dmp
memory/1344-1562-0x0000000004A60000-0x0000000004A82000-memory.dmp
memory/1344-1559-0x0000000004D60000-0x0000000005388000-memory.dmp
memory/1344-1970-0x0000000007950000-0x0000000007972000-memory.dmp
memory/1344-1971-0x0000000007F30000-0x00000000084D4000-memory.dmp
memory/1344-1854-0x0000000007100000-0x000000000710A000-memory.dmp
memory/1344-1838-0x000000006FFB0000-0x0000000070304000-memory.dmp
memory/1344-1846-0x0000000006FE0000-0x0000000006FFE000-memory.dmp
memory/1344-1837-0x0000000073C10000-0x0000000073C5C000-memory.dmp
memory/1344-1836-0x0000000006FA0000-0x0000000006FD2000-memory.dmp
memory/1808-1577-0x00000000034F0000-0x0000000004153000-memory.dmp
memory/1808-1579-0x00000000034F0000-0x0000000004153000-memory.dmp
memory/1808-1578-0x00000000034F0000-0x0000000004153000-memory.dmp
memory/1808-1581-0x00000000034F0000-0x0000000004153000-memory.dmp
memory/1808-1618-0x0000000000540000-0x0000000000A76000-memory.dmp
memory/1808-1537-0x00000000034F0000-0x0000000004153000-memory.dmp
memory/1808-1611-0x00000000034F0000-0x0000000004153000-memory.dmp
memory/1808-1580-0x00000000034F0000-0x0000000004153000-memory.dmp
memory/1844-2169-0x0000000005D70000-0x00000000060C4000-memory.dmp
memory/1844-2178-0x00000000069C0000-0x0000000006A0C000-memory.dmp
memory/1844-2188-0x00000000068E0000-0x00000000068E8000-memory.dmp
memory/1920-1851-0x0000000003730000-0x0000000004393000-memory.dmp
memory/1920-1862-0x0000000000D30000-0x0000000001266000-memory.dmp
memory/1920-1850-0x0000000003730000-0x0000000004393000-memory.dmp
memory/1920-1853-0x0000000003730000-0x0000000004393000-memory.dmp
memory/1920-1852-0x0000000003730000-0x0000000004393000-memory.dmp
memory/1920-1818-0x0000000003730000-0x0000000004393000-memory.dmp
memory/1920-1849-0x0000000003730000-0x0000000004393000-memory.dmp
memory/1920-1861-0x0000000003730000-0x0000000004393000-memory.dmp
memory/2060-1233-0x00000000032D0000-0x0000000003F33000-memory.dmp
memory/2060-1378-0x00000000032D0000-0x0000000003F33000-memory.dmp
memory/2060-347-0x00000000032D0000-0x0000000003F33000-memory.dmp
memory/2060-289-0x00000000032D0000-0x0000000003F33000-memory.dmp
memory/2060-1289-0x0000000000EF0000-0x0000000001426000-memory.dmp
memory/2060-1338-0x00000000032D0000-0x0000000003F33000-memory.dmp
memory/2060-1363-0x00000000032D0000-0x0000000003F33000-memory.dmp
memory/2060-288-0x00000000032D0000-0x0000000003F33000-memory.dmp
memory/2060-1380-0x0000000000EF0000-0x0000000001426000-memory.dmp
memory/2060-128-0x00000000032D0000-0x0000000003F33000-memory.dmp
memory/2060-42-0x00000000032D0000-0x0000000003F33000-memory.dmp
memory/2060-335-0x00000000032D0000-0x0000000003F33000-memory.dmp
memory/2060-340-0x00000000032D0000-0x0000000003F33000-memory.dmp
memory/3112-2211-0x0000000005BE0000-0x0000000005F34000-memory.dmp
memory/3112-2214-0x0000000006700000-0x000000000674C000-memory.dmp
memory/3112-2222-0x0000000006050000-0x0000000006058000-memory.dmp
memory/3292-1447-0x0000000003330000-0x0000000003F93000-memory.dmp
memory/3292-1476-0x0000000000970000-0x0000000000EA6000-memory.dmp
memory/3292-1448-0x0000000003330000-0x0000000003F93000-memory.dmp
memory/3292-1445-0x0000000003330000-0x0000000003F93000-memory.dmp
memory/3292-1858-0x0000000003330000-0x0000000003F93000-memory.dmp
memory/3292-1446-0x0000000003330000-0x0000000003F93000-memory.dmp
memory/3292-1515-0x0000000003330000-0x0000000003F93000-memory.dmp
memory/3292-1511-0x0000000003330000-0x0000000003F93000-memory.dmp
memory/3292-1510-0x0000000003330000-0x0000000003F93000-memory.dmp
memory/3292-1499-0x0000000003330000-0x0000000003F93000-memory.dmp
memory/3292-1402-0x0000000003330000-0x0000000003F93000-memory.dmp
memory/3292-1449-0x0000000003330000-0x0000000003F93000-memory.dmp
memory/3368-2244-0x0000000006B00000-0x0000000006B2A000-memory.dmp
memory/3368-2243-0x0000000006BA0000-0x0000000006BEC000-memory.dmp
memory/3368-2242-0x00000000061C0000-0x0000000006514000-memory.dmp
memory/3368-2245-0x0000000006B30000-0x0000000006B54000-memory.dmp
memory/3828-0-0x0000000000400000-0x00000000029BC000-memory.dmp
memory/4864-1290-0x0000016683BB0000-0x0000016684466000-memory.dmp
memory/5908-10956-0x0000064488000000-0x000006448802B000-memory.dmp
memory/7308-10190-0x00000283D4600000-0x00000283D462A000-memory.dmp
memory/7308-10140-0x00000283BBFB0000-0x00000283BBFD2000-memory.dmp
memory/7308-10187-0x00000283D45B0000-0x00000283D45CC000-memory.dmp
memory/7308-10188-0x00000283D4890000-0x00000283D4945000-memory.dmp
memory/7308-10189-0x00000283D45A0000-0x00000283D45AA000-memory.dmp
memory/7308-10191-0x00000283D4600000-0x00000283D4624000-memory.dmp
memory/7492-10240-0x00007FF8231B0000-0x00007FF8231B1000-memory.dmp
memory/7492-10352-0x0000015172EE0000-0x000001517361F000-memory.dmp
memory/7492-10239-0x00007FF823A50000-0x00007FF823A51000-memory.dmp
memory/7536-10353-0x0000024D6F210000-0x0000024D6F94F000-memory.dmp
memory/7980-10267-0x000001E73B310000-0x000001E73B4D2000-memory.dmp
memory/7980-10268-0x000001E73BA10000-0x000001E73BF38000-memory.dmp
memory/8124-10857-0x0000000000850000-0x0000000000858000-memory.dmp
memory/8152-10978-0x0000064449A20000-0x0000064449B18000-memory.dmp
memory/10656-11285-0x0000014968FC0000-0x0000014968FE0000-memory.dmp
memory/10656-11305-0x0000014969360000-0x0000014969368000-memory.dmp
memory/10656-11283-0x0000014969190000-0x00000149692B2000-memory.dmp
memory/10656-11282-0x0000014968F60000-0x0000014968F7A000-memory.dmp
memory/10656-11279-0x0000014968F80000-0x0000014968FB2000-memory.dmp
memory/10656-11277-0x00000149688C0000-0x00000149688D2000-memory.dmp
memory/10656-11287-0x0000014969120000-0x000001496915C000-memory.dmp
memory/10656-11161-0x0000014950580000-0x0000014950588000-memory.dmp
memory/10656-11160-0x0000014968A20000-0x0000014968A6A000-memory.dmp
memory/10656-11159-0x0000014950570000-0x0000014950578000-memory.dmp
memory/10656-11153-0x00000149689A0000-0x0000014968A12000-memory.dmp
memory/10656-11158-0x0000014968870000-0x00000149688BA000-memory.dmp
memory/10656-11156-0x0000014950560000-0x000001495056C000-memory.dmp
memory/10656-11289-0x00000149690E0000-0x00000149690FA000-memory.dmp
memory/10656-11290-0x0000014950590000-0x000001495059A000-memory.dmp
memory/10656-11291-0x0000014969330000-0x0000014969356000-memory.dmp
memory/10656-11292-0x0000014950590000-0x000001495059A000-memory.dmp
memory/10656-11294-0x0000014968830000-0x0000014968838000-memory.dmp
memory/10656-11299-0x0000014969100000-0x0000014969108000-memory.dmp
memory/10656-11152-0x00000149505A0000-0x00000149505E4000-memory.dmp
memory/10656-11298-0x0000014969000000-0x000001496900A000-memory.dmp
memory/10656-11303-0x0000014969340000-0x0000014969348000-memory.dmp
memory/10656-11151-0x00000149688E0000-0x000001496899A000-memory.dmp
memory/10656-11306-0x0000014969370000-0x0000014969378000-memory.dmp
memory/10656-11273-0x0000014968840000-0x000001496885C000-memory.dmp
memory/10656-11304-0x0000014969350000-0x0000014969358000-memory.dmp
memory/10656-11272-0x0000014968A70000-0x0000014968AAA000-memory.dmp
memory/10656-11276-0x0000014969D90000-0x000001496A25C000-memory.dmp
memory/10656-11281-0x0000014968F40000-0x0000014968F5E000-memory.dmp
memory/10656-11280-0x0000014969010000-0x0000014969054000-memory.dmp
memory/10656-11284-0x0000014969060000-0x00000149690DE000-memory.dmp
memory/10656-11288-0x0000014968FE0000-0x0000014968FF2000-memory.dmp
memory/10656-11278-0x0000014968F20000-0x0000014968F40000-memory.dmp
memory/10656-11146-0x0000014968AC0000-0x0000014968E60000-memory.dmp
memory/10656-11293-0x0000014968820000-0x0000014968828000-memory.dmp
memory/10656-11157-0x0000014968E60000-0x0000014968F12000-memory.dmp
memory/10656-11297-0x0000014969160000-0x0000014969172000-memory.dmp
memory/10656-11295-0x0000014968860000-0x000001496886A000-memory.dmp
memory/10656-11296-0x0000014968AB0000-0x0000014968AB8000-memory.dmp
memory/10656-11300-0x0000014969110000-0x0000014969118000-memory.dmp
memory/10656-11301-0x0000014969180000-0x0000014969188000-memory.dmp
memory/10656-11302-0x0000014969330000-0x0000014969338000-memory.dmp
memory/11752-10955-0x0000020245F40000-0x0000020245FF2000-memory.dmp
memory/11752-10954-0x000002022DCB0000-0x000002022DCD2000-memory.dmp
memory/11752-10953-0x0000020246010000-0x0000020246196000-memory.dmp
memory/11752-10952-0x000002022DB30000-0x000002022DB80000-memory.dmp
memory/11752-10951-0x000002022DAC0000-0x000002022DAD8000-memory.dmp
memory/13792-11035-0x0000064443EC0000-0x0000064443F11000-memory.dmp
memory/15364-10357-0x000001A7040A0000-0x000001A7047DF000-memory.dmp
memory/16828-10472-0x000001AE261D0000-0x000001AE26285000-memory.dmp
memory/17060-10573-0x0000000003C00000-0x0000000004863000-memory.dmp
memory/17060-10578-0x0000000003C00000-0x0000000004863000-memory.dmp
memory/17060-10571-0x0000000003C00000-0x0000000004863000-memory.dmp
memory/17060-10572-0x0000000003C00000-0x0000000004863000-memory.dmp
memory/17060-10536-0x0000000003C00000-0x0000000004863000-memory.dmp
memory/17060-10581-0x0000000000320000-0x0000000000856000-memory.dmp
memory/17060-10569-0x0000000003C00000-0x0000000004863000-memory.dmp
memory/17060-10570-0x0000000003C00000-0x0000000004863000-memory.dmp
memory/17084-10566-0x0000000003920000-0x0000000004583000-memory.dmp
memory/17084-10574-0x0000000003920000-0x0000000004583000-memory.dmp
memory/17084-10508-0x0000000003920000-0x0000000004583000-memory.dmp
memory/17084-10577-0x0000000000970000-0x0000000000EA6000-memory.dmp
memory/17084-10568-0x0000000003920000-0x0000000004583000-memory.dmp
memory/17084-10567-0x0000000003920000-0x0000000004583000-memory.dmp
memory/17084-10565-0x0000000003920000-0x0000000004583000-memory.dmp
memory/17084-10564-0x0000000003920000-0x0000000004583000-memory.dmp