Edit tour

Windows Analysis Report
FiddlerSetup.5.0.20245.10105-latest.exe

Overview

General Information

Sample name:	FiddlerSetup.5.0.20245.10105-latest.exe
Analysis ID:	1556543
MD5:	c1980b018489df28be8809eb32519001
SHA1:	e860439703d7b6665af4507b20bbef2bbb7b73f4
SHA256:	588024037b1e5929b1f2a741fff52a207bcab17f0650ec7cb0cd3cb78051998d
Tags:	exeuser-WS77754
Infos:

Detection

PureLog Stealer, zgRAT

Score:	44
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	36
Range:	0 - 100

Signatures

Malicious sample detected (through community Yara rule)

Yara detected Powershell download and execute

Yara detected PureLog Stealer

Yara detected zgRAT

Modifies the windows firewall

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses netsh to modify the Windows network and firewall settings

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Connects to many different domains

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

EXE planting / hijacking vulnerabilities found

Found dropped PE file which has not been started or loaded

HTML page contains hidden javascript code

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sigma detected: Execution of Suspicious File Type Extension

Stores files to the Windows start menu directory

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

FiddlerSetup.5.0.20245.10105-latest.exe (PID: 6948 cmdline: "C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe" MD5: C1980B018489DF28BE8809EB32519001)

FiddlerSetup.exe (PID: 2972 cmdline: "C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D= MD5: C2A0EB6F104EACEC3F39581451EE208F)

netsh.exe (PID: 3992 cmdline: "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="FiddlerProxy" MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 5352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6488 cmdline: "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="FiddlerProxy" program="C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe" action=allow profile=any dir=in edge=deferuser protocol=tcp description="Permit inbound connections to Fiddler" MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ngen.exe (PID: 1076 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe" MD5: B6C3FE33B436E5006514403824F17C66)

conhost.exe (PID: 6396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mscorsvw.exe (PID: 6128 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 0 -NGENProcess 1bc -Pipe 1c8 -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 7804 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 0 -NGENProcess 274 -Pipe 27c -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 7812 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 0 -NGENProcess 1bc -Pipe 264 -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 7820 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 0 -NGENProcess 288 -Pipe 290 -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 7828 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 0 -NGENProcess 298 -Pipe 1dc -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 8060 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 0 -NGENProcess 28c -Pipe 280 -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 8068 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 0 -NGENProcess 2bc -Pipe 26c -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 7448 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 330 -Pipe 320 -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 3480 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 0 -NGENProcess 2dc -Pipe 33c -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 3472 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 0 -NGENProcess 34c -Pipe 354 -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 7948 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 0 -NGENProcess 328 -Pipe 2dc -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 8004 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 0 -NGENProcess 36c -Pipe 34c -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 768 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 0 -NGENProcess 330 -Pipe 368 -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 7644 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 0 -NGENProcess 36c -Pipe 18c -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 5432 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 0 -NGENProcess 38c -Pipe 388 -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 7504 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 0 -NGENProcess 3a4 -Pipe 3b0 -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 8016 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 0 -NGENProcess 3a0 -Pipe 38c -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 2468 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 0 -NGENProcess 3c8 -Pipe 3a4 -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 5476 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 0 -NGENProcess 3b4 -Pipe 390 -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 7484 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 0 -NGENProcess 394 -Pipe 18c -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 7444 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 0 -NGENProcess 328 -Pipe 380 -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

ngen.exe (PID: 2636 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\user\AppData\Local\Programs\Fiddler\EnableLoopback.exe" MD5: B6C3FE33B436E5006514403824F17C66)

conhost.exe (PID: 6192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mscorsvw.exe (PID: 7100 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 0 -NGENProcess 1c8 -Pipe 1d4 -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 7520 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 0 -NGENProcess 24c -Pipe 260 -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 7552 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 0 -NGENProcess 270 -Pipe 278 -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 3356 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 0 -NGENProcess 26c -Pipe 284 -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 7536 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 0 -NGENProcess 28c -Pipe 294 -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 7700 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 0 -NGENProcess 310 -Pipe 30c -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

mscorsvw.exe (PID: 2892 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 0 -NGENProcess 31c -Pipe 324 -Comment "NGen Worker Process" MD5: 412A3FB0C25743DA59375C1E298933EA)

SetupHelper (PID: 1436 cmdline: "C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper" /a "C:\Users\user\AppData\Local\Programs\Fiddler" MD5: B1827FCA38A5D49FB706A4A7EEE4A778)

conhost.exe (PID: 5428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 2820 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://fiddler2.com/r/?Fiddler2FirstRun MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 940 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2020,i,18335219383054077630,11953133906641342437,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7104 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4208 --field-trial-handle=2020,i,18335219383054077630,11953133906641342437,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7912 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4092 --field-trial-handle=2020,i,18335219383054077630,11953133906641342437,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\netstandard.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x2c14ea:$s1: file:/// 0x2c1428:$s2: {11111-22222-10009-11112} 0x2c147a:$s3: {11111-22222-50001-00000} 0x2bebe0:$s4: get_Module 0x298958:$s5: Reverse 0x28123f:$s6: BlockCopy 0x28a658:$s7: ReadByte 0x2c14fc:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
C:\Users\user\AppData\Local\Temp\nsbEF3C.tmp	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Local\Temp\nsbEF3C.tmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: FiddlerSetup.exe PID: 2972	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Unpacked PEs

Source	Rule	Description	Author
1.2.FiddlerSetup.exe.2afd7b8.9.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.FiddlerSetup.exe.2aa1db0.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.FiddlerSetup.exe.2ab3df8.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: "C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper" /a "C:\Users\user\AppData\Local\Programs\Fiddler", CommandLine: "C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper" /a "C:\Users\user\AppData\Local\Programs\Fiddler", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper, NewProcessName: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper, OriginalFileName: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=, ParentImage: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe, ParentProcessId: 2972, ParentProcessName: FiddlerSetup.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper" /a "C:\Users\user\AppData\Local\Programs\Fiddler", ProcessId: 1436, ProcessName: SetupHelper

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe, ProcessId: 2972, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyHttp1.1

Suricata Signatures

ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T15:59:41.271180+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.5	49897	104.244.42.195	443	TCP
2024-11-15T15:59:41.384655+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.5	49896	162.159.140.229	443	TCP
2024-11-15T15:59:41.386199+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.5	49895	162.159.140.229	443	TCP
2024-11-15T15:59:41.389543+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.5	49902	104.244.42.195	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\Tools\Zopfli.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\Tools\Brotli.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\ForceCPU.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\EnableLoopback.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\Tools\PngDistill.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\Tools\JXR2PNG.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\Tools\dwebp.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\FSE2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\ExecAction.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\TrustCert.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\uninst.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\makecert.exe	Jump to behavior

Phishing

HTML page contains hidden javascript code

Source: https://www.telerik.com/download/fiddler/first-run

HTTP Parser: Base64 decoded: CcsZdTfh9PzHKtrD8mbBfQ==

Source: https://www.telerik.com/download/fiddler/first-run	HTTP Parser: No favicon
Source: https://www.telerik.com/download/fiddler/first-run	HTTP Parser: No favicon
Source: https://www.telerik.com/download/fiddler/first-run	HTTP Parser: No favicon

Bitcoin Miner

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION Fiddler.exe

Jump to behavior

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\Tools\Zopfli.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\Tools\Brotli.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\ForceCPU.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\EnableLoopback.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\Tools\PngDistill.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\Tools\JXR2PNG.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\Tools\dwebp.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\FSE2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\ExecAction.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\TrustCert.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\uninst.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Fiddler\makecert.exe	Jump to behavior

Uses 32bit PE files

Source: FiddlerSetup.5.0.20245.10105-latest.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Creates a software uninstall entry

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fiddler2

Jump to behavior

Creates install or setup log file

Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SetupHelper.log

Jump to behavior

Creates license or readme file

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe

File created: C:\Users\user\AppData\Local\Programs\Fiddler\license.txt

Jump to behavior

PE / OLE file has a valid certificate

Source: FiddlerSetup.5.0.20245.10105-latest.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.5:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.5:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:50125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50142 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: FiddlerSetup.5.0.20245.10105-latest.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\src\GitHub\fiddler\Fiddler2\Common\ExecAction\v4\obj\x86\Release\ExecAction.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: -: Completederik Fiddler Classicp\nsu12C2.tmp\System.dll0, 0) .r9lerrt.pdb\..kConnections.Windows.dll\." action=allow profile=any dir=in edge=deferuser protocol=tcp description="Permit inbound connections to Fiddler" source: FiddlerSetup.exe, 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler\FiddlerOrchestra\FiddlerOrchestra.Addon\obj\Release\FiddlerOrchestra.Addon.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\BundledExtensions\RulesTab2\obj\Release Signed\RulesTab2.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Extract: SimpleFilter.pdb source: FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\BundledExtensions\SimpleFilter\obj\Release Signed\SimpleFilter.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, SimpleFilter.dll.1.dr
Source:	Binary string: Extract: FiddlerOrchestra.Addon.pdbk source: FiddlerSetup.exe, 00000001.00000002.3311319713.0000000000813000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Extract: Timeline.pdb source: FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Data.SqlXml.ni.pdb source: System.Data.SqlXml.dll.45.dr, System.Data.SqlXml.dll.19.dr
Source:	Binary string: \Analytics.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: System.Data.SqlXml.ni.pdbRSDS2 source: System.Data.SqlXml.dll.45.dr, System.Data.SqlXml.dll.19.dr
Source:	Binary string: C:\Jenkins\NetworkConnections_Release\workspace\src\Telerik.NetworkConnections\Telerik.NetworkConnections.Windows\obj\Release\net40\Telerik.NetworkConnections.Windows.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Telerik.NetworkConnections.Windows.dll.1.dr
Source:	Binary string: System.EnterpriseServices.Wrapper.ni.pdb source: System.EnterpriseServices.Wrapper.dll.26.dr
Source:	Binary string: System.Security.pdb source: System.Security.dll.46.dr
Source:	Binary string: \ScriptEditorFSE2.exe.configBasicFormats.dllBasicFormats.pdbVSWebTestExport.dllVSWebTestExport.pdbWarning: Failed to write one or more files. source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Jenkins\NetworkConnections_Release\workspace\src\Telerik.NetworkConnections\Telerik.NetworkConnections\obj\Release\net40\Telerik.NetworkConnections.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Telerik.NetworkConnections.dll.1.dr
Source:	Binary string: F:\Projects\Dot.NET\SVN\Editor.NET\source\obj\Release\QWhale.Syntax.Schemes.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002A5A000.00000004.00000020.00020000.00000000.sdmp, QWhale.Syntax.Schemes.dll.1.dr
Source:	Binary string: System.Runtime.Caching.pdb source: System.Runtime.Caching.dll.27.dr
Source:	Binary string: D:\telerik\fiddler\ThirdParty\zopfli\Release\Zopfli.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Zopfli.exe.1.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\Timeline.pdbg source: FiddlerSetup.exe, 00000001.00000002.3311319713.0000000000813000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: F:\Projects\Dot.NET\SVN\Editor.NET\source\obj\Release\QWhale.Syntax.Parsers.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Scripts\Timeline.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\GA.Analytics.Monitor.pdbl source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007A8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \ScriptEditor\GA.Analytics.Monitor.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: F:\Projects\Dot.NET\SVN\Editor.NET\source\obj\Release\QWhale.Syntax.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002A21000.00000004.00000020.00020000.00000000.sdmp, QWhale.Syntax.dll1.1.dr
Source:	Binary string: C:\JenkinsHome\jobs\AnalyticsReleaseBuild\workspace\Telerik.FJ.Analytics\JFAnalytics\obj\Release\Analytics.pdb source: Analytics.dll0.1.dr
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\BundledExtensions\PngDistill\obj\Release Signed\PngDistill.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, PngDistill.exe.1.dr
Source:	Binary string: ?\|<>/":%s%S.dllCallers\user\AppData\Local\Temp\nsu12C2.tmp\System.dllt\VSWebTestExport.pdb\.*.kConnections.Windows.dll\.C:\Users\user\AppData\Local\Temp\nsu12C2.tmp\System.dllr2SWebTestExport.pdbdlltworkConnections.Windows.dllFalsers\user\AppData\Local\Temp\nsu12C2.tmper/tasks/configurefiddlere"ppData\Local\Programs\Fiddler\Fiddler.exe" action=allow profile=any dir=in edge=deferuser protocol=tcp description="Permit inbound connections to Fiddler"Trueers\user\AppData\Local\Temp\nsu12C2.tmp\System.dllr\FSE2.exe source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp
Source:	Binary string: Extract: Analytics.pdb source: FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Fiddler.pdb source: Fiddler.exe.1.dr
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\BundledExtensions\VSWebTestExport\obj\Release Signed\VSWebTestExport.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, VSWebTestExport.dll.1.dr
Source:	Binary string: System.EnterpriseServices.Wrapper.ni.pdbRSDS source: System.EnterpriseServices.Wrapper.dll.26.dr
Source:	Binary string: \GA.Analytics.Monitor.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\BundledExtensions\EnableLoopback\obj\Release Signed\EnableLoopback.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Deployment.ni.pdb source: System.Deployment.dll.22.dr
Source:	Binary string: \Tools\PngDistill.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: F:\Projects\Dot.NET\SVN\Editor.NET\source\obj\Release\QWhale.Editor.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002955000.00000004.00000020.00020000.00000000.sdmp, QWhale.Editor.dll1.1.dr
Source:	Binary string: \REGISTRY\USER\S-1-5-21-2246122658-3693405117-2476756634-1003t\BasicFormats.pdb\.atM source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Runtime.Serialization.Formatters.Soap.ni.pdbRSDS source: System.Runtime.Serialization.Formatters.Soap.dll.49.dr
Source:	Binary string: Extract: EnableLoopback.pdbl% source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.EnterpriseServices.Wrapper.pdb source: System.EnterpriseServices.Wrapper.dll.26.dr
Source:	Binary string: Extract: Fiddler.pdbW source: FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Would you like to go download manually now?https://fiddler2.com/r/?GetDotNet4open https://fiddler2.com/r/?GetDotNet4Compatible .NET Framework/Service Pack found.Installing Progress Telerik Fiddler Classic2500Fiddler.exe.configFiddler.pdbSetupHelperTrustCert.exeTrustCert.pdbInstalling Dependencies... source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Fiddler.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: \EnableLoopback.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: \ScriptEditor\Analytics.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: System.Web.RegularExpressions.ni.pdb source: System.Web.RegularExpressions.dll.29.dr
Source:	Binary string: System.Runtime.Caching.ni.pdbRSDS source: System.Runtime.Caching.dll.27.dr
Source:	Binary string: \ImportExport\VSWebTestExport.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: \UpdateFiddler.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: \TrustCert.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: System.Web.RegularExpressions.ni.pdbRSDS source: System.Web.RegularExpressions.dll.29.dr
Source:	Binary string: \ImportExport\BasicFormats.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\BundledExtensions\FSE.Net45\obj\Release Signed\FSE2.pdb source: FSE2.exe.1.dr
Source:	Binary string: \Scripts\FiddlerOrchestra.Addon.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: C:\JenkinsHome\jobs\AnalyticsReleaseBuild\workspace\Telerik.FJ.Analytics\GA.Analytics.Monitor\obj\Release\GA.Analytics.Monitor.pdb source: GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr
Source:	Binary string: \Inspectors\Be.Windows.Forms.HexBox.dllAnalytics.dllAnalytics.pdbGA.Analytics.Monitor.dllGA.Analytics.Monitor.pdbNewtonsoft.Json.dllDotNetZip.dll source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Extract: BasicFormats.pdb\ source: FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Extract: TrustCert.pdb source: FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Deployment.ni.pdbRSDS source: System.Deployment.dll.22.dr
Source:	Binary string: F:\Projects\Dot.NET\SVN\Editor.NET\source\obj\Release\QWhale.Common.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.000000000293C000.00000004.00000020.00020000.00000000.sdmp, QWhale.Common.dll.1.dr, QWhale.Common.dll1.1.dr
Source:	Binary string: Fiddler.pdbx source: Fiddler.exe.1.dr
Source:	Binary string: System.Security.ni.pdbRSDS source: System.Security.dll.46.dr
Source:	Binary string: FiddlerOrchestra.Utilities.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Deployment.pdb source: System.Deployment.dll.22.dr
Source:	Binary string: EnableLoopback.exeEnableLoopback.pdbApp.icoCountdown.wavLoadScript.wavLoadScriptError.wavNOTICES.txtScreenshot.wavcredits.txtsaz.ico source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Extract: GA.Analytics.Monitor.pdb source: FiddlerSetup.exe, 00000001.00000002.3311319713.0000000000813000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Web.RegularExpressions.pdb source: System.Web.RegularExpressions.dll.29.dr
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\TrustCert\TrustCert\obj\x86\Release Signed\TrustCert.pdb source: TrustCert.exe.1.dr
Source:	Binary string: C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Programs\Fiddler\Analytics.pdb\. source: FiddlerSetup.exe, 00000001.00000002.3311319713.0000000000813000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\TrustCert\TrustCert\obj\x86\Release Signed\TrustCert.pdb\8v8 h8_CorExeMainmscoree.dll source: TrustCert.exe.1.dr
Source:	Binary string: Extract: PngDistill.pdb source: FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Runtime.Serialization.Formatters.Soap.pdb source: System.Runtime.Serialization.Formatters.Soap.dll.49.dr
Source:	Binary string: C:\JenkinsHome\jobs\AnalyticsReleaseBuild\workspace\Telerik.FJ.Analytics\GA.Analytics.Monitor\obj\Release\GA.Analytics.Monitor.pdbg source: GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr
Source:	Binary string: MakeCert.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, makecert.exe.1.dr
Source:	Binary string: c:\src\JPEGXR2PNG\JPEGXR2PNG\obj\Release\JXR2PNG.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, JXR2PNG.exe.1.dr
Source:	Binary string: FiddlerOrchestra.Connection.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Data.SqlXml.pdb source: System.Data.SqlXml.dll.45.dr, System.Data.SqlXml.dll.19.dr
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\BundledExtensions\SimpleFilter\obj\Release Signed\SimpleFilter.pdb4 source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, SimpleFilter.dll.1.dr
Source:	Binary string: \ToolsPngDistill.exePngDistill.pdbInstalling FiddlerExtensions...SimpleFilter.dllSimpleFilter.pdbTimeline.dllTimeline.pdbRulesTab2.dllQWhale.Syntax.Parsers.dllInstalling Fiddler Orchestra addon...FiddlerOrchestra.Addon.dllFiddlerOrchestra.Addon.pdbFiddlerOrchestra.Connection.dllFiddlerOrchestra.Protocol.dllFiddlerOrchestra.Utilities.dllnetstandard.dll source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: FiddlerOrchestra.Protocol.pdbSHA256R source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, FiddlerOrchestra.Protocol.dll.1.dr
Source:	Binary string: System.Runtime.Caching.ni.pdb source: System.Runtime.Caching.dll.27.dr
Source:	Binary string: System.Security.ni.pdb source: System.Security.dll.46.dr
Source:	Binary string: \Scripts\SimpleFilter.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: FiddlerOrchestra.Utilities.pdbSHA256 source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Runtime.Serialization.Formatters.Soap.ni.pdb source: System.Runtime.Serialization.Formatters.Soap.dll.49.dr
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\BundledExtensions\Timeline\obj\Release Signed\Timeline.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: FiddlerOrchestra.Connection.pdbSHA256 source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: FiddlerOrchestra.Protocol.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, FiddlerOrchestra.Protocol.dll.1.dr
Source:	Binary string: Extract: VSWebTestExport.pdb source: FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Extract: Analytics.pdbB source: FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\Fiddler.SetupHelper\obj\Release Signed\Fiddler.SetupHelper.pdb source: SetupHelper, 0000000A.00000000.2150082623.00000000004D2000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\BundledExtensions\BasicFormats\obj\Release Signed\BasicFormats.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, BasicFormats.dll.1.dr

Spreading

Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Code function: 0_2_00405C4D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C4D
Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Code function: 0_2_0040689E FindFirstFileW,FindClose,	0_2_0040689E
Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Code function: 0_2_00402930 FindFirstFileW,	0_2_00402930
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Code function: 1_2_00402930 FindFirstFileW,	1_2_00402930
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Code function: 1_2_004069FF FindFirstFileW,FindClose,	1_2_004069FF
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Code function: 1_2_00405DAE CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	1_2_00405DAE

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File opened: C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File opened: C:\Users\user\AppData\Local\Programs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File opened: C:\Users\user\AppData\Local\Programs\Fiddler	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 1.2.FiddlerSetup.exe.2afd7b8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FiddlerSetup.exe.2aa1db0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FiddlerSetup.exe.2ab3df8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\netstandard.dll, type: DROPPED

Connects to many different domains

Source: unknown

Network traffic detected: DNS query count 45

Detected non-DNS traffic on DNS port

Source: global traffic	TCP traffic: 192.168.2.5:49847 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:49872 -> 1.1.1.1:53

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 18.66.122.7 18.66.122.7
Source: Joe Sandbox View	IP Address: 13.224.245.89 13.224.245.89

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.5:49896 -> 162.159.140.229:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.5:49895 -> 162.159.140.229:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.5:49897 -> 104.244.42.195:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.5:49902 -> 104.244.42.195:443

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /download/fiddler/first-run HTTP/1.1Host: www.telerik.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=DzHrpQl5URXarFHAtrmzFsPwWIExaUeLHf3gTuslFxiRsjc9gU89IWbLw9lFnSTXl5qZVz-0iBHHB3aQBiGWPYzKfk3ndhT8iH1RSf_M6Sk7X3EWbQzPMVpb-rxAUHFQlncyLjOo3RP6E9HfRXn18roSCYCGCRaVqv9jyNWgJTH95Urh0&t=638646398980000000 HTTP/1.1Host: www.telerik.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/download/fiddler/first-runAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=HtQyXelCu6mzSPcVcvK_BiMPfgaXcXtBpU_p4oPRWdaaTkgqeBOpXuu1TRv9pAGD-FAzjGGeBeqirrj8SJpv3YU7eO6rv9kziBqvktqcdZzC15nZHrag4kg_mMMtSYLloBTL1HIRNuD4Iepyub_zCpOjm9RyH4DXkI1YDpCN_mnfRNsYUjpSNKzgKVak4AN3FQYzZOcP1Z4PmfVVfM_48qg3YrI1&t=638646398980000000 HTTP/1.1Host: www.telerik.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/download/fiddler/first-runAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=wnB2OjhYopty-dCFa4b2kKCIWGgLoaj0QQ4I7F_PiSysmtqnVBUtsGpmlAymZDgXEXdRjhe5BdfNkuyybLSHMhRnbzI9oh6WXC-y-EwOrJPY0qCvfWaOo0ltV4TVm8apzRlzF5O244Y4u7-m5V8Vv2yC1Tun7PurVRoOxfv28sPwY-isOJNAi7MSqc1tycGYAkqZXHU_zlVNorSTBDv4W4jemDM1&t=638646398980000000 HTTP/1.1Host: www.telerik.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/download/fiddler/first-runAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=NjxTqR2bqTw1rewxxlkHPoKtHrXAWC0HAaoiA_KkRcUyXkV02CSw2viy3BbwqQQWnOeUM4JljOrJ6SdN8P6xkcmc02D5IE0_hoR3ujKOHMUMV0D80Ax-2HQgUBn3JFGVcQMIptO-sbrJg4UhPcfKleFkBd3KXta5g771qRLz1--cqQWHZet4VERXE7zwP_V-_reX4bmQVhWS6yxLXOsj2Tnqll01&t=638646398980000000 HTTP/1.1Host: www.telerik.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/download/fiddler/first-runAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/jquery/3.7.1/jquery.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/jquery-migrate/3.4.1/jquery-migrate.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/2.2.7/css/metric.min.css HTTP/1.1Host: d6vtbcy3ong79.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/2.2.7/metric/Metric-Regular.woff2 HTTP/1.1Host: d6vtbcy3ong79.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.telerik.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/2.2.7/metric/Metric-Light.woff2 HTTP/1.1Host: d6vtbcy3ong79.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.telerik.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /telerik-navigation/3.5.50/css/index.min.css HTTP/1.1Host: d6vtbcy3ong79.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/2.2.7/metric/Metric-Semibold.woff2 HTTP/1.1Host: d6vtbcy3ong79.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.telerik.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/2.2.7/metric/Metric-Medium.woff2 HTTP/1.1Host: d6vtbcy3ong79.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.telerik.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /telerik-navigation/3.5.50/js/index.min.mjs HTTP/1.1Host: d6vtbcy3ong79.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.telerik.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/3dfce4f2-dab6-4128-9f33-df7e0597da82/otSDKStub.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cache/b3485d7dde1ec57a3915d1079237c8c34a5198c1/telerik/js/dist/polyfills.min.js HTTP/1.1Host: dtzbdy9anri2p.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cache/3771543484f465487bb9712eed986edeb1f314a2/telerik/css/style.css HTTP/1.1Host: dtzbdy9anri2p.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cache/5466ecb2c23eafce4b55ab412dec4fc40c31abe5/telerik/js/dist/all.min.js HTTP/1.1Host: dtzbdy9anri2p.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3cCfEDfTkrdh+vP&MD=KKfBweXO HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /Frontend-Assembly/Web.SitefinityExtensions.EloquaConnector/Scripts/BrowserSessionStorage.min.js?package=PureMvc&v=Q2NzWmRUZmg5UHpIS3RyRDhtYkJmUT09 HTTP/1.1Host: d585tldpucybw.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/3dfce4f2-dab6-4128-9f33-df7e0597da82/3dfce4f2-dab6-4128-9f33-df7e0597da82.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.telerik.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /webapi/Announcements/GetPromo?url=https://www.telerik.com/download/fiddler/first-run HTTP/1.1Host: www.telerik.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.telerik.com/download/fiddler/first-runAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /Frontend-Assembly/Web.SitefinityExtensions.EloquaConnector/Scripts/SetBrowserSessionStorage.min.js?package=PureMvc&v=SURNTlNWL0Q2UU9sSFp4Z2dmYnp0UT09) HTTP/1.1Host: d585tldpucybw.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sdk/sitefinity-insight-client.min.3.1.13.js HTTP/1.1Host: cdn.insight.sitefinity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.telerik.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cache/3771543484f465487bb9712eed986edeb1f314a2/telerik/iconfont/tlrk-icon-font-dc6cff9dd8.woff2 HTTP/1.1Host: dtzbdy9anri2p.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.telerik.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://dtzbdy9anri2p.cloudfront.net/cache/3771543484f465487bb9712eed986edeb1f314a2/telerik/css/style.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.telerik.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /RestApi/personalizations/render?pageNodeId=5ceb4be1-05bd-4c69-892a-2c2bbd37538b&pageDataId=1f960fad-aef2-4475-8978-52fb7a29dbc9&pageNodeKey=5CEB4BE1-05BD-4C69-892A-2C2BBD37538B/b31ca85c-a1c5-4a9d-8b5d-e7b0736a8b16/SitefinitySiteMap&url=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&controls=09f9bb4f-5990-40af-b361-7849c73c9604_1,0cd3f511-e7d9-4e23-8773-26005ae09893_1,25637a62-a321-49a0-8b7e-5962dc977e95_1,6b5ac4dc-8fd0-4043-bd0a-e9ffd31e3bc8_1&correlationId=m3iv7avxzpfywghsi2 HTTP/1.1Host: www.telerik.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SF_NO_URL_REFERER: trueUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-type: application/json; charset=utf-8Accept: application/jsonX-Requested-With: XMLHttpRequestsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.telerik.com/download/fiddler/first-runAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico?v=rebv1 HTTP/1.1Host: www.telerik.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telerik.com/download/fiddler/first-runAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /scripttemplates/202401.2.0/otBannerSdk.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /sfimages/default-source/productsimages/kendo-ui-complete/kendoka_icon.png?sfvrsn=922435fb_2 HTTP/1.1Host: www.telerik.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telerik.com/download/fiddler/first-runAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/3dfce4f2-dab6-4128-9f33-df7e0597da82/018f398d-e7fe-774d-a988-aae80a524894/en.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.telerik.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /scripttemplates/202401.2.0/assets/otCommonStyles.css HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.telerik.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/202401.2.0/assets/otFlat.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.telerik.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /visitor/v200/svrGP?pps=70&siteid=1325 HTTP/1.1Host: s1325.t.eloqua.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /external-assets/1.0.22/utils/store-lead-data.min.js HTTP/1.1Host: d6vtbcy3ong79.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=HtQyXelCu6mzSPcVcvK_BiMPfgaXcXtBpU_p4oPRWdaaTkgqeBOpXuu1TRv9pAGD-FAzjGGeBeqirrj8SJpv3YU7eO6rv9kziBqvktqcdZzC15nZHrag4kg_mMMtSYLloBTL1HIRNuD4Iepyub_zCpOjm9RyH4DXkI1YDpCN_mnfRNsYUjpSNKzgKVak4AN3FQYzZOcP1Z4PmfVVfM_48qg3YrI1&t=638646398980000000 HTTP/1.1Host: www.telerik.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sf-tracking-consent=true; sf-prs-ss=638672795720460000; sf-prs-lu=https://www.telerik.com/download/fiddler/first-run; sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; sf-ins-pv-id=dc2da7be-2d6c-4e3e-9a51-88b40d4f050e; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=DzHrpQl5URXarFHAtrmzFsPwWIExaUeLHf3gTuslFxiRsjc9gU89IWbLw9lFnSTXl5qZVz-0iBHHB3aQBiGWPYzKfk3ndhT8iH1RSf_M6Sk7X3EWbQzPMVpb-rxAUHFQlncyLjOo3RP6E9HfRXn18roSCYCGCRaVqv9jyNWgJTH95Urh0&t=638646398980000000 HTTP/1.1Host: www.telerik.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sf-tracking-consent=true; sf-prs-ss=638672795720460000; sf-prs-lu=https://www.telerik.com/download/fiddler/first-run; sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; sf-ins-pv-id=dc2da7be-2d6c-4e3e-9a51-88b40d4f050e; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /ajax/libs/jquery-migrate/3.4.1/jquery-migrate.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/jquery/3.7.1/jquery.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=NjxTqR2bqTw1rewxxlkHPoKtHrXAWC0HAaoiA_KkRcUyXkV02CSw2viy3BbwqQQWnOeUM4JljOrJ6SdN8P6xkcmc02D5IE0_hoR3ujKOHMUMV0D80Ax-2HQgUBn3JFGVcQMIptO-sbrJg4UhPcfKleFkBd3KXta5g771qRLz1--cqQWHZet4VERXE7zwP_V-_reX4bmQVhWS6yxLXOsj2Tnqll01&t=638646398980000000 HTTP/1.1Host: www.telerik.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sf-tracking-consent=true; sf-prs-ss=638672795720460000; sf-prs-lu=https://www.telerik.com/download/fiddler/first-run; sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; sf-ins-pv-id=dc2da7be-2d6c-4e3e-9a51-88b40d4f050e; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1
Source: global traffic	HTTP traffic detected: GET /consent/3dfce4f2-dab6-4128-9f33-df7e0597da82/otSDKStub.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=wnB2OjhYopty-dCFa4b2kKCIWGgLoaj0QQ4I7F_PiSysmtqnVBUtsGpmlAymZDgXEXdRjhe5BdfNkuyybLSHMhRnbzI9oh6WXC-y-EwOrJPY0qCvfWaOo0ltV4TVm8apzRlzF5O244Y4u7-m5V8Vv2yC1Tun7PurVRoOxfv28sPwY-isOJNAi7MSqc1tycGYAkqZXHU_zlVNorSTBDv4W4jemDM1&t=638646398980000000 HTTP/1.1Host: www.telerik.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sf-tracking-consent=true; sf-prs-ss=638672795720460000; sf-prs-lu=https://www.telerik.com/download/fiddler/first-run; sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; sf-ins-pv-id=dc2da7be-2d6c-4e3e-9a51-88b40d4f050e; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1
Source: global traffic	HTTP traffic detected: GET /consent/3dfce4f2-dab6-4128-9f33-df7e0597da82/3dfce4f2-dab6-4128-9f33-df7e0597da82.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /webapi/Announcements/GetPromo?url=https://www.telerik.com/download/fiddler/first-run HTTP/1.1Host: www.telerik.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sf-tracking-consent=true; sf-prs-ss=638672795720460000; sf-prs-lu=https://www.telerik.com/download/fiddler/first-run; sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; sf-ins-pv-id=dc2da7be-2d6c-4e3e-9a51-88b40d4f050e; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1
Source: global traffic	HTTP traffic detected: GET /cache/b3485d7dde1ec57a3915d1079237c8c34a5198c1/telerik/js/dist/polyfills.min.js HTTP/1.1Host: dtzbdy9anri2p.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cache/5466ecb2c23eafce4b55ab412dec4fc40c31abe5/telerik/js/dist/all.min.js HTTP/1.1Host: dtzbdy9anri2p.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /visitor/v200/svrGP.aspx?pps=70&siteid=1325&elqCookie=1 HTTP/1.1Host: s1325.t.eloqua.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ELOQUA=GUID=556417D9DDDE4E9DB23F8F04730AE93B; ELQSTATUS=OK
Source: global traffic	HTTP traffic detected: GET /scripttemplates/202401.2.0/otBannerSdk.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Frontend-Assembly/Web.SitefinityExtensions.EloquaConnector/Scripts/BrowserSessionStorage.min.js?package=PureMvc&v=Q2NzWmRUZmg5UHpIS3RyRDhtYkJmUT09 HTTP/1.1Host: d585tldpucybw.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/3dfce4f2-dab6-4128-9f33-df7e0597da82/018f398d-e7fe-774d-a988-aae80a524894/en.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/202401.2.0/assets/otFlat.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/202401.2.0/assets/otCommonStyles.css HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /telerik-navigation/3.5.50/js/index.min.mjs HTTP/1.1Host: d6vtbcy3ong79.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /RestApi/personalizations/render?pageNodeId=5ceb4be1-05bd-4c69-892a-2c2bbd37538b&pageDataId=1f960fad-aef2-4475-8978-52fb7a29dbc9&pageNodeKey=5CEB4BE1-05BD-4C69-892A-2C2BBD37538B/b31ca85c-a1c5-4a9d-8b5d-e7b0736a8b16/SitefinitySiteMap&url=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&controls=09f9bb4f-5990-40af-b361-7849c73c9604_1,0cd3f511-e7d9-4e23-8773-26005ae09893_1,25637a62-a321-49a0-8b7e-5962dc977e95_1,6b5ac4dc-8fd0-4043-bd0a-e9ffd31e3bc8_1&correlationId=m3iv7avxzpfywghsi2 HTTP/1.1Host: www.telerik.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sf-tracking-consent=true; sf-prs-ss=638672795720460000; sf-prs-lu=https://www.telerik.com/download/fiddler/first-run; sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; sf-ins-pv-id=dc2da7be-2d6c-4e3e-9a51-88b40d4f050e; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /Frontend-Assembly/Web.SitefinityExtensions.EloquaConnector/Scripts/SetBrowserSessionStorage.min.js?package=PureMvc&v=SURNTlNWL0Q2UU9sSFp4Z2dmYnp0UT09) HTTP/1.1Host: d585tldpucybw.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico?v=rebv1 HTTP/1.1Host: www.telerik.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sf-tracking-consent=true; sf-prs-ss=638672795720460000; sf-prs-lu=https://www.telerik.com/download/fiddler/first-run; sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; sf-ins-pv-id=dc2da7be-2d6c-4e3e-9a51-88b40d4f050e; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1
Source: global traffic	HTTP traffic detected: GET /sfimages/default-source/productsimages/kendo-ui-complete/kendoka_icon.png?sfvrsn=922435fb_2 HTTP/1.1Host: www.telerik.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sf-tracking-consent=true; sf-prs-ss=638672795720460000; sf-prs-lu=https://www.telerik.com/download/fiddler/first-run; sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; sf-ins-pv-id=dc2da7be-2d6c-4e3e-9a51-88b40d4f050e; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1
Source: global traffic	HTTP traffic detected: GET /sdk/sitefinity-insight-client.min.3.1.13.js HTTP/1.1Host: cdn.insight.sitefinity.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /external-assets/1.0.22/utils/store-lead-data.min.js HTTP/1.1Host: d6vtbcy3ong79.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /web-vitals/dist/web-vitals.iife.js HTTP/1.1Host: unpkg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /visitor/v200/svrGP.aspx?pps=70&siteid=1325&elqCookie=1 HTTP/1.1Host: s1325.t.eloqua.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ELOQUA=GUID=556417D9DDDE4E9DB23F8F04730AE93B; ELQSTATUS=OK
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c/hotjar-66905.js?sv=7 HTTP/1.1Host: static.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sxp/i/940047942047f9f048d2c1e1f6b78492.js HTTP/1.1Host: euob.ytwohlcq.telerik.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1; gauuid=d2144829-e324-4fbe-8dab-96fd3d3ecb59
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /bat.js HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uwt.js HTTP/1.1Host: static.ads-twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /web-vitals@4.2.4/dist/web-vitals.iife.js HTTP/1.1Host: unpkg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /prum.min.js HTTP/1.1Host: rum-static.pingdom.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /monitor/stat.js HTTP/1.1Host: www.clickcease.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /visitor/v200/svrGP?pps=3&siteid=1325&ref=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&ref2=elqNone&tzo=300&ms=666&optin=disabled HTTP/1.1Host: s1325.t.eloqua.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ELOQUA=GUID=556417D9DDDE4E9DB23F8F04730AE93B; ELQSTATUS=OK
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /p/action/5614127.js HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/ga/rul?tid=G-9JSNBCSF54&gacid=146950673.1731682778&gtm=45je4bc0h1v9167661709z8536291za200zb536291&dma=0&gcs=G111&gcd=13v3v3v3v5l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067554~102067808~102077855&z=903480811 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /modules.6f60e575cf8ad7cb10f7.js HTTP/1.1Host: script.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /collect/v2/data-centers/76766c2b-82f4-2453-81e5-fd840f3b455b/datasources/TelerikCom/interactions HTTP/1.1Host: api.insight.sitefinity.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /visitor/v200/svrGP?pps=3&siteid=1325&ref=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&ref2=elqNone&tzo=300&ms=666&optin=disabled HTTP/1.1Host: s1325.t.eloqua.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ELOQUA=GUID=556417D9DDDE4E9DB23F8F04730AE93B; ELQSTATUS=OK
Source: global traffic	HTTP traffic detected: GET /prum.min.js HTTP/1.1Host: rum-static.pingdom.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /web-vitals@4.2.4/dist/web-vitals.iife.js HTTP/1.1Host: unpkg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bat.js HTTP/1.1Host: bat.bing.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/beacon.gif?id=54328dddabe53db9497b23c6&sAW=1280&sAH=984&bIW=1034&bIH=870&pD=24&dPR=1&or=landscape-primary&nT=0&rC=0&nS=0&cS=1740&cE=2590&dLE=1740&dLS=1732&fS=1719&hS=1740&rE=-1&rS=-1&reS=2607&resS=2883&resE=3006&uEE=-1&uES=-1&dL=2920&dI=6111&dCLES=12491&dCLEE=12493&dC=12525&lES=12525&lEE=12525&s=nt&title=First%20run&path=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&ref=&sId=6d4mnwic&sST=1731682778&sIS=1&rV=0&v=1.4.1 HTTP/1.1Host: rum-collector-2.pingdom.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.telerik.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c/hotjar-66905.js?sv=7 HTTP/1.1Host: static.hotjar.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sxp/i/940047942047f9f048d2c1e1f6b78492.js HTTP/1.1Host: euob.ytwohlcq.telerik.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1; gauuid=d2144829-e324-4fbe-8dab-96fd3d3ecb59; _gcl_au=1.1.816168706.1731682775; _cq_duid=1.1731682777.ns9ymyf7k6usbTXX; _cq_suid=1.1731682777.eziSzDGYZbIOehGF; _ga_9JSNBCSF54=GS1.1.1731682777.1.0.1731682777.60.0.0; _ga=GA1.1.146950673.1731682778; _uetsid=3c075310a36211ef9214e39993a332b6; _uetvid=3c0795e0a36211ef90d903624085c4d8
Source: global traffic	HTTP traffic detected: GET /uwt.js HTTP/1.1Host: static.ads-twitter.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /p/action/5614127.js HTTP/1.1Host: bat.bing.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /monitor/stat.js HTTP/1.1Host: www.clickcease.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/adsct?bci=3&dv=America%2FNew_York%26en-US%2Cen%26Google%20Inc.%26Win32%26255%261280%261024%264%2624%261280%26984%260%26na&eci=2&event_id=d3c56a3e-5e46-458b-9cfc-58e4034af68a&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=b44ecccc-6ffc-4513-83c8-8720371a64fe&tw_document_href=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nurcc&type=javascript&version=2.3.31 HTTP/1.1Host: t.coConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ki.js/24100/4Nr.js HTTP/1.1Host: cl.qualaroo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/adsct?bci=3&dv=America%2FNew_York%26en-US%2Cen%26Google%20Inc.%26Win32%26255%261280%261024%264%2624%261280%26984%260%26na&eci=2&event_id=cff2a29a-f564-408a-9834-ff7d0dacc979&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=b44ecccc-6ffc-4513-83c8-8720371a64fe&tw_document_href=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzcii&type=javascript&version=2.3.31 HTTP/1.1Host: t.coConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/adsct?bci=3&dv=America%2FNew_York%26en-US%2Cen%26Google%20Inc.%26Win32%26255%261280%261024%264%2624%261280%26984%260%26na&eci=2&event_id=d3c56a3e-5e46-458b-9cfc-58e4034af68a&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=b44ecccc-6ffc-4513-83c8-8720371a64fe&tw_document_href=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nurcc&type=javascript&version=2.3.31 HTTP/1.1Host: analytics.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en_US/fbevents.js HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/beacon.gif?id=54328dddabe53db9497b23c6&sAW=1280&sAH=984&bIW=1034&bIH=870&pD=24&dPR=1&or=landscape-primary&nT=0&rC=0&nS=0&cS=1740&cE=2590&dLE=1740&dLS=1732&fS=1719&hS=1740&rE=-1&rS=-1&reS=2607&resS=2883&resE=3006&uEE=-1&uES=-1&dL=2920&dI=6111&dCLES=12491&dCLEE=12493&dC=12525&lES=12525&lEE=12525&s=nt&title=First%20run&path=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&ref=&sId=6d4mnwic&sST=1731682778&sIS=1&rV=0&v=1.4.1 HTTP/1.1Host: rum-collector-2.pingdom.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /i/adsct?bci=3&dv=America%2FNew_York%26en-US%2Cen%26Google%20Inc.%26Win32%26255%261280%261024%264%2624%261280%26984%260%26na&eci=2&event_id=cff2a29a-f564-408a-9834-ff7d0dacc979&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=b44ecccc-6ffc-4513-83c8-8720371a64fe&tw_document_href=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzcii&type=javascript&version=2.3.31 HTTP/1.1Host: analytics.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /ct?id=37678&url=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&sf=0&tpi=&ch=Telerik&uvid=&tsf=0&tsfmi=&tsfu=&cb=1731682777838&hl=1&op=0&ag=300509663&rand=94219511611726670010517191162220925295088562972027691985027161100609009027118186878291&fs=1034x870&fst=1034x870&np=win32&nv=google%20inc.&ref=&ss=1280x1024&nc=0&at=&di=W1siZWYiLDgwOTZdLFsiYWJuY2giLDE5XSxbLTIsIjEyLGQ0SE9YVlBYN2ZOak5iMUt1N2NXOWdURzgydlFWSTZBbTlneUZBQWlIa1R5REJmTW1YWGlpcGhFRG94Y2IwRmpDWTBBM0dOdURlSkZkWlhkb3k1VzMvNTg1cXBiVXc1Y3RQZnYiXSxbLTgsIi0iXSxbLTEzLCItIl0sWy0xNywiNCJdLFstMTksIlsxMCwxMCwxMCwxMCwwLDAsMSwyNCwyNCxcIi1cIiwxMjgwLDk4NCwxMjgwLDEwMjQsMTA1MCw5NjQsMTAzNCw4NzAsMCwwLDAsMCxcIi1cIixcIi1cIiwxMDE3LDg3MF0iXSxbLTIwLCItIl0sWy0zMSwiZmFsc2UiXSxbLTE0LCItIl0sWy0xNSwiLSJdLFstMTYsIjAiXSxbLTIyLCJbXCJuXCIsXCJuXCJdIl0sWy0yNCwiW1wic2F5c3dob1wiLDAsMSwxLDFdIl0sWy0zNSwiWzE3MzE2ODI3NzY5MzEsNV0iXSxbLTQ2LCIwIl0sWy00LCItIl0sWy0yNywiWzI1MCwxLjY1LDAsXCIzZ1wiLG51bGxdIl0sWy01OCwiLSJdLFsxMiwie1wiY3R4XCI6XCJ3ZWJnbFwiLFwidlwiOlwiZ29vZ2xlIGluYy4gKGdvb2dsZSlcIixcInJcIjpcImFuZ2xlIChnb29nbGUsIHZ1bGthbiAxLjMuMCAoc3dpZnRzaGFkZXIgZGV2aWNlIChzdWJ6ZXJvKSAoMHgwMDAwYzBkZSkpLCBzd2lmdHNoYWRlciBkcml2ZXIpXCIsXCJzbHZcIjpcIndlYmdsIGdsc2wgZXMgMS4wIChvcGVuZ2wgZXMgZ2xzbCBlcyAxLjAgY2hyb21pdW0pXCIsXCJndmVyXCI6XCJ3ZWJnbCAxLjAgKG9wZW5nbCBlcyAyLjAgY2hyb21pdW0pXCIsXCJndmVuXCI6XCJ3ZWJraXRcIixcImJlblwiOjEwLFwid2dsXCI6MSxcImdyZW5cIjpcIndlYmtpdCB3ZWJnbFwiLFwic2VmXCI6MzY5ODUxODcxMCxcInNlY1wiOlwiXCJ9Il0sWy03LCItIl0sWy05LCIrIl0sWy0xMSwie1widFwiOlwiXCIsXCJtXCI6W1wib2c6dGl0bGVcIixcInR3aXR0ZXI6dGl0bGVcIl19Il0sWy0yMywiKyJdLFstMjYsIntcInRqaHNcIjoxODU2MTE5NCxcInVqaHNcIjoxMzc2MTkxNCxcImpoc2xcIjoyMTcyNjQ5NDcyfSJdLFstMjksIi0iXSxbLTMyLCIwIl0sWy0zNywiLTEwOS02Ni03MC0iXSxbLTQyLCIxNzI0Mjk3NjUzIl0sWy00NywiQW1lcmljYS9OZXdfWW9yayxlbi1VUyxsYXRuLGdyZWdvcnkiXSxbLTYyLCI4MCJdLFstNjcsIjI1MzIzMTI4ODg6OTIiXSxbLTMzLCItIl0sWy0zNCwiLSJdLFstNDMsIjAwMDAwMDAxMDEwMDAwMDExMDExMTAxMTAxMTAxMTAxMDAwMDAxMCJdLFstNTcsIldFMFplRXRMV0VBWFQxd1pFVkZOVFVsS0F4WVdYRXhXV3hkQVRVNVdVVlZhU0JkTlhGVmNTMUJTRjFwV1ZCWktRVWtXVUJZQURRa0pEUTRBRFFzSkRRNWZBRjhKRFFGZEMxb0lYQWhmRDFzT0FRMEFDeGRUU2dNSUF3OEJDZ3NJRUJWWVRSbExHUkZSVFUxSlNnTVdGbHhNVmxzWFFFMU9WbEZWV2tnWFRWeFZYRXRRVWhkYVZsUVdTa0ZKRmxBV0FBMEpDUTBPQUEwTENRME9Yd0JmQ1EwQlhRdGFDRndJWHc5YkRnRU5BQXNYVTBvRENBTU9Dd0FCQ0JBPSJdLFstNjYsImdlb2xvY2F0aW9uLHN0b3JhZ2VhY2Nlc3MsZ2FtZXBhZCxjaGVjdCxtaWRpLGRpc3BsYXljYXB0dXJlLHVzYixicm93c2luZ3RvcGljcyxsb2NhbGZvbnRzLHBpY3R1cmVpbnBpY3R1cmUsam9pbmFkaW50ZXJlc3Rncm91cCxwdWJsaWNrZXljcmVkZW50aWFsc2dldCxvdHBjcmVkZW50aWFscyxjaHVhZm9ybWZhY3RvcixlbmNyeXB0ZWRtZWRpYSxjaHNhdmVkYXRhLGNodWFmdWxsdmVyc2lvbmxpc3QsY2h1YXdvdzY0LHNoYXJlZHN0b3JhZ2UsY2hkb3dubGluayxjaHByZWZlcnNjb2xvcnNjaGVtZSxzeW5jeGhyLGNodWFtb2RlbCxzZXJpYWwsY2FtZXJhLGNocHJlZmVyc3JlZHVjZWRtb3Rpb24scHJpdmF0ZXN0YXRldG9rZW5pc3N1YW5jZSxibHVldG9vdGgsaWRlbnRpdHljcmVkZW50aWFsc2dldCxjaHVhZnVsbHZlcnNpb24sZnVsbHNjcmVlbixjaGRwcix1bmxvYWQsa2V5Ym9hcmRtYXAsY2h1YXBsYXRmb3JtLHNoYXJlZHN0b3JhZ2VzZWxlY3R1cmwsZ3lyb3Njb3BlLGludGVyZXN0Y29ob3J0LHdpbmRvd3BsYWNlbWVudCxjaHVhb
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /action/0?ti=5614127&tm=gtm002&Ver=2&mid=0aa61c40-c9ab-4708-a25e-e720e70bd2ef&bo=1&sid=3c075310a36211ef9214e39993a332b6&vid=3c0795e0a36211ef90d903624085c4d8&vids=1&msclkid=N&uach=pv%3D10.0.0&pi=918639831&lg=en-US&sw=1280&sh=1024&sc=24&tl=First%20run&p=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&r=&lt=12525&evt=pageLoad&sv=1&cdb=AQED&rn=433531 HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /modules.6f60e575cf8ad7cb10f7.js HTTP/1.1Host: script.hotjar.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /action/0?ti=5614127&tm=gtm002&Ver=2&mid=0aa61c40-c9ab-4708-a25e-e720e70bd2ef&bo=2&sid=3c075310a36211ef9214e39993a332b6&vid=3c0795e0a36211ef90d903624085c4d8&vids=0&msclkid=N&ec=CHEQ&el=Invalid_Users&ev=0&ea=Invalid_Users&en=Y&p=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&sw=1280&sh=1024&sc=24&evt=custom&cdb=AQET&rn=403315 HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/action/223000243.js HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/rul/975652292?random=1731682780912&cv=11&fst=1731682780912&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45je4bc0h1v9167661709za200zb536291&gcs=G111&gcd=13v3v3v3v5l1&dma=0&tag_exp=101925629~102067554~102067808~102077855&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&label=p4zxCNq_8IkYEMSLndED&hn=www.googleadservices.com&frm=0&tiba=First%20run&gtm_ee=1&npa=0&pscdl=noapi&auid=816168706.1731682775&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&data=event%3Dconversion&ct_cookie_present=0 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /i/adsct?bci=3&dv=America%2FNew_York%26en-US%2Cen%26Google%20Inc.%26Win32%26255%261280%261024%264%2624%261280%26984%260%26na&eci=2&event_id=d3c56a3e-5e46-458b-9cfc-58e4034af68a&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=b44ecccc-6ffc-4513-83c8-8720371a64fe&tw_document_href=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nurcc&type=javascript&version=2.3.31 HTTP/1.1Host: analytics.twitter.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: personalization_id="v1_qWdBg7UfUb1N1Z/SS9IVHg=="
Source: global traffic	HTTP traffic detected: GET /frame.html HTTP/1.1Host: dntcl.qualaroo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /i/adsct?bci=3&dv=America%2FNew_York%26en-US%2Cen%26Google%20Inc.%26Win32%26255%261280%261024%264%2624%261280%26984%260%26na&eci=2&event_id=cff2a29a-f564-408a-9834-ff7d0dacc979&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=b44ecccc-6ffc-4513-83c8-8720371a64fe&tw_document_href=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzcii&type=javascript&version=2.3.31 HTTP/1.1Host: analytics.twitter.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: personalization_id="v1_qWdBg7UfUb1N1Z/SS9IVHg=="
Source: global traffic	HTTP traffic detected: GET /i/adsct?bci=3&dv=America%2FNew_York%26en-US%2Cen%26Google%20Inc.%26Win32%26255%261280%261024%264%2624%261280%26984%260%26na&eci=2&event_id=cff2a29a-f564-408a-9834-ff7d0dacc979&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=b44ecccc-6ffc-4513-83c8-8720371a64fe&tw_document_href=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzcii&type=javascript&version=2.3.31 HTTP/1.1Host: t.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: muc_ads=794b6615-e75e-4d2d-8535-6ac71126796e; __cf_bm=KPen1Zd9VNIs1TF9i2h9MUU7HgsfGzPHuQZZaVGYPSQ-1731682781-1.0.1.1-tOm_i.k0EhfB7HUqS4omPvNh95hXDRb.pmcwU6Epkiiv388LhIHfa29vevY1f8p9D6ixm2BrKpYV43OimYNb2A
Source: global traffic	HTTP traffic detected: GET /i/adsct?bci=3&dv=America%2FNew_York%26en-US%2Cen%26Google%20Inc.%26Win32%26255%261280%261024%264%2624%261280%26984%260%26na&eci=2&event_id=d3c56a3e-5e46-458b-9cfc-58e4034af68a&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=b44ecccc-6ffc-4513-83c8-8720371a64fe&tw_document_href=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nurcc&type=javascript&version=2.3.31 HTTP/1.1Host: t.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: muc_ads=794b6615-e75e-4d2d-8535-6ac71126796e; __cf_bm=KPen1Zd9VNIs1TF9i2h9MUU7HgsfGzPHuQZZaVGYPSQ-1731682781-1.0.1.1-tOm_i.k0EhfB7HUqS4omPvNh95hXDRb.pmcwU6Epkiiv388LhIHfa29vevY1f8p9D6ixm2BrKpYV43OimYNb2A
Source: global traffic	HTTP traffic detected: GET /ki.js/24100/4Nr.js HTTP/1.1Host: cl.qualaroo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en_US/fbevents.js HTTP/1.1Host: connect.facebook.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /action/0?ti=223000243&Ver=2&mid=85eb9b3d-66db-4373-8f34-c308536e482f&bo=1&sid=3c075310a36211ef9214e39993a332b6&vid=3c0795e0a36211ef90d903624085c4d8&vids=0&msclkid=N&uach=pv%3D10.0.0&pi=918639831&lg=en-US&sw=1280&sh=1024&sc=24&p=about%3Asrcdoc&r=&lt=91&evt=pageLoad&ifm=1&sv=1&cdb=AQAQ&rn=471192 HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MR=0; MUID=05E39236C2C06A670320870EC3E56B27
Source: global traffic	HTTP traffic detected: GET /ct?id=37678&url=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&sf=0&tpi=&ch=Telerik&uvid=&tsf=0&tsfmi=&tsfu=&cb=1731682777838&hl=1&op=0&ag=300509663&rand=94219511611726670010517191162220925295088562972027691985027161100609009027118186878291&fs=1034x870&fst=1034x870&np=win32&nv=google%20inc.&ref=&ss=1280x1024&nc=0&at=&di=W1siZWYiLDgwOTZdLFsiYWJuY2giLDE5XSxbLTIsIjEyLGQ0SE9YVlBYN2ZOak5iMUt1N2NXOWdURzgydlFWSTZBbTlneUZBQWlIa1R5REJmTW1YWGlpcGhFRG94Y2IwRmpDWTBBM0dOdURlSkZkWlhkb3k1VzMvNTg1cXBiVXc1Y3RQZnYiXSxbLTgsIi0iXSxbLTEzLCItIl0sWy0xNywiNCJdLFstMTksIlsxMCwxMCwxMCwxMCwwLDAsMSwyNCwyNCxcIi1cIiwxMjgwLDk4NCwxMjgwLDEwMjQsMTA1MCw5NjQsMTAzNCw4NzAsMCwwLDAsMCxcIi1cIixcIi1cIiwxMDE3LDg3MF0iXSxbLTIwLCItIl0sWy0zMSwiZmFsc2UiXSxbLTE0LCItIl0sWy0xNSwiLSJdLFstMTYsIjAiXSxbLTIyLCJbXCJuXCIsXCJuXCJdIl0sWy0yNCwiW1wic2F5c3dob1wiLDAsMSwxLDFdIl0sWy0zNSwiWzE3MzE2ODI3NzY5MzEsNV0iXSxbLTQ2LCIwIl0sWy00LCItIl0sWy0yNywiWzI1MCwxLjY1LDAsXCIzZ1wiLG51bGxdIl0sWy01OCwiLSJdLFsxMiwie1wiY3R4XCI6XCJ3ZWJnbFwiLFwidlwiOlwiZ29vZ2xlIGluYy4gKGdvb2dsZSlcIixcInJcIjpcImFuZ2xlIChnb29nbGUsIHZ1bGthbiAxLjMuMCAoc3dpZnRzaGFkZXIgZGV2aWNlIChzdWJ6ZXJvKSAoMHgwMDAwYzBkZSkpLCBzd2lmdHNoYWRlciBkcml2ZXIpXCIsXCJzbHZcIjpcIndlYmdsIGdsc2wgZXMgMS4wIChvcGVuZ2wgZXMgZ2xzbCBlcyAxLjAgY2hyb21pdW0pXCIsXCJndmVyXCI6XCJ3ZWJnbCAxLjAgKG9wZW5nbCBlcyAyLjAgY2hyb21pdW0pXCIsXCJndmVuXCI6XCJ3ZWJraXRcIixcImJlblwiOjEwLFwid2dsXCI6MSxcImdyZW5cIjpcIndlYmtpdCB3ZWJnbFwiLFwic2VmXCI6MzY5ODUxODcxMCxcInNlY1wiOlwiXCJ9Il0sWy03LCItIl0sWy05LCIrIl0sWy0xMSwie1widFwiOlwiXCIsXCJtXCI6W1wib2c6dGl0bGVcIixcInR3aXR0ZXI6dGl0bGVcIl19Il0sWy0yMywiKyJdLFstMjYsIntcInRqaHNcIjoxODU2MTE5NCxcInVqaHNcIjoxMzc2MTkxNCxcImpoc2xcIjoyMTcyNjQ5NDcyfSJdLFstMjksIi0iXSxbLTMyLCIwIl0sWy0zNywiLTEwOS02Ni03MC0iXSxbLTQyLCIxNzI0Mjk3NjUzIl0sWy00NywiQW1lcmljYS9OZXdfWW9yayxlbi1VUyxsYXRuLGdyZWdvcnkiXSxbLTYyLCI4MCJdLFstNjcsIjI1MzIzMTI4ODg6OTIiXSxbLTMzLCItIl0sWy0zNCwiLSJdLFstNDMsIjAwMDAwMDAxMDEwMDAwMDExMDExMTAxMTAxMTAxMTAxMDAwMDAxMCJdLFstNTcsIldFMFplRXRMV0VBWFQxd1pFVkZOVFVsS0F4WVdYRXhXV3hkQVRVNVdVVlZhU0JkTlhGVmNTMUJTRjFwV1ZCWktRVWtXVUJZQURRa0pEUTRBRFFzSkRRNWZBRjhKRFFGZEMxb0lYQWhmRDFzT0FRMEFDeGRUU2dNSUF3OEJDZ3NJRUJWWVRSbExHUkZSVFUxSlNnTVdGbHhNVmxzWFFFMU9WbEZWV2tnWFRWeFZYRXRRVWhkYVZsUVdTa0ZKRmxBV0FBMEpDUTBPQUEwTENRME9Yd0JmQ1EwQlhRdGFDRndJWHc5YkRnRU5BQXNYVTBvRENBTU9Dd0FCQ0JBPSJdLFstNjYsImdlb2xvY2F0aW9uLHN0b3JhZ2VhY2Nlc3MsZ2FtZXBhZCxjaGVjdCxtaWRpLGRpc3BsYXljYXB0dXJlLHVzYixicm93c2luZ3RvcGljcyxsb2NhbGZvbnRzLHBpY3R1cmVpbnBpY3R1cmUsam9pbmFkaW50ZXJlc3Rncm91cCxwdWJsaWNrZXljcmVkZW50aWFsc2dldCxvdHBjcmVkZW50aWFscyxjaHVhZm9ybWZhY3RvcixlbmNyeXB0ZWRtZWRpYSxjaHNhdmVkYXRhLGNodWFmdWxsdmVyc2lvbmxpc3QsY2h1YXdvdzY0LHNoYXJlZHN0b3JhZ2UsY2hkb3dubGluayxjaHByZWZlcnNjb2xvcnNjaGVtZSxzeW5jeGhyLGNodWFtb2RlbCxzZXJpYWwsY2FtZXJhLGNocHJlZmVyc3JlZHVjZWRtb3Rpb24scHJpdmF0ZXN0YXRldG9rZW5pc3N1YW5jZSxibHVldG9vdGgsaWRlbnRpdHljcmVkZW50aWFsc2dldCxjaHVhZnVsbHZlcnNpb24sZnVsbHNjcmVlbixjaGRwcix1bmxvYWQsa2V5Ym9hcmRtYXAsY2h1YXBsYXRmb3JtLHNoYXJlZHN0b3JhZ2VzZWxlY3R1cmwsZ3lyb3Njb3BlLGludGVyZXN0Y29ob3J0LHdpbmRvd3BsYWNlbWVudCxjaHVhb
Source: global traffic	HTTP traffic detected: GET /tag/uet/223000243 HTTP/1.1Host: www.clarity.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /healthcheck HTTP/1.1Host: assets-tracking.crazyegg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.telerik.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /healthcheck HTTP/1.1Host: pagestates-tracking.crazyegg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.telerik.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/975652292/?label=p4zxCNq_8IkYEMSLndED&guid=ON&script=0&ct_cookie_present=false&random=1045446&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQII6saxAgjTxbECCKXGsQIiAQFAAQ&pscrd=COazjdm896zLbSITCN-Rk4nN3okDFQix_QcdtQQxtTICCAMyAggEMgIIBzICCAgyAggJMgIICjICCAIyAggLMgIIFTICCB8yAggTMgIIEjoYaHR0cHM6Ly93d3cudGVsZXJpay5jb20v HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUng7FNaGwFIxFXNOb-oJfrlWLmS8s482CDPCE4RJVNfRR_zhMx7myQ7CptU
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /s/0.7.56/clarity.js HTTP/1.1Host: www.clarity.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CLID=511e6b8d1fe64f1d9c159778977e922d.20241115.20251115
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /action/0?ti=223000243&Ver=2&mid=7d21d41e-69db-453b-88c7-caaa116a1362&bo=1&sid=3c075310a36211ef9214e39993a332b6&vid=3c0795e0a36211ef90d903624085c4d8&vids=0&msclkid=N&uach=pv%3D10.0.0&pi=918639831&lg=en-US&sw=1280&sh=1024&sc=24&tl=First%20run&p=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&r=&lt=12525&evt=pageLoad&sv=1&cdb=AQED&rn=443358 HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MR=0; MUID=05E39236C2C06A670320870EC3E56B27; MSPTC=Svj7-KObM3JUAowayt_M6SOtc93MB69dPwieSoYODvE
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /signals/config/1444093252502226?v=2.9.177&r=stable&domain=www.telerik.com&hme=c3e4904c1dde42d643265ef909b9e193c41cedcd6f559a3ff5e1b178e36647fa&ex_m=70%2C121%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C172%2C175%2C187%2C183%2C184%2C186%2C29%2C101%2C53%2C77%2C185%2C167%2C170%2C180%2C181%2C188%2C131%2C41%2C189%2C190%2C34%2C143%2C15%2C50%2C195%2C194%2C133%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C168%2C171%2C140%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113 HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tracker/tc_imp.gif?e=37dfbd8ee84e001269efc13de840829c9225c24f567d43d6da1908be6245cad7bd70a976750ef80ed89373bfe70e9c20c1e53e8d5d168b6a2f17071a10acf9f29f674fd38b8b062c3913af78720c866ade66c10c6507259a040157330c57c1eb6e1b77be26bb25cb43e2923cf34c6da909337814da4de44fec8bc59a7ee46a56a82b9eec47679c796e092818c5871d61eb72bffeb1ba131be20ecca7478c31db6bda508e1547f77303fd1f564c2acf503ed79ffca8328828bf7d8557ec4b7274a7d43169230121e118f58109ac5d6ead83c6771e217dcf965d78c9df014b3545700015a7902c7e7d17c7ab1f28cef2ea2b93e745711b3eb7b4e7c1d965b4cfd652ba53940c36339eeb9cb5f761c1d5e46c90660cd6f89c7f4e16f56868a1c40678fc86ae668503fa43b6980a870d97dd75d66071d2d964d27a8f95afb491abb6457fb476eda5a9760c2be88c24cee81de21159578e090ed9859385c5f79521de65c089b9c836ae7a7c74dc2b65d484964d36dde433f352b5c11cc439ef7c021314fb07ff439cc7ee27ebc978d01fa7d78a95279e5e406aed4e13433e113e87e223b54f9494c712a29062ed9b259acca9f27e9bbbe25c707585e51e1c9bbb491442f1efc33afd6fc4ae25bbf224a061b22d870586678bf169995e5eb0bc9874222d7c1168574e1dc1e08c6cd102ab46525e2ef9b553c29f1908e2a5d9babc01deffb0b9dfacbdfb594e22fa4085b75f668144621cc93d1e7825ab32f97142c4ae8231ee08bf3797b96f88e1598b711d203e037b109dc6ecd93b7c52844d0fccb093cfc7a33957e7cfe825e1b96167ca9657653deb9bcb573fb620865e9912e1389c15c5b014bab34eb9d2c1dbdf423a9ab34435906ab4cff0fd049607590a17d62c1a42bba3439db8458ec8e797079cc3de6c505512e964f45bb85fb09d7bc26701334b3b7d7fe25a92937308e87dcaa6e927999218ce6679ac0d6e6cc2aac3005af263aacd438b153b0156ae646fd1fa957ac1542288da50f29dcff5805ec804037707f8763940cdd31e56b23de7fedd3fd690954e2f20fd397b515a98055ab0c8b25b44dd&cri=dC4EKuJhV2&ts=3155&cb=1731682780993 HTTP/1.1Host: obseu.ytwohlcq.telerik.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1; gauuid=d2144829-e324-4fbe-8dab-96fd3d3ecb59; _gcl_au=1.1.816168706.1731682775; _cq_duid=1.1731682777.ns9ymyf7k6usbTXX; _cq_suid=1.1731682777.eziSzDGYZbIOehGF; _ga=GA1.1.146950673.1731682778; _hjSessionUser_66905=eyJpZCI6ImU3ZDdjYjk4LTMzYTgtNWVlNC04OTU1LTYwM2E4MzBlNjZjNyIsImNyZWF0ZWQiOjE3MzE2ODI3Nzk3MTcsImV4aXN0aW5nIjpmYW
Source: global traffic	HTTP traffic detected: GET /pagead/1p-conversion/975652292/?label=p4zxCNq_8IkYEMSLndED&guid=ON&script=0&ct_cookie_present=false&random=1045446&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQII6saxAgjTxbECCKXGsQIiAQFAAQ&pscrd=COazjdm896zLbSITCN-Rk4nN3okDFQix_QcdtQQxtTICCAMyAggEMgIIBzICCAgyAggJMgIICjICCAIyAggLMgIIFTICCB8yAggTMgIIEjoYaHR0cHM6Ly93d3cudGVsZXJpay5jb20v&is_vtc=1&cid=CAQSKQCa7L7dQMKAMcg-9wSmTEniUBO2fU4DW0mhRyIsxTvK1UmOFpeFMErh&random=619890663 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tag/uet/223000243 HTTP/1.1Host: www.clarity.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CLID=511e6b8d1fe64f1d9c159778977e922d.20241115.20251115
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /p/action/223000243.js HTTP/1.1Host: bat.bing.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MR=0; MUID=05E39236C2C06A670320870EC3E56B27
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/975652292/?random=298145632&cv=11&fst=1731682780912&bg=ffffff&guid=ON&async=1&gtm=45je4bc0h1v9167661709za200zb536291&gcs=G111&gcd=13v3v3v3v5l1&dma=0&tag_exp=101925629~102067554~102067808~102077855&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&label=p4zxCNq_8IkYEMSLndED&hn=www.googleadservices.com&frm=0&tiba=First%20run&gtm_ee=1&npa=0&pscdl=noapi&auid=816168706.1731682775&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&data=event%3Dconversion&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQII6saxAgjTxbECIgEBQAFKLGV2ZW50LXNvdXJjZSwgdHJpZ2dlciwgbm90LW5hdmlnYXRpb24tc291cmNlYgQKAgID&pscrd=CPCnjvapqJe2GiITCKypk4nN3okDFS2W_QcdF78UGTICCAMyAggEMgIIBzICCAgyAggJMgIICjICCAIyAggLMgIIFTICCB8yAggTMgIIEjoYaHR0cHM6Ly93d3cudGVsZXJpay5jb20vQldDaEFJZ1BfYnVRWVF2S19MdWNDQy0taGNFaTBBRGo4OWFObm8zRFZrU19Db29NRk1Va0FnaGF5ZFhKME0tY0NEanpxdUhFTUxRTURJUkJ3dWdvN0NmYU0 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUng7FNaGwFIxFXNOb-oJfrlWLmS8s482CDPCE4RJVNfRR_zhMx7myQ7CptU
Source: global traffic	HTTP traffic detected: GET /tag/uet/223000243 HTTP/1.1Host: www.clarity.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CLID=511e6b8d1fe64f1d9c159778977e922d.20241115.20251115
Source: global traffic	HTTP traffic detected: GET /s/0.7.56/clarity.js HTTP/1.1Host: www.clarity.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CLID=511e6b8d1fe64f1d9c159778977e922d.20241115.20251115
Source: global traffic	HTTP traffic detected: GET /healthcheck HTTP/1.1Host: pagestates-tracking.crazyegg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /healthcheck HTTP/1.1Host: assets-tracking.crazyegg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-conversion/975652292/?label=p4zxCNq_8IkYEMSLndED&guid=ON&script=0&ct_cookie_present=false&random=1045446&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQII6saxAgjTxbECCKXGsQIiAQFAAQ&pscrd=COazjdm896zLbSITCN-Rk4nN3okDFQix_QcdtQQxtTICCAMyAggEMgIIBzICCAgyAggJMgIICjICCAIyAggLMgIIFTICCB8yAggTMgIIEjoYaHR0cHM6Ly93d3cudGVsZXJpay5jb20v&is_vtc=1&cid=CAQSKQCa7L7dQMKAMcg-9wSmTEniUBO2fU4DW0mhRyIsxTvK1UmOFpeFMErh&random=619890663 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mon HTTP/1.1Host: obseu.ytwohlcq.telerik.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1; gauuid=d2144829-e324-4fbe-8dab-96fd3d3ecb59; _gcl_au=1.1.816168706.1731682775; _cq_duid=1.1731682777.ns9ymyf7k6usbTXX; _cq_suid=1.1731682777.eziSzDGYZbIOehGF; _ga=GA1.1.146950673.1731682778; _hjSessionUser_66905=eyJpZCI6ImU3ZDdjYjk4LTMzYTgtNWVlNC04OTU1LTYwM2E4MzBlNjZjNyIsImNyZWF0ZWQiOjE3MzE2ODI3Nzk3MTcsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_66905=eyJpZCI6ImFhMmJkODYyLWM1NWQtNDgyZi04OWE2LTY0MDZlYjNjNzQ2NCIsImMiOjE3MzE2ODI3Nzk3MjEsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; cg_uuid=6a821068a0581a1468e269f186887e5d; _cq_pxg=3\|a0547055754154\|975652292\|event=conversion; _ga_9JSNBCSF54=GS1.1.1731682777.1.0.1731682780.57.0.0; cebs=1; _ce.s=v~e7595a9f04b373fdca4209822be974887bb73f29~lcw~1731682782071~vir~new~lva~1731682782071~vpv~0~lcw~1731682782072
Source: global traffic	HTTP traffic detected: GET /tracker/tc_imp.gif?e=37dfbd8ee84e001269efc13de840829c9225c24f567d43d6da1908be6245cad7bd70a976750ef80ed89373bfe70e9c20c1e53e8d5d168b6a2f17071a10acf9f29f674fd38b8b062c3913af78720c866ade66c10c6507259a040157330c57c1eb6e1b77be26bb25cb43e2923cf34c6da909337814da4de44fec8bc59a7ee46a56a82b9eec47679c796e092818c5871d61eb72bffeb1ba131be20ecca7478c31db6bda508e1547f77303fd1f564c2acf503ed79ffca8328828bf7d8557ec4b7274a7d43169230121e118f58109ac5d6ead83c6771e217dcf965d78c9df014b3545700015a7902c7e7d17c7ab1f28cef2ea2b93e745711b3eb7b4e7c1d965b4cfd652ba53940c36339eeb9cb5f761c1d5e46c90660cd6f89c7f4e16f56868a1c40678fc86ae668503fa43b6980a870d97dd75d66071d2d964d27a8f95afb491abb6457fb476eda5a9760c2be88c24cee81de21159578e090ed9859385c5f79521de65c089b9c836ae7a7c74dc2b65d484964d36dde433f352b5c11cc439ef7c021314fb07ff439cc7ee27ebc978d01fa7d78a95279e5e406aed4e13433e113e87e223b54f9494c712a29062ed9b259acca9f27e9bbbe25c707585e51e1c9bbb491442f1efc33afd6fc4ae25bbf224a061b22d870586678bf169995e5eb0bc9874222d7c1168574e1dc1e08c6cd102ab46525e2ef9b553c29f1908e2a5d9babc01deffb0b9dfacbdfb594e22fa4085b75f668144621cc93d1e7825ab32f97142c4ae8231ee08bf3797b96f88e1598b711d203e037b109dc6ecd93b7c52844d0fccb093cfc7a33957e7cfe825e1b96167ca9657653deb9bcb573fb620865e9912e1389c15c5b014bab34eb9d2c1dbdf423a9ab34435906ab4cff0fd049607590a17d62c1a42bba3439db8458ec8e797079cc3de6c505512e964f45bb85fb09d7bc26701334b3b7d7fe25a92937308e87dcaa6e927999218ce6679ac0d6e6cc2aac3005af263aacd438b153b0156ae646fd1fa957ac1542288da50f29dcff5805ec804037707f8763940cdd31e56b23de7fedd3fd690954e2f20fd397b515a98055ab0c8b25b44dd&cri=dC4EKuJhV2&ts=3155&cb=1731682780993 HTTP/1.1Host: obseu.ytwohlcq.telerik.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1; gauuid=d2144829-e324-4fbe-8dab-96fd3d3ecb59; _gcl_au=1.1.816168706.1731682775; _cq_duid=1.1731682777.ns9ymyf7k6usbTXX; _cq_suid=1.1731682777.eziSzDGYZbIOehGF; _ga=GA1.1.146950673.1731682778; _hjSessionUser_66905=eyJpZCI6ImU3ZDdjYjk4LTMzYTgtNWVlNC04OTU1LTYwM2E4MzBlNjZjNyIsImNyZWF0ZWQiOjE3MzE2ODI3Nzk3MTcsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_66905=eyJpZCI6ImFhMmJkODYyLWM1NWQtNDgyZi04OWE2LTY0MDZlYjNjNzQ2NCIsImMiOjE3MzE2ODI3Nzk3MjEsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; cg_uuid=6a821068a0581a1468e269f186887e5d; _cq_pxg=3\|a054705
Source: global traffic	HTTP traffic detected: GET /clock?u=874351&st=449044&t=1731682782074&tk=0c56c1290466cbadcdbfab23ec5affdd HTTP/1.1Host: tracking.crazyegg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /signals/config/1444093252502226?v=2.9.177&r=stable&domain=www.telerik.com&hme=c3e4904c1dde42d643265ef909b9e193c41cedcd6f559a3ff5e1b178e36647fa&ex_m=70%2C121%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C172%2C175%2C187%2C183%2C184%2C186%2C29%2C101%2C53%2C77%2C185%2C167%2C170%2C180%2C181%2C188%2C131%2C41%2C189%2C190%2C34%2C143%2C15%2C50%2C195%2C194%2C133%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C168%2C171%2C140%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113 HTTP/1.1Host: connect.facebook.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tag/uet/223000243 HTTP/1.1Host: www.clarity.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CLID=511e6b8d1fe64f1d9c159778977e922d.20241115.20251115
Source: global traffic	HTTP traffic detected: GET /tr/?id=1444093252502226&ev=PageView&dl=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&rl=&if=false&ts=1731682786415&sw=1280&sh=1024&v=2.9.177&r=stable&ec=0&o=4126&fbp=fb.1.1731682786412.73675803251272972&cs_est=true&ler=empty&cdl=API_unavailable&it=1731682781227&coo=false&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=1444093252502226&ev=PageView&dl=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&rl=&if=false&ts=1731682786415&sw=1280&sh=1024&v=2.9.177&r=stable&ec=0&o=4126&fbp=fb.1.1731682786412.73675803251272972&cs_est=true&ler=empty&cdl=API_unavailable&it=1731682781227&coo=false&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: trigger;navigation-source, event-sourceReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=1444093252502226&ev=CHEQ&dl=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&rl=&if=false&ts=1731682786417&sw=1280&sh=1024&v=2.9.177&r=stable&ec=1&o=4126&fbp=fb.1.1731682786412.73675803251272972&ler=empty&cdl=API_unavailable&it=1731682781227&coo=false&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=1444093252502226&ev=CHEQ&dl=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&rl=&if=false&ts=1731682786417&sw=1280&sh=1024&v=2.9.177&r=stable&ec=1&o=4126&fbp=fb.1.1731682786412.73675803251272972&ler=empty&cdl=API_unavailable&it=1731682781227&coo=false&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: trigger=navigation-source, event-sourceReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-conversion/975652292/?random=298145632&cv=11&fst=1731682780912&bg=ffffff&guid=ON&async=1&gtm=45je4bc0h1v9167661709za200zb536291&gcs=G111&gcd=13v3v3v3v5l1&dma=0&tag_exp=101925629~102067554~102067808~102077855&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&label=p4zxCNq_8IkYEMSLndED&hn=www.googleadservices.com&frm=0&tiba=First%20run&gtm_ee=1&npa=0&pscdl=noapi&auid=816168706.1731682775&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&data=event%3Dconversion&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQII6saxAgjTxbECIgEBQAFKLGV2ZW50LXNvdXJjZSwgdHJpZ2dlciwgbm90LW5hdmlnYXRpb24tc291cmNlYgQKAgID&pscrd=CPCnjvapqJe2GiITCKypk4nN3okDFS2W_QcdF78UGTICCAMyAggEMgIIBzICCAgyAggJMgIICjICCAIyAggLMgIIFTICCB8yAggTMgIIEjoYaHR0cHM6Ly93d3cudGVsZXJpay5jb20vQldDaEFJZ1BfYnVRWVF2S19MdWNDQy0taGNFaTBBRGo4OWFObm8zRFZrU19Db29NRk1Va0FnaGF5ZFhKME0tY0NEanpxdUhFTUxRTURJUkJ3dWdvN0NmYU0&is_vtc=1&cid=CAQSKQCa7L7dHB7KYvcSYAMxPc6zerBXQcqfiepX-R4CZzmd-t6Arhp_PN0q&random=4223965958 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mon HTTP/1.1Host: obseu.ytwohlcq.telerik.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1; gauuid=d2144829-e324-4fbe-8dab-96fd3d3ecb59; _gcl_au=1.1.816168706.1731682775; _cq_duid=1.1731682777.ns9ymyf7k6usbTXX; _cq_suid=1.1731682777.eziSzDGYZbIOehGF; _ga=GA1.1.146950673.1731682778; _hjSessionUser_66905=eyJpZCI6ImU3ZDdjYjk4LTMzYTgtNWVlNC04OTU1LTYwM2E4MzBlNjZjNyIsImNyZWF0ZWQiOjE3MzE2ODI3Nzk3MTcsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_66905=eyJpZCI6ImFhMmJkODYyLWM1NWQtNDgyZi04OWE2LTY0MDZlYjNjNzQ2NCIsImMiOjE3MzE2ODI3Nzk3MjEsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; cg_uuid=6a821068a0581a1468e269f186887e5d; _cq_pxg=3\|a0547055754154\|975652292\|event=conversion; _ga_9JSNBCSF54=GS1.1.1731682777.1.0.1731682780.57.0.0; cebs=1; _ce.s=v~e7595a9f04b373fdca4209822be974887bb73f29~lcw~1731682782071~vir~new~lva~1731682782071~vpv~0~lcw~1731682782072
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tr/?id=1444093252502226&ev=PageView&dl=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&rl=&if=false&ts=1731682786415&sw=1280&sh=1024&v=2.9.177&r=stable&ec=0&o=4126&fbp=fb.1.1731682786412.73675803251272972&cs_est=true&ler=empty&cdl=API_unavailable&it=1731682781227&coo=false&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=1444093252502226&ev=CHEQ&dl=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&rl=&if=false&ts=1731682786417&sw=1280&sh=1024&v=2.9.177&r=stable&ec=1&o=4126&fbp=fb.1.1731682786412.73675803251272972&ler=empty&cdl=API_unavailable&it=1731682781227&coo=false&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=1444093252502226&ev=PageView&dl=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&rl=&if=false&ts=1731682786415&sw=1280&sh=1024&v=2.9.177&r=stable&ec=0&o=4126&fbp=fb.1.1731682786412.73675803251272972&cs_est=true&ler=empty&cdl=API_unavailable&it=1731682781227&coo=false&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=1444093252502226&ev=CHEQ&dl=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&rl=&if=false&ts=1731682786417&sw=1280&sh=1024&v=2.9.177&r=stable&ec=1&o=4126&fbp=fb.1.1731682786412.73675803251272972&ler=empty&cdl=API_unavailable&it=1731682781227&coo=false&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-conversion/975652292/?random=298145632&cv=11&fst=1731682780912&bg=ffffff&guid=ON&async=1&gtm=45je4bc0h1v9167661709za200zb536291&gcs=G111&gcd=13v3v3v3v5l1&dma=0&tag_exp=101925629~102067554~102067808~102077855&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&label=p4zxCNq_8IkYEMSLndED&hn=www.googleadservices.com&frm=0&tiba=First%20run&gtm_ee=1&npa=0&pscdl=noapi&auid=816168706.1731682775&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&data=event%3Dconversion&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQII6saxAgjTxbECIgEBQAFKLGV2ZW50LXNvdXJjZSwgdHJpZ2dlciwgbm90LW5hdmlnYXRpb24tc291cmNlYgQKAgID&pscrd=CPCnjvapqJe2GiITCKypk4nN3okDFS2W_QcdF78UGTICCAMyAggEMgIIBzICCAgyAggJMgIICjICCAIyAggLMgIIFTICCB8yAggTMgIIEjoYaHR0cHM6Ly93d3cudGVsZXJpay5jb20vQldDaEFJZ1BfYnVRWVF2S19MdWNDQy0taGNFaTBBRGo4OWFObm8zRFZrU19Db29NRk1Va0FnaGF5ZFhKME0tY0NEanpxdUhFTUxRTURJUkJ3dWdvN0NmYU0&is_vtc=1&cid=CAQSKQCa7L7dHB7KYvcSYAMxPc6zerBXQcqfiepX-R4CZzmd-t6Arhp_PN0q&random=4223965958 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mon HTTP/1.1Host: obseu.ytwohlcq.telerik.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1; gauuid=d2144829-e324-4fbe-8dab-96fd3d3ecb59; _gcl_au=1.1.816168706.1731682775; _cq_duid=1.1731682777.ns9ymyf7k6usbTXX; _cq_suid=1.1731682777.eziSzDGYZbIOehGF; _ga=GA1.1.146950673.1731682778; _hjSessionUser_66905=eyJpZCI6ImU3ZDdjYjk4LTMzYTgtNWVlNC04OTU1LTYwM2E4MzBlNjZjNyIsImNyZWF0ZWQiOjE3MzE2ODI3Nzk3MTcsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_66905=eyJpZCI6ImFhMmJkODYyLWM1NWQtNDgyZi04OWE2LTY0MDZlYjNjNzQ2NCIsImMiOjE3MzE2ODI3Nzk3MjEsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; cg_uuid=6a821068a0581a1468e269f186887e5d; _cq_pxg=3\|a0547055754154\|975652292\|event=conversion; _ga_9JSNBCSF54=GS1.1.1731682777.1.0.1731682780.57.0.0; cebs=1; _ce.s=v~e7595a9f04b373fdca4209822be974887bb73f29~lcw~1731682782071~vir~new~lva~1731682782071~vpv~0~lcw~1731682782072
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mon HTTP/1.1Host: obseu.ytwohlcq.telerik.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1; gauuid=d2144829-e324-4fbe-8dab-96fd3d3ecb59; _gcl_au=1.1.816168706.1731682775; _cq_duid=1.1731682777.ns9ymyf7k6usbTXX; _cq_suid=1.1731682777.eziSzDGYZbIOehGF; _ga=GA1.1.146950673.1731682778; _hjSessionUser_66905=eyJpZCI6ImU3ZDdjYjk4LTMzYTgtNWVlNC04OTU1LTYwM2E4MzBlNjZjNyIsImNyZWF0ZWQiOjE3MzE2ODI3Nzk3MTcsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_66905=eyJpZCI6ImFhMmJkODYyLWM1NWQtNDgyZi04OWE2LTY0MDZlYjNjNzQ2NCIsImMiOjE3MzE2ODI3Nzk3MjEsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; cg_uuid=6a821068a0581a1468e269f186887e5d; _cq_pxg=3\|a0547055754154\|975652292\|event=conversion; _ga_9JSNBCSF54=GS1.1.1731682777.1.0.1731682780.57.0.0; cebs=1; _ce.clock_data=-569%2C173.254.250.89%2C1%2C22210ca73bf1af2ec2eace74a96ee356%2CChrome%2CUS; _CEFT=Q%3D%3D%3D; cebsp_=1; _fbp=fb.1.1731682786412.73675803251272972; _ce.s=v~e7595a9f04b373fdca4209822be974887bb73f29~lcw~1731682787599~vir~new~lva~1731682782071~vpv~0~v11.cs~449044~v11.s~40a67cf0-a362-11ef-b6a0-93046c348906~v11.sla~1731682787611~lcw~1731682787611
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mon HTTP/1.1Host: obseu.ytwohlcq.telerik.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1; gauuid=d2144829-e324-4fbe-8dab-96fd3d3ecb59; _gcl_au=1.1.816168706.1731682775; _cq_duid=1.1731682777.ns9ymyf7k6usbTXX; _cq_suid=1.1731682777.eziSzDGYZbIOehGF; _ga=GA1.1.146950673.1731682778; _hjSessionUser_66905=eyJpZCI6ImU3ZDdjYjk4LTMzYTgtNWVlNC04OTU1LTYwM2E4MzBlNjZjNyIsImNyZWF0ZWQiOjE3MzE2ODI3Nzk3MTcsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_66905=eyJpZCI6ImFhMmJkODYyLWM1NWQtNDgyZi04OWE2LTY0MDZlYjNjNzQ2NCIsImMiOjE3MzE2ODI3Nzk3MjEsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; cg_uuid=6a821068a0581a1468e269f186887e5d; _cq_pxg=3\|a0547055754154\|975652292\|event=conversion; _ga_9JSNBCSF54=GS1.1.1731682777.1.0.1731682780.57.0.0; cebs=1; _ce.clock_data=-569%2C173.254.250.89%2C1%2C22210ca73bf1af2ec2eace74a96ee356%2CChrome%2CUS; _CEFT=Q%3D%3D%3D; cebsp_=1; _fbp=fb.1.1731682786412.73675803251272972; _clsk=i0jyvx%7C1731682787942%7C1%7C1%7Cb.clarity.ms%2Fcollect; _ce.s=v~e7595a9f04b373fdca4209822be974887bb73f29~lcw~1731682791062~vir~new~lva~1731682782071~vpv~0~v11.cs~449044~v11.s~40a67cf0-a362-11ef-b6a0-93046c348906~v11.sla~1731682791078~gtrk.la~m3iv803u~lcw~1731682791078
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mon HTTP/1.1Host: obseu.ytwohlcq.telerik.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1; gauuid=d2144829-e324-4fbe-8dab-96fd3d3ecb59; _gcl_au=1.1.816168706.1731682775; _cq_duid=1.1731682777.ns9ymyf7k6usbTXX; _cq_suid=1.1731682777.eziSzDGYZbIOehGF; _ga=GA1.1.146950673.1731682778; _hjSessionUser_66905=eyJpZCI6ImU3ZDdjYjk4LTMzYTgtNWVlNC04OTU1LTYwM2E4MzBlNjZjNyIsImNyZWF0ZWQiOjE3MzE2ODI3Nzk3MTcsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_66905=eyJpZCI6ImFhMmJkODYyLWM1NWQtNDgyZi04OWE2LTY0MDZlYjNjNzQ2NCIsImMiOjE3MzE2ODI3Nzk3MjEsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; cg_uuid=6a821068a0581a1468e269f186887e5d; _cq_pxg=3\|a0547055754154\|975652292\|event=conversion; _ga_9JSNBCSF54=GS1.1.1731682777.1.0.1731682780.57.0.0; cebs=1; _ce.clock_data=-569%2C173.254.250.89%2C1%2C22210ca73bf1af2ec2eace74a96ee356%2CChrome%2CUS; _CEFT=Q%3D%3D%3D; cebsp_=1; _fbp=fb.1.1731682786412.73675803251272972; _clsk=i0jyvx%7C1731682787942%7C1%7C1%7Cb.clarity.ms%2Fcollect; _ce.s=v~e7595a9f04b373fdca4209822be974887bb73f29~lcw~1731682796813~vir~new~lva~1731682782071~vpv~0~v11.cs~449044~v11.s~40a67cf0-a362-11ef-b6a0-93046c348906~v11.sla~1731682796828~gtrk.la~m3iv803u~lcw~1731682796828
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3cCfEDfTkrdh+vP&MD=KKfBweXO HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mon HTTP/1.1Host: obseu.ytwohlcq.telerik.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1; gauuid=d2144829-e324-4fbe-8dab-96fd3d3ecb59; _gcl_au=1.1.816168706.1731682775; _cq_duid=1.1731682777.ns9ymyf7k6usbTXX; _cq_suid=1.1731682777.eziSzDGYZbIOehGF; _ga=GA1.1.146950673.1731682778; _hjSessionUser_66905=eyJpZCI6ImU3ZDdjYjk4LTMzYTgtNWVlNC04OTU1LTYwM2E4MzBlNjZjNyIsImNyZWF0ZWQiOjE3MzE2ODI3Nzk3MTcsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_66905=eyJpZCI6ImFhMmJkODYyLWM1NWQtNDgyZi04OWE2LTY0MDZlYjNjNzQ2NCIsImMiOjE3MzE2ODI3Nzk3MjEsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; cg_uuid=6a821068a0581a1468e269f186887e5d; _cq_pxg=3\|a0547055754154\|975652292\|event=conversion; _ga_9JSNBCSF54=GS1.1.1731682777.1.0.1731682780.57.0.0; cebs=1; _ce.clock_data=-569%2C173.254.250.89%2C1%2C22210ca73bf1af2ec2eace74a96ee356%2CChrome%2CUS; _CEFT=Q%3D%3D%3D; cebsp_=1; _fbp=fb.1.1731682786412.73675803251272972; _clsk=i0jyvx%7C1731682787942%7C1%7C1%7Cb.clarity.ms%2Fcollect; _ce.s=v~e7595a9f04b373fdca4209822be974887bb73f29~lcw~1731682811944~vir~new~lva~1731682782071~vpv~0~v11.cs~449044~v11.s~40a67cf0-a362-11ef-b6a0-93046c348906~v11.sla~1731682811979~gtrk.la~m3iv8gso~lcw~1731682811980
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mon HTTP/1.1Host: obseu.ytwohlcq.telerik.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1; gauuid=d2144829-e324-4fbe-8dab-96fd3d3ecb59; _gcl_au=1.1.816168706.1731682775; _cq_duid=1.1731682777.ns9ymyf7k6usbTXX; _cq_suid=1.1731682777.eziSzDGYZbIOehGF; _ga=GA1.1.146950673.1731682778; _hjSessionUser_66905=eyJpZCI6ImU3ZDdjYjk4LTMzYTgtNWVlNC04OTU1LTYwM2E4MzBlNjZjNyIsImNyZWF0ZWQiOjE3MzE2ODI3Nzk3MTcsImV4aXN0aW5nIjpmYWxzZX0=; _hjSession_66905=eyJpZCI6ImFhMmJkODYyLWM1NWQtNDgyZi04OWE2LTY0MDZlYjNjNzQ2NCIsImMiOjE3MzE2ODI3Nzk3MjEsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; cg_uuid=6a821068a0581a1468e269f186887e5d; _cq_pxg=3\|a0547055754154\|975652292\|event=conversion; _ga_9JSNBCSF54=GS1.1.1731682777.1.0.1731682780.57.0.0; cebs=1; _ce.clock_data=-569%2C173.254.250.89%2C1%2C22210ca73bf1af2ec2eace74a96ee356%2CChrome%2CUS; _CEFT=Q%3D%3D%3D; cebsp_=1; _fbp=fb.1.1731682786412.73675803251272972; _clsk=i0jyvx%7C1731682787942%7C1%7C1%7Cb.clarity.ms%2Fcollect; _ce.s=v~e7595a9f04b373fdca4209822be974887bb73f29~lcw~1731682841924~vir~new~lva~1731682782071~vpv~0~v11.cs~449044~v11.s~40a67cf0-a362-11ef-b6a0-93046c348906~v11.sla~1731682841944~gtrk.la~m3iv9100~lcw~1731682841944
Source: global traffic	HTTP traffic detected: GET /r/?Fiddler2FirstRun HTTP/1.1Host: fiddler2.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /download/fiddler/first-run HTTP/1.1Host: www.telerik.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: chromecache_327.17.dr	String found in binary or memory: If you do not allow these cookies then some or all of these services may not function properly.","GroupNameMobile":"Functional Cookies","GroupNameOTT":"Functional Cookies","GroupName":"Functional Cookies","IsIabPurpose":false,"GeneralVendorsIds":[],"FirstPartyCookies":[{"id":"2fcfda82-c2f4-4ce5-968c-b7902eba8422","Name":"ki_u","Host":"www.telerik.com","IsSession":false,"Length":"1826","description":"These cookies are used to set surveys to collect feedback and/or to track engagement and activity.\n","thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":"Cookieki_u","DurationType":1,"category":null,"isThirdParty":false},{"id":"be4b481b-bdfb-49b6-8305-17fc90d45d20","Name":"liveagent_ptid","Host":"www.telerik.com","IsSession":false,"Length":"3653","description":"This cookie name is associated with technology from LiveAgent, which provides online chat and customer support functionality.","thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":"Cookieliveagent_ptid","DurationType":1,"category":null,"isThirdParty":false},{"id":"52299236-e183-4b3c-bd29-a16d3ee2eca3","Name":"liveagent_sid","Host":"www.telerik.com","IsSession":true,"Length":"0","description":"This cookie name is associated with technology from LiveAgent, which provides online chat and customer support functionality.","thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":"Cookieliveagent_sid","DurationType":1,"category":null,"isThirdParty":false},{"id":"f5a78ffb-1082-45a0-9c41-f6bea095ce7c","Name":"liveagent_oref","Host":"www.telerik.com","IsSession":false,"Length":"3653","description":"This cookie name is associated with technology from LiveAgent, which provides online chat and customer support functionality.","thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":"Cookieliveagent_oref","DurationType":1,"category":null,"isThirdParty":false},{"id":"3b63a8fb-54d4-4fc5-96f2-bb0c4021acec","Name":"liveagent_vc","Host":"www.telerik.com","IsSession":false,"Length":"3653","description":"This cookie name is associated with technology from LiveAgent, which provides online chat and customer support functionality.","thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":"Cookieliveagent_vc","DurationType":1,"category":null,"isThirdParty":false},{"id":"fc68cb2d-cd5f-4de2-846a-44ee9e3efbcb","Name":"Telerik.Web.UI.DeviceInfoCookie","Host":"demos.telerik.com","IsSession":false,"Length":"3650","description":"","thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":null,"DurationType":1,"category":null,"isThirdParty":false}],"Hosts":[{"HostName":"youtube.com","DisplayName":"youtube.com","HostId":"H5","Description":"","PrivacyPolicy":"","Cookies":[{"id":"c6310d4f-8044-4503-b3ef-9aa0b70cd827","Name":"VISITOR_INFO1_LIVE","Host":"youtube.com","IsSession":false,"Length":"180","description":"This cookie is used as a unique identifier to track viewing of
Source: chromecache_318.17.dr	String found in binary or memory: Math.round(q);t["gtm.videoElapsedTime"]=Math.round(f);t["gtm.videoPercent"]=r;t["gtm.videoVisible"]=u;return t},yk:function(){e=qb()},zd:function(){d()}}};var Zb=wa(["data-gtm-yt-inspected-"]),AD=["www.youtube.com","www.youtube-nocookie.com"],BD,CD=!1; equals www.youtube.com (Youtube)
Source: chromecache_327.17.dr	String found in binary or memory: Sales Force uses these cookies to be able to provide live chat functionality to the user.","thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":"CookieX-Salesforce-CHAT","DurationType":1,"category":null,"isThirdParty":false}]},{"HostName":"accounts.google.com","DisplayName":"accounts.google.com","HostId":"H420","Description":"","PrivacyPolicy":"","Cookies":[{"id":"3dd555f6-3504-49d3-9684-27d9b287e378","Name":"__Host-GAPS","Host":"accounts.google.com","IsSession":false,"Length":"730","description":"This domain is owned by Google. The main business activity is: User Accounts sub-domain. Cookies in this domain have lifespans between 1 month to 2 years.","thirdPartyDescription":"This domain is owned by Google. The main business activity is: User Accounts sub-domain. Cookies in this domain have lifespans between 1 month to 2 years.","patternKey":null,"thirdPartyKey":"Cookie\|accounts.google.com","firstPartyKey":null,"DurationType":1,"category":null,"isThirdParty":false}]},{"HostName":"stackblitz.com","DisplayName":"stackblitz.com","HostId":"H211","Description":"","PrivacyPolicy":"","Cookies":[{"id":"32977556-3784-4f2c-a65f-dfb187cd24e0","Name":"_session_id","Host":"stackblitz.com","IsSession":true,"Length":"0","description":"This cookie creates an interim session ID used as an in-session user ID.\n","thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":"Cookie_session_id","DurationType":1,"category":null,"isThirdParty":false},{"id":"64235104-de6f-4447-b04c-5fd2c54cbc1a","Name":"guest_id","Host":"stackblitz.com","IsSession":false,"Length":"7305","description":"This cookie is set by Twitter to identify and track the website visitor. ","thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":"Cookieguest_id","DurationType":1,"category":null,"isThirdParty":false}]},{"HostName":"service.force.com","DisplayName":"service.force.com","HostId":"H321","Description":"","PrivacyPolicy":"","Cookies":[{"id":"cfcc5023-5133-4015-bea8-88868ecf0b7c","Name":"LSKey-c$CookieConsentPolicy","Host":"service.force.com","IsSession":false,"Length":"364","description":"","thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":null,"DurationType":1,"category":null,"isThirdParty":false}]},{"HostName":"force.com","DisplayName":"force.com","HostId":"H183","Description":"","PrivacyPolicy":"","Cookies":[{"id":"6c5cc0b0-fafc-4b39-bdb8-a7d06d227c24","Name":"BrowserId_sec","Host":"force.com","IsSession":false,"Length":"365","description":"Used to log secure browser sessions/visits for internal-only product analytics.","thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":"CookieBrowserId_sec","DurationType":1,"category":null,"isThirdParty":false}]},{"HostName":"www.recaptcha.net","DisplayName":"www.recaptcha.net","HostId":"H288","Description":"","PrivacyPolicy":"","Cookies":[{"id":"f2eda266-e516-43f0-8952-62a866964cea","Name":"_GRECAPTCHA","Host":"www.rec
Source: chromecache_318.17.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=gB(a,c,e);V(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return V(122),!0;if(d&&f){for(var m=Bb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},jB=function(){var a=[],b=function(c){return eb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_318.17.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={Ah:e,yh:f,zh:g,ii:k,ji:m,Qe:n,Ib:b},q=B.YT;if(q)return q.ready&&q.ready(d),b;var r=B.onYouTubeIframeAPIReady;B.onYouTubeIframeAPIReady=function(){r&&r();d()};F(function(){for(var u=E.getElementsByTagName("script"),v=u.length,t=0;t<v;t++){var w=u[t].getAttribute("src");if(LD(w,"iframe_api")\|\|LD(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!CD&&JD(x[A],p.Qe))return qc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_344.17.dr, chromecache_326.17.dr	String found in binary or memory: return b}yD.F="internal.enableAutoEventOnTimer";var Zb=wa(["data-gtm-yt-inspected-"]),AD=["www.youtube.com","www.youtube-nocookie.com"],BD,CD=!1; equals www.youtube.com (Youtube)
Source: chromecache_303.17.dr	String found in binary or memory: return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var b=f.getFbeventsModules("signalsFBEventsGetTier"),c=d();function d(){try{if(a.trustedTypes&&a.trustedTypes.createPolicy){var b=a.trustedTypes;return b.createPolicy("facebook.com/signals/iwl",{createScriptURL:function(a){var b=new URL(a);b=b.hostname.endsWith(".facebook.com")&&b.pathname=="/signals/iwl.js";if(!b)throw new Error("Disallowed script URL");return a}})}}catch(a){}return null}e.exports=function(a,d){d=b(d);d=d==null?"www.facebook.com":"www."+d+".facebook.com";d="https://"+d+"/signals/iwl.js?pixel_id="+a;if(c!=null)return c.createScriptURL(d);else return d}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_303.17.dr	String found in binary or memory: return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_303.17.dr	String found in binary or memory: return function(f,g,h,i){var j={exports:{}};j.exports;(function(){"use strict";var a={ENDPOINT:"https://www.facebook.com/tr/",INSTAGRAM_TRIGGER_ATTRIBUTION:"https://www.instagram.com/tr/",AEM_ENDPOINT:"https://www.facebook.com/.well-known/aggregated-event-measurement/",GPS_ENDPOINT:"https://www.facebook.com/privacy_sandbox/pixel/register/trigger/",TOPICS_API_ENDPOINT:"https://www.facebook.com/privacy_sandbox/topics/registration/"};j.exports=a})();return j.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_318.17.dr	String found in binary or memory: var NC=function(a,b,c,d,e){var f=EA("fsl",c?"nv.mwt":"mwt",0),g;g=c?EA("fsl","nv.ids",[]):EA("fsl","ids",[]);if(!g.length)return!0;var k=JA(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);V(121);if(m==="https://www.facebook.com/tr/")return V(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!qz(k,sz(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: fiddler2.com
Source: global traffic	DNS traffic detected: DNS query: www.telerik.com
Source: global traffic	DNS traffic detected: DNS query: dtzbdy9anri2p.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: d6vtbcy3ong79.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.cookielaw.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdn.insight.sitefinity.com
Source: global traffic	DNS traffic detected: DNS query: d585tldpucybw.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: geolocation.onetrust.com
Source: global traffic	DNS traffic detected: DNS query: s1325.t.eloqua.com
Source: global traffic	DNS traffic detected: DNS query: api.insight.sitefinity.com
Source: global traffic	DNS traffic detected: DNS query: euob.ytwohlcq.telerik.com
Source: global traffic	DNS traffic detected: DNS query: static.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: unpkg.com
Source: global traffic	DNS traffic detected: DNS query: img.en25.com
Source: global traffic	DNS traffic detected: DNS query: static.ads-twitter.com
Source: global traffic	DNS traffic detected: DNS query: snap.licdn.com
Source: global traffic	DNS traffic detected: DNS query: a.quora.com
Source: global traffic	DNS traffic detected: DNS query: script.crazyegg.com
Source: global traffic	DNS traffic detected: DNS query: rum-static.pingdom.net
Source: global traffic	DNS traffic detected: DNS query: www.clickcease.com
Source: global traffic	DNS traffic detected: DNS query: px.ads.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: q.quora.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: script.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: rum-collector-2.pingdom.net
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: cl.qualaroo.com
Source: global traffic	DNS traffic detected: DNS query: obseu.ytwohlcq.telerik.com
Source: global traffic	DNS traffic detected: DNS query: t.co
Source: global traffic	DNS traffic detected: DNS query: analytics.twitter.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: geo.qualaroo.com
Source: global traffic	DNS traffic detected: DNS query: dntcl.qualaroo.com
Source: global traffic	DNS traffic detected: DNS query: www.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: tracking.crazyegg.com
Source: global traffic	DNS traffic detected: DNS query: pagestates-tracking.crazyegg.com
Source: global traffic	DNS traffic detected: DNS query: assets-tracking.crazyegg.com
Source: global traffic	DNS traffic detected: DNS query: www.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: c.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: b.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com

Source: unknown

HTTP traffic detected: POST /collect/v2/data-centers/76766c2b-82f4-2453-81e5-fd840f3b455b/datasources/TelerikCom/interactions HTTP/1.1Host: api.insight.sitefinity.comConnection: keep-aliveContent-Length: 1895sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-Type: application/jsonx-dataintelligence-sdk-version: js-3.1.41sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.telerik.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.telerik.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 15 Nov 2024 14:59:39 GMTContent-Type: text/html; charset=utf-8Content-Length: 235Connection: closeAccess-Control-Allow-Headers: Content-Type, Content-Length, X-Requested-With, Authorization, x-dataintelligence-accountkey, x-dataintelligence-datacenterkey, x-dataintelligence-datasource, x-dataintelligence-sort, x-dataintelligence-skip, x-dataintelligence-take, x-dataintelligence-fields, x-dataintelligence-count, x-dataintelligence-filterby, x-dataintelligence-filter, x-dataintelligence-contains, x-dataintelligence-nextrowkey, x-dataintelligence-flush, x-dataintelligence-fromdate, x-dataintelligence-todate, x-dataintelligence-period, x-dataintelligence-scale, x-dataintelligence-predicate, x-dataintelligence-subject, x-dataintelligence-ids, x-dataintelligence-datasources, x-dataintelligence-imagecrop, x-dataintelligence-contacts, x-forwarded-for, x-dataintelligence-sdk-version, Referer, Origin, x-dataintelligence-clientid, x-dataintelligence-campaignids, x-dataintelligence-userid, x-dataintelligence-errorid, x-dataintelligence-correlationid, cf-connecting-ip, x-forwarded-for, http_x_forwarded_for, x-forwarded, x-cluster-client-ip, forwarded-for, forwarded, remote_addr, client-ipAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONSAccess-Control-Allow-Origin: *request-context: appId=cid-v1:a33f2e3a-ec15-4d53-8ac6-897af884626bContent-Security-Policy: default-src 'none'X-Content-Type-Options: nosniffStrict-Transport-Security: max-age=31536000

Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Telerik.NetworkConnections.Windows.dll.1.dr, Telerik.NetworkConnections.dll.1.dr	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, BasicFormats.dll.1.dr	String found in binary or memory: http://bayden.com/meddler/
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, SimpleFilter.dll.1.dr	String found in binary or memory: http://bit.ly/29O65sI
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, SimpleFilter.dll.1.dr	String found in binary or memory: http://bit.ly/29VDtCe
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blogs.msdn.com/b/fiddler/archive/2011/11/05/http-expect-continue-delays-transmitting-post-bod
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Standard.dll.1.dr	String found in binary or memory: http://blogs.msdn.com/ieinternals/archive/2009/07/20/Using-post_2D00_check-and-pre_2D00_check-cache-
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://browserscope2.org/browse?category=selectors&ua=Mobile%20Safari
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, JXR2PNG.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, JXR2PNG.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, JXR2PNG.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://commons.apache.org/proper/commons-compress/
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Analytics.dll0.1.dr, Telerik.NetworkConnections.dll.1.dr	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Analytics.dll0.1.dr, Telerik.NetworkConnections.dll.1.dr	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: FiddlerSetup.5.0.20245.10105-latest.exe, FiddlerOrchestra.Protocol.dll.1.dr, uninst.exe.1.dr, Standard.dll.1.dr, Fiddler.exe.1.dr, SyntaxView.dll.1.dr, TrustCert.exe.1.dr, PngDistill.exe.1.dr, SimpleFilter.dll.1.dr, FiddlerSetup.exe.0.dr, VSWebTestExport.dll.1.dr, BasicFormats.dll.1.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, GA.Analytics.Monitor.dll.1.dr, Zopfli.exe.1.dr, GA.Analytics.Monitor.dll0.1.dr, Be.Windows.Forms.HexBox.dll.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Analytics.dll0.1.dr, Telerik.NetworkConnections.dll.1.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, JXR2PNG.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, JXR2PNG.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, JXR2PNG.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, JXR2PNG.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, JXR2PNG.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, JXR2PNG.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, JXR2PNG.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, JXR2PNG.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0B
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, BasicFormats.dll.1.dr	String found in binary or memory: http://curl.haxx.se/
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, BasicFormats.dll.1.dr	String found in binary or memory: http://curl.haxx.se/S
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, BasicFormats.dll.1.dr	String found in binary or memory: http://diveintohtml5.info/offline.html
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, BasicFormats.dll.1.dr	String found in binary or memory: http://diveintohtml5.info/offline.htmlO
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.telerik.com/fiddler/configure-fiddler/tasks/configurefiddlerURLUpdateInfohttp://www.tele
Source: System.Data.SqlXml.dll.45.dr, System.Data.SqlXml.dll.19.dr	String found in binary or memory: http://exslt.org/common
Source: Fiddler.exe.1.dr	String found in binary or memory: http://fiddler.wikidot.com/prefs
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiddler2.com/
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiddler2.com/fiddlercore
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiddler2.com/r/?Fiddler2FirstRun
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiddler2.com/r/?Fiddler2FirstRun.
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiddler2.com/r/?Fiddler2FirstRun1003
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.0000000000881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiddler2.com/r/?Fiddler2FirstRun=
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.0000000000813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiddler2.com/r/?Fiddler2FirstRun_
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiddler2.com/r/?Fiddler2FirstRuna
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.0000000000881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiddler2.com/r/?Fiddler2FirstRuni
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.0000000000881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiddler2.com/r/?Fiddler2FirstRunn
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiddler2.com/r/?Fiddler2FirstRunopenDetectedBrowsererrorShellExecExhttp://fiddler2.com/r/?Fid
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.0000000000881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiddler2.com/r/?Fiddler2FirstRuny
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiddler2.com/r/?FiddlerSandboxSOFTWARE
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiddler2.com/r/?SYNTAXVIEWINSTALL
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiddler2.com/r/?fiddlercolumns
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiddler2.com/r/?fiddlerscriptcookbook
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiddler2.com/r/?id=bitness
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiddler2.com/r/?id=bitness)
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiddler2.com/r/?msdnjsnet
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiddler2.com/r/?quickexec
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, license.txt.1.dr	String found in binary or memory: http://getfiddler.com/
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, BasicFormats.dll.1.dr	String found in binary or memory: http://groups.google.com/group/http-archive-specification
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, BasicFormats.dll.1.dr	String found in binary or memory: http://groups.google.com/group/http-archive-specification/
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: FiddlerSetup.5.0.20245.10105-latest.exe, uninst.exe.1.dr, FiddlerSetup.exe.0.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, credits.txt.1.dr	String found in binary or memory: http://nsis.sourceforge.net/Main_Page
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, JXR2PNG.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, JXR2PNG.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, JXR2PNG.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr, Analytics.dll0.1.dr	String found in binary or memory: http://ocsp.entrust.net01
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Analytics.dll0.1.dr, Telerik.NetworkConnections.dll.1.dr	String found in binary or memory: http://ocsp.entrust.net02
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Telerik.NetworkConnections.Windows.dll.1.dr, Telerik.NetworkConnections.dll.1.dr	String found in binary or memory: http://ocsp.entrust.net03
Source: FiddlerSetup.5.0.20245.10105-latest.exe, FiddlerOrchestra.Protocol.dll.1.dr, uninst.exe.1.dr, Standard.dll.1.dr, Fiddler.exe.1.dr, SyntaxView.dll.1.dr, TrustCert.exe.1.dr, PngDistill.exe.1.dr, SimpleFilter.dll.1.dr, FiddlerSetup.exe.0.dr, VSWebTestExport.dll.1.dr, BasicFormats.dll.1.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, GA.Analytics.Monitor.dll.1.dr, Zopfli.exe.1.dr, GA.Analytics.Monitor.dll0.1.dr, Be.Windows.Forms.HexBox.dll.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Analytics.dll0.1.dr, Telerik.NetworkConnections.dll.1.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr, Analytics.dll0.1.dr	String found in binary or memory: http://rb.symcb.com/rb.crl0a
Source: GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr, Analytics.dll0.1.dr	String found in binary or memory: http://rb.symcb.com/rb.crt0
Source: GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr, Analytics.dll0.1.dr	String found in binary or memory: http://rb.symcd.com0&
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, GA.Analytics.Monitor.dll.1.dr, Zopfli.exe.1.dr, GA.Analytics.Monitor.dll0.1.dr, Be.Windows.Forms.HexBox.dll.1.dr, Analytics.dll0.1.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr, Analytics.dll0.1.dr	String found in binary or memory: http://s.symcd.com0
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Zopfli.exe.1.dr, Be.Windows.Forms.HexBox.dll.1.dr	String found in binary or memory: http://s.symcd.com06
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Zopfli.exe.1.dr, Be.Windows.Forms.HexBox.dll.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Telerik.NetworkConnections.dll.1.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Zopfli.exe.1.dr, Be.Windows.Forms.HexBox.dll.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Telerik.NetworkConnections.dll.1.dr	String found in binary or memory: http://s2.symcb.com0
Source: System.Runtime.Serialization.Formatters.Soap.dll.49.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: FiddlerSetup.5.0.20245.10105-latest.exe, FiddlerOrchestra.Protocol.dll.1.dr, uninst.exe.1.dr, Standard.dll.1.dr, Fiddler.exe.1.dr, SyntaxView.dll.1.dr, TrustCert.exe.1.dr, PngDistill.exe.1.dr, SimpleFilter.dll.1.dr, FiddlerSetup.exe.0.dr, VSWebTestExport.dll.1.dr, BasicFormats.dll.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, Standard.dll.1.dr, credits.txt.1.dr	String found in binary or memory: http://sourceforge.net/projects/hexbox/
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Zopfli.exe.1.dr, Be.Windows.Forms.HexBox.dll.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Telerik.NetworkConnections.dll.1.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Zopfli.exe.1.dr, Be.Windows.Forms.HexBox.dll.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Telerik.NetworkConnections.dll.1.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Zopfli.exe.1.dr, Be.Windows.Forms.HexBox.dll.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Telerik.NetworkConnections.dll.1.dr	String found in binary or memory: http://sv.symcd.com0&
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Zopfli.exe.1.dr, Be.Windows.Forms.HexBox.dll.1.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, GA.Analytics.Monitor.dll.1.dr, Zopfli.exe.1.dr, GA.Analytics.Monitor.dll0.1.dr, Be.Windows.Forms.HexBox.dll.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Analytics.dll0.1.dr, Telerik.NetworkConnections.dll.1.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Zopfli.exe.1.dr, Be.Windows.Forms.HexBox.dll.1.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, GA.Analytics.Monitor.dll.1.dr, Zopfli.exe.1.dr, GA.Analytics.Monitor.dll0.1.dr, Be.Windows.Forms.HexBox.dll.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Analytics.dll0.1.dr, Telerik.NetworkConnections.dll.1.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, GA.Analytics.Monitor.dll.1.dr, Zopfli.exe.1.dr, GA.Analytics.Monitor.dll0.1.dr, Be.Windows.Forms.HexBox.dll.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Analytics.dll0.1.dr, Telerik.NetworkConnections.dll.1.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Zopfli.exe.1.dr, Be.Windows.Forms.HexBox.dll.1.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.URLtoDownloadFrom.net
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, Zopfli.exe.1.dr, credits.txt.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bouncycastle.org)
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.businessobjects.com/products/dev_zone/net/default.asp
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bzip.org/
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.codeplex.com/DotNetZip
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.contoso.com/
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.contoso.com/books.xml
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, JXR2PNG.exe.1.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Analytics.dll0.1.dr, Telerik.NetworkConnections.dll.1.dr	String found in binary or memory: http://www.entrust.net/rpa0
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Analytics.dll0.1.dr, Telerik.NetworkConnections.dll.1.dr	String found in binary or memory: http://www.entrust.net/rpa03
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, credits.txt.1.dr	String found in binary or memory: http://www.fatcow.com/free-icons
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, 307_RedirectWithMethod.dat.1.dr	String found in binary or memory: http://www.fiddler2.com/sandbox/FormAndCookie.asp
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Standard.dll.1.dr	String found in binary or memory: http://www.fiddlerbook.com/fiddler/help/http/headers.asp?query=
Source: FSE2.exe.1.dr	String found in binary or memory: http://www.fiddlertool.com/fiddler/dev/scriptsamples.asp
Source: GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr	String found in binary or memory: http://www.google-analytics.com/collect
Source: GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr	String found in binary or memory: http://www.google-analytics.com/debug/collect
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/bot.html)
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/search?hl=en&btnI=I%27m
Source: Fiddler.exe.1.dr	String found in binary or memory: http://www.host.com/filepath?query.
Source: Fiddler.exe.1.dr	String found in binary or memory: http://www.host.com/filepath?query.v
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, BasicFormats.dll.1.dr	String found in binary or memory: http://www.iis.net/community/Performance
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, credits.txt.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.000000000293C000.00000004.00000020.00020000.00000000.sdmp, QWhale.Common.dll.1.dr, QWhale.Common.dll1.1.dr	String found in binary or memory: http://www.qwhale.net
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, credits.txt.1.dr	String found in binary or memory: http://www.qwhale.net/products/editor.htm
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.someserver.com/upload.aspx
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Zopfli.exe.1.dr, Be.Windows.Forms.HexBox.dll.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Telerik.NetworkConnections.dll.1.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Zopfli.exe.1.dr, Be.Windows.Forms.HexBox.dll.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Telerik.NetworkConnections.dll.1.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: FiddlerSetup.5.0.20245.10105-latest.exe, uninst.exe.1.dr, FiddlerSetup.exe.0.dr	String found in binary or memory: http://www.telerik.com/fiddler
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Telerik.NetworkConnections.Windows.dll.1.dr, Telerik.NetworkConnections.dll.1.dr	String found in binary or memory: http://www.telerik.com/fiddler/fiddlercore0
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Be.Windows.Forms.HexBox.dll.1.dr	String found in binary or memory: http://www.telerik.com/fiddler0
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp, FiddlerSetup.exe, 00000001.00000002.3310445767.000000000019A000.00000004.00000010.00020000.00000000.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, license.txt.1.dr	String found in binary or memory: http://www.telerik.com/purchase/fiddler
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp, FiddlerSetup.exe, 00000001.00000002.3310445767.000000000019A000.00000004.00000010.00020000.00000000.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, license.txt.1.dr	String found in binary or memory: http://www.telerik.com/purchase/license-agreement/fiddler-enterprise-support
Source: GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr, Analytics.dll0.1.dr	String found in binary or memory: http://www.telerik.com0
Source: System.Deployment.dll.22.dr	String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2core
Source: chromecache_326.17.dr	String found in binary or memory: https://a.quora.com/qevents.js
Source: chromecache_326.17.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: SimpleFilter.dll.1.dr	String found in binary or memory: https://api.getfiddler.com/r/?FiddlerLog
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.getfiddler.com/r/?FiddlerOrchestra/Clients/FiddlerOrchestra.Client.Android.apk
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.getfiddler.com/r/?FiddlerOrchestra/Clients/FiddlerOrchestra.Client.Android.apk%BtnToogle
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.getfiddler.com/r/?FiddlerOrchestra/Clients/FiddlerOrchestra.Client.NetCore.WindowsMacLin
Source: FSE2.exe.1.dr	String found in binary or memory: https://api.getfiddler.com/r/?SCRIPTFORUM
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.getfiddler.com/r/?WIN8ELo
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, BasicFormats.dll.1.dr	String found in binary or memory: https://api.getfiddler.com/r/?fiddler
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.getfiddler.com/r/?fiddlercolumns
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.getfiddler.com/r/?fiddlercore
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.getfiddler.com/r/?quickexec
Source: chromecache_318.17.dr, chromecache_344.17.dr, chromecache_326.17.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_279.17.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/googleData.json
Source: chromecache_279.17.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iab2Data.json
Source: chromecache_279.17.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iab2V2Data.json
Source: chromecache_279.17.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iabData.json
Source: chromecache_303.17.dr	String found in binary or memory: https://connect.facebook.net/
Source: chromecache_303.17.dr	String found in binary or memory: https://connect.facebook.net/log/fbevents_telemetry/
Source: chromecache_279.17.dr	String found in binary or memory: https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, GA.Analytics.Monitor.dll.1.dr, Zopfli.exe.1.dr, GA.Analytics.Monitor.dll0.1.dr, Be.Windows.Forms.HexBox.dll.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Analytics.dll0.1.dr, Telerik.NetworkConnections.dll.1.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: Be.Windows.Forms.HexBox.dll.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Analytics.dll0.1.dr, Telerik.NetworkConnections.dll.1.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Zopfli.exe.1.dr, Be.Windows.Forms.HexBox.dll.1.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr, Analytics.dll0.1.dr	String found in binary or memory: https://d.symcb.com/rpa06
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fiddler2.com/r/?GetDotNet4Compatible
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fiddler2.com/r/?GetDotNet4open
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, credits.txt.1.dr	String found in binary or memory: https://fiddler2.com/r/?credits
Source: chromecache_279.17.dr	String found in binary or memory: https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Zopfli.exe.1.dr	String found in binary or memory: https://github.com/google/zopfli/commit/720b20e8db19ea90b38edce82aca52815edf8c1a
Source: Zopfli.exe.1.dr	String found in binary or memory: https://github.com/google/zopfli0
Source: chromecache_326.17.dr	String found in binary or memory: https://github.com/krux/postscribe/blob/master/LICENSE.
Source: chromecache_309.17.dr, chromecache_332.17.dr	String found in binary or memory: https://github.com/microsoft/clarity
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ymnk/jzlib
Source: chromecache_326.17.dr	String found in binary or memory: https://google.com
Source: chromecache_326.17.dr	String found in binary or memory: https://googleads.g.doubleclick.net
Source: chromecache_326.17.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_318.17.dr, chromecache_344.17.dr, chromecache_326.17.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_326.17.dr	String found in binary or memory: https://q.quora.com/_/ad/
Source: chromecache_326.17.dr	String found in binary or memory: https://script.crazyegg.com/pages/scripts/
Source: chromecache_326.17.dr	String found in binary or memory: https://snap.licdn.com/li.lms-analytics/insight.min.js
Source: GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr	String found in binary or memory: https://ssl.google-analytics.com/collect
Source: GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr	String found in binary or memory: https://ssl.google-analytics.com/debug/collect
Source: chromecache_326.17.dr	String found in binary or memory: https://static.ads-twitter.com/uwt.js
Source: chromecache_326.17.dr	String found in binary or memory: https://static.hotjar.com/c/hotjar-
Source: chromecache_318.17.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_318.17.dr, chromecache_344.17.dr, chromecache_326.17.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_326.17.dr	String found in binary or memory: https://unpkg.com/web-vitals/dist/web-vitals.iife.js
Source: chromecache_317.17.dr	String found in binary or memory: https://www.clarity.ms/tag/uet/
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, JXR2PNG.exe.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: FiddlerSetup.5.0.20245.10105-latest.exe, FiddlerOrchestra.Protocol.dll.1.dr, uninst.exe.1.dr, Standard.dll.1.dr, Fiddler.exe.1.dr, SyntaxView.dll.1.dr, TrustCert.exe.1.dr, PngDistill.exe.1.dr, SimpleFilter.dll.1.dr, FiddlerSetup.exe.0.dr, VSWebTestExport.dll.1.dr, BasicFormats.dll.1.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: chromecache_326.17.dr	String found in binary or memory: https://www.google.com
Source: chromecache_326.17.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_326.17.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_318.17.dr, chromecache_344.17.dr, chromecache_326.17.dr	String found in binary or memory: https://www.googletagmanager.com/a?
Source: chromecache_318.17.dr, chromecache_344.17.dr, chromecache_326.17.dr	String found in binary or memory: https://www.googletagmanager.com/static/service_worker/
Source: chromecache_318.17.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, credits.txt.1.dr	String found in binary or memory: https://www.nuget.org/packages/DotNetZip/
Source: chromecache_327.17.dr	String found in binary or memory: https://www.progress.com/legal/cookie-policy
Source: chromecache_327.17.dr	String found in binary or memory: https://www.progress.com/legal/privacy-center
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, license.txt.1.dr	String found in binary or memory: https://www.progress.com/legal/privacy-policy).
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.telerik.com/blogs/a-brief-user-guide-on-fiddler-orchestra?utm_medium=product&utm_source=
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.telerik.com/blogs/fiddlercore-for-net-standard-and-fiddler-orchestra-the-future-of-fiddl
Source: FiddlerSetup.5.0.20245.10105-latest.exe, FiddlerOrchestra.Protocol.dll.1.dr, uninst.exe.1.dr, Standard.dll.1.dr, Fiddler.exe.1.dr, SyntaxView.dll.1.dr, TrustCert.exe.1.dr, PngDistill.exe.1.dr, SimpleFilter.dll.1.dr, FiddlerSetup.exe.0.dr, VSWebTestExport.dll.1.dr, BasicFormats.dll.1.dr	String found in binary or memory: https://www.telerik.com/fiddler0
Source: chromecache_318.17.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.5:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.5:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:50125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50142 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality for read data from the clipboard

Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe

Code function: 0_2_00405705 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405705

System Summary

Malicious sample detected (through community Yara rule)

Source: C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe, type: DROPPED

Matched rule: Detects zgRAT Author: ditekSHen

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Code function: 0_2_0040351C EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_0040351C
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Code function: 1_2_00403665 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		1_2_00403665

Creates files inside the system directory

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	File created: C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	File created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	File created: C:\Windows\Microsoft.NET\ngennicupdatelock.dat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	File created: C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	File created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	File created: C:\Windows\Microsoft.NET\ngennicupdatelock.dat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\78d6922d3a02a93359e189f060d76f47
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\78d6922d3a02a93359e189f060d76f47\System.Data.SqlXml.ni.dll.aux.tmp
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\bde2021ecdaa53585a395f095971633c
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\bde2021ecdaa53585a395f095971633c\System.Security.ni.dll.aux.tmp
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\4fa111e50d95d3e08c2d856a5394af3b
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\4fa111e50d95d3e08c2d856a5394af3b\System.Deployment.ni.dll.aux.tmp
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\f975db3abcedde8df2408b15e2c6dd09
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\f975db3abcedde8df2408b15e2c6dd09\System.Runtime.Serialization.Formatters.Soap.ni.dll.aux.tmp
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\8e9f4b8ba90f0dd7ead0f6d3724d12f0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\8e9f4b8ba90f0dd7ead0f6d3724d12f0\Microsoft.JScript.ni.dll.aux.tmp
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\0bc179a6f5376dabed45d64773e7a963
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\0bc179a6f5376dabed45d64773e7a963\System.Web.ni.dll.aux.tmp
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\cbb85b2c3ecfe129570a8c187041de31
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\cbb85b2c3ecfe129570a8c187041de31\System.EnterpriseServices.ni.dll.aux.tmp
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt19c51595#
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt19c51595#\b5d4608754b2d1d4f1d2d3c00cbcdfe0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt19c51595#\b5d4608754b2d1d4f1d2d3c00cbcdfe0\System.Runtime.Caching.ni.dll.aux.tmp
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\9c63130543c9d395491387159924bf83
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\9c63130543c9d395491387159924bf83\System.Web.RegularExpressions.ni.dll.aux.tmp
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Design
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Design\e6264fe3334740cf9e7da3afc7d524cc
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Design\e6264fe3334740cf9e7da3afc7d524cc\System.Design.ni.dll.aux.tmp
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\EnableLoopback
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\EnableLoopback\656decbd27699754c5f7dcdf8abebd4d
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\EnableLoopback\656decbd27699754c5f7dcdf8abebd4d\EnableLoopback.ni.exe.aux.tmp
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\78d6922d3a02a93359e189f060d76f47
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\78d6922d3a02a93359e189f060d76f47\System.Data.SqlXml.ni.dll.aux.tmp
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\bde2021ecdaa53585a395f095971633c
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\bde2021ecdaa53585a395f095971633c\System.Security.ni.dll.aux.tmp
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\ce1e4670373608336100bea63bbc8990
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\ce1e4670373608336100bea63bbc8990\System.Numerics.ni.dll.aux.tmp
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\4fa111e50d95d3e08c2d856a5394af3b
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\4fa111e50d95d3e08c2d856a5394af3b\System.Deployment.ni.dll.aux.tmp
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\ngenlock.dat
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\f975db3abcedde8df2408b15e2c6dd09
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\f975db3abcedde8df2408b15e2c6dd09\System.Runtime.Serialization.Formatters.Soap.ni.dll.aux.tmp

Deletes files inside the Windows folder

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

File deleted: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1e7c-0

Detected potential crypto function

Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Code function: 0_2_00406C5F	0_2_00406C5F
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Code function: 1_2_00406DC0	1_2_00406DC0
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Code function: 1_2_6E0E1BFF	1_2_6E0E1BFF

Uses 32bit PE files

Source: FiddlerSetup.5.0.20245.10105-latest.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Yara signature match

Source: C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe, type: DROPPED

Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: DotNetZip.dll.1.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformBlock'
Source: DotNetZip.dll.1.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: DotNetZip.dll.1.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'

Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QWhale.Syntax.Parsers.VbParser.resources
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Images.VbParser.bmp
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QWhale.Syntax.Parsers.VbParser
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QWhale.Syntax.Parsers.Images.VbParser.bmp

Source: classification engine

Classification label: mal44.troj.evad.winEXE@97/347@170/59

Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Code function: 0_2_0040351C EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_0040351C
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Code function: 1_2_00403665 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		1_2_00403665

Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe

Code function: 0_2_004049B1 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004049B1

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe

Code function: 1_2_6E0E2B98 CreateToolhelp32Snapshot,

1_2_6E0E2B98

Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe

Code function: 0_2_004021CF CoCreateInstance,

0_2_004021CF

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5352:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6192:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5428:120:WilError_03

Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe

File created: C:\Users\user\AppData\Local\Temp\nsqEDC4.tmp

Jump to behavior

Source: FiddlerSetup.5.0.20245.10105-latest.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe

File read: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe

Jump to behavior

Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	Section loaded: fusion.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	Section loaded: fusion.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Section loaded: wofutil.dll

Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Automated click: I Agree
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Automated click: Install

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Creates a software uninstall entry

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fiddler2

Jump to behavior

PE / OLE file has a valid certificate

Source: FiddlerSetup.5.0.20245.10105-latest.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: FiddlerSetup.5.0.20245.10105-latest.exe

Static file information: File size 4656360 > 1048576

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: FiddlerSetup.5.0.20245.10105-latest.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\src\GitHub\fiddler\Fiddler2\Common\ExecAction\v4\obj\x86\Release\ExecAction.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: -: Completederik Fiddler Classicp\nsu12C2.tmp\System.dll0, 0) .r9lerrt.pdb\..kConnections.Windows.dll\." action=allow profile=any dir=in edge=deferuser protocol=tcp description="Permit inbound connections to Fiddler" source: FiddlerSetup.exe, 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler\FiddlerOrchestra\FiddlerOrchestra.Addon\obj\Release\FiddlerOrchestra.Addon.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\BundledExtensions\RulesTab2\obj\Release Signed\RulesTab2.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Extract: SimpleFilter.pdb source: FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\BundledExtensions\SimpleFilter\obj\Release Signed\SimpleFilter.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, SimpleFilter.dll.1.dr
Source:	Binary string: Extract: FiddlerOrchestra.Addon.pdbk source: FiddlerSetup.exe, 00000001.00000002.3311319713.0000000000813000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Extract: Timeline.pdb source: FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Data.SqlXml.ni.pdb source: System.Data.SqlXml.dll.45.dr, System.Data.SqlXml.dll.19.dr
Source:	Binary string: \Analytics.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: System.Data.SqlXml.ni.pdbRSDS2 source: System.Data.SqlXml.dll.45.dr, System.Data.SqlXml.dll.19.dr
Source:	Binary string: C:\Jenkins\NetworkConnections_Release\workspace\src\Telerik.NetworkConnections\Telerik.NetworkConnections.Windows\obj\Release\net40\Telerik.NetworkConnections.Windows.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Telerik.NetworkConnections.Windows.dll.1.dr
Source:	Binary string: System.EnterpriseServices.Wrapper.ni.pdb source: System.EnterpriseServices.Wrapper.dll.26.dr
Source:	Binary string: System.Security.pdb source: System.Security.dll.46.dr
Source:	Binary string: \ScriptEditorFSE2.exe.configBasicFormats.dllBasicFormats.pdbVSWebTestExport.dllVSWebTestExport.pdbWarning: Failed to write one or more files. source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Jenkins\NetworkConnections_Release\workspace\src\Telerik.NetworkConnections\Telerik.NetworkConnections\obj\Release\net40\Telerik.NetworkConnections.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Telerik.NetworkConnections.dll.1.dr
Source:	Binary string: F:\Projects\Dot.NET\SVN\Editor.NET\source\obj\Release\QWhale.Syntax.Schemes.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002A5A000.00000004.00000020.00020000.00000000.sdmp, QWhale.Syntax.Schemes.dll.1.dr
Source:	Binary string: System.Runtime.Caching.pdb source: System.Runtime.Caching.dll.27.dr
Source:	Binary string: D:\telerik\fiddler\ThirdParty\zopfli\Release\Zopfli.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Zopfli.exe.1.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\Timeline.pdbg source: FiddlerSetup.exe, 00000001.00000002.3311319713.0000000000813000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: F:\Projects\Dot.NET\SVN\Editor.NET\source\obj\Release\QWhale.Syntax.Parsers.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Scripts\Timeline.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\GA.Analytics.Monitor.pdbl source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007A8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \ScriptEditor\GA.Analytics.Monitor.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: F:\Projects\Dot.NET\SVN\Editor.NET\source\obj\Release\QWhale.Syntax.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002A21000.00000004.00000020.00020000.00000000.sdmp, QWhale.Syntax.dll1.1.dr
Source:	Binary string: C:\JenkinsHome\jobs\AnalyticsReleaseBuild\workspace\Telerik.FJ.Analytics\JFAnalytics\obj\Release\Analytics.pdb source: Analytics.dll0.1.dr
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\BundledExtensions\PngDistill\obj\Release Signed\PngDistill.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, PngDistill.exe.1.dr
Source:	Binary string: ?\|<>/":%s%S.dllCallers\user\AppData\Local\Temp\nsu12C2.tmp\System.dllt\VSWebTestExport.pdb\.*.kConnections.Windows.dll\.C:\Users\user\AppData\Local\Temp\nsu12C2.tmp\System.dllr2SWebTestExport.pdbdlltworkConnections.Windows.dllFalsers\user\AppData\Local\Temp\nsu12C2.tmper/tasks/configurefiddlere"ppData\Local\Programs\Fiddler\Fiddler.exe" action=allow profile=any dir=in edge=deferuser protocol=tcp description="Permit inbound connections to Fiddler"Trueers\user\AppData\Local\Temp\nsu12C2.tmp\System.dllr\FSE2.exe source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp
Source:	Binary string: Extract: Analytics.pdb source: FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Fiddler.pdb source: Fiddler.exe.1.dr
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\BundledExtensions\VSWebTestExport\obj\Release Signed\VSWebTestExport.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, VSWebTestExport.dll.1.dr
Source:	Binary string: System.EnterpriseServices.Wrapper.ni.pdbRSDS source: System.EnterpriseServices.Wrapper.dll.26.dr
Source:	Binary string: \GA.Analytics.Monitor.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\BundledExtensions\EnableLoopback\obj\Release Signed\EnableLoopback.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Deployment.ni.pdb source: System.Deployment.dll.22.dr
Source:	Binary string: \Tools\PngDistill.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: F:\Projects\Dot.NET\SVN\Editor.NET\source\obj\Release\QWhale.Editor.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002955000.00000004.00000020.00020000.00000000.sdmp, QWhale.Editor.dll1.1.dr
Source:	Binary string: \REGISTRY\USER\S-1-5-21-2246122658-3693405117-2476756634-1003t\BasicFormats.pdb\.atM source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Runtime.Serialization.Formatters.Soap.ni.pdbRSDS source: System.Runtime.Serialization.Formatters.Soap.dll.49.dr
Source:	Binary string: Extract: EnableLoopback.pdbl% source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.EnterpriseServices.Wrapper.pdb source: System.EnterpriseServices.Wrapper.dll.26.dr
Source:	Binary string: Extract: Fiddler.pdbW source: FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Would you like to go download manually now?https://fiddler2.com/r/?GetDotNet4open https://fiddler2.com/r/?GetDotNet4Compatible .NET Framework/Service Pack found.Installing Progress Telerik Fiddler Classic2500Fiddler.exe.configFiddler.pdbSetupHelperTrustCert.exeTrustCert.pdbInstalling Dependencies... source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Fiddler.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: \EnableLoopback.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: \ScriptEditor\Analytics.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: System.Web.RegularExpressions.ni.pdb source: System.Web.RegularExpressions.dll.29.dr
Source:	Binary string: System.Runtime.Caching.ni.pdbRSDS source: System.Runtime.Caching.dll.27.dr
Source:	Binary string: \ImportExport\VSWebTestExport.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: \UpdateFiddler.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: \TrustCert.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: System.Web.RegularExpressions.ni.pdbRSDS source: System.Web.RegularExpressions.dll.29.dr
Source:	Binary string: \ImportExport\BasicFormats.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\BundledExtensions\FSE.Net45\obj\Release Signed\FSE2.pdb source: FSE2.exe.1.dr
Source:	Binary string: \Scripts\FiddlerOrchestra.Addon.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: C:\JenkinsHome\jobs\AnalyticsReleaseBuild\workspace\Telerik.FJ.Analytics\GA.Analytics.Monitor\obj\Release\GA.Analytics.Monitor.pdb source: GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr
Source:	Binary string: \Inspectors\Be.Windows.Forms.HexBox.dllAnalytics.dllAnalytics.pdbGA.Analytics.Monitor.dllGA.Analytics.Monitor.pdbNewtonsoft.Json.dllDotNetZip.dll source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Extract: BasicFormats.pdb\ source: FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Extract: TrustCert.pdb source: FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Deployment.ni.pdbRSDS source: System.Deployment.dll.22.dr
Source:	Binary string: F:\Projects\Dot.NET\SVN\Editor.NET\source\obj\Release\QWhale.Common.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.000000000293C000.00000004.00000020.00020000.00000000.sdmp, QWhale.Common.dll.1.dr, QWhale.Common.dll1.1.dr
Source:	Binary string: Fiddler.pdbx source: Fiddler.exe.1.dr
Source:	Binary string: System.Security.ni.pdbRSDS source: System.Security.dll.46.dr
Source:	Binary string: FiddlerOrchestra.Utilities.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Deployment.pdb source: System.Deployment.dll.22.dr
Source:	Binary string: EnableLoopback.exeEnableLoopback.pdbApp.icoCountdown.wavLoadScript.wavLoadScriptError.wavNOTICES.txtScreenshot.wavcredits.txtsaz.ico source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Extract: GA.Analytics.Monitor.pdb source: FiddlerSetup.exe, 00000001.00000002.3311319713.0000000000813000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Web.RegularExpressions.pdb source: System.Web.RegularExpressions.dll.29.dr
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\TrustCert\TrustCert\obj\x86\Release Signed\TrustCert.pdb source: TrustCert.exe.1.dr
Source:	Binary string: C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Programs\Fiddler\Analytics.pdb\. source: FiddlerSetup.exe, 00000001.00000002.3311319713.0000000000813000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\TrustCert\TrustCert\obj\x86\Release Signed\TrustCert.pdb\8v8 h8_CorExeMainmscoree.dll source: TrustCert.exe.1.dr
Source:	Binary string: Extract: PngDistill.pdb source: FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Runtime.Serialization.Formatters.Soap.pdb source: System.Runtime.Serialization.Formatters.Soap.dll.49.dr
Source:	Binary string: C:\JenkinsHome\jobs\AnalyticsReleaseBuild\workspace\Telerik.FJ.Analytics\GA.Analytics.Monitor\obj\Release\GA.Analytics.Monitor.pdbg source: GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr
Source:	Binary string: MakeCert.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, makecert.exe.1.dr
Source:	Binary string: c:\src\JPEGXR2PNG\JPEGXR2PNG\obj\Release\JXR2PNG.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, JXR2PNG.exe.1.dr
Source:	Binary string: FiddlerOrchestra.Connection.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Data.SqlXml.pdb source: System.Data.SqlXml.dll.45.dr, System.Data.SqlXml.dll.19.dr
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\BundledExtensions\SimpleFilter\obj\Release Signed\SimpleFilter.pdb4 source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, SimpleFilter.dll.1.dr
Source:	Binary string: \ToolsPngDistill.exePngDistill.pdbInstalling FiddlerExtensions...SimpleFilter.dllSimpleFilter.pdbTimeline.dllTimeline.pdbRulesTab2.dllQWhale.Syntax.Parsers.dllInstalling Fiddler Orchestra addon...FiddlerOrchestra.Addon.dllFiddlerOrchestra.Addon.pdbFiddlerOrchestra.Connection.dllFiddlerOrchestra.Protocol.dllFiddlerOrchestra.Utilities.dllnetstandard.dll source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: FiddlerOrchestra.Protocol.pdbSHA256R source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, FiddlerOrchestra.Protocol.dll.1.dr
Source:	Binary string: System.Runtime.Caching.ni.pdb source: System.Runtime.Caching.dll.27.dr
Source:	Binary string: System.Security.ni.pdb source: System.Security.dll.46.dr
Source:	Binary string: \Scripts\SimpleFilter.pdb source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr
Source:	Binary string: FiddlerOrchestra.Utilities.pdbSHA256 source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Runtime.Serialization.Formatters.Soap.ni.pdb source: System.Runtime.Serialization.Formatters.Soap.dll.49.dr
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\BundledExtensions\Timeline\obj\Release Signed\Timeline.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: FiddlerOrchestra.Connection.pdbSHA256 source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: FiddlerOrchestra.Protocol.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, FiddlerOrchestra.Protocol.dll.1.dr
Source:	Binary string: Extract: VSWebTestExport.pdb source: FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Extract: Analytics.pdbB source: FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\Fiddler.SetupHelper\obj\Release Signed\Fiddler.SetupHelper.pdb source: SetupHelper, 0000000A.00000000.2150082623.00000000004D2000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\fiddler-classic\fiddler-classic\Fiddler2\BundledExtensions\BasicFormats\obj\Release Signed\BasicFormats.pdb source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, BasicFormats.dll.1.dr

Data Obfuscation

Binary contains a suspicious time stamp

Source: Newtonsoft.Json.dll.1.dr

Static PE information: 0xB73F2470 [Fri Jun 3 23:17:04 2067 UTC]

Contains functionality to dynamically determine API calls

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe

Code function: 1_2_6E0E1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

1_2_6E0E1BFF

PE file contains sections with non-standard names

Source: Brotli.exe.1.dr

Static PE information: section name: .eh_fram

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe

Code function: 1_2_6E0E30C0 push eax; ret

1_2_6E0E30EE

Source: DotNetZip.dll.1.dr

Static PE information: section name: .text entropy: 6.813484022115832

Persistence and Installation Behavior

Drops PE files

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1e94-0\System.Deployment.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Tools\Zopfli.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Be.Windows.Forms.HexBox.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\d98-0\System.EnterpriseServices.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\QWhale.Editor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Editor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsu12C2.tmp\System.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1d18-0\System.Web.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Analytics.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1d60-0\EnableLoopback.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\QWhale.Syntax.Parsers.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\EnableLoopback\656decbd27699754c5f7dcdf8abebd4d\EnableLoopback.ni.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\QWhale.Syntax.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\FSE2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Telerik.NetworkConnections.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\4fa111e50d95d3e08c2d856a5394af3b\System.Deployment.ni.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\d1c-0\System.Security.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Syntax.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1f84-0\Microsoft.JScript.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\RulesTab2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Addon.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\bde2021ecdaa53585a395f095971633c\System.Security.ni.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Tools\Brotli.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\QWhale.Common.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Common.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\d90-0\System.Runtime.Caching.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\EnableLoopback.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\8e9f4b8ba90f0dd7ead0f6d3724d12f0\Microsoft.JScript.ni.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\SyntaxView.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\300-0\System.Design.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\b4c-0\System.Runtime.Serialization.Formatters.Soap.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\QWhale.Editor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Tools\JXR2PNG.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Connection.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Tools\dwebp.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\Timeline.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\ExecAction.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\SimpleFilter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\Analytics.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1f44-0\System.Web.RegularExpressions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\Standard.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\0bc179a6f5376dabed45d64773e7a963\System.Web.ni.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\ForceCPU.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\cbb85b2c3ecfe129570a8c187041de31\System.EnterpriseServices.Wrapper.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\ImportExport\VSWebTestExport.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\ce1e4670373608336100bea63bbc8990\System.Numerics.ni.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\QWhale.Syntax.Schemes.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	File created: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Plugins\NetworkConnections\Telerik.NetworkConnections.Windows.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\netstandard.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\f975db3abcedde8df2408b15e2c6dd09\System.Runtime.Serialization.Formatters.Soap.ni.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\QWhale.Syntax.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\TrustCert.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\uninst.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1e14-0\System.Deployment.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\makecert.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt19c51595#\b5d4608754b2d1d4f1d2d3c00cbcdfe0\System.Runtime.Caching.ni.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Syntax.Parsers.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1e8c-0\System.Security.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\cbb85b2c3ecfe129570a8c187041de31\System.EnterpriseServices.ni.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1e7c-0\System.Data.SqlXml.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\DotNetZip.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\78d6922d3a02a93359e189f060d76f47\System.Data.SqlXml.ni.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\QWhale.Common.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Design\e6264fe3334740cf9e7da3afc7d524cc\System.Design.ni.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\d98-0\System.EnterpriseServices.Wrapper.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1d70-0\System.Numerics.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Protocol.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Tools\PngDistill.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\GA.Analytics.Monitor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Utilities.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\ImportExport\BasicFormats.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1f7c-0\System.Runtime.Serialization.Formatters.Soap.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\9c63130543c9d395491387159924bf83\System.Web.RegularExpressions.ni.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\GA.Analytics.Monitor.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1d80-0\System.Data.SqlXml.dll	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1e94-0\System.Deployment.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1f44-0\System.Web.RegularExpressions.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\d98-0\System.EnterpriseServices.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\0bc179a6f5376dabed45d64773e7a963\System.Web.ni.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\cbb85b2c3ecfe129570a8c187041de31\System.EnterpriseServices.Wrapper.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\ce1e4670373608336100bea63bbc8990\System.Numerics.ni.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1d18-0\System.Web.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1d60-0\EnableLoopback.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\EnableLoopback\656decbd27699754c5f7dcdf8abebd4d\EnableLoopback.ni.exe (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\f975db3abcedde8df2408b15e2c6dd09\System.Runtime.Serialization.Formatters.Soap.ni.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\4fa111e50d95d3e08c2d856a5394af3b\System.Deployment.ni.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\d1c-0\System.Security.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1e14-0\System.Deployment.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1f84-0\Microsoft.JScript.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt19c51595#\b5d4608754b2d1d4f1d2d3c00cbcdfe0\System.Runtime.Caching.ni.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1e8c-0\System.Security.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\cbb85b2c3ecfe129570a8c187041de31\System.EnterpriseServices.ni.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\bde2021ecdaa53585a395f095971633c\System.Security.ni.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1e7c-0\System.Data.SqlXml.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\78d6922d3a02a93359e189f060d76f47\System.Data.SqlXml.ni.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\d90-0\System.Runtime.Caching.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Design\e6264fe3334740cf9e7da3afc7d524cc\System.Design.ni.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\d98-0\System.EnterpriseServices.Wrapper.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1d70-0\System.Numerics.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\8e9f4b8ba90f0dd7ead0f6d3724d12f0\Microsoft.JScript.ni.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\300-0\System.Design.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\b4c-0\System.Runtime.Serialization.Formatters.Soap.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1f7c-0\System.Runtime.Serialization.Formatters.Soap.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\9c63130543c9d395491387159924bf83\System.Web.RegularExpressions.ni.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	File created: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1d80-0\System.Data.SqlXml.dll	Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe

File created: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper

Jump to dropped file

Creates install or setup log file

Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SetupHelper.log

Jump to behavior

Creates license or readme file

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe

File created: C:\Users\user\AppData\Local\Programs\Fiddler\license.txt

Jump to behavior

Boot Survival

Stores files to the Windows start menu directory

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fiddler Classic.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fiddler ScriptEditor.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Hooking and other Techniques for Hiding and Protection

Stores large binary data to the registry

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0 ImageList

Jump to behavior

Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: ngen.exe, 00000007.00000002.2509580136.00000253F3EE1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MSCORLIB, VERSION=4.0.0.0, CULTURE=NEUTRAL, PUBLICKEYTOKEN=B77A5C561934E089S\FIDDLER\FIDDLER.EXE
Source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr	Binary or memory string: \FIDDLER.EXE.CONFIG
Source: ngen.exe, 00000007.00000002.2511844756.00000253F3F2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ERROR COMPILING C:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE: AN ATTEMPT WAS MADE TO LOAD A PROGRAM WITH AN INCORRECT FORMAT. (EXCEPTION FROM HRESULT: 0X8007000B)
Source: ngen.exe, 00000007.00000002.2491859507.000000BB8A8FC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: 11/15/2024 09:59:31.744 [1076]: 1>ERROR COMPILING C:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE: AN ATTEMPT WAS MADE TO LOAD A PROGRAM WITH AN INCORRECT FORMAT. (EXCEPTION FROM HRESULT: 0X8007000B)
Source: ngen.exe, 00000007.00000002.2511844756.00000253F3F2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DLER\FIDDLER.EXEUSER
Source: ngen.exe, 00000007.00000002.2511288172.00000253F3F27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WARNING: SYSTEM.BADIMAGEFORMATEXCEPTION: [C:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE] INVALID TYPEREF TOKEN. WHILE RESOLVING 0X10002FF - .
Source: ngen.exe, 00000007.00000002.2491859507.000000BB8A8FC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: CAL\PROGRAMS\FIDDLER\FIDDLER.EXE: AN
Source: Fiddler.exe.1.dr	Binary or memory string: INTERNALNAMEFIDDLER.EXE
Source: ngen.exe, 00000007.00000002.2510018775.00000253F3F1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:/USERS/user/APPDATA/LOCAL/PROGRAMS/FIDDLER/FIDDLER.EXE
Source: ngen.exe, 00000007.00000002.2509811063.00000253F3F00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: N FROM HRESULT: LY C:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE BECAUSE OF AN ERROR DURING COMPILATION: AN ATTEMPT WAS MADE TO LOAD A PROGRAM WITH AN INCORRECT FORMAT. (EXCEPTION FROM HRESULT: 0X8007000B)
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \FIDDLER.EXE"INSTALL "
Source: ngen.exe, 00000007.00000002.2491859507.000000BB8A8FC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: C:SES\AS\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXEB~<
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \FIDDLER.EXE" -VIEWER "%1"KERNEL32::GETCURRENTPROCESS()P.SKERNEL32::ISWOW64PROCESS2(PS,I0S,I)\|KERNEL32::ISWOW64PROCESS(P-1,*I0S)INT64OPWRITE X64 HKLM KEYS9999UPDATEPENDINGSOFTWARE\MICROSOFT\FIDDLER2\PREFS\.DEFAULTFIDDLER.UI.LASTVIEWSOFTWARE\MICROSOFT\FIDDLER2\UIFRMVIEWER_WSTATEJSEDITORNOTEPAD.EXE
Source: ngen.exe, 00000007.00000002.2502931944.00000253F3EB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE:
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \FIDDLER.EXE -STARTEDBYUPDATE3000
Source: ngen.exe, 00000007.00000002.2509811063.00000253F3F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXENEUTRAL, PUBLICKEYTOKEN=B77A5C561934E089
Source: ConDrv.7.dr	Binary or memory string: 1>WARNING: SYSTEM.BADIMAGEFORMATEXCEPTION: [C:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE] INVALID TYPEREF TOKEN. WHILE RESOLVING 0X10002FF - .
Source: ngen.exe, 00000007.00000002.2502931944.00000253F3EB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\NGEN.EXEINSTALLC:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE*
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRACT: FIDDLER.EXE
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp, Fiddler.exe.1.dr, FSE2.exe.1.dr	Binary or memory string: FIDDLER.EXE
Source: ngen.exe, 00000007.00000002.2511288172.00000253F3F27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UNINSTALLING ASSEMBLY C:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE BECAUSE OF AN ERROR DURING COMPILATION: AN ATTEMPT WAS MADE TO LOAD A PROGRAM WITH AN INCORRECT FORMAT. (EXCEPTION FROM HRESULT: 0X8007000B)
Source: ngen.exe, 00000007.00000002.2509811063.00000253F3F00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TC:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE PUBLICKEYTOKEN=B03F5F7F11D50A3A (CLR V4.0.30319)
Source: ngen.exe, 00000007.00000002.2502931944.00000253F3EBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXEE
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \FIDDLER.EXE
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \FIDDLER.EXE" -NOATTACH "%1"SOFTWARE\CLASSES\FIDDLER.ARCHIVEZIP\SHELL\OPEN &IN VIEWER\COMMAND"
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRACT: FIDDLER.EXE.CONFIG
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr	Binary or memory string: \FIDDLER.EXEWAITING FOR PROGRESS TELERIK FIDDLER CLASSIC COMPONENT TO CLOSE ITSELF AUTOMATICALLY...500A PROGRESS TELERIK FIDDLER CLASSIC COMPONENT APPEARS TO BE RUNNING.
Source: ngen.exe, 00000007.00000002.2502931944.00000253F3EB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\NGEN.EXE"C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\NGEN.EXE" INSTALL "C:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE"C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\NGEN.EXEWINSTA0\DEFAULT,
Source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr	Binary or memory string: \FIDDLER.EXE" ACTION=ALLOW PROFILE=ANY DIR=IN EDGE=DEFERUSER PROTOCOL=TCP DESCRIPTION="PERMIT INBOUND CONNECTIONS TO FIDDLER"UNINSTALLSOFTWARE\MICROSOFT\FIDDLER2\INSTALLERSETTINGSKERNEL32::GETCURRENTPROCESS()P.SKERNEL32::ISWOW64PROCESS2(PS,I0S,I)\|KERNEL32::ISWOW64PROCESS(P-1,*I0S)INT64OPSHOULD I DELETE ALL PROGRESS TELERIK FIDDLER CLASSIC-RELATED SETTINGS?
Source: ngen.exe, 00000007.00000002.2502931944.00000253F3EBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SOFT.NET\FRAMEWORK64\V4.0.30319\NGEN.EXEINSTALLC:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE
Source: ngen.exe, 00000007.00000002.2513373763.00000253F41D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\NGEN.EXEINSTALLC:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXEI
Source: ngen.exe, 00000007.00000002.2502931944.00000253F3EB0000.00000004.00000020.00020000.00000000.sdmp, ngen.exe, 00000007.00000002.2509580136.00000253F3ED5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\NGEN.EXEINSTALLC:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE
Source: ngen.exe, 00000007.00000002.2511844756.00000253F3F2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TC:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXEICKEYTOKEN=B03F5F7F11D50A3A510A
Source: FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NOTE: THIS TOOL WILL INVALIDATE THE AUTHENTICODE DIGITAL SIGNATUREUON FIDDLER.EXE, WHICH IS GENERALLY HARMLESS, BUT MAY CAUSE;FIREWALL OR ANTIVIRUS ALERTS.Q
Source: ngen.exe, 00000007.00000002.2502931944.00000253F3EB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\NGEN.EXE" INSTALL "C:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE"H
Source: ConDrv.7.dr	Binary or memory string: 1>UNINSTALLING ASSEMBLY C:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE BECAUSE OF AN ERROR DURING COMPILATION: AN ATTEMPT WAS MADE TO LOAD A PROGRAM WITH AN INCORRECT FORMAT. (EXCEPTION FROM HRESULT: 0X8007000B)
Source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp	Binary or memory string: ?\|<>/":%S%S.DLLCALLERS\user\APPDATA\LOCAL\TEMP\NSU12C2.TMP\SYSTEM.DLLT\VSWEBTESTEXPORT.PDB\.*.KCONNECTIONS.WINDOWS.DLL\.C:\USERS\user\APPDATA\LOCAL\TEMP\NSU12C2.TMP\SYSTEM.DLLR2SWEBTESTEXPORT.PDBDLLTWORKCONNECTIONS.WINDOWS.DLLFALSERS\user\APPDATA\LOCAL\TEMP\NSU12C2.TMPER/TASKS/CONFIGUREFIDDLERE"PPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE" ACTION=ALLOW PROFILE=ANY DIR=IN EDGE=DEFERUSER PROTOCOL=TCP DESCRIPTION="PERMIT INBOUND CONNECTIONS TO FIDDLER"TRUEERS\user\APPDATA\LOCAL\TEMP\NSU12C2.TMP\SYSTEM.DLLR\FSE2.EXE
Source: ngen.exe, 00000007.00000002.2502931944.00000253F3EB0000.00000004.00000020.00020000.00000000.sdmp, ngen.exe, 00000007.00000002.2509580136.00000253F3ED5000.00000004.00000020.00020000.00000000.sdmp, ngen.exe, 00000007.00000002.2513373763.00000253F41D0000.00000004.00000020.00020000.00000000.sdmp, ngen.exe, 00000007.00000002.2502931944.00000253F3EBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE
Source: ngen.exe, 00000007.00000002.2502931944.00000253F3EB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\NGEN.EXE" INSTALL "C:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE"
Source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr	Binary or memory string: \UPDATEFIDDLER.EXE
Source: ngen.exe, 00000007.00000002.2510018775.00000253F3F1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:/USERS/user/APPDATA/LOCAL/PROGRAMS/FIDDLER/FIDDLER.EXEVT
Source: ngen.exe, 00000007.00000002.2511288172.00000253F3F27000.00000004.00000020.00020000.00000000.sdmp, ngen.exe, 00000007.00000002.2511844756.00000253F3F2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WARNING: SYSTEM.BADIMAGEFORMATEXCEPTION: [C:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE] INVALID TYPEREF TOKEN. WHILE RESOLVING 0X1000308 - .
Source: ngen.exe, 00000007.00000002.2511844756.00000253F3F2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXEUSER:T:C:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE
Source: ngen.exe, 00000007.00000002.2502931944.00000253F3EB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE
Source: ConDrv.7.dr	Binary or memory string: 1>NGEN FAILED TO GENERATE NATIVE CODE FOR IMAGE C:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE BECAUSE OF THE FOLLOWING ERROR: AN ATTEMPT WAS MADE TO LOAD A PROGRAM WITH AN INCORRECT FORMAT. (EXCEPTION FROM HRESULT: 0X8007000B)
Source: ngen.exe, 00000007.00000002.2511844756.00000253F3F2C000.00000004.00000020.00020000.00000000.sdmp, ConDrv.7.dr	Binary or memory string: 1>WARNING: SYSTEM.BADIMAGEFORMATEXCEPTION: [C:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE] INVALID TYPEREF TOKEN. WHILE RESOLVING 0X1000308 - .
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WOULD YOU LIKE TO GO DOWNLOAD MANUALLY NOW?HTTPS://FIDDLER2.COM/R/?GETDOTNET4OPEN HTTPS://FIDDLER2.COM/R/?GETDOTNET4COMPATIBLE .NET FRAMEWORK/SERVICE PACK FOUND.INSTALLING PROGRESS TELERIK FIDDLER CLASSIC2500FIDDLER.EXE.CONFIGFIDDLER.PDBSETUPHELPERTRUSTCERT.EXETRUSTCERT.PDBINSTALLING DEPENDENCIES...
Source: ngen.exe, 00000007.00000002.2509580136.00000253F3EE1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSTEM, VERSION=4.0.0.0, CULTURE=NEUTRAL, PUBLICKEYTOKEN=B77A5C561934E089S\FIDDLER\FIDDLER.EXE
Source: FiddlerSetup.exe, 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp, uninst.exe.1.dr	Binary or memory string: \FIDDLER.EXE"UNINSTALL "
Source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \FIDDLER.EXE" ACTION=ALLOW PROFILE=ANY DIR=IN EDGE=DEFERUSER PROTOCOL=TCP DESCRIPTION="PERMIT INBOUND CONNECTIONS TO FIDDLER"FIDDLER.EXEWAITING FOR PROGRESS TELERIK FIDDLER CLASSIC COMPONENT TO CLOSE ITSELF AUTOMATICALLY...500A PROGRESS TELERIK FIDDLER CLASSIC COMPONENT APPEARS TO BE RUNNING.
Source: Fiddler.exe.1.dr	Binary or memory string: ORIGINALFILENAMEFIDDLER.EXE0
Source: ConDrv.7.dr	Binary or memory string: 1> COMPILING ASSEMBLY C:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE (CLR V4.0.30319) ...
Source: ngen.exe, 00000007.00000002.2511844756.00000253F3F2C000.00000004.00000020.00020000.00000000.sdmp, ConDrv.7.dr	Binary or memory string: 1>ERROR COMPILING C:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE: AN ATTEMPT WAS MADE TO LOAD A PROGRAM WITH AN INCORRECT FORMAT. (EXCEPTION FROM HRESULT: 0X8007000B)
Source: ConDrv.7.dr	Binary or memory string: 1>NGEN WILL RETRY COMPILATION OF IMAGE C:\USERS\user\APPDATA\LOCAL\PROGRAMS\FIDDLER\FIDDLER.EXE

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Memory allocated: 25F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Memory allocated: 2750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Memory allocated: 4750000 memory reserve \| memory write watch	Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477

Found dropped PE file which has not been started or loaded

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1e94-0\System.Deployment.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Tools\Zopfli.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Be.Windows.Forms.HexBox.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\d98-0\System.EnterpriseServices.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\QWhale.Editor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Editor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsu12C2.tmp\System.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1d18-0\System.Web.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Analytics.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1d60-0\EnableLoopback.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\QWhale.Syntax.Parsers.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\EnableLoopback\656decbd27699754c5f7dcdf8abebd4d\EnableLoopback.ni.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\FSE2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\QWhale.Syntax.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Telerik.NetworkConnections.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\4fa111e50d95d3e08c2d856a5394af3b\System.Deployment.ni.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\d1c-0\System.Security.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Syntax.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1f84-0\Microsoft.JScript.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\RulesTab2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Addon.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\bde2021ecdaa53585a395f095971633c\System.Security.ni.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Tools\Brotli.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\QWhale.Common.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Common.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\d90-0\System.Runtime.Caching.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\EnableLoopback.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\8e9f4b8ba90f0dd7ead0f6d3724d12f0\Microsoft.JScript.ni.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\SyntaxView.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\b4c-0\System.Runtime.Serialization.Formatters.Soap.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\300-0\System.Design.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\QWhale.Editor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Tools\JXR2PNG.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Tools\dwebp.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Connection.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\Timeline.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\ExecAction.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\SimpleFilter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\Analytics.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1f44-0\System.Web.RegularExpressions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\Standard.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\0bc179a6f5376dabed45d64773e7a963\System.Web.ni.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\ForceCPU.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\cbb85b2c3ecfe129570a8c187041de31\System.EnterpriseServices.Wrapper.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\ImportExport\VSWebTestExport.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\ce1e4670373608336100bea63bbc8990\System.Numerics.ni.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\QWhale.Syntax.Schemes.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Plugins\NetworkConnections\Telerik.NetworkConnections.Windows.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\netstandard.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\f975db3abcedde8df2408b15e2c6dd09\System.Runtime.Serialization.Formatters.Soap.ni.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\QWhale.Syntax.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\TrustCert.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\uninst.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1e14-0\System.Deployment.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\makecert.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt19c51595#\b5d4608754b2d1d4f1d2d3c00cbcdfe0\System.Runtime.Caching.ni.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Syntax.Parsers.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\cbb85b2c3ecfe129570a8c187041de31\System.EnterpriseServices.ni.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1e8c-0\System.Security.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1e7c-0\System.Data.SqlXml.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\DotNetZip.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\78d6922d3a02a93359e189f060d76f47\System.Data.SqlXml.ni.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Design\e6264fe3334740cf9e7da3afc7d524cc\System.Design.ni.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\QWhale.Common.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1d70-0\System.Numerics.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\d98-0\System.EnterpriseServices.Wrapper.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Protocol.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Tools\PngDistill.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Utilities.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\GA.Analytics.Monitor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\ImportExport\BasicFormats.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\9c63130543c9d395491387159924bf83\System.Web.RegularExpressions.ni.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1f7c-0\System.Runtime.Serialization.Formatters.Soap.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\GA.Analytics.Monitor.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Dropped PE file which has not been started: C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1d80-0\System.Data.SqlXml.dll	Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper TID: 2716	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe TID: 3472	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe TID: 8008	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe TID: 8016	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe TID: 7968	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe TID: 7980	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe TID: 7704	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe TID: 5432	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe TID: 6552	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe TID: 7904	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe TID: 7832	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe TID: 7836	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe TID: 6176	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe TID: 8148	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe TID: 7468	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe TID: 3624	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe TID: 7528	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe TID: 2624	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe TID: 1292	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe TID: 7444	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe TID: 8116	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File Volume queried: C:\Users\user\AppData\Local FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File Volume queried: C:\Users\user\AppData\Local FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Code function: 0_2_00405C4D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C4D
Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Code function: 0_2_0040689E FindFirstFileW,FindClose,	0_2_0040689E
Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	Code function: 0_2_00402930 FindFirstFileW,	0_2_00402930
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Code function: 1_2_00402930 FindFirstFileW,	1_2_00402930
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Code function: 1_2_004069FF FindFirstFileW,FindClose,	1_2_004069FF
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Code function: 1_2_00405DAE CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	1_2_00405DAE

Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File opened: C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File opened: C:\Users\user\AppData\Local\Programs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File opened: C:\Users\user\AppData\Local\Programs\Fiddler	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007A8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\\}

Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	API call chain: ExitProcess graph end node	graph_0-3650
Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe	API call chain: ExitProcess graph end node	graph_0-3653
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	API call chain: ExitProcess graph end node	graph_1-4550
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	API call chain: ExitProcess graph end node	graph_1-4553

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to dynamically determine API calls

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe

Code function: 1_2_6E0E1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

1_2_6E0E1BFF

Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: FiddlerSetup.exe PID: 2972, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsbEF3C.tmp, type: DROPPED

Creates a process in suspended mode (likely to inject code)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process created: C:\Windows\SysWOW64\netsh.exe "c:\windows\system32\netsh.exe" advfirewall firewall add rule name="fiddlerproxy" program="c:\users\user\appdata\local\programs\fiddler\fiddler.exe" action=allow profile=any dir=in edge=deferuser protocol=tcp description="permit inbound connections to fiddler"
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Process created: C:\Windows\SysWOW64\netsh.exe "c:\windows\system32\netsh.exe" advfirewall firewall add rule name="fiddlerproxy" program="c:\users\user\appdata\local\programs\fiddler\fiddler.exe" action=allow profile=any dir=in edge=deferuser protocol=tcp description="permit inbound connections to fiddler"			Jump to behavior

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	Queries volume information: C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Fiddler\DotNetZip.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Fiddler\Telerik.NetworkConnections.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition\v4.0_4.0.0.0__b77a5c561934e089\System.ComponentModel.Composition.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Fiddler\Newtonsoft.Json.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Fiddler\Analytics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.RegularExpressions\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Design.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.ApplicationServices\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.ApplicationServices.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\v4.0_4.0.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v4.0.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Caching\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Caching.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.v4.0.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Fiddler\GA.Analytics.Monitor.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Fiddler\DotNetZip.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Http.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Fiddler\Analytics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Fiddler\Telerik.NetworkConnections.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition\v4.0_4.0.0.0__b77a5c561934e089\System.ComponentModel.Composition.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Fiddler\Newtonsoft.Json.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.ApplicationServices\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.ApplicationServices.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\v4.0_4.0.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.Protocols\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v4.0.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Caching\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Caching.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.RegularExpressions\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Design.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Services\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.v4.0.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Caching\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Caching.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Fiddler\DotNetZip.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Http.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Fiddler\Analytics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Fiddler\Telerik.NetworkConnections.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition\v4.0_4.0.0.0__b77a5c561934e089\System.ComponentModel.Composition.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Fiddler\Newtonsoft.Json.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.RegularExpressions\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Design.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.RegularExpressions\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Fiddler\EnableLoopback.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Fiddler\EnableLoopback.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation

Source: C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe

Code function: 0_2_0040351C EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040351C

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="FiddlerProxy"

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="FiddlerProxy"

Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION			Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsbEF3C.tmp, type: DROPPED

Yara detected zgRAT

Source: Yara match

File source: C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe, type: DROPPED

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsbEF3C.tmp, type: DROPPED

Yara detected zgRAT

Source: Yara match

File source: C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Native API	1 Scripting	1 DLL Side-Loading	21 Disable or Modify Tools	OS Credential Dumping	3 File and Directory Discovery	Remote Services	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Search Order Hijacking	1 Deobfuscate/Decode Files or Information	LSASS Memory	14 System Information Discovery	Remote Desktop Protocol	1 Clipboard Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Search Order Hijacking	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Windows Service	1 Windows Service	1 Software Packing	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Timestomp	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Search Order Hijacking	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	31 Masquerading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Modify Registry	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	31 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Access Token Manipulation	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	11 Process Injection	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
FiddlerSetup.5.0.20245.10105-latest.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Programs\Fiddler\Analytics.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Be.Windows.Forms.HexBox.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\DotNetZip.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\EnableLoopback.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\ExecAction.exe	3%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\ForceCPU.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\GA.Analytics.Monitor.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\ImportExport\BasicFormats.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\ImportExport\VSWebTestExport.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\QWhale.Common.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\QWhale.Editor.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\QWhale.Syntax.Schemes.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\QWhale.Syntax.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\Standard.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\SyntaxView.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Plugins\NetworkConnections\Telerik.NetworkConnections.Windows.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\Analytics.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\FSE2.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\GA.Analytics.Monitor.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Common.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Editor.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Syntax.Parsers.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Syntax.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Addon.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Connection.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Protocol.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Utilities.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\QWhale.Common.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\QWhale.Editor.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\QWhale.Syntax.Parsers.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\QWhale.Syntax.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\RulesTab2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\SimpleFilter.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\Timeline.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\netstandard.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Telerik.NetworkConnections.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Tools\Brotli.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Tools\JXR2PNG.exe	3%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Tools\PngDistill.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Tools\Zopfli.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\Tools\dwebp.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\TrustCert.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\makecert.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Fiddler\uninst.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsu12C2.tmp\System.dll	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\8e9f4b8ba90f0dd7ead0f6d3724d12f0\Microsoft.JScript.ni.dll (copy)	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\78d6922d3a02a93359e189f060d76f47\System.Data.SqlXml.ni.dll (copy)	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\4fa111e50d95d3e08c2d856a5394af3b\System.Deployment.ni.dll (copy)	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Design\e6264fe3334740cf9e7da3afc7d524cc\System.Design.ni.dll (copy)	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\cbb85b2c3ecfe129570a8c187041de31\System.EnterpriseServices.Wrapper.dll (copy)	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\cbb85b2c3ecfe129570a8c187041de31\System.EnterpriseServices.ni.dll (copy)	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\ce1e4670373608336100bea63bbc8990\System.Numerics.ni.dll (copy)	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt19c51595#\b5d4608754b2d1d4f1d2d3c00cbcdfe0\System.Runtime.Caching.ni.dll (copy)	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\f975db3abcedde8df2408b15e2c6dd09\System.Runtime.Serialization.Formatters.Soap.ni.dll (copy)	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\bde2021ecdaa53585a395f095971633c\System.Security.ni.dll (copy)	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\9c63130543c9d395491387159924bf83\System.Web.RegularExpressions.ni.dll (copy)	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\0bc179a6f5376dabed45d64773e7a963\System.Web.ni.dll (copy)	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1d18-0\System.Web.dll	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1d70-0\System.Numerics.dll	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1d80-0\System.Data.SqlXml.dll	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1e14-0\System.Deployment.dll	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1e7c-0\System.Data.SqlXml.dll	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1e8c-0\System.Security.dll	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1e94-0\System.Deployment.dll	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1f44-0\System.Web.RegularExpressions.dll	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1f7c-0\System.Runtime.Serialization.Formatters.Soap.dll	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1f84-0\Microsoft.JScript.dll	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\300-0\System.Design.dll	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\b4c-0\System.Runtime.Serialization.Formatters.Soap.dll	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\d1c-0\System.Security.dll	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\d90-0\System.Runtime.Caching.dll	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\d98-0\System.EnterpriseServices.Wrapper.dll	0%	ReversingLabs
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\d98-0\System.EnterpriseServices.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://www.progress.com/legal/cookie-policy	0%	Avira URL Cloud	safe
http://nsis.sourceforge.net/Main_Page	0%	Avira URL Cloud	safe
http://commons.apache.org/proper/commons-compress/	0%	Avira URL Cloud	safe
https://api.getfiddler.com/r/?fiddler	0%	Avira URL Cloud	safe
http://www.fiddler2.com/sandbox/FormAndCookie.asp	0%	Avira URL Cloud	safe
https://api.getfiddler.com/r/?SCRIPTFORUM	0%	Avira URL Cloud	safe
https://api.getfiddler.com/r/?fiddlercore	0%	Avira URL Cloud	safe
https://api.getfiddler.com/r/?FiddlerOrchestra/Clients/FiddlerOrchestra.Client.Android.apk	0%	Avira URL Cloud	safe
http://fiddler.wikidot.com/prefs	0%	Avira URL Cloud	safe
https://www.progress.com/legal/privacy-policy).	0%	Avira URL Cloud	safe
http://www.qwhale.net/products/editor.htm	0%	Avira URL Cloud	safe
http://www.fiddlerbook.com/fiddler/help/http/headers.asp?query=	0%	Avira URL Cloud	safe
https://d6vtbcy3ong79.cloudfront.net/fonts/2.2.7/metric/Metric-Semibold.woff2	0%	Avira URL Cloud	safe
https://api.getfiddler.com/r/?quickexec	0%	Avira URL Cloud	safe
http://www.someserver.com/upload.aspx	0%	Avira URL Cloud	safe
http://www.fatcow.com/free-icons	0%	Avira URL Cloud	safe
http://www.URLtoDownloadFrom.net	0%	Avira URL Cloud	safe
http://www.bouncycastle.org)	0%	Avira URL Cloud	safe
https://d6vtbcy3ong79.cloudfront.net/telerik-navigation/3.5.50/js/index.min.mjs	0%	Avira URL Cloud	safe
https://api.getfiddler.com/r/?WIN8ELo	0%	Avira URL Cloud	safe
https://api.getfiddler.com/r/?FiddlerLog	0%	Avira URL Cloud	safe
http://getfiddler.com/	0%	Avira URL Cloud	safe
https://d6vtbcy3ong79.cloudfront.net/external-assets/1.0.22/utils/store-lead-data.min.js	0%	Avira URL Cloud	safe
https://api.getfiddler.com/r/?fiddlercolumns	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
telerik.com	50.56.19.112	true	false	high
d6vtbcy3ong79.cloudfront.net	18.66.17.64	true	false	unknown
sni1gl.wpc.gammacdn.net	152.199.21.175	true	false	high
p01f.t.eloqua.com	192.29.11.142	true	false	high
euob.ytwohlcq.telerik.com	18.66.122.127	true	false	unknown
platform.twitter.map.fastly.net	146.75.120.157	true	false	high
stats.g.doubleclick.net	66.102.1.155	true	false	high
pagestates-tracking.crazyegg.com	18.164.68.79	true	false	high
rum-static.pingdom.net	104.22.54.104	true	false	high
scontent.xx.fbcdn.net	157.240.253.1	true	false	high
t.co	162.159.140.229	true	false	high
script.hotjar.com	3.165.206.67	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
www.google.com	142.250.186.132	true	false	high
static-cdn.hotjar.com	13.224.245.89	true	false	high
star-mini.c10r.facebook.com	157.240.253.35	true	false	high
s.twitter.com	104.244.42.195	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
bcltest2.b-cdn.net	169.150.236.105	true	false	high
obseu.ytwohlcq.telerik.com	54.75.69.192	true	false	high
d585tldpucybw.cloudfront.net	18.66.107.176	true	false	unknown
ax-0001.ax-msedge.net	150.171.28.10	true	false	high
d2no1x7oj2rkdb.cloudfront.net	18.172.112.30	true	false	high
analytics-alv.google.com	216.239.34.181	true	false	high
prod-dem-collector-elb-611025824.eu-west-1.elb.amazonaws.com	54.217.99.7	true	false	high
qualdnt.b-cdn.net	169.150.247.36	true	false	high
googleads.g.doubleclick.net	142.250.185.162	true	false	high
assets-tracking.crazyegg.com	13.32.27.5	true	false	high
td.doubleclick.net	172.217.18.98	true	false	high
dtzbdy9anri2p.cloudfront.net	18.245.206.63	true	false	unknown
fiddler2.com	50.56.19.116	true	false	high
unpkg.com	104.17.247.203	true	false	high
cdn.cookielaw.org	104.18.86.42	true	false	high
geolocation.onetrust.com	104.18.32.137	true	false	high
geo.qualaroo.com	98.83.237.110	true	false	high
tracking.crazyegg.com	63.32.145.9	true	false	high
api.insight.sitefinity.com	52.252.156.53	true	false	high
static.ads-twitter.com	unknown	unknown	false	high
a.quora.com	unknown	unknown	false	high
s1325.t.eloqua.com	unknown	unknown	false	high
www.telerik.com	unknown	unknown	false	high
script.crazyegg.com	unknown	unknown	false	high
static.hotjar.com	unknown	unknown	false	high
cl.qualaroo.com	unknown	unknown	false	high
c.clarity.ms	unknown	unknown	false	high
q.quora.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
www.clarity.ms	unknown	unknown	false	high
img.en25.com	unknown	unknown	false	high
www.linkedin.com	unknown	unknown	false	high
www.clickcease.com	unknown	unknown	false	high
rum-collector-2.pingdom.net	unknown	unknown	false	high
px.ads.linkedin.com	unknown	unknown	false	high
connect.facebook.net	unknown	unknown	false	high
analytics.twitter.com	unknown	unknown	false	high
dntcl.qualaroo.com	unknown	unknown	false	high
b.clarity.ms	unknown	unknown	false	high
snap.licdn.com	unknown	unknown	false	high
analytics.google.com	unknown	unknown	false	high
cdn.insight.sitefinity.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.telerik.com/webapi/Announcements/GetPromo?url=https://www.telerik.com/download/fiddler/first-run	false		high
https://s1325.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=1325&ref=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&ref2=elqNone&tzo=300&ms=666&optin=disabled	false		high
https://www.clarity.ms/s/0.7.56/clarity.js	false		high
https://www.telerik.com/RestApi/personalizations/render?pageNodeId=5ceb4be1-05bd-4c69-892a-2c2bbd37538b&pageDataId=1f960fad-aef2-4475-8978-52fb7a29dbc9&pageNodeKey=5CEB4BE1-05BD-4C69-892A-2C2BBD37538B/b31ca85c-a1c5-4a9d-8b5d-e7b0736a8b16/SitefinitySiteMap&url=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&controls=09f9bb4f-5990-40af-b361-7849c73c9604_1,0cd3f511-e7d9-4e23-8773-26005ae09893_1,25637a62-a321-49a0-8b7e-5962dc977e95_1,6b5ac4dc-8fd0-4043-bd0a-e9ffd31e3bc8_1&correlationId=m3iv7avxzpfywghsi2	false		high
https://pagestates-tracking.crazyegg.com/healthcheck	false		high
https://connect.facebook.net/signals/config/1444093252502226?v=2.9.177&r=stable&domain=www.telerik.com&hme=c3e4904c1dde42d643265ef909b9e193c41cedcd6f559a3ff5e1b178e36647fa&ex_m=70%2C121%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C172%2C175%2C187%2C183%2C184%2C186%2C29%2C101%2C53%2C77%2C185%2C167%2C170%2C180%2C181%2C188%2C131%2C41%2C189%2C190%2C34%2C143%2C15%2C50%2C195%2C194%2C133%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C168%2C171%2C140%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113	false		high
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975652292/?label=p4zxCNq_8IkYEMSLndED&guid=ON&script=0&ct_cookie_present=false&random=1045446&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQII6saxAgjTxbECCKXGsQIiAQFAAQ&pscrd=COazjdm896zLbSITCN-Rk4nN3okDFQix_QcdtQQxtTICCAMyAggEMgIIBzICCAgyAggJMgIICjICCAIyAggLMgIIFTICCB8yAggTMgIIEjoYaHR0cHM6Ly93d3cudGVsZXJpay5jb20v	false		high
https://www.google.com/pagead/1p-conversion/975652292/?label=p4zxCNq_8IkYEMSLndED&guid=ON&script=0&ct_cookie_present=false&random=1045446&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQII6saxAgjTxbECCKXGsQIiAQFAAQ&pscrd=COazjdm896zLbSITCN-Rk4nN3okDFQix_QcdtQQxtTICCAMyAggEMgIIBzICCAgyAggJMgIICjICCAIyAggLMgIIFTICCB8yAggTMgIIEjoYaHR0cHM6Ly93d3cudGVsZXJpay5jb20v&is_vtc=1&cid=CAQSKQCa7L7dQMKAMcg-9wSmTEniUBO2fU4DW0mhRyIsxTvK1UmOFpeFMErh&random=619890663	false		high
https://s1325.t.eloqua.com/visitor/v200/svrGP?pps=70&siteid=1325	false		high
http://www.telerik.com/download/fiddler/first-run	false		high
https://cl.qualaroo.com/ki.js/24100/4Nr.js	false		high
https://d6vtbcy3ong79.cloudfront.net/telerik-navigation/3.5.50/js/index.min.mjs	false	Avira URL Cloud: safe	unknown
https://d6vtbcy3ong79.cloudfront.net/fonts/2.2.7/metric/Metric-Semibold.woff2	false	Avira URL Cloud: safe	unknown
https://obseu.ytwohlcq.telerik.com/tracker/tc_imp.gif?e=37dfbd8ee84e001269efc13de840829c9225c24f567d43d6da1908be6245cad7bd70a976750ef80ed89373bfe70e9c20c1e53e8d5d168b6a2f17071a10acf9f29f674fd38b8b062c3913af78720c866ade66c10c6507259a040157330c57c1eb6e1b77be26bb25cb43e2923cf34c6da909337814da4de44fec8bc59a7ee46a56a82b9eec47679c796e092818c5871d61eb72bffeb1ba131be20ecca7478c31db6bda508e1547f77303fd1f564c2acf503ed79ffca8328828bf7d8557ec4b7274a7d43169230121e118f58109ac5d6ead83c6771e217dcf965d78c9df014b3545700015a7902c7e7d17c7ab1f28cef2ea2b93e745711b3eb7b4e7c1d965b4cfd652ba53940c36339eeb9cb5f761c1d5e46c90660cd6f89c7f4e16f56868a1c40678fc86ae668503fa43b6980a870d97dd75d66071d2d964d27a8f95afb491abb6457fb476eda5a9760c2be88c24cee81de21159578e090ed9859385c5f79521de65c089b9c836ae7a7c74dc2b65d484964d36dde433f352b5c11cc439ef7c021314fb07ff439cc7ee27ebc978d01fa7d78a95279e5e406aed4e13433e113e87e223b54f9494c712a29062ed9b259acca9f27e9bbbe25c707585e51e1c9bbb491442f1efc33afd6fc4ae25bbf224a061b22d870586678bf169995e5eb0bc9874222d7c1168574e1dc1e08c6cd102ab46525e2ef9b553c29f1908e2a5d9babc01deffb0b9dfacbdfb594e22fa4085b75f668144621cc93d1e7825ab32f97142c4ae8231ee08bf3797b96f88e1598b711d203e037b109dc6ecd93b7c52844d0fccb093cfc7a33957e7cfe825e1b96167ca9657653deb9bcb573fb620865e9912e1389c15c5b014bab34eb9d2c1dbdf423a9ab34435906ab4cff0fd049607590a17d62c1a42bba3439db8458ec8e797079cc3de6c505512e964f45bb85fb09d7bc26701334b3b7d7fe25a92937308e87dcaa6e927999218ce6679ac0d6e6cc2aac3005af263aacd438b153b0156ae646fd1fa957ac1542288da50f29dcff5805ec804037707f8763940cdd31e56b23de7fedd3fd690954e2f20fd397b515a98055ab0c8b25b44dd&cri=dC4EKuJhV2&ts=3155&cb=1731682780993	false		high
https://unpkg.com/web-vitals/dist/web-vitals.iife.js	false		high
https://www.telerik.com/WebResource.axd?d=wnB2OjhYopty-dCFa4b2kKCIWGgLoaj0QQ4I7F_PiSysmtqnVBUtsGpmlAymZDgXEXdRjhe5BdfNkuyybLSHMhRnbzI9oh6WXC-y-EwOrJPY0qCvfWaOo0ltV4TVm8apzRlzF5O244Y4u7-m5V8Vv2yC1Tun7PurVRoOxfv28sPwY-isOJNAi7MSqc1tycGYAkqZXHU_zlVNorSTBDv4W4jemDM1&t=638646398980000000	false		high
https://dntcl.qualaroo.com/frame.html	false		high
https://www.telerik.com/favicon.ico?v=rebv1	false		high
https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1444093252502226&ev=CHEQ&dl=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&rl=&if=false&ts=1731682786417&sw=1280&sh=1024&v=2.9.177&r=stable&ec=1&o=4126&fbp=fb.1.1731682786412.73675803251272972&ler=empty&cdl=API_unavailable&it=1731682781227&coo=false&rqm=FGET	false		high
https://unpkg.com/web-vitals@4.2.4/dist/web-vitals.iife.js	false		high
https://rum-static.pingdom.net/prum.min.js	false		high
https://d6vtbcy3ong79.cloudfront.net/external-assets/1.0.22/utils/store-lead-data.min.js	false	Avira URL Cloud: safe	unknown
https://www.telerik.com/download/fiddler/first-run	false		high
https://www.telerik.com/WebResource.axd?d=HtQyXelCu6mzSPcVcvK_BiMPfgaXcXtBpU_p4oPRWdaaTkgqeBOpXuu1TRv9pAGD-FAzjGGeBeqirrj8SJpv3YU7eO6rv9kziBqvktqcdZzC15nZHrag4kg_mMMtSYLloBTL1HIRNuD4Iepyub_zCpOjm9RyH4DXkI1YDpCN_mnfRNsYUjpSNKzgKVak4AN3FQYzZOcP1Z4PmfVVfM_48qg3YrI1&t=638646398980000000	false		high
https://t.co/i/adsct?bci=3&dv=America%2FNew_York%26en-US%2Cen%26Google%20Inc.%26Win32%26255%261280%261024%264%2624%261280%26984%260%26na&eci=2&event_id=d3c56a3e-5e46-458b-9cfc-58e4034af68a&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=b44ecccc-6ffc-4513-83c8-8720371a64fe&tw_document_href=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nurcc&type=javascript&version=2.3.31	false		high
https://cdn.cookielaw.org/consent/3dfce4f2-dab6-4128-9f33-df7e0597da82/otSDKStub.js	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://fiddler2.com/r/?credits	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, credits.txt.1.dr	false		high
http://www.fiddler2.com/sandbox/FormAndCookie.asp	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, 307_RedirectWithMethod.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://stats.g.doubleclick.net/g/collect	chromecache_318.17.dr	false		high
http://fiddler2.com/r/?Fiddler2FirstRuni	FiddlerSetup.exe, 00000001.00000002.3311319713.0000000000881000.00000004.00000020.00020000.00000000.sdmp	false		high
http://fiddler2.com/r/?id=bitness)	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp	false		high
http://fiddler2.com/r/?Fiddler2FirstRuna	FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://fiddler2.com/r/?Fiddler2FirstRun_	FiddlerSetup.exe, 00000001.00000002.3311319713.0000000000813000.00000004.00000020.00020000.00000000.sdmp	false		high
http://fiddler.wikidot.com/prefs	Fiddler.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://api.getfiddler.com/r/?FiddlerOrchestra/Clients/FiddlerOrchestra.Client.Android.apk	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://q.quora.com/_/ad/	chromecache_326.17.dr	false		high
http://www.opensource.org/licenses/mit-license.php	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, credits.txt.1.dr	false		high
http://groups.google.com/group/http-archive-specification/	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, BasicFormats.dll.1.dr	false		high
https://www.telerik.com/blogs/fiddlercore-for-net-standard-and-fiddler-orchestra-the-future-of-fiddl	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://commons.apache.org/proper/commons-compress/	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sourceforge.net/Main_Page	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, credits.txt.1.dr	false	Avira URL Cloud: safe	unknown
http://fiddler2.com/r/?Fiddler2FirstRuny	FiddlerSetup.exe, 00000001.00000002.3311319713.0000000000881000.00000004.00000020.00020000.00000000.sdmp	false		high
http://fiddler2.com/r/?quickexec	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp	false		high
http://fiddler2.com/r/?Fiddler2FirstRunn	FiddlerSetup.exe, 00000001.00000002.3311319713.0000000000881000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.getfiddler.com/r/?fiddlercore	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/microsoft/clarity	chromecache_309.17.dr, chromecache_332.17.dr	false		high
https://www.nuget.org/packages/DotNetZip/	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, credits.txt.1.dr	false		high
http://www.telerik.com/fiddler	FiddlerSetup.5.0.20245.10105-latest.exe, uninst.exe.1.dr, FiddlerSetup.exe.0.dr	false		high
https://www.progress.com/legal/cookie-policy	chromecache_327.17.dr	false	Avira URL Cloud: safe	unknown
https://www.progress.com/legal/privacy-policy).	FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, license.txt.1.dr	false	Avira URL Cloud: safe	unknown
http://www.entrust.net/rpa03	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Analytics.dll0.1.dr, Telerik.NetworkConnections.dll.1.dr	false		high
http://www.google.com/bot.html)	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://exslt.org/common	System.Data.SqlXml.dll.45.dr, System.Data.SqlXml.dll.19.dr	false		high
https://api.getfiddler.com/r/?fiddler	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, BasicFormats.dll.1.dr	false	Avira URL Cloud: safe	unknown
https://api.getfiddler.com/r/?SCRIPTFORUM	FSE2.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://github.com/google/zopfli/commit/720b20e8db19ea90b38edce82aca52815edf8c1a	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Zopfli.exe.1.dr	false		high
http://www.fiddlerbook.com/fiddler/help/http/headers.asp?query=	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Standard.dll.1.dr	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Zopfli.exe.1.dr, Be.Windows.Forms.HexBox.dll.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Telerik.NetworkConnections.dll.1.dr	false		high
https://connect.facebook.net/	chromecache_303.17.dr	false		high
http://127.0.0.1:	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://fiddler2.com/r/?Fiddler2FirstRun=	FiddlerSetup.exe, 00000001.00000002.3311319713.0000000000881000.00000004.00000020.00020000.00000000.sdmp	false		high
http://sourceforge.net/projects/hexbox/	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, Standard.dll.1.dr, credits.txt.1.dr	false		high
http://www.symauth.com/rpa00	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Zopfli.exe.1.dr, Be.Windows.Forms.HexBox.dll.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Telerik.NetworkConnections.dll.1.dr	false		high
http://www.URLtoDownloadFrom.net	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.contoso.com/	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.someserver.com/upload.aspx	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://fiddler2.com/r/?Fiddler2FirstRun.	FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://fiddler2.com/r/?SYNTAXVIEWINSTALL	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Analytics.dll0.1.dr, Telerik.NetworkConnections.dll.1.dr	false		high
http://html4/loose.dtd	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://fiddler2.com/r/?id=bitness	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp	false		high
http://fiddler2.com/fiddlercore	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/ymnk/jzlib	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://curl.haxx.se/	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, BasicFormats.dll.1.dr	false		high
https://www.clarity.ms/tag/uet/	chromecache_317.17.dr	false		high
http://.css	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.getfiddler.com/r/?quickexec	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.qwhale.net/products/editor.htm	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, credits.txt.1.dr	false	Avira URL Cloud: safe	unknown
https://cdn.cookielaw.org/vendorlist/googleData.json	chromecache_279.17.dr	false		high
http://fiddler2.com/	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, GA.Analytics.Monitor.dll.1.dr, Zopfli.exe.1.dr, GA.Analytics.Monitor.dll0.1.dr, Be.Windows.Forms.HexBox.dll.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Analytics.dll0.1.dr, Telerik.NetworkConnections.dll.1.dr	false		high
http://www.fatcow.com/free-icons	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, credits.txt.1.dr	false	Avira URL Cloud: safe	unknown
http://blogs.msdn.com/ieinternals/archive/2009/07/20/Using-post_2D00_check-and-pre_2D00_check-cache-	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Standard.dll.1.dr	false		high
http://fiddler2.com/r/?Fiddler2FirstRun1003	FiddlerSetup.exe, 00000001.00000002.3311319713.000000000082D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.cookielaw.org/vendorlist/iab2Data.json	chromecache_279.17.dr	false		high
http://fiddler2.com/r/?FiddlerSandboxSOFTWARE	FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.bouncycastle.org)	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/ts1ca.crl0	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, GA.Analytics.Monitor.dll.1.dr, GA.Analytics.Monitor.dll0.1.dr, Telerik.NetworkConnections.Windows.dll.1.dr, Analytics.dll0.1.dr, Telerik.NetworkConnections.dll.1.dr	false		high
https://api.getfiddler.com/r/?WIN8ELo	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://.jpg	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/google/zopfli0	Zopfli.exe.1.dr	false		high
http://getfiddler.com/	FiddlerSetup.exe, 00000001.00000002.3311319713.00000000007D2000.00000004.00000020.00020000.00000000.sdmp, FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, license.txt.1.dr	false	Avira URL Cloud: safe	unknown
https://api.getfiddler.com/r/?fiddlercolumns	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.getfiddler.com/r/?FiddlerLog	SimpleFilter.dll.1.dr	false	Avira URL Cloud: safe	unknown
http://aia.entrust.net/ts1-chain256.cer01	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002867000.00000004.00000020.00020000.00000000.sdmp, Telerik.NetworkConnections.Windows.dll.1.dr, Telerik.NetworkConnections.dll.1.dr	false		high
https://googleads.g.doubleclick.net	chromecache_326.17.dr	false		high
https://static.hotjar.com/c/hotjar-	chromecache_326.17.dr	false		high
https://td.doubleclick.net	chromecache_318.17.dr, chromecache_344.17.dr, chromecache_326.17.dr	false		high
http://www.codeplex.com/DotNetZip	FiddlerSetup.exe, 00000001.00000002.3312227281.0000000002ED2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com	chromecache_326.17.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.29.11.142	p01f.t.eloqua.com	United States	31898	ORACLE-BMC-31898US	false
52.252.156.53	api.insight.sitefinity.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
216.239.34.181	analytics-alv.google.com	United States	15169	GOOGLEUS	false
18.245.46.123	unknown	United States	16509	AMAZON-02US	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.66.122.7	unknown	United States	3	MIT-GATEWAYSUS	false
13.224.245.89	static-cdn.hotjar.com	United States	16509	AMAZON-02US	false
169.150.247.36	qualdnt.b-cdn.net	United States	2711	SPIRITTEL-ASUS	false
50.56.19.116	fiddler2.com	United States	19994	RACKSPACEUS	false
98.83.237.110	geo.qualaroo.com	United States	11351	TWC-11351-NORTHEASTUS	false
66.102.1.155	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
3.160.156.198	unknown	United States	16509	AMAZON-02US	false
104.18.32.137	geolocation.onetrust.com	United States	13335	CLOUDFLARENETUS	false
52.210.32.20	unknown	United States	16509	AMAZON-02US	false
50.56.19.112	telerik.com	United States	19994	RACKSPACEUS	false
54.75.69.192	obseu.ytwohlcq.telerik.com	United States	16509	AMAZON-02US	false
18.164.68.79	pagestates-tracking.crazyegg.com	United States	3	MIT-GATEWAYSUS	false
18.245.206.63	dtzbdy9anri2p.cloudfront.net	United States	16509	AMAZON-02US	false
162.159.140.229	t.co	United States	13335	CLOUDFLARENETUS	false
104.18.87.42	unknown	United States	13335	CLOUDFLARENETUS	false
18.66.107.59	unknown	United States	3	MIT-GATEWAYSUS	false
157.240.0.35	unknown	United States	32934	FACEBOOKUS	false
104.244.42.131	unknown	United States	13414	TWITTERUS	false
172.64.155.119	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.5.216	unknown	United States	13335	CLOUDFLARENETUS	false
169.150.236.105	bcltest2.b-cdn.net	United States	2711	SPIRITTEL-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
54.217.99.7	prod-dem-collector-elb-611025824.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
63.32.145.9	tracking.crazyegg.com	United States	16509	AMAZON-02US	false
152.199.21.175	sni1gl.wpc.gammacdn.net	United States	15133	EDGECASTUS	false
146.75.120.157	platform.twitter.map.fastly.net	Sweden	30051	SCCGOVUS	false
157.240.253.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
13.33.187.109	unknown	United States	16509	AMAZON-02US	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
18.66.17.64	d6vtbcy3ong79.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
18.172.112.30	d2no1x7oj2rkdb.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
13.224.245.27	unknown	United States	16509	AMAZON-02US	false
18.66.107.176	d585tldpucybw.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
13.35.58.128	unknown	United States	16509	AMAZON-02US	false
150.171.28.10	ax-0001.ax-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.66.122.127	euob.ytwohlcq.telerik.com	United States	3	MIT-GATEWAYSUS	false
3.165.206.67	script.hotjar.com	United States	16509	AMAZON-02US	false
142.250.185.162	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
3.248.162.96	unknown	United States	16509	AMAZON-02US	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false
13.32.27.5	assets-tracking.crazyegg.com	United States	7018	ATT-INTERNET4US	false
172.217.18.98	td.doubleclick.net	United States	15169	GOOGLEUS	false
18.66.122.74	unknown	United States	3	MIT-GATEWAYSUS	false
34.251.101.162	unknown	United States	16509	AMAZON-02US	false
104.244.42.195	s.twitter.com	United States	13414	TWITTERUS	false
157.240.251.9	unknown	United States	32934	FACEBOOKUS	false
104.17.247.203	unpkg.com	United States	13335	CLOUDFLARENETUS	false
157.240.253.1	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
142.250.186.164	unknown	United States	15169	GOOGLEUS	false
104.18.86.42	cdn.cookielaw.org	United States	13335	CLOUDFLARENETUS	false
172.217.16.132	unknown	United States	15169	GOOGLEUS	false
104.22.54.104	rum-static.pingdom.net	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.6
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1556543
Start date and time:	2024-11-15 15:58:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	50
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FiddlerSetup.5.0.20245.10105-latest.exe
Detection:	MAL
Classification:	mal44.troj.evad.winEXE@97/347@170/59
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 105 Number of non-executed functions: 59
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.99, 142.250.186.78, 142.251.173.84, 34.104.35.123, 199.232.214.172, 192.229.221.95, 172.217.18.8, 23.201.244.51, 216.58.206.40, 2.16.164.10, 2.16.164.35, 162.159.152.17, 162.159.153.247, 13.107.42.14, 104.19.148.8, 104.19.147.8, 142.250.184.200, 23.47.50.183, 23.47.50.153, 23.47.50.171, 23.47.50.159, 23.47.50.174, 142.250.186.66, 104.18.41.41, 172.64.146.215, 13.74.129.1, 4.153.129.168, 172.217.16.194, 13.107.21.237, 204.79.197.237, 142.250.186.131, 142.250.186.174
Excluded domains from analysis (whitelisted): www.googleadservices.com, slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, wildcard.en25.com.edgekey.net, clientservices.googleapis.com, a.quora.com.cdn.cloudflare.net, script.crazyegg.com.cdn.cloudflare.net, l-0005.l-msedge.net, clients2.google.com, ocsp.digicert.com, www.googletagmanager.com, sitefinity-insight.ec.azureedge.net, bat.bing.com, update.googleapis.com, azurefd-t-prod.trafficmanager.net, e5763.x.akamaiedge.net, www-linkedin-com.l-0005.l-msedge.net, q.quora.com.cdn.cloudflare.net, vmss-clarity-ingest-eus2.eastus2.cloudapp.azure.com, clients1.google.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, c-bing-com.dual-a-0034.a-msedge.net, sitefinity-insight.azureedge.net, ctldl.windowsupdate.com, od.linkedin.edgesuite.net, fe3cr.delivery.mp.microsoft.com, www.linkedin.com.cdn.cloudflare.net, edgedl.me.gvt1.com, c.bing.com, dual-a-0034.a-msedge.net, clients.l.google.com, a1916.dscg2.akamai.net
Execution Graph export aborted for target SetupHelper, PID 1436 because it is empty
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: FiddlerSetup.5.0.20245.10105-latest.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
192.29.11.142	FiddlerSetup.5.0.20243.10853-latest.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	FiddlerSetup.5.0.20242.10753-latest.exe.7z	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse
52.252.156.53	FiddlerSetup.5.0.20243.10853-latest.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	FiddlerSetup.5.0.20242.10753-latest.exe.7z	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	https://www.telerik.com/download/fiddler	Get hash	malicious	Unknown	Browse
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4
18.66.122.7	https://www.dropbox.com/l/scl/AACFGimR3EJt-RbOzI8FO3hUk-bWh7Zwq_k	Get hash	malicious	Unknown	Browse
	https://www.dropbox.com/l/scl/AADL_v5DzsoHwkyegIhk6J0bQm3A7UWklCA	Get hash	malicious	Unknown	Browse
	https://www.dropbox.com/scl/fi/4fnryjjmfp8le01uyciyl/IASSecurity.paper?rlkey=4ezd7413h2y3rkfjifz9e7enl&st=6sa33sex&dl=0	Get hash	malicious	HTMLPhisher	Browse
	https://www.dropbox.com/l/scl/AACzaw-9E1aatxpEZpO1dkWZ_aWUL6KS_-Q	Get hash	malicious	Unknown	Browse
	http://10f4cf3.wcomhost.com/	Get hash	malicious	Unknown	Browse
13.224.245.89	http://my-ledgerlive-login.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse
	http://uphaild-login.gitbook.io/	Get hash	malicious	Unknown	Browse
	http://tok2np0ckht.top/	Get hash	malicious	HTMLPhisher	Browse
	https://app.startinfinity.com/p/i67650-d3d02d52-1ced-4ae1-878d-9b9804a9dcc0/paco-equipment-ef341	Get hash	malicious	Unknown	Browse
	http://arvestsave.embarkdigitalonboarding.com/	Get hash	malicious	Unknown	Browse
	http://starlit-lolly-57trf9.netlify.app/	Get hash	malicious	Unknown	Browse
	https://ad-content-not-following-community-st.netlify.app/dev_case_id_84868267986/	Get hash	malicious	Unknown	Browse
	https://cs-sweeps.com/registration?theme=m-2-blankerX&v_id=d0115da1-f9ca-21c8-0788-11016aff1766&capo=dHVybmh1Yi5uZXQ=&entityId=2&capoUrl=turnhub.net&page=m-2-blanker&clickid=63e051493bcb46d4b676bed39fd712dc&pubid=224_&a_aid=365dshtb44	Get hash	malicious	Unknown	Browse
	http://openeye.net	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
euob.ytwohlcq.telerik.com	FiddlerSetup.5.0.20243.10853-latest.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	18.239.94.100
	FiddlerSetup.5.0.20242.10753-latest.exe.7z	Get hash	malicious	PureLog Stealer, zgRAT	Browse	18.160.213.33
	SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	18.154.206.13
platform.twitter.map.fastly.net	https://sewing-ladyltd.myshopify.com/sol?syclid=365862d9-5d6e-4a94-b401-31f50f547182	Get hash	malicious	Unknown	Browse	146.75.120.157
	Invitation Letter from Ministry of Defence China.html	Get hash	malicious	HTMLPhisher	Browse	146.75.120.157
	http://xoilacxd.cc	Get hash	malicious	Unknown	Browse	146.75.120.157
	https://us.services.docusign.net/webforms-ux/v1.0/forms/de9dbdc77cc2367bb50c45c4d2a0b8c4	Get hash	malicious	Unknown	Browse	146.75.120.157
	https://bio.to/Q6knqu	Get hash	malicious	Unknown	Browse	146.75.120.157
	https://o000005496.photoshelter.com/	Get hash	malicious	Unknown	Browse	146.75.120.157
	http://software.oldversion.com/download.php?f=YTo1OntzOjQ6InRpbWUiO2k6MTczMTQ4OTAwMjtzOjI6ImlkIjtpOjEzODk4O3M6NDoiZmlsZSI7czo0MzoicGRmY3JlYXRvci0xLTYtMi1QREZDcmVhdG9yLTFfNl8yX3NldHVwLmV4ZSI7czozOiJ1cmwiO3M6NTA6Imh0dHA6Ly93d3cub2xkdmVyc2lvbi5jb20vd2luZG93cy9wZGZjcmVhdG9yLTEtNi0yIjtzOjQ6InBhc3MiO3M6MzI6IjMwYzExNzY3MTEwNWY3MjhjYjA0YzU2ZjkzYTc1YTRjIjt9	Get hash	malicious	Unknown	Browse	146.75.120.157
	https://axieu.com/terma/GeHDLf	Get hash	malicious	Unknown	Browse	146.75.120.157
	http://swctch.com	Get hash	malicious	Unknown	Browse	146.75.120.157
	https://anzsupportus.web.app/#	Get hash	malicious	Unknown	Browse	146.75.120.157
sni1gl.wpc.gammacdn.net	https://www.app-rackspaces.e-kei.pl/	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	http://app-rackspaces.e-kei.pl/	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	http://aprackspace.serveusers.com/	Get hash	malicious	Unknown	Browse	152.199.21.175
	http://ipfs.io/ipfs/QmdV2HGdtwWnonRSvaFvw4QTsSJKp6SREdhoc9BgEawLxT/Karyo.html	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	http://ipfs.io/ipfs/QmSsom8wzWHgXAAArwiqhdL56utwvwYhrV1nR1HmuJWqNX/level.html	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	FiddlerSetup.5.0.20243.10853-latest.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	152.199.21.175
	https://ipfs.io/ipfs/bafybeicrstdrgrb5nxrucbwv2zdzs2sc5ndvw4c5dfs6n5vqqa42x7qfpm/gttrindeed.html/	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	http://pub-94ea1b539f4b44779977b549b505079d.r2.dev/borhl.html	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	FiddlerSetup.5.0.20242.10753-latest.exe.7z	Get hash	malicious	PureLog Stealer, zgRAT	Browse	152.195.19.97
	SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	152.195.19.97
p01f.t.eloqua.com	FiddlerSetup.5.0.20243.10853-latest.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	192.29.11.142
	FiddlerSetup.5.0.20242.10753-latest.exe.7z	Get hash	malicious	PureLog Stealer, zgRAT	Browse	192.29.11.142
	SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	192.29.11.142
	https://www.telerik.com/download/fiddler	Get hash	malicious	Unknown	Browse	142.0.173.26
d6vtbcy3ong79.cloudfront.net	https://p2p.travelers.com/human.aspx?OrgID=3217&language=en&Username=melvinat%40davislaw.com&Arg06=178870601&Arg12=message	Get hash	malicious	Unknown	Browse	18.244.115.197
	FiddlerSetup.5.0.20243.10853-latest.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	18.244.115.182
	FiddlerSetup.5.0.20242.10753-latest.exe.7z	Get hash	malicious	PureLog Stealer, zgRAT	Browse	18.160.218.188
	SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	13.226.251.88
	https://www.telerik.com/download/fiddler	Get hash	malicious	Unknown	Browse	143.204.214.44

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://www.photogallerybd.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPWMydFJkbWs9JnVpZD1VU0VSMjgxMDIwMjRVMjQxMDI4NTQ=N0123N	Get hash	malicious	Mamba2FA	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.45
	Tjones-In Service Agreement-817744.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	https://tenereteam.digidip.net/visit?url=https%3A%2F%2Fzp73eW7jfL3crnrfCoQ60D1yS.adpk.com.br/xQwrPPjghfe/viWyugvQwer/bvdfreGhjik/saQriuhbT/SWn28u/ZnVjay55b3VAd2hhdGV2ZXIuY29t	Get hash	malicious	Unknown	Browse	13.107.246.45
	VNC Sales.xlsx	Get hash	malicious	Unknown	Browse	52.146.76.30
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	Remittance Advice__cybg.com_4093180040.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	https://midlandtxconstruction.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5VVmliM0U9JnVpZD1VU0VSMTcxMDIwMjRVMDAxMDE3NDA=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
AMAZON-02US	https://sewing-ladyltd.myshopify.com/sol?syclid=365862d9-5d6e-4a94-b401-31f50f547182	Get hash	malicious	Unknown	Browse	76.76.21.21
	ProtectedDoc.docx	Get hash	malicious	KnowBe4	Browse	52.217.133.184
	https://www.photogallerybd.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPWMydFJkbWs9JnVpZD1VU0VSMjgxMDIwMjRVMjQxMDI4NTQ=N0123N	Get hash	malicious	Mamba2FA	Browse	13.35.58.91
	http://deepai.org	Get hash	malicious	LiteHTTP Bot	Browse	108.128.191.47
	gusetup.exe	Get hash	malicious	Unknown	Browse	18.197.133.28
	https://www.youtubedownloaderhd.com/	Get hash	malicious	Unknown	Browse	108.138.26.111
	.i.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://tenereteam.digidip.net/visit?url=https%3A%2F%2Fzp73eW7jfL3crnrfCoQ60D1yS.adpk.com.br/xQwrPPjghfe/viWyugvQwer/bvdfreGhjik/saQriuhbT/SWn28u/ZnVjay55b3VAd2hhdGV2ZXIuY29t	Get hash	malicious	Unknown	Browse	3.125.2.57
	https://brand.page/N0www1904	Get hash	malicious	Unknown	Browse	13.35.58.6
	sshd.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
ORACLE-BMC-31898US	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	https://bankinter.codix-imx.solutions/iMX/login.jsp	Get hash	malicious	Unknown	Browse	193.122.9.62
	EKSTRE_1022.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	dekont_7083037 T#U00dcRK#U0130YE HALK BANKASI A.#U015e pdf .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	CloudServices_Slayed.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.6.168
	CloudServices.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	SOF-41593-21052024112851.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	xd.ppc.elf	Get hash	malicious	Mirai	Browse	144.25.107.55
	xd.mips.elf	Get hash	malicious	Mirai	Browse	193.123.85.107
	Transfer Copy Invoice92384747swift.com.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://www.photogallerybd.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPWMydFJkbWs9JnVpZD1VU0VSMjgxMDIwMjRVMjQxMDI4NTQ=N0123N	Get hash	malicious	Mamba2FA	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.45
	Tjones-In Service Agreement-817744.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	https://tenereteam.digidip.net/visit?url=https%3A%2F%2Fzp73eW7jfL3crnrfCoQ60D1yS.adpk.com.br/xQwrPPjghfe/viWyugvQwer/bvdfreGhjik/saQriuhbT/SWn28u/ZnVjay55b3VAd2hhdGV2ZXIuY29t	Get hash	malicious	Unknown	Browse	13.107.246.45
	VNC Sales.xlsx	Get hash	malicious	Unknown	Browse	52.146.76.30
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	Remittance Advice__cybg.com_4093180040.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	https://midlandtxconstruction.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5VVmliM0U9JnVpZD1VU0VSMTcxMDIwMjRVMDAxMDE3NDA=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://sewing-ladyltd.myshopify.com/sol?syclid=365862d9-5d6e-4a94-b401-31f50f547182	Get hash	malicious	Unknown	Browse	2.19.244.127 52.149.20.212 13.107.246.45 20.12.23.50
	ProtectedDoc.docx	Get hash	malicious	KnowBe4	Browse	2.19.244.127 52.149.20.212 13.107.246.45 20.12.23.50
	https://www.photogallerybd.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPWMydFJkbWs9JnVpZD1VU0VSMjgxMDIwMjRVMjQxMDI4NTQ=N0123N	Get hash	malicious	Mamba2FA	Browse	2.19.244.127 52.149.20.212 13.107.246.45 20.12.23.50
	http://5p.valcondunar.com	Get hash	malicious	Unknown	Browse	2.19.244.127 52.149.20.212 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	LummaC	Browse	2.19.244.127 52.149.20.212 13.107.246.45 20.12.23.50
	http://deepai.org	Get hash	malicious	LiteHTTP Bot	Browse	2.19.244.127 52.149.20.212 13.107.246.45 20.12.23.50
	gusetup.exe	Get hash	malicious	Unknown	Browse	2.19.244.127 52.149.20.212 13.107.246.45 20.12.23.50
	https://www.youtubedownloaderhd.com/	Get hash	malicious	Unknown	Browse	2.19.244.127 52.149.20.212 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	2.19.244.127 52.149.20.212 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	LummaC	Browse	2.19.244.127 52.149.20.212 13.107.246.45 20.12.23.50

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Programs\Fiddler\Be.Windows.Forms.HexBox.dll	FiddlerSetup.5.0.20243.10853-latest.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	FiddlerSetup.5.0.20242.10753-latest.exe.7z	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	Update_browser_17.645327.js	Get hash	malicious	NetSupport RAT	Browse
	Update_browser_17.645329.js	Get hash	malicious	NetSupport RAT	Browse
	Update_browser_17.6436.js	Get hash	malicious	NetSupport RAT	Browse
	Update_browser_17.645330.js	Get hash	malicious	NetSupport RAT	Browse
	Update_browser_17.645328.js	Get hash	malicious	NetSupport RAT	Browse
	https://www.telerik.com/download/fiddler	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Programs\Fiddler\Analytics.dll	FiddlerSetup.5.0.20243.10853-latest.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	FiddlerSetup.5.0.20242.10753-latest.exe.7z	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	https://www.telerik.com/download/fiddler	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SetupHelper.log

Download File

Process:	C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Programs\Fiddler\Analytics.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33224
Entropy (8bit):	6.525851583552875
Encrypted:	false
SSDEEP:	384:gpeCB0nVQ/EMq7+Zi9nQwnHgfLtVUEoBXejF6XFlnwnYPLYyTcGq1y2h33XcQ7:/U0VQMMrZi9QiHWtVxOFxwxGqXR7
MD5:	1C2BD080B0E972A3EE1579895EA17B42
SHA1:	A09454BC976B4AF549A6347618F846D4C93B769B
SHA-256:	166E1A6CF86B254525A03D1510FE76DA574F977C012064DF39DD6F4AF72A4B29
SHA-512:	946E56D543A6D00674D8FA17ECD9589CBA3211CFA52C978E0C9DAB0FA45CDFC7787245D14308F5692BD99D621C0CACA3C546259FCFA725FFF9171B144514B6E0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: FiddlerSetup.5.0.20243.10853-latest.exe, Detection: malicious, Browse Filename: FiddlerSetup.5.0.20242.10753-latest.exe.7z, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4.+[.........." ..0..F...........e... ........... ....................................`..................................d..O....................N...3.......... d............................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................d......H............4...................c.......................................0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3.J.(.....s....}.....0...........{......,....o......&...................0..S........{....,..H..}.....,9.{....o.....+..o.....o.....o....-....,..o......~....o......&......... ..8..........OO.......0..S........{....-..H..}.....{....o.....+..o......u....,..u....o.....o....-....,..o.......&...........

C:\Users\user\AppData\Local\Programs\Fiddler\Analytics.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	MSVC program database ver 7.00, 512*95 bytes
Category:	dropped
Size (bytes):	48640
Entropy (8bit):	3.4063107578330305
Encrypted:	false
SSDEEP:	384:IzCZdxQVINRdRoNFAYAz3GclBLEKiuNCFJkOLxYbs63N:fxz3oNqbTLUnjpLxY
MD5:	F84FB6CD84B5D07E3DE4D78D38F388FF
SHA1:	0B31F09EEB1AF0681614C2F9F90D98B541DF580F
SHA-256:	03CA5A20D36BBC0AEA28AA3184D65B322CECC3080D55A975CDF0F5D31199829D
SHA-512:	03FA13B39D4FAE8BC83B4F37CF24AAFC8C4A12A5DB0462968AE6A0C96232D727DF9264D190FF641115921E350A1981AD518A4740C20E54C433B2F2065522AD52
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS..........._...........[...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\App.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	MS Windows icon resource - 8 icons, 32x32, 8 bits/pixel, 16x16, 8 bits/pixel
Category:	dropped
Size (bytes):	25517
Entropy (8bit):	3.599286303451927
Encrypted:	false
SSDEEP:	768:iYgTDEuowwuwwwwowwwwwwIwwwwwwwwOwwwwwwwwwwIwwwwwwwwwwwwowwwwwwws:iYKowwuwwwwowwwwwwIwwwwwwwwOwww8
MD5:	2D49CDB07BAAD04A2BC9F50547783C6A
SHA1:	604BAC84FD8AE87BBE9DC9A7C6503CB3A4014839
SHA-256:	FBE4D11CA28371BF36D48378A9E1DA29DCE0EFC373FF4E092E47B656505FC4C4
SHA-512:	CDEDF711EAD1C551D33050DB4C9502E09F50534904B1ABFCE72AAF64846A9032886BDB19F31AF30C1E1A46303CD147091E4ECF244486934D8B3B7F3B7B25521D
Malicious:	false
Preview:	...... ......................h............. .........00.... ..%...... .... .....]>........ ......O........ ......X........ .h...E_..(... ...@...................................9. .:.!.@.'.B.*.C.,.D.,.I.1.K.4.L.6.Y.D.^.J.a.M.k.Y.k.].s.a.p.f...r...v...x.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\Be.Windows.Forms.HexBox.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61816
Entropy (8bit):	6.170522177953126
Encrypted:	false
SSDEEP:	1536:/KS4Z+5ZUOxinOGm7kF5Gw5qQ0DaK/nbL0LolKo4I/AhYe:T4ZkiHOGT0Dpf08Bve
MD5:	E6F7B8C5EC4D1543EAA7F5D148C6327C
SHA1:	61A5BF82B4F7DA4040F76E7AEC4B4B5FE0C544EC
SHA-256:	BBFD21490A4BE96E1A44A92E39406E87978AEA1FC58B603702E4E21A143DD89E
SHA-512:	6F4516677937F6D58D250F7B6A50F3815691F84AC17E455DD09DC6D4ECC215A8A8EA000706885C858708603223661908067ED36C037766A52D15F2EB33AF1FC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: FiddlerSetup.5.0.20243.10853-latest.exe, Detection: malicious, Browse Filename: FiddlerSetup.5.0.20242.10753-latest.exe.7z, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe, Detection: malicious, Browse Filename: Update_browser_17.645327.js, Detection: malicious, Browse Filename: Update_browser_17.645329.js, Detection: malicious, Browse Filename: Update_browser_17.6436.js, Detection: malicious, Browse Filename: Update_browser_17.645330.js, Detection: malicious, Browse Filename: Update_browser_17.645328.js, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0..T...........!..................... ........... ....................... ......9.....@.....................................O.......................x3........................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Ho...e...........n................................................(....:.(......(......(......0..&........(......i........}.......{......(....Z.{....-........{....v..}.....{....,..{......o....Z.{....,..{......o......{...."..}......0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3..{......

C:\Users\user\AppData\Local\Programs\Fiddler\Countdown.wav

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 22050 Hz
Category:	dropped
Size (bytes):	1406
Entropy (8bit):	1.5924009631413472
Encrypted:	false
SSDEEP:	12:MREwW732ltVOelT71qf4lhk7F5JU1OGuNE0EsHsktLhZv:QEH32l+elTy4lh2F5q9u9hhZv
MD5:	3241067E4D532F5FEB4AD907076946B0
SHA1:	9130FEFCAA638B7128C09EA12EE81A4D3A8AA720
SHA-256:	E10937BD9491CC7944C8C5904FAA3ECD971B329438CC1E5FE606CE731DC15DBC
SHA-512:	D9F189C89242594F9FD89C353037F2822B7869639C30984C424F7C45AD2F5135808EBCB776A6D7730F479147A3CCC9F33C246E33B7C1CCAA140B72DB93219600
Malicious:	false
Preview:	RIFFv...WAVEfmt ........"V..D.......dataR...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\DotNetZip.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	472064
Entropy (8bit):	6.800291881803086
Encrypted:	false
SSDEEP:	6144:DuCInHLhJI4FY/ixjci6ychf8xalGQGtSV41kJDsTDDpBnse6OVxLV/W:3QL32ikCaUS4csRBse6sfW
MD5:	A999D7F3807564CC816C16F862A60BBE
SHA1:	1EE724DAAF70C6B0083BF589674B6F6D8427544F
SHA-256:	8E9C0362E9BFB3C49AF59E1B4D376D3E85B13AED0FBC3F5C0E1EBC99C07345F3
SHA-512:	6F1F73314D86AE324CC7F55D8E6352E90D4A47F0200671F7069DAA98592DAACEEA34CF89B47DEFBECDDA7D3B3E4682DE70E80A5275567B82AA81B002958E4414
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....p.a.........." ..0..,............... ...`....... ....................................@.....................................O....`............................................................................... ............... ..H............text...l+... ...,.................. ..`.rsrc........`......................@..@.reloc...............2..............@..B........................H.......................$..../............................................{...."..}.......(......0..F.......s....%r...po ....{.........(<...o ...r...po ....\|....(!...o ...&o"......0...........s#......o$...(.....0.............{......E............,.......8...D...+Q..{..........+M..{.......+A..{..........+2..{.......+&..{.......+...{..........+.r...ps%...z.6..om...(......(....*....0..a.......s....%.\|..........o"...o ...r...po ....{.........(<...o ...r...po ....\|....r#..p

C:\Users\user\AppData\Local\Programs\Fiddler\EnableLoopback.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	84040
Entropy (8bit):	5.593238479544139
Encrypted:	false
SSDEEP:	768:AREI16zcI2eupxmhm/ljPb0O7/Al25znrShUABg4CqnZx6qmmlkoxPLabCxf1mlr:y1HLdwOLFzrShURwZoxmlkoxDtfIIM
MD5:	81564947D42846910EEC2D08310E0D25
SHA1:	B7A167DCD3AFB29C8A0E18C943D634E3FC58A44C
SHA-256:	543F16B73F7D40177585332F433CE76DDDC1526E12BCD62CB73EDD11EB002341
SHA-512:	8F06409517697B022787BC9E2ED7E73100018422177AA3F63ECB406C3BDB6B021624F909A16FCA0430002BFA7D35A461B38750C79C0273A154F63316B4E13037
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#..g.........."...0......R........... ........@.. ...............................8....`.....................................O........O...........(..H ...`......\|................................................ ............... ..H............text........ ...................... ..`.rsrc....O.......P..................@..@.reloc.......`.......&..............@..B........................H........G...^......L...$...XK............................................(.....0..A........(....-..r...po....-.. ....s........o....~....([.....-..o....."..(V..."..(Y..."..(Z...2......(W.....(X.....{....,..{.....i./.r...pr...p.{....(......{...."..}......{....B.{....%-.&r...p...{....(....,..{....o....r=..p..{....o...../.rU..pr...p.{....(....B.{....%-.&rq..pB.{....%-.&r...pB.{....%-.&r...p.0...........s....}.....~....}.....(......}......}.....r...p}.....r.

C:\Users\user\AppData\Local\Programs\Fiddler\EnableLoopback.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	MSVC program database ver 7.00, 512*115 bytes
Category:	dropped
Size (bytes):	58880
Entropy (8bit):	3.630616860600802
Encrypted:	false
SSDEEP:	768:DpRUiZxj/OiqdAJ5YvwKGuctURhEbi/N3Z:1qdc+YlUtV
MD5:	2E546F82FB5BDD9C5CD4E9A840A2559E
SHA1:	E2CF9985022B2CA78C65009E120BD8D7C484FE99
SHA-256:	B4E093041DD9943E8401D489FA65706F2D7853AB9A092F6612BDD59C8BB4A975
SHA-512:	23127F8D29653B3609234EB14C8138445E138BB62021376F4ED0FF26DE13E4D47D37FB38CD2F60F3AA60D013B8C4C0808284850A1F2CEA2CDFD5164EDE5BDE7D
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........s...0.......r...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\ExecAction.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19832
Entropy (8bit):	6.657885201327926
Encrypted:	false
SSDEEP:	192:ZsCrRJUlWDSnYe+PjPxucwwSoDvucwwfih5H0JOqxEV1a//bZ28WhTEn:GGOZnYPLxoAjo4S+JNY1cAhhY
MD5:	519310853C0EE273A3F8787D7518DD2E
SHA1:	22C4E25C4C4C2B5654D05CD6A1E737C6BCB588D8
SHA-256:	A23C852D3ED4148044708925E56E17246CDB88D6ECAAA375503FA1F915BA1272
SHA-512:	30E51202416AB2D0BAC9CD294D08C12D7973E75696283B1823C6442033698F85075D14DCD79FB1F56886F4491981B1E278D3A506E5E458A1EEE6BB372D5E683D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...D.S............................>-... ...@....@.. ....................................@..................................,..K....@.. ...............x3...`......h,............................................... ............... ..H............text...D.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B................ -......H........ ...............................................................0............i...r...p(......rT..p(.....~.....(....,.r...p(............... ....(....}.........}......(......{....o.....i}......J~......(....&...BSJB............v4.0.30319......l.......#~..$.......#Strings............#US.........#GUID...........#Blob...........W.........%3............................................................................K.D...R.D...............".....A.....Z.....s.............

C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3668408
Entropy (8bit):	6.131373696684986
Encrypted:	false
SSDEEP:	49152:cbvLSgf+VOdx3Vw5+mbSgwJKI0Qpvs3c2KTn4Xj9Bh:cTmgf+VOdc5vbSgwJKDP24Rf
MD5:	87BC17F56E744E74408E6AE8BB28B724
SHA1:	3AA572388083FF00A95405D34D1189C99C7FF5BE
SHA-256:	FFB24FC36ADE87988F9908E848D0333CE7FFB2B4E4D0FFB43F6556246069D057
SHA-512:	CBEEE155C97B87A22B92B808F86FEE25C18DB51AB43A36B657D532D2D47D3A7DB2F4507A699B72AF904BF6D5ED851D1AE1FCFB4833A57096E6C7787211C0F35D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...!..g..............0..d7..p........7.. ....7...@.. .......................@8.......8...`.................................P.7.K.....7.`m............7..#... 8.......7.............................................. ............... ..H............text....c7.. ...d7................. ..`.rsrc...`m....7..n...f7.............@..@.reloc....... 8.......7.............@..B..................7.....H.......`z!.............TT-..+....7....................................."+.(..wk...J+.(.U{[(a5..(.....:+.(..<.(.....:+.(g.:U.{.....:+.(...W.{.....:+.(..0g.{......+.(..Hi(.6...(......}......}......}........0..i.......+.(D..> ........8........E........,.......y...........S...8.....u...... ....~....{....9....& ....8.......;.... ....~....{....:....& ....8......9.... ....~....{....:q...& ....8f...(.....{......{....o....:Z... ....~....{....:6...& ....8+...(.....{......{....

C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	261
Entropy (8bit):	4.985852904910388
Encrypted:	false
SSDEEP:	6:JiMVBdTMkII5KNZk2ygAyONw5K3OSO1N5MC5lvfqHlE3QIm:MMHd41zNZoE0w03OSO1NNqm3xm
MD5:	C2EDC7B631ABCE6DB98B978995561E57
SHA1:	5B1E7A3548763CB6C30145065CFA4B85ED68EB31
SHA-256:	E59AFC2818AD61C1338197A112C936A811C5341614F4AD9AD33D35C8356C0B14
SHA-512:	5BEF4B5487ECB4226544EF0F68D17309CF64BFE52D5C64732480A10F94259B69D2646E4C1B22AA5C80143A4057EE17B06239EC131D5FE0AF6C4AB30E351FABA2
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <runtime>.. <generatePublisherEvidence enabled="false"/>.. </runtime>.. <appSettings>.. <add key="EnableWindowsFormsHighDpiAutoResizing" value="true" />.. </appSettings>..</configuration>..

C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	MSVC program database ver 7.00, 512*3655 bytes
Category:	dropped
Size (bytes):	1871360
Entropy (8bit):	4.306964678215916
Encrypted:	false
SSDEEP:	12288:g+KL1RuHRAvLd5aHBh+8uLcIOpfSZs5qwBmo52D:gbxRuHRAvLdwHBhrucys5qUmoo
MD5:	5C43B7F1CFF2F8F74D0C75721DD34797
SHA1:	75ACF5D64BD38A4483B8CA99EC7D89AF4A13E060
SHA-256:	9C50823F84CE09AF60ED760C95CE73DA559505DBF411EF7797F4CE65FC0BF1BB
SHA-512:	41984C51A4FFF1EC003ACE3E86A26A1A0612CC86DF995FEA9D2183E937FC8E20EC44E796AE7178AB12DF657337016A88D1FAC5DA55CCDD56F048AB7E7F089661
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........G...8A......F...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\ForceCPU.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19832
Entropy (8bit):	6.665574873412458
Encrypted:	false
SSDEEP:	192:fHtIemmfltxD5WLtWwiyT5hNGnYe+PjPxucwwyibSucwwQJk35H0JOqxEV1a//bG:xD5WLZ5qnYPLxoDfoDg+JNY1cAhhv
MD5:	B982A103B0D4E0DB856026A163124BF3
SHA1:	40772BE00068BBD394FF0FCCD551151A822F3E70
SHA-256:	2D209C2B823E350C1F1661F87A3A013804302477AFE56877F94ADBAFE7A2E06D
SHA-512:	214ECDF348E2093E91A489C0541F05EB3356E2531C1840A99D9F727CAF1130F5041CCBC6356A7BC31FB4DECE927D3FEE2FA9E4689D2BADBE680FD40104A9D327
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../..R............................N.... ...@....@.. ....................................@.....................................K....@..................x3...`....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0.......H........"..8............................................................0..h.........r...p..s.......s...... ....j.o....&.o.........3........-..o........r...p.o....(....(............+............"1..........BC.......0..Y.........r...p..s......s...... .....o....&..o......o........ ..r...p.o....(....(...........+..............56.......0..O........r)..p(.....ru..p(.....r...p(.....r...p(.....r...p(.....r...p(.....r...p(.....*..0.............i........-..(.......8.......r3..p.o..

C:\Users\user\AppData\Local\Programs\Fiddler\GA.Analytics.Monitor.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	53704
Entropy (8bit):	6.271434268217771
Encrypted:	false
SSDEEP:	768:7su21mzJ3+LDDke5WcsvOvHOQ+5bQZdKXJccxYi:7qmByvke5Wcs22QRGKLi
MD5:	6F9E5C4B5662C7F8D1159EDCBA6E7429
SHA1:	C7630476A50A953DAB490931B99D2A5ECA96F9F6
SHA-256:	E3261A13953F4BEDEC65957B58074C71D2E1B9926529D48C77CFB1E70EC68790
SHA-512:	78FD28A0B19A3DAE1D0AE151CE09A42F7542DE816222105D4DAFE1C0932586B799B835E611CE39A9C9424E60786FBD2949CABAC3F006D611078E85B345E148C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4.+[.........." ..0.................. ........... ..............................).....`.................................?...O.......`................3........................................................... ............... ..H............text........ ...................... ..`.rsrc...`...........................@..@.reloc..............................@..B................s.......H.......PM...c..........................................................>..(......(......{...."..}......{...."..}....f.(......(.....(....(......{...."..}......{...."..}......{......{...."..}......{...."..}......(.....s....}.....{.....o.....s....}......(.....s....}.....{.....o......s....}......(......s....}.....{.....o......s....}........0..z........-.r...ps....z.-.r...ps....zs......r!..pr%..po.....r1..p.o.....r7..p.o.....,..r=..p.o.....,..rC..p..(....(....o.

C:\Users\user\AppData\Local\Programs\Fiddler\GA.Analytics.Monitor.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	MSVC program database ver 7.00, 512*187 bytes
Category:	dropped
Size (bytes):	95744
Entropy (8bit):	3.5761633792805214
Encrypted:	false
SSDEEP:	768:qT0N9rXf8+G/ne3F8VWITK2gaZbAjJcrNtPja+RLDVa:i0N9rX2nevITK2CjC2+RPVa
MD5:	DF9591879A5AF2A8458FB9148E197313
SHA1:	189DF547DB269F1694603EAB40519EC0086FC326
SHA-256:	6C19EC08FFB13998ACE51E1B531128AF12CD47CCADFF5E346176C6992C00A843
SHA-512:	89C8F7686048E3329D47BD7F6678CCA880D1C2A704664A44276090ED2A5B6452D964C69E2D0161EC8B69586E3AAE3C99F63445C22122A1B9BF532234F93AF65C
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\ImportExport\BasicFormats.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	114248
Entropy (8bit):	5.83677610073684
Encrypted:	false
SSDEEP:	3072:T5zlHe5PmH2YVy3zhKOupG9g1rERA1Ten6V++HOHv7w:Lg/d2Z
MD5:	58A251D92731AFB962B29636A887B9C7
SHA1:	E54785F1804C9613B0E5B1728AEE97F49B6D66AD
SHA-256:	28A908AC2D08DE1DD2AE55EDFA417FF72F535EC9207226A9FF4A0134871429F3
SHA-512:	4831534FEBA39A30E7CF86E496C41FF7661D44784AA80B6CE1562B71BC36EAE38308DDA46E76209B919952E5E615AB5B8AD80CC349B78522F6E87E4A45F1B421
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..g.........." ..0.................. ........... ...............................b....`.................................h...O.......................H ..........0................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......$...\|............................................................+".o.....3..o....r...p(....,..o.....o....-.~......0..w.......s.....+`.o.....3W.o......r...p(....-..r...p(....-.+4..o....o....&.r!..po....&+...o....o....&.r'..po....&.o....-..o....*..0............r-..p.r7..p......8.....o.....@.....o........rI..p(....-:..rQ..p(....-5..r_..p(....->..rw..p(....-G..r...p(....-G+R.o.....+I.o......(....,:r-..p.+2.o......(....,#r7..p.+..o....(.....+..o....(.......o....:G...r..

C:\Users\user\AppData\Local\Programs\Fiddler\ImportExport\BasicFormats.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	MSVC program database ver 7.00, 512*367 bytes
Category:	dropped
Size (bytes):	187904
Entropy (8bit):	3.9001442499609995
Encrypted:	false
SSDEEP:	1536:YhKTzCxE+1iFoNKelb/PxrEw+aFlq/N/Q55T4aXrkAcQ3hIHDmcSvbhcVYhN2xXs:YsaXrZxymcYhtN+UgwsC6Yd
MD5:	4EDF49F4586AAC097367723D0AF7E94C
SHA1:	B3194A116E69672FE2D83A66E164D5E1A67823FB
SHA-256:	9E3A2B553A53F069572285911E38800E9B696BD5C72D445009E844A59D8A1B7B
SHA-512:	0CAC8AF303A608D7A5DDFC8084E6F6262E726677248AFE5BD63CA1C2C9DC1CBAAEFEBB1E358934EE8FC3268C9867C02E8ABD2650ECFE15298E92ACEB60A02D1A
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........o...........l...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\ImportExport\VSWebTestExport.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45128
Entropy (8bit):	5.969741385593911
Encrypted:	false
SSDEEP:	768:obJ9YyrdngGT7Enn/IRXILJtGiU83aTwBmxCnF0Cxf1mlD0Z:EyEw/LtrU83aImx4fIIZ
MD5:	03FCFF4A49159E5C405420DF08B37757
SHA1:	89B0BC35A78F56212E53556E45D1F9039D2488D1
SHA-256:	5566857F213582DDCA5D202BC19A1B649061437FBFD7E699AFD64986FEA5FB61
SHA-512:	8CB0D400B848D01E74A0050CDD779224D96DB3B87EA393A098A5E75C52C16FD3B3BF20F49196DA976AF61960C865620EF82FF0295774E2E67AC5C92949C248C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#..g.........." ..0.................. ........... ..............................,.....`....................................O.......................H ........................................................... ............... ..H............text... .... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........K..XY.........................................................j.(.....(......}.....(......0..C........{....o.....+...(......{....o......o....&..(....-...........o..............(4........{...."..}....z.,..{....,..{....o......(....*.0...........s....}.....s....}.....s....}.....s....}.....(.....{......o.....{.....o.....{......s....o.....{....r...po ....{.... .... ....s!...o"....{.....o#....{......o.....{.....o$....{.... .... ....s....o.....{....r...po ....{.....K..

C:\Users\user\AppData\Local\Programs\Fiddler\ImportExport\VSWebTestExport.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	MSVC program database ver 7.00, 512*203 bytes
Category:	dropped
Size (bytes):	103936
Entropy (8bit):	3.8049460739974887
Encrypted:	false
SSDEEP:	768:9b4+hNvVmLAzJJ1LcR4OSEMGvq/G2HzfKRPb3eUCYiumAyxens+d0hT/Hj8qnAOL:9TfKRPb3D1y8nehTvpAOd/dV5
MD5:	E6B2EEF554733187FA765E2D268794F9
SHA1:	15387EB99DC7C3CD14425AD0662AAEE40BD568DC
SHA-256:	1000C8BBFB78A5F3F0A9575814A166799E93538045DBF6ED18E19D403EB3BC0D
SHA-512:	C59BD84BD6457F3B37B9A76CB9D0F879695242D20AB1A721E82092FA4BBCB4C68AEB6B83A88C2BBF960B6AF801C5D0A224855C3B421258E0843C70FFF7F7FA90
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\QWhale.Common.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	5.177812068372721
Encrypted:	false
SSDEEP:	1536:jnPlSpsvrGlP3wYeBKpqmSNbgM9ZtZLZQErK3PmIDXRtFhCj6ocpjyc44lc:rlSpsnQCg4ZtZmECfRtF0cpjy94lc
MD5:	AC80E3CA5EC3ED77EF7F1A5648FD605A
SHA1:	593077C0D921DF0819D48B627D4A140967A6B9E0
SHA-256:	93B0F5D3A2A8A82DA1368309C91286EE545B9ED9DC57AD1B31C229E2C11C00B5
SHA-512:	3ECC0FE3107370CB5EF5003B5317E4EA0D78BD122D662525EC4912DC30B8A1849C4FA2BBB76E6552B571F156D616456724AEE6CD9495AE60A7CB4AAA6CF22159
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8V...........!......... ........... ........@.. .......................@............@.....................................W............................ ......X................................................ ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\QWhale.Editor.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	835584
Entropy (8bit):	5.8267693764214945
Encrypted:	false
SSDEEP:	12288:vC84TFHhCRR87er17m62l/YpMVuRWGoN0ty6B:vC9T+R87er325wMVuRaGtPB
MD5:	EAA268802C633F27FCFC90FD0F986E10
SHA1:	21F3A19D6958BCFE9209DF40C4FD8E7C4CE7A76F
SHA-256:	FE26C7E4723BF81124CDCFD5211B70F5E348250AE74B6C0ABC326F1084EC3D54
SHA-512:	C0D6559FC482350C4ED5C5A9A0C0C58EEC0A1371F5A254C20AE85521F5CEC4C917596BC2EC538C665C3AA8E7EE7B2D3D322B3601D69B605914280FF38315BB47
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8V...........!......... .......... ........@.. ...................................@.....................................K.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\QWhale.Syntax.Schemes.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	290816
Entropy (8bit):	4.492482530864054
Encrypted:	false
SSDEEP:	1536:/YiCDgqGqtbeBLmTnNLUSgk9NPOEbg0hIc2Vrl2XuPtlPpXB1sJOm8M93f2AkkgW:abMmTnNLUSgk9NPOEL2Wg1TOV
MD5:	681ABB88692A8D2662C527EAB350744B
SHA1:	58BF5FDFA668C2ADD65A6B7EDBB43EAB47648821
SHA-256:	9AD5749BA1914101CD4CF2736D0E74BBB8C7ABBE93FD5E83377D5CBF33DDB78D
SHA-512:	5F2A370B4BD64E03469DDAA90B7EBD75E588033DBE48AE1B111FA537E56AA13B5BD7E067126D3CC543FAF45CD0595EA2355D8FA412197B61F18754E4F9876823
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8V...........!.....@... .......P... ...`....@.. ..............................G.....@..................................P..K....`...............................P............................................... ............... ..H............text....0... ...@.................. ..`.rsrc........`.......P..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\QWhale.Syntax.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	233472
Entropy (8bit):	5.650842692777023
Encrypted:	false
SSDEEP:	3072:Ns/3b/8FpHf3kBFcCsbfqai2/8Fjitdmus95jMRrgk+vWZYz39dHiB796k9gR5+r:NQLa/kBFcCsbfRgzM07XGk+V
MD5:	3BE64186E6E8AD19DC3559EE3C307070
SHA1:	2F9E70E04189F6C736A3B9D0642F46208C60380A
SHA-256:	79A2C829DE00E56D75EEB81CD97B04EAE96BC41D6A2DBDC0CA4E7E0B454B1B7C
SHA-512:	7D0E657B3A1C23D13D1A7E7D1B95B4D9280CB08A0ACA641FEB9A89E6B8F0C8760499D63E240FE9C62022790A4822BF4FE2C9D9B19B12BD7F0451454BE471FF78
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8V...........!.....`... ......>w... ........@.. ....................................@..................................v..W...................................hv............................................... ............... ..H............text...DW... ...`.................. ..`.rsrc................p..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\Standard.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	252488
Entropy (8bit):	5.5158865195833995
Encrypted:	false
SSDEEP:	6144:5DdXkVTfwIyE8W+pb7fUQ/51ftYx2Ngzs2L3NUR/m1N:5DdXkiIyEV+pb7Znrxmb
MD5:	2F2DCF9A8BEA903A95ABB95808066201
SHA1:	98B473A015E874638D35731710B5790FE8EC9DF9
SHA-256:	E7F653B706F4D083D089670B8862B579F888450D3184085BC970DAA3FF040012
SHA-512:	228F56ACEA5AC941DCB192775F8E8E8230C0B0E24487F135BFB5025B1A1BF64EE8CC733C44F5DCDC8EB2F63A9040E9A8EC251EC3E105F81E3007D31A15608344
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..g.........." ..0.................. ........... ....................... .......l....`.....................................O.......`...............H ........................................................... ............... ..H............text........ ...................... ..`.rsrc...`...........................@..@.reloc..............................@..B........................H.......4...@...........t................................................0..`........(.....(......}.....{....~....o....~.....{....o....o.....%.{.....{....o....o....~....s....o....z.,..{....,..{....o......( .....0...........s!...}.....("....{....(#...o.....{.....o$....{....r...p"...A...s%...o.....{.....o&....{......s'...o(....{....r...po)....{.....o*....{.... 0... ....s+...o,....{.....o-....{....r'..po.....{...........s/...o0....(1....{....o2....r)..p().... 0... ....s+...(,.

C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\SyntaxView.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69704
Entropy (8bit):	5.272364253119166
Encrypted:	false
SSDEEP:	1536:KSYKCJHDFPc0WIo1zf2tr7OWzKxrCfIP:K2CRDFYIo1zfBgG/
MD5:	49C71E4F9141CC77798718E41EC8A0D3
SHA1:	84BF7E9F3A462DBBE7EE3E627A83422CF0DF4D08
SHA-256:	9C5178B2AAB92A79BE9E4B31E2214D6650961B53BBDC48D952D20725E473B2FE
SHA-512:	ED7D35E6929670CD181A398B4C09FDF444B7EACFF147A9BE3BC783944E65541EBF883629FC23D6C6B642EB6719E8E9FA8A4D1C4C9EF65BA78D1EA5539F9F4843
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#..g.........." ..0...... ........... ........... ....................... ............`.....................................O.......l...............H ........................................................... ............... ..H............text........ ...................... ..`.rsrc...l...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\LoadScript.wav

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 8 bit, mono 8000 Hz
Category:	dropped
Size (bytes):	4781
Entropy (8bit):	6.524615403942935
Encrypted:	false
SSDEEP:	96:IiHTx2ZENf0NWxuKKVf5Pwb1fT0qUB6X6:lTx22kWxujf5Pwb1b07
MD5:	6EA0ADCB5AF7AB65714E76374AD655FE
SHA1:	6BD0ECAFD9ECD4B7921624DBA983680CADEC14FE
SHA-256:	4D97CAEEE07CFD354E2F5210AD1522C948BDCFC520FE8BDE27652CDA92F28241
SHA-512:	834391490FE6F99EFE358DBD58F051A87717ACCCE839FDE5524F8CEF4D7F872707B220AE975591038909E9AE95D04A04104EE7294D4AC0C53ECF5CA0076C4E39
Malicious:	false
Preview:	RIFF....WAVEfmt ........@...@.......data....}}{{{{{y{{}}.........}ytrkggbdkry............p`SG<<?EQ^p............gO;+ ..);Ol...........cF,......Kj...........aB.....1Kj..........._C).....4Nl..........._C,.....4Nl..........}_D,...."5Ql..........}`D+....#8Qo..........}^C,....#8Qo..........{^C,....$9To..........{^D-....':Tq..........{]B.....(<Uq..........y]C,....(=Ws..........y[C-....)=Ws..........z\B.....@Xt..........x\B,....-@Zv..........x\C-....-CZv..........xZA,... .C]v..........v[B-...!1D]x..........v[B- .."1F]x..........vZA.!..#2G_x..........tX?- ..%4I`z...........tX@- ..&5Ibz...........tYA,...'7Lb\|...........sW?+ ..):Nd\|..........sV>,!..:Nd\|..........qV>,"."+;Of~..........qV?-"."-<Of~...........qU>,!.#.>Sh...........pU=-".$/@Tj...........pT=,! '1BVk...........pT<+" '3EXl...........nS;!!(4EXm...........nS;,$$8GZm...........mR<-&&-9HZo...........mR;,%'-;L\p...........lQ;,&(.;L^q...........lP9+'(2?N`r...........lP9,')3@Oar...........lP;.-7DRbs....

C:\Users\user\AppData\Local\Programs\Fiddler\LoadScriptError.wav

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 8 bit, mono 8000 Hz
Category:	dropped
Size (bytes):	1490
Entropy (8bit):	7.084431883129677
Encrypted:	false
SSDEEP:	24:Lh8u49YDWju0+Ufc7fGT/+sDQdEU92zKWGw+SVb4Z1ljHK8zEceIol9yai/WJlkk:LSuaYDY+pO5y92z4O4Z1s8zEceXM8CvA
MD5:	72309F20F2BFEE0595FE8D20B8CBEFB0
SHA1:	EFC2B2B263722DDDFFEA44FFC7A116DAF09709B3
SHA-256:	DCE3297D94996C91126446E133145E4395C87BA47C4B731CA86C4C845DAD8049
SHA-512:	0DE89F9B0CA62CD9977E2BECF30D8E9C416AD42F66D1BFBF78E34DC6301E0CEC559813D76A05F11ABEB39C7CAC45E6C20BDF88C86C398C09158CB9F6C3AF5942
Malicious:	false
Preview:	RIFF....WAVEfmt ........@...@.......data.........~teVGR......\|l`Rf....}rkdb].....yg]TTW......paWSY....v_JGX^n....^pzh\IN......vT=.Ey...paJ<8~...h=..&s...mIFok_v..{s...nTc...w..wmOADi....c#.......p;0>a....lc[H]......XG]YVm~.......G..8p...o3..]...t=.8n.....d50Lb....qR`.....vU=H....obi....[...9.....eA..A.....N2>k....S2:l....~ji...d8Dv...uWWh~....}^A'"K.....;...V....dNd...s^R^.....p\f~.....aRT]q.....`4 4p...j)."o.....;..Bq........sX?6Hl.......vYC?Sz...b<8^....8..3.....Q?H`......~j^^h\|.....qijnl`WZs....b...C....eBCd....vXKM\v.....^5'8a.....ulx...lWRe....K(,Z....Y'.'Q.....\|T;<U{....eS]....m@/?h..........{I&"C{....hE7>X}....X3,I....t<!0^....~lq....uXLVp....}rt.....ydTLM]\|....k(..<....l@8T.....f[cu..........ubY\hw.......jQGUw....d?6S....f1.,U.......vh]X[i~.....\|z\|~\|wst}...}j\ay....}R8;Z.....v`[ew.....ynfdjz.....wcZ_ly.........jSKWs.....h]dv....\|lcem{......n`\dv.....plr~...}usy...{pkp.....\|eWVcx......tidhs.....skn{....{iaer..........\|rkks.....}snpv~.....wk

C:\Users\user\AppData\Local\Programs\Fiddler\NOTICES.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (2966), with CRLF line terminators
Category:	dropped
Size (bytes):	52307
Entropy (8bit):	5.024626361667652
Encrypted:	false
SSDEEP:	1536:SNtCkkRZhAgD0eL8kcp8ZMoh0FVntHOIzm:SNtgRZhF58kcKiXtHnC
MD5:	ADFC592F90745C1CEB5088BE6233CA8E
SHA1:	323558F4EEC2237D47DFA0805337C99FA1E952CD
SHA-256:	0A28FB1C261B7EED6CF8F59373BFED456A622B1C30BA828693F1834CD24C1E25
SHA-512:	0BB50A823270F9AA629E4CF7DE4D4DE3B04BDB79A6F2DC732C50243DE1040CDBDAA46E8E75CE0B3DD9CD85224D69974CE44E57FF319FDDF4B1BEDCF19AE51D9F
Malicious:	false
Preview:	Progress Telerik Fiddler Classic v5....Copyright . 2003-2021 Progress Software Corporation and/or one of its subsidiaries or affiliates. All rights reserved.....Portions of the Product include certain open source and commercial third-party components listed below ("Third-Party Components"). The authors of the Third-Party Components require Progress Software Corporation ("PSC") to include the following notices and additional licensing terms as a condition of PSC's use of such Third-Party Components. You acknowledge that the authors of the Third-Party Components have no obligation to provide support to you for the Third-Party Components or the Product. You hereby undertake to comply with all licenses related to the applicable Third-Party Components. Notwithstanding anything to the contrary, to the extent that any of the terms and conditions of the Progress Agreement conflict, vary, or are in addition to the terms and conditions of the aforementioned third-party licenses for these tec

C:\Users\user\AppData\Local\Programs\Fiddler\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	711952
Entropy (8bit):	5.967185619483575
Encrypted:	false
SSDEEP:	12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
MD5:	195FFB7167DB3219B217C4FD439EEDD6
SHA1:	1E76E6099570EDE620B76ED47CF8D03A936D49F8
SHA-256:	E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
SHA-512:	56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Users\user\AppData\Local\Programs\Fiddler\Plugins\NetworkConnections\Telerik.NetworkConnections.Windows.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34440
Entropy (8bit):	6.5351759096470525
Encrypted:	false
SSDEEP:	768:2LpjNBBUyOzcB7RZbkTg+jO4HmBWKNTjNTlfKaE:2LB9VRpOg+jmBPFjF0aE
MD5:	5889357424D717C8629C8BFABCD0BE50
SHA1:	87E7047A40E24BD5AC23F89E072EE39A14A53023
SHA-256:	3564B25B24569B8D8A0128F2F4BDDEC89C0B8986DA7542D9C64AAC730360A600
SHA-512:	1AF458742CEFD4730D64B19ECC05460354F0E47A79CDCD7794877AA0F6C56CFB92F37A0DAF66FEDAEC2A579EB0187D774B7D5BA1FFF65D6AB1504DF4C3668FAD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....X.].........." ..0..H...........f... ........... ..............................Y.....@..................................f..O....................R...4..........\e............................................... ............... ..H............text....F... ...H.................. ..`.rsrc................J..............@..@.reloc...............P..............@..B.................f......H........0...4...................d......................................Z..,...%..;.%.. ........0..Q.......~..........(.....(....~....,'~....- ....r...p.......s....(............,..(................>F.......0..A.......~..........(.....(....~....-.~....,.~....o.............,..(.................6.......0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..........~......,....o.....s...........u....,..t.....o.....(.....(

C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\200_FiddlerGif.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	433
Entropy (8bit):	7.006813236327367
Encrypted:	false
SSDEEP:	6:uh38iIRf2Q+x9vhyyq5tasR1jvT/8Lr4wlguOPS+Gel0EcdqqRxavDG:cMiIIQO/qzasR1jjoswlcS+GNFRxN
MD5:	0847D00123F892514A4AD127632AE14E
SHA1:	193C87427C3B37FCEA7E1FF20918BD18F4D487FF
SHA-256:	07DB49DC0D250B90E8F6CBD8D3A4340EB01AF2AFBCC1AE6E539312B1E7F71B97
SHA-512:	DD5727B39F13EB05BE49AEC3654479AC5162C28157258BF8AF8F6878FF55B1E111335FD73BE04346A6685ECD0C22CCD7726E7D7B2CD7CE871888F9BC148BE27E
Malicious:	false
Preview:	HTTP/1.1 200 OK..Date: Fri, 25 Jan 2013 16:49:29 GMT..FiddlerTemplate: True..Content-Length: 308..Content-Type: image/gif....GIF89a#.$.w..!.......,....#.$................................H......*\x..@.. F\|Hq.E..':..#..CV..q....... @.%/.l.. ..-....gJ.'e..Y3..4...I..S.I.....f.B.f.j5..<....iE.b..y1..ZK..;.kN.N.^..t`Y.u{.....B.\|.....o.d..`...W.\.>.kxk...2$.y.c."....:'N.UY.~.....GEn.M....R....C.{..[9j.K...3...k....;

C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\200_SimpleHTML.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	150
Entropy (8bit):	5.098902738457552
Encrypted:	false
SSDEEP:	3:uVorFR6ZX4Qidv9leIrRNFQ4LXFMCE2AZA/lXIZnHm:uA3eIRdbFu2AZA/lXIZG
MD5:	CE18F4915C278F5196CACBB086E0AFDD
SHA1:	3CD4F950BEEDBA52F6988F082BEC98C153706AE3
SHA-256:	C1DE5D01D11CFE466B819AF52BA381F217573C889781C60BE82EB285E9FA8908
SHA-512:	D4B756F9AD78DA3FE740CC283AAAB754E3FBCCE81E030AD01598F63022452E0AFBBEA06F9EABD45F22CB0AEA12E876BDEA462FF56FC7A0CF4F432219F0F008D8
Malicious:	false
Preview:	HTTP/1.1 200 OK..FiddlerTemplate: True..Date: Fri, 25 Jan 2013 16:49:29 GMT..Content-Length: 51....This is a simple Fiddler-returned <B>HTML</B> page.

C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\200_TransPixel.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	173
Entropy (8bit):	5.257157707003835
Encrypted:	false
SSDEEP:	3:uVoaoZX4Qidv0Q+LAIeAtMx9v90IrRNFRRov5cUVAae/XExlHrfx/n:uh38iQ+x9v2IRBRFaOUJ/n
MD5:	2312C8130D9203F27C0CECE742B8928F
SHA1:	03FFC27128A1D8C87E0E3B47797FC1914AAD5C40
SHA-256:	55E9D8ACC7DC6EAD2E4B09C5212D23FDE6E9D7F8DE739A2CF3821C4D93713845
SHA-512:	AFB5A0FAFA9F2297899C16745E04CB2F8C647F1C8CAEAE6522732E5C62075A1B771156795E0C148D64FB79A738E33FEBB28523217EBC9A7EC7A548D574EC77A6
Malicious:	false
Preview:	HTTP/1.1 200 OK..Date: Fri, 25 Jan 2013 16:49:29 GMT..FiddlerTemplate: True..Content-Type: image/gif..Content-Length: 49....GIF89a...................!.......,...........T..;

C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\204_NoContent.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.910249518995826
Encrypted:	false
SSDEEP:	3:6amplo7M2FR6ZX4Qidv9leIrRNFV7v:6amLw13eIRF7v
MD5:	B381D9C48A57EC5D61D20B963FA2E0C7
SHA1:	77D0E8255534785CED3DDA0906C871F2D662A7D2
SHA-256:	57A03EA6C0480797D923C72ECE7E6E5D3B0B34299BFB879F67E519C9B6CD4FCC
SHA-512:	07A8A08143AB20350CE04FB51C70356748E76C486C33495B5BAE1D72D53B8913BB420694B55F7FEA8D9CE087B4418B965F7FDC4FE368F61662569EA2DC109808
Malicious:	false
Preview:	HTTP/1.1 204 No Content..FiddlerTemplate: True..Date: Fri, 25 Jan 2013 16:49:29 GMT..Content-Length: 0....

C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\302_Redirect.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	165
Entropy (8bit):	5.17690837820763
Encrypted:	false
SSDEEP:	3:z3AgGXFR6ZX4QidvkbcS4QIbdmELxKdKjMZsROBjs2IrRNFV7v:A13Mbj4Qwdmi7wUO5IRF7v
MD5:	BED4C478EC0842F8230BF9A025491A14
SHA1:	362E4D075AA2846C4E1B998E1A3F15A1D96DFF81
SHA-256:	5192579A4A2761B0C65544D1B61804222C169CDABD007FED0F40DE09C3F9E854
SHA-512:	723E56024F577A082FDE1907A29CCD80B8A5D0CB9A2877BA68D1C0A69AA5AB0395CFD8749E8D73B70D4E680BC8E7892A7100DC42EAF8FFF921D25B8505129F33
Malicious:	false
Preview:	HTTP/1.1 302 Redirect..FiddlerTemplate: True..Date: Fri, 25 Jan 2013 16:49:29 GMT..Location: http://www.fiddler2.com/sandbox/FormAndCookie.asp..Content-Length: 0....

C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\303_RedirectWithGet.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	175
Entropy (8bit):	5.224949708789029
Encrypted:	false
SSDEEP:	3:T6TcLCEM2FR6ZX4QidvkbcS4QIbdmELxKdKjMZsROBjs2IrRNFV7v:TJzMo3Mbj4Qwdmi7wUO5IRF7v
MD5:	972CDF70D09EAC166BD8D82573382698
SHA1:	DF3D3874688F2294DE50590C754411AAD8171952
SHA-256:	E857508C27591ECF82C522121AB261472AC57023CBF817CA5EB1212AC8B18735
SHA-512:	96C4C0DCFE37236845F135D9A50B895433D4B49D532D3DAC3A0D7E2831A9AFAE5C2BB8FCFDF5723D74D50BE842A67AD675C33C2F1554D2F59A05B476E7E7C33A
Malicious:	false
Preview:	HTTP/1.1 303 Redirect Using GET..FiddlerTemplate: True..Date: Fri, 25 Jan 2013 16:49:29 GMT..Location: http://www.fiddler2.com/sandbox/FormAndCookie.asp..Content-Length: 0....

C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\304_NotModified.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	108
Entropy (8bit):	4.979178963108823
Encrypted:	false
SSDEEP:	3:lGme7ABGFR6ZX4Qidv9leIrRNFV7v:i7AB43eIRF7v
MD5:	155D2112C5A34E0122456E65EEA0415E
SHA1:	4600910AB706B69A9EF2EEEACA73FC015BA16C92
SHA-256:	4D34160482A2FE82B27D396EAC3C32B5E9AED7E774E8A60DBE787BD066988944
SHA-512:	7FAA29CAB291902AF60FDB8AED74E3A686DE80B047B0941D4B47DD1D8D5C669F640D220ACD785AC775F74B3A0C7F852BA1859C5F09AE82E31AF0589D3FFD97B1
Malicious:	false
Preview:	HTTP/1.1 304 Not Modified..FiddlerTemplate: True..Date: Fri, 25 Jan 2013 16:49:29 GMT..Content-Length: 0....

C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\307_RedirectWithMethod.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	183
Entropy (8bit):	5.181576542946864
Encrypted:	false
SSDEEP:	3:WkmdR1MBBGFR6ZX4QidvkbcS4QIbdmELxKdKjMZsROBjs2IrRNFV7v:hdBB43Mbj4Qwdmi7wUO5IRF7v
MD5:	EC8F186D82B4D5D32EE18DB08C59BFB0
SHA1:	452A15EBFA2A7C0FF53F4A5A85903F8D09C8ED65
SHA-256:	631EE98F55964E23C04D6E24A445CDD0B0DE7D2F1DC3EAF5BE7AE211DDB7D2DC
SHA-512:	FF5C154F8F8992816FE9F41CA6CE84BFF2318ADEE26E5090DC92A4371FED08EC3B36E848A864CB509813CCF4DBFB3F830D1F5D45BF89E5C502D0BDA9A4274C25
Malicious:	false
Preview:	HTTP/1.1 307 Redirect using same Method..FiddlerTemplate: True..Date: Fri, 25 Jan 2013 16:49:29 GMT..Location: http://www.fiddler2.com/sandbox/FormAndCookie.asp..Content-Length: 0....

C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\401_AuthBasic.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	ASCII text, with very long lines (520), with CRLF line terminators
Category:	dropped
Size (bytes):	707
Entropy (8bit):	2.434991755598168
Encrypted:	false
SSDEEP:	3:6L9aNACpjMBBGFR6ZX4QidvBw90uJdwB/xv2IeAtRATWIJeeIrRNFQFAMtFKRVW7:RLpwBB43HuMp2Q8a0tIRfMqRMExC
MD5:	0760F4F0ADBEE7ABFB5D05530450FF33
SHA1:	69D35928F1D2061047129C99BEDF56B5E0D0FBCC
SHA-256:	3E2E69628454FD3C220F099FEC1CCCE73F2E779BD43939762928BC8079383DFA
SHA-512:	C3824DC3882282399D2C3211217DEF0E96F94D6986B6FBFF5378B3AA864D8E93788B529502FE3137E15BD753DD52496192851C846A83D09F471998EC2741FC1E
Malicious:	false
Preview:	HTTP/1.1 401 Authentication Required..FiddlerTemplate: True..Date: Fri, 25 Jan 2013 16:49:29 GMT..WWW-Authenticate: Basic realm="Fiddler"..Content-Type: text/html..Content-Length: 520....Fiddler: HTTP/401 Basic Server Auth Required.

C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\401_AuthDigest.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	ASCII text, with very long lines (520), with CRLF line terminators
Category:	dropped
Size (bytes):	823
Entropy (8bit):	3.1083687079781006
Encrypted:	false
SSDEEP:	12:RLpwBBN1TgeGgrD0mEDQAQYtIGqccWbyW:t6VjBFNCSGqcnbyW
MD5:	49756F7861BF92FF1FD84076616B242A
SHA1:	38187C1D3C748FADE05DBC10DA27DC93D183FD15
SHA-256:	CD8B03F62A20D47FC5C9A495615B350E4DA7EABFFF34B8E112AFEC63BAB1CBEC
SHA-512:	08655D1D59E13F95D8A2A36A9DE88BE2A5ABD3B6A21A98ED8DDC8B7C53F38E912E64064BF1D9D83D2DF4EB41E3ABC2477463CC454BD531800F49857DA8D7DCA5
Malicious:	false
Preview:	HTTP/1.1 401 Authentication Required..FiddlerTemplate: True..Date: Fri, 25 Jan 2013 16:49:29 GMT..WWW-Authenticate: Digest realm="realm@example.com",qop="auth,auth-int",nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",opaque="5ccc069c403ebaf9f0171e9517f40e41"..Content-Type: text/html..Content-Length: 520....Fiddler: HTTP/401 Digest Server Auth Required.

C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\403_AuthDeny.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	ASCII text, with very long lines (520), with CRLF line terminators
Category:	dropped
Size (bytes):	631
Entropy (8bit):	1.7576506650773096
Encrypted:	false
SSDEEP:	3:GRuuC0BGFR6ZX4Qidv9leIrRNFQFAMtFKRVRuuBF/X:G1B43eIRfMqR1Fv
MD5:	7374B4D828FBA72D4C46F9BADC47CA3E
SHA1:	0DEE779BB2D38FE4E8E712F214E743D647A8788C
SHA-256:	3768D4F6467396343BAAD8DF2FE102D22611318F2BE090C2CFD8AC82FD201513
SHA-512:	678046183FA344BE53841D88B2A978FEF3FA1352A1C084A50D1864D6F95D36188523D6D1987DF14D682FD589EFEC6D2228530F18F038725C6E94A86F22946813
Malicious:	false
Preview:	HTTP/1.1 403 Access Denied..FiddlerTemplate: True..Date: Fri, 25 Jan 2013 16:49:29 GMT..Content-Length: 520....Fiddler: HTTP/403 Access Denied.

C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\404_Plain.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	ASCII text, with very long lines (520), with CRLF line terminators
Category:	dropped
Size (bytes):	652
Entropy (8bit):	1.8652089301157977
Encrypted:	false
SSDEEP:	3:mKbyjM3GFR6ZX4Qidv9leIeAtRATWIJeeIrRNFQFAMtFKRVaRb/FNd:zbwk43eQ8a0tIRfMqRIRb/Ff
MD5:	5463FF9BABDC2DC1E1304F04400120AA
SHA1:	351449F2043E8CCEF14AC76AE8AA87E8CA4B7A9D
SHA-256:	A136C0E17264C40873534669AF5F78E7E17E70F8661046C32599C6615CAD80CF
SHA-512:	3C8F8D41ACF6C26F85A5FFF8FB12D062381F45820D529E6037E54804CC043EB4D956BF5A4F807429A9EB816A8FAFA29BEC4DB720B6ECB987075CCD13845D6BBB
Malicious:	false
Preview:	HTTP/1.1 404 Not Found..FiddlerTemplate: True..Date: Fri, 25 Jan 2013 16:49:29 GMT..Content-Type: text/html..Content-Length: 520....Fiddler: HTTP/404 Not Found

C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\407_ProxyAuthBasic.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	ASCII text, with very long lines (520), with CRLF line terminators
Category:	dropped
Size (bytes):	719
Entropy (8bit):	2.4558303990917083
Encrypted:	false
SSDEEP:	3:7zRwUPjMBBGFR6ZX4QidvdLIv490uJdwB/Kl8Rj10IeAtRATWIJeeIrRNFQFAMtY:7ddwBB43hItuMKlJQ8a0tIRfMqRIt+
MD5:	32C8D78B7BCEFA8EA4D459BD9328BCB0
SHA1:	F816A637E20F541618BB9C62095C175DF16ED48B
SHA-256:	A39A2DBA0A39AB590535EC9BB33C1095B7B6E79F7686C2FD5368230010721876
SHA-512:	5D6339DAA5BB788E6AD6B3A600F153467859793E78E8FA1E2143D335E90D815BD683A1660ED97E5672350BE61085F15B0D84AC3C24C59FB89FBCD8DB8F59D9F5
Malicious:	false
Preview:	HTTP/1.1 407 Proxy Auth Required..FiddlerTemplate: True..Date: Fri, 25 Jan 2013 16:49:29 GMT..Proxy-Authenticate: Basic realm="Fiddler (just hit Ok)"..Content-Type: text/html..Content-Length: 520....Fiddler: HTTP/407 Proxy Auth Required.

C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\502_Unreachable.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	ASCII text, with very long lines (520), with CRLF line terminators
Category:	dropped
Size (bytes):	661
Entropy (8bit):	2.048027069290318
Encrypted:	false
SSDEEP:	3:3YGNEHN6546ZX4Qidv0Q+LAIeAtRATWIJeeIrRNFQFAMtFKQ9qLXpHtNZ:bAdN8iQ8a0tIRfMqyMd
MD5:	1C7DF40E98F04B29A79AF929A3AEC437
SHA1:	C7E246673A4EFBDAE3955095F3183C95AF2F3732
SHA-256:	056E734FD9EF5BBE213A5FCCFC32B23F71F7F6CF7B792FA8E614D1C968A2210E
SHA-512:	552D3D89716BF3C9068179E2190D6DC257AE1BC023356A228BA36FA5FC6E61C89AC9A9CEE95BD67779F13B8C04FE1C3CEA08834D4E96D2CFB08E6E54E81DC5BE
Malicious:	false
Preview:	HTTP/1.1 502 Unreachable Server..Date: Fri, 25 Jan 2013 16:49:29 GMT..FiddlerTemplate: True..Content-Type: text/html..Content-Length: 520....Fiddler: HTTP/502 unreachable server.

C:\Users\user\AppData\Local\Programs\Fiddler\Screenshot.wav

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	13090
Entropy (8bit):	6.7279638747220565
Encrypted:	false
SSDEEP:	384:dIR94458ov44jkTZeh9QUHsG0h6rWll9Rm3BI:GZnPjkTZeh9fBMAiNm3q
MD5:	99803241008EE3D6F14AD27A5F24C34B
SHA1:	43A13F3C5844A577A5221FCFDBFB75A58478683F
SHA-256:	D474865A5E5C2F9D039C0F7A017E9A5E23A159CF6F534E879E979C61085FA1F9
SHA-512:	4366935AF45CB5C3B963AEEA3D19507A028760BE375717C5F7EC59115417680359A404C8D87A33A5BE362EBF3F12EB28CDAC539C153F3388446D912A57B37C96
Malicious:	false
Preview:	RIFF.3..WAVEfmt .........>...}........fact....t...data.2..........(.(...,.C.=.j.>.{.x.......j.c.;.<.................4.......t.#.d.;...+.o.R.f.x.T.{............s.....A.......^.....3...Z.....1.b...+.-.F...............d...9.....J.)...S.....6.V...........{...w.....G.....d.^.8...2...v.X...!."...-...]...7...S.R.......f.....}. .....K.....B...M...:...........Z.....~.H.g...<.9.T.............6.....Y.v.d...@.A...m.G.....i...#...D.L...N.....D..........K...........^.......c...c.f.....%.!.......Q.S...........i.N.....L...k...............H.,.........~.......O...j...........i...6...k.........D.......6...Y.....:.=.1.......=.......`.......P.........>.:.8.......B.......h.&.......<.....B.s.....%.h...Q.h.g...............b.:.......y.........%...3.....d.i.w.d.8.s.^...K...................$.X...I.......1...O...H.....d.../...W..D._....\|...N.!.......n...B.l...w.U...\.:.....7.....#.....a.A.......Q.j.W.a...<.....=...}.........o...6.......c.x.o.0.......=.......].....A...l.S...&.N...........8.#.........p.l.......

C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\Analytics.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33224
Entropy (8bit):	6.525851583552875
Encrypted:	false
SSDEEP:	384:gpeCB0nVQ/EMq7+Zi9nQwnHgfLtVUEoBXejF6XFlnwnYPLYyTcGq1y2h33XcQ7:/U0VQMMrZi9QiHWtVxOFxwxGqXR7
MD5:	1C2BD080B0E972A3EE1579895EA17B42
SHA1:	A09454BC976B4AF549A6347618F846D4C93B769B
SHA-256:	166E1A6CF86B254525A03D1510FE76DA574F977C012064DF39DD6F4AF72A4B29
SHA-512:	946E56D543A6D00674D8FA17ECD9589CBA3211CFA52C978E0C9DAB0FA45CDFC7787245D14308F5692BD99D621C0CACA3C546259FCFA725FFF9171B144514B6E0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4.+[.........." ..0..F...........e... ........... ....................................`..................................d..O....................N...3.......... d............................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................d......H............4...................c.......................................0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3.J.(.....s....}.....0...........{......,....o......&...................0..S........{....,..H..}.....,9.{....o.....+..o.....o.....o....-....,..o......~....o......&......... ..8..........OO.......0..S........{....-..H..}.....{....o.....+..o......u....,..u....o.....o....-....,..o.......&...........

C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\Analytics.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	MSVC program database ver 7.00, 512*95 bytes
Category:	dropped
Size (bytes):	48640
Entropy (8bit):	3.4063107578330305
Encrypted:	false
SSDEEP:	384:IzCZdxQVINRdRoNFAYAz3GclBLEKiuNCFJkOLxYbs63N:fxz3oNqbTLUnjpLxY
MD5:	F84FB6CD84B5D07E3DE4D78D38F388FF
SHA1:	0B31F09EEB1AF0681614C2F9F90D98B541DF580F
SHA-256:	03CA5A20D36BBC0AEA28AA3184D65B322CECC3080D55A975CDF0F5D31199829D
SHA-512:	03FA13B39D4FAE8BC83B4F37CF24AAFC8C4A12A5DB0462968AE6A0C96232D727DF9264D190FF641115921E350A1981AD518A4740C20E54C433B2F2065522AD52
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS..........._...........[...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\FSE2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	51712
Entropy (8bit):	5.433894056505587
Encrypted:	false
SSDEEP:	768:YhiPG/qDcpEr7+zQ3Eo8P0gsH8Ufj02e0r/oEbkG3wR:ozKcy3+z7o88gsH5fjyXR
MD5:	C2FE7C92A8FC763407233203B49685F9
SHA1:	D2F199E71EB7531CAA71F85A679E49FA400CC401
SHA-256:	F55D5CB9968BCB875DC39CC84153BD52375F4CF8A680E0F5EB53A57A7E532561
SHA-512:	F74D29F4520AE0C9AA153F3649BDF80C1ED882A61ADD7267EAFAECB2D036F43FC44434279E3DACD763EBC42FEDC78EC3AD52A11B55D14B224B01A8BEBCA0F6B5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$..g.........."...0.................. ........@.. ....................... ............`.....................................O.................................................................................... ............... ..H............text...(.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......x]...m......O....................................................0...........o....o....r...p(....(......r...po.......(....,.rA..pr...p(....&...o.......(....,.r...p.r...p(....r...p(....&..s.......o.........8.............o....r...p..o....o....(....s........( ...o!.......o"........,9....o#...r...p ....($........o%...tK.......o&.......o'......X.......i?o.....~W...%-.&~V.....q...s(...%.W...o).....o*.....+...(+......o......o,...&..(-...-...........o.......o/....o0........

C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\FSE2.exe.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.504588688812839
Encrypted:	false
SSDEEP:	3:cTIMOoJOObWNRLTSL2ygAyO+gN5KXeRObK4QIMOn:8II5KNZk2ygAyONw5W4QIT
MD5:	C5AD2C7E6331C37E5A70D989832EB250
SHA1:	53C2EC3AAE4BBD62B5B7095BEC8FE7E915ADE4F6
SHA-256:	F72019A677A2A8447D6E72A731C2EC3EBEC6AE03CD7FE266637E665EE11AF7FF
SHA-512:	92DA69B448DF5821895AA017F630F1F9916F8A8623F726D72C245375B6BDA6C8B6522DD629E297E65C70F854A6457BFE9B43534FFA3A0A28FE0084EB0A07E30D
Malicious:	false
Preview:	<configuration>.. <runtime>.. <generatePublisherEvidence enabled="false"/>.. </runtime>..</configuration>

C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\GA.Analytics.Monitor.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	53704
Entropy (8bit):	6.271434268217771
Encrypted:	false
SSDEEP:	768:7su21mzJ3+LDDke5WcsvOvHOQ+5bQZdKXJccxYi:7qmByvke5Wcs22QRGKLi
MD5:	6F9E5C4B5662C7F8D1159EDCBA6E7429
SHA1:	C7630476A50A953DAB490931B99D2A5ECA96F9F6
SHA-256:	E3261A13953F4BEDEC65957B58074C71D2E1B9926529D48C77CFB1E70EC68790
SHA-512:	78FD28A0B19A3DAE1D0AE151CE09A42F7542DE816222105D4DAFE1C0932586B799B835E611CE39A9C9424E60786FBD2949CABAC3F006D611078E85B345E148C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4.+[.........." ..0.................. ........... ..............................).....`.................................?...O.......`................3........................................................... ............... ..H............text........ ...................... ..`.rsrc...`...........................@..@.reloc..............................@..B................s.......H.......PM...c..........................................................>..(......(......{...."..}......{...."..}....f.(......(.....(....(......{...."..}......{...."..}......{......{...."..}......{...."..}......(.....s....}.....{.....o.....s....}......(.....s....}.....{.....o......s....}......(......s....}.....{.....o......s....}........0..z........-.r...ps....z.-.r...ps....zs......r!..pr%..po.....r1..p.o.....r7..p.o.....,..r=..p.o.....,..rC..p..(....(....o.

C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\GA.Analytics.Monitor.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	MSVC program database ver 7.00, 512*187 bytes
Category:	dropped
Size (bytes):	95744
Entropy (8bit):	3.5761633792805214
Encrypted:	false
SSDEEP:	768:qT0N9rXf8+G/ne3F8VWITK2gaZbAjJcrNtPja+RLDVa:i0N9rX2nevITK2CjC2+RPVa
MD5:	DF9591879A5AF2A8458FB9148E197313
SHA1:	189DF547DB269F1694603EAB40519EC0086FC326
SHA-256:	6C19EC08FFB13998ACE51E1B531128AF12CD47CCADFF5E346176C6992C00A843
SHA-512:	89C8F7686048E3329D47BD7F6678CCA880D1C2A704664A44276090ED2A5B6452D964C69E2D0161EC8B69586E3AAE3C99F63445C22122A1B9BF532234F93AF65C
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Common.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	5.177812068372721
Encrypted:	false
SSDEEP:	1536:jnPlSpsvrGlP3wYeBKpqmSNbgM9ZtZLZQErK3PmIDXRtFhCj6ocpjyc44lc:rlSpsnQCg4ZtZmECfRtF0cpjy94lc
MD5:	AC80E3CA5EC3ED77EF7F1A5648FD605A
SHA1:	593077C0D921DF0819D48B627D4A140967A6B9E0
SHA-256:	93B0F5D3A2A8A82DA1368309C91286EE545B9ED9DC57AD1B31C229E2C11C00B5
SHA-512:	3ECC0FE3107370CB5EF5003B5317E4EA0D78BD122D662525EC4912DC30B8A1849C4FA2BBB76E6552B571F156D616456724AEE6CD9495AE60A7CB4AAA6CF22159
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8V...........!......... ........... ........@.. .......................@............@.....................................W............................ ......X................................................ ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Editor.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	835584
Entropy (8bit):	5.8267693764214945
Encrypted:	false
SSDEEP:	12288:vC84TFHhCRR87er17m62l/YpMVuRWGoN0ty6B:vC9T+R87er325wMVuRaGtPB
MD5:	EAA268802C633F27FCFC90FD0F986E10
SHA1:	21F3A19D6958BCFE9209DF40C4FD8E7C4CE7A76F
SHA-256:	FE26C7E4723BF81124CDCFD5211B70F5E348250AE74B6C0ABC326F1084EC3D54
SHA-512:	C0D6559FC482350C4ED5C5A9A0C0C58EEC0A1371F5A254C20AE85521F5CEC4C917596BC2EC538C665C3AA8E7EE7B2D3D322B3601D69B605914280FF38315BB47
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8V...........!......... .......... ........@.. ...................................@.....................................K.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Syntax.Parsers.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1196032
Entropy (8bit):	5.697795751444429
Encrypted:	false
SSDEEP:	6144:DDsAkHPWoMvThdMlLQtRZfScxaHrlXnp55VAWvRY02OCo6+shEd2qxrGa:DDs7uounM5WSNAG2otTh
MD5:	9FE6E9CFEDB661C61A2C70FA75008EC3
SHA1:	0F6A0F4E7FC5552088D3F2DD0C0ADF6F6C45B686
SHA-256:	ACFF23204982780D844F5B0CBFE0BF1849C1DFE782CB4084BA2BDC9BF53F026C
SHA-512:	A8864EE43628F667D6E0ACF071FBBA414FF768FE9DD302E6F9498432B3CE48A22DEECFE438099A3CAA684AD8E9588FAE111DE752C37C158EEBD76E48AB67E02D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8V...........!......... ......./... ...@....@.. ..............................].....@.....................................W....@.......................`......@................................................ ............... ..H............text...$.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Syntax.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	233472
Entropy (8bit):	5.650842692777023
Encrypted:	false
SSDEEP:	3072:Ns/3b/8FpHf3kBFcCsbfqai2/8Fjitdmus95jMRrgk+vWZYz39dHiB796k9gR5+r:NQLa/kBFcCsbfRgzM07XGk+V
MD5:	3BE64186E6E8AD19DC3559EE3C307070
SHA1:	2F9E70E04189F6C736A3B9D0642F46208C60380A
SHA-256:	79A2C829DE00E56D75EEB81CD97B04EAE96BC41D6A2DBDC0CA4E7E0B454B1B7C
SHA-512:	7D0E657B3A1C23D13D1A7E7D1B95B4D9280CB08A0ACA641FEB9A89E6B8F0C8760499D63E240FE9C62022790A4822BF4FE2C9D9B19B12BD7F0451454BE471FF78
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8V...........!.....`... ......>w... ........@.. ....................................@..................................v..W...................................hv............................................... ............... ..H............text...DW... ...`.................. ..`.rsrc................p..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Addon.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	48568
Entropy (8bit):	6.066592666691454
Encrypted:	false
SSDEEP:	768:h/M61OLoQSR1KWAEI086vCNVTFzQyx0yHjNbpV+5y43hDxnTxiDTxf1mlQh5VdJs:h/cBEI08WCNVT7Hjdv+hhDxn9WfI+vIz
MD5:	465761EFFBD26E70FB83595CB5F8A20A
SHA1:	9B98750EBBC7CE144A2F8150F3B1D8201A53A2AF
SHA-256:	38A7FA0C13D5700EEC8178DB2116A51C7E23D97871DBD159FB16104F91C0BFEE
SHA-512:	063C93D8CFC0DD17D56ABCCB25C00C430066A117E993205CEB0161260214A104627672EAAC0EA2EC6C8BE488CD2056B92CF002C94C873EFCF464EFE35EFBDA7C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.........." ..0.............B.... ........... ...............................v....`....................................O........................#........................................................... ............... ..H............text...H.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H........I...^..........................................................J.(.....s....}......0..F.........P.....{.....o.....o....(.......i..iX.P........i(.........i..i(.....2r...p.(......0..........~....%-.&+....o......&.....................Vr-..p.....r[..p......(G.......0...........(......o.....3z.o ....3....o ....3 .o!... 6...2....o!.....2......o ...-=.o!... ov..30.o"... ....2....o"... .G..2...o"... .:..1....:.(......}....V.{......{.....X}.......0..........

C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Addon.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	MSVC program database ver 7.00, 512*143 bytes
Category:	dropped
Size (bytes):	73216
Entropy (8bit):	3.7662640565192125
Encrypted:	false
SSDEEP:	768:9iqJO0yQHfxdjKn5z/S5ewtbWohS79rHsjbYblVkE81JbvaYB7O4K/NI03e9:miJtbRS9fVkp1JbvzvK/NI03e
MD5:	71B456D4426BF662AC9D742B962617E1
SHA1:	CF491E85D93BC63B4ACAFE8DD614179DED8230BA
SHA-256:	2767835DB3F851E82F993538F3F73C016790DA3A7F9BBD9539A3E8D95D5BD844
SHA-512:	177DDABFC413742BC7FB48FD30059790D943917CB9207E8554B168EB804D59A5A289B07B2E6A57ED4794EE09228814F1207B6EF70B9F3C2F0C676F208059BA23
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Connection.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1923656
Entropy (8bit):	6.38559686957406
Encrypted:	false
SSDEEP:	49152:pkLbcPdI5jVkVyEf8qLFlBPdl7KsQ3+rLmk54aqJJd:YEPFXYzd
MD5:	19D00193A0DF0B4D0734D209989F594C
SHA1:	1ADAABF30EF7350DF16B7FED023BD980809F4086
SHA-256:	7A041DEB6934864BC3C057D1440F00E2E56104018069E57201F0FC877EF78713
SHA-512:	6402FA43A1B0E5A96F3270751F18BE7B22774FA59A1A6737A0C1549642EF4F148765EAF30776C46F371D5DFF69A164454B908AD00FC371D8BDEEDDC52F7C9789
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0............." ..0..0..........6.... ...`....... ..............................).....`....................................O....`...............:..H ...........>..p............................................ ............... ..H............text..../... ...0.................. ..`.rsrc........`.......2..............@..@.reloc...............8..............@..B........................H............x..........................................................Z..3...,..-....(....Z..3...,..-....(....Z..3...,..-....(....Z..3...,..-....(.....0..&.........i....i.....+...Y........a`..-.....Z..3...,..-....(....Z..3...,..-....(.....0............i....i.....Y...........-....0............i....i.....Y...........-....0............i....i.....Y...........-....0............i....i.....Y...........-....0............i....i.....Y...........-..*.

C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Protocol.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23992
Entropy (8bit):	6.987137012913893
Encrypted:	false
SSDEEP:	384:XjDVyjBjiEBh7oMb1ZPcSVrRSj2qXksk3nrAixn7pdcTjdAA1m5wMQhKuVdJRm5J:XcLPc8rRST3Kn3xTcTxf1mlQh5VdJRm/
MD5:	D045D2BEBB047748DCC73D2BB50AB6D1
SHA1:	1A793331A1724A82D25A989006530461B2311955
SHA-256:	CBCBFFD8CD89DDCF1E4D6A4AB6F0D3C14112CAC8E03E3F8F2236BAB96977EBE2
SHA-512:	1359F51A80204D0A8C100DC24DCF473F494F871FF430599779C20A9F747428074387DD607A3C594993179E2B46269FB97409A486F02E5F3AE9F6A36C1354DF01
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...o............." ..0..0...........O... ...`....... ..............................\|J....`..................................N..O....`...............:...#...........8..p............................................ ............... ..H............text..../... ...0.................. ..`.rsrc........`.......2..............@..@.reloc...............8..............@..B.................N......H........%..<.............................................................(....^~....-.s.........~............0..8........(........iX..iX.!..............i(..........iX..i(......0..b.........(....,.r...ps....z..(.......!......i.Y~....Y.Y.!......~....X...(......~....X.X....i(......s..........(....&...(..........(....&...(.......0..`........(......~....X..iX...iX.!.........(...........i(........~....X..i(.........~....X..iX...i(......0............(.......r]..pr...p....

C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Utilities.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19384
Entropy (8bit):	7.038669448689911
Encrypted:	false
SSDEEP:	384:nLb4drWQGX2OGsctX63rAix8XwTjdAA1m5wMQhKuVdJHm5LrAe:X4AF+VK3HxEwTxf1mlQh5VdJHm5Xv
MD5:	0BD9F14A40E05BDAC2C6E79AE92F3081
SHA1:	049C44CEFB7789D93796F6ED3415476F4C3BE6B9
SHA-256:	DA9BA58734468C70EFD57A7DA7CF6D9F5405BC563EB2136B7A6E7B1B07FE6F3E
SHA-512:	D759DD46E2D47A1A18A04C8F44F91390FFD917FF76EC1D4898DEC93512EF7B6F33B045F22835E8225F4F679C09210DF3FCA6649143FD507EDF7CC3002B40BE4E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...FY............" ..0..............<... ...@....... ..............................L.....`.................................7<..O....@..$............(...#...`.......)..p............................................ ............... ..H............text........ ...................... ..`.rsrc...$....@....... ..............@..@.reloc.......`.......&..............@..B................k<......H.......,!..h............................................................0..6.........i(......(......i..iX..........i(.........i..i(........0..........~................i(.....(.......i~......r...pr=..p~.........(....s....z.(......(.......0...........(......(.....:~....,..(.............BSJB............v4.0.30319......l...d...#~......4...#Strings........X...#US.\.......#GUID...l.......#Blob...........W..........3............................................................

C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\QWhale.Common.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	5.177812068372721
Encrypted:	false
SSDEEP:	1536:jnPlSpsvrGlP3wYeBKpqmSNbgM9ZtZLZQErK3PmIDXRtFhCj6ocpjyc44lc:rlSpsnQCg4ZtZmECfRtF0cpjy94lc
MD5:	AC80E3CA5EC3ED77EF7F1A5648FD605A
SHA1:	593077C0D921DF0819D48B627D4A140967A6B9E0
SHA-256:	93B0F5D3A2A8A82DA1368309C91286EE545B9ED9DC57AD1B31C229E2C11C00B5
SHA-512:	3ECC0FE3107370CB5EF5003B5317E4EA0D78BD122D662525EC4912DC30B8A1849C4FA2BBB76E6552B571F156D616456724AEE6CD9495AE60A7CB4AAA6CF22159
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8V...........!......... ........... ........@.. .......................@............@.....................................W............................ ......X................................................ ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\QWhale.Editor.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	835584
Entropy (8bit):	5.8267693764214945
Encrypted:	false
SSDEEP:	12288:vC84TFHhCRR87er17m62l/YpMVuRWGoN0ty6B:vC9T+R87er325wMVuRaGtPB
MD5:	EAA268802C633F27FCFC90FD0F986E10
SHA1:	21F3A19D6958BCFE9209DF40C4FD8E7C4CE7A76F
SHA-256:	FE26C7E4723BF81124CDCFD5211B70F5E348250AE74B6C0ABC326F1084EC3D54
SHA-512:	C0D6559FC482350C4ED5C5A9A0C0C58EEC0A1371F5A254C20AE85521F5CEC4C917596BC2EC538C665C3AA8E7EE7B2D3D322B3601D69B605914280FF38315BB47
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8V...........!......... .......... ........@.. ...................................@.....................................K.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\QWhale.Syntax.Parsers.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1196032
Entropy (8bit):	5.697795751444429
Encrypted:	false
SSDEEP:	6144:DDsAkHPWoMvThdMlLQtRZfScxaHrlXnp55VAWvRY02OCo6+shEd2qxrGa:DDs7uounM5WSNAG2otTh
MD5:	9FE6E9CFEDB661C61A2C70FA75008EC3
SHA1:	0F6A0F4E7FC5552088D3F2DD0C0ADF6F6C45B686
SHA-256:	ACFF23204982780D844F5B0CBFE0BF1849C1DFE782CB4084BA2BDC9BF53F026C
SHA-512:	A8864EE43628F667D6E0ACF071FBBA414FF768FE9DD302E6F9498432B3CE48A22DEECFE438099A3CAA684AD8E9588FAE111DE752C37C158EEBD76E48AB67E02D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8V...........!......... ......./... ...@....@.. ..............................].....@.....................................W....@.......................`......@................................................ ............... ..H............text...$.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\QWhale.Syntax.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	233472
Entropy (8bit):	5.650842692777023
Encrypted:	false
SSDEEP:	3072:Ns/3b/8FpHf3kBFcCsbfqai2/8Fjitdmus95jMRrgk+vWZYz39dHiB796k9gR5+r:NQLa/kBFcCsbfRgzM07XGk+V
MD5:	3BE64186E6E8AD19DC3559EE3C307070
SHA1:	2F9E70E04189F6C736A3B9D0642F46208C60380A
SHA-256:	79A2C829DE00E56D75EEB81CD97B04EAE96BC41D6A2DBDC0CA4E7E0B454B1B7C
SHA-512:	7D0E657B3A1C23D13D1A7E7D1B95B4D9280CB08A0ACA641FEB9A89E6B8F0C8760499D63E240FE9C62022790A4822BF4FE2C9D9B19B12BD7F0451454BE471FF78
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8V...........!.....`... ......>w... ........@.. ....................................@..................................v..W...................................hv............................................... ............... ..H............text...DW... ...`.................. ..`.rsrc................p..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\RulesTab2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35400
Entropy (8bit):	6.0888063704567905
Encrypted:	false
SSDEEP:	384:YSz6dWOaBkYRnJOAtTeoa8pGjMqxYMjZ09CZe4862VXQ2I/Q2FQ/urixGP6BiUCd:mNoBcMhW986ePQa/u2x63UCxf1mlD0
MD5:	042541FF2925D654930906B654B724AA
SHA1:	ECE609E7B1871530473CEDB77C375535AB15044A
SHA-256:	DAC4BF7E1EB765E462A43E6567602D35F512118BAB9F75A0A4DA972966972941
SHA-512:	25879CC5EE5BFDB43EF044D449D6F636A0D330480750DD4E4B9243FB702EA978D667E7C64F5080CE95E540411BBDAE34F29AE6533BE81002DEA7DD9CC6C9A965
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#..g.........." ..0..`...........~... ........... ..............................{.....`.................................t~..O.......<............j..H ..........<}............................................... ............... ..H............text....^... ...`.................. ..`.rsrc...<............b..............@..@.reloc...............h..............@..B.................~......H........<...:...........v..H.............................................(.....0...........{....,.(....{.....{....o.....{....o.....s....}....~.....{....o....o.....T.{.....{....o....o....~....s....o.....{....{.....{....{....o....o....~....s....o.....{....o.....{....o.....{.....o....~....,.~...........s....o ...~...........s!...o"...+.r...pro..p(#...&.{.....o$.....0...........r...ps%...}.....{.....o&....s'...}.....{.... ......s(...o)....{....(...o+....{....r...p".. As,...o

C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\SampleRules.cs

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	C++ source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24199
Entropy (8bit):	4.823916268934862
Encrypted:	false
SSDEEP:	192:/HpPawh9p96vClMRhLYTOdyB0kHKdbKAzUaN5lXDmxpl9XB3KLTHIJLerD0xF7PV:/pPFvZW8VTHdx9LArm
MD5:	6329A822FC0D3E5DE5BAB3B05D86E3B1
SHA1:	47F4E415686E7A10CCC28BB211F4A6F1316BF41D
SHA-256:	7CC16A1B2010C7CFC15D763D093F18455D337D2089F9AA17EED6905B313E074F
SHA-512:	E334BDFF2E975F3D4BCA0DD50022FC431B47647F3051DDA2E4D63313CFB68010C249ED06522B10CDEAAC0DC9FC1BF7A0FC31DA11E68CD0B92C87AA95603B09C6
Malicious:	false
Preview:	using System;..using Fiddler;..using System.Text;..using System.Windows.Forms;..using System.Collections;..using System.Collections.Generic;....// INTRODUCTION..// This is the FiddlerScript Rules file, which creates some of the menu commands and..// other features of Fiddler. You can edit this file to modify or add new commands...//..// NOTE: This is the C# version of the script, which can be used on Windows and Mono,..// unlike the JScript.NET script, which can be used only on Windows. In order to use..// a JScript.NET script on Mono, you must rewrite it in C#...//..// The original version of this file is named SampleRules.cs and it is in the..// \Fiddler\ app folder. When Fiddler first starts, it creates a copy named..// CustomRules.cs inside your \Documents\Fiddler2\Scripts folder. If you make a..// mistake in editing this file, simply delete the CustomRules.cs file and restart..// Fiddler. A fresh copy of the default rules will be created from the original..// sample rules file....

C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\SampleRules.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	5.048901021011334
Encrypted:	false
SSDEEP:	192:M8hsqImy1MTb0LB1GeagkQqzzzgWGZIVW0Gdcen9CpNlPdhr3f8nYny7+zjW6CXp:MI0gg2zWia9SVnyqOZ
MD5:	CB7BF8B2D0E15C0ECC290A242B9F743A
SHA1:	F1215262C0729DC6700FD5158EF6E437E64A4821
SHA-256:	69CC5397E0FA9F99A0D21476DA21147631A213F9F15652F8F182F34025ABB500
SHA-512:	49202347079E366477BA67372B086F5064B108C0C40AA52DFD833DEE821B87CC37D9929D5DA4FEFDD62A824EBF34C161107F08EA7B33D866D21C266CE99972FE
Malicious:	false
Preview:	.import System;..import System.Windows.Forms;..import Fiddler;....// INTRODUCTION..//..// Well, hello there!..//..// Don't be scared! :-)..//..// This is the FiddlerScript Rules file, which creates some of the menu commands and..// other features of Progress Telerik Fiddler Classic. You can edit this file to modify or add new commands...//..// The original version of this file is named SampleRules.js and it is in the..// \Program Files\Fiddler\ folder. When Fiddler Classic first runs, it creates a copy named..// CustomRules.js inside your \Documents\Fiddler2\Scripts folder. If you make a ..// mistake in editing this file, simply delete the CustomRules.js file and restart..// Fiddler Classic. A fresh copy of the default rules will be created from the original..// sample rules file.....// The best way to edit this file is to install the FiddlerScript Editor, part of..// the free SyntaxEditing addons. Get it here: http://fiddler2.com/r/?SYNTAXVIEWINSTALL....// GLOBALIZATION NOTE: Save t

C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\SimpleFilter.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	140216
Entropy (8bit):	5.89830188714415
Encrypted:	false
SSDEEP:	3072:cZNNCgj9CZFkWb8S2ubYZgzSR2ATfwIrWKyajC9aTGqqtfL7OrMz037CDWCye3O7:cZNNgkWb8S2ubYZgzSR2ATfwIrW3ajCA
MD5:	C258BDC1ADE8A12029F394DB00956DB9
SHA1:	ADFABB841DF1C3CFA1FB1E97A5B3F8783054BAA1
SHA-256:	487F39724BF1E4F387E131E6D932A0900BC949153077E200DDBC1A8E80B08337
SHA-512:	093D3909859C7907BBF6034460A3CD0B087E4890D25C515199C612A9FEBAD2FD9B3C1ACF4D639C8E9FBB6092D183258919BA68C308E9F3E9205B0680BA89BED9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..g.........." ..0.............^.... ... ....... .......................`.......u....`.....................................O.... ..H................#...@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H.... ......................@..@.reloc.......@......................@..B................@.......H............................>...........................................0..4.......r...ps.............s....o....(....{....o.....o....&.0..T.......~....r5..prK..p.o....s......(....o.....2Xo.....(....o ....2Xo!....{.....o"....o#....0..;........{....o$....+...(%...o&.....('...-...........o(......}..............%......J.s)...}.....(...6.(+....(........0..8.........o,...ru..po-...-..o,...~....o-...-...%.o/....+..o/....0..(........o,...ru..po0...t......,...i./...(....*.0..

C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\SimpleFilter.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	MSVC program database ver 7.00, 512*315 bytes
Category:	dropped
Size (bytes):	161280
Entropy (8bit):	4.102871568191864
Encrypted:	false
SSDEEP:	1536:b/lXb6Llgb4WgzVkJXr6bd2LKOxHmyFFwRsCc0YY8m/EulWy8WQbvPMA:bF1sWTVeSG6m+CSY8msunNEXM
MD5:	0487154E9DC1B67AA06337526090CBEC
SHA1:	9B38D0F546379F8CC6EBF86A68AA7FF9F9FD8A89
SHA-256:	E60C267B2B5B9D8D4565EEFB656A2ADE3BC67B964919F8F5B1B4E90EC3DA9E75
SHA-512:	DDEFBBC34931C18B26358EE095BD7474B408F05BDF1DF21540A13BB3BCF904C010E451D492595A61101783553F0B4DB4E113A350B964A78B139C4FA598F22EC9
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........;...........8...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\Timeline.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40376
Entropy (8bit):	6.158608693501068
Encrypted:	false
SSDEEP:	768:FE8uqoL19VqLPLyYh/9L5POBRz6e4NPTiIgxUXVCE6Txf1mlBqsvrvcYh:MVqLPLyYh9BGzyiIgx/fIQsTt
MD5:	10C47BCA8FF64C65A0C987B29A2DC53C
SHA1:	E7C2A97E4C27DC3641707F04BE1DE351AA96E897
SHA-256:	6A26C68A703720ECAE24B54B4E288D7C2F486FDBA18AFD90FAB09223D2FC1FB6
SHA-512:	CC7CD0B390D6B899244F9B2856B410E8486D879BF196E1C521761724FB0B0984EE33521D10C7046A06A11112E34F1222031CA266468E1C3012D42EBC09411D39
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..g.........." ..0..p.............. ........... ..............................m.....`.....................................O.......(............z...#..........P................................................ ............... ..H............text....n... ...p.................. ..`.rsrc...(............r..............@..@.reloc...............x..............@..B........................H........U...6...........................................................0..R......................................... .........(.........(......... ...................0..'........u......-.r...ps....z.\|.....{....(......(......0..n........~....}%....~....}&.... ....}'....(.....r]..p"...@s....} ....r]..p".. A.s....}!....(....rk..p.{'...o....}'......0..I........r...ps....}.....{......o....(....{....o.....{....o ..........s!...("..."..}.......0..J........o#... ....3<.(....,

C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\Timeline.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	MSVC program database ver 7.00, 512*79 bytes
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	3.5903602804832335
Encrypted:	false
SSDEEP:	384:Z4RN/OYENw2WU576+k2g1K1Kz3Z3I44JLJbanBg+ekKS:Z4RN/OC2Thk2g1L35WLJiK
MD5:	8FCC3CD7CD603BC67055FC66A80BF582
SHA1:	43531818827C7C19DDFDF25BA57E05492F7D3C42
SHA-256:	0EB3F319506F82E2FA24F59BD3E3D597DF13F34A7B3E893F6CE717C20D74F546
SHA-512:	EC55162CD8B1D5799E078F0C593315D60D92F1032028C328A654C9A1A9CA36E04A4A868C0FABC5697D557C16BB8DB507F64665C3CBA717CFDA79664C6F8FF785
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........O...........N...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\netstandard.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	98616
Entropy (8bit):	5.627990537858435
Encrypted:	false
SSDEEP:	1536:Q2Ec05j4eAH64rh5fSt5T9nFcI94WiVQTjpu:nlK4eA7mDmWqQXpu
MD5:	0ADF6F32F4D14F9B0BE9AA94F7EFB279
SHA1:	68E1AF02CDDD57B5581708984C2B4A35074982A3
SHA-256:	8BE4A2270F8B2BEA40F33F79869FDCCA34E07BB764E63B81DED49D90D2B720DD
SHA-512:	F81AC2895048333AC50E550D2B03E90003865F18058CE4A1DFBA9455A5BDA2485A2D31B0FDC77F6CBDFB1BB2E32D9F8AB81B3201D96D56E060E4A440719502D6
Malicious:	false
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\netstandard.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M..Z.........." ..0..8...........U... ...`....... ..............................v.....@..................................U..O....`..,............B..8?........................................................... ............... ..H............text....6... ...8.................. ..`.rsrc...,....`.......:..............@..@.reloc...............@..............@..B.................U......H.......P ...4..................,U......................................BSJB............v4.0.30319......l...\|...#~.....d...#Strings....L3......#US.T3......#GUID...d3..x...#Blob......................3................................q.....2B........e$.M...,.M.....M...4.M...1.M...1.M..v..M....M....M....p...........................!.....).....1.....9.....A.....I.................................#.......+.......3.......;.J.....C.f.....K.f...................2.....................

C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18496
Entropy (8bit):	6.272865991323523
Encrypted:	false
SSDEEP:	384:tCgQl6Tk+JUEt/aSowaKaix0iAFCjdAA1m5wMDBu4d:tCHsk+JxaSLhxaFCxf1mlD0C
MD5:	B1827FCA38A5D49FB706A4A7EEE4A778
SHA1:	95E342F3B6EE3EBC34F98BBB14CA042BCA3D779F
SHA-256:	77523D1504AB2C0A4CDE6FCC2C8223CA1172841E2FD9D59D18E5FC132E808AE2
SHA-512:	41BE41372FE3C12DD97F504EBABB70CE899473C0C502FF7BFEADDC748B223C4A78625B6481DBAB9CB54C10615E62B8B2DBE9A9C08EB2F69C54EBF5933EFBEB1B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#..g.........."...0..............:... ...@....@.. ....................................`.................................X:..O....@...............(..@ ...`...... 9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................:......H.......D$...............................................................0..Z.......r...p.....r...p~....r5..p(.........rQ..p~....r@..p(.........ry..p....(....r...p(............0..t.........,....r...p(....,.~....(......(......(.....,.......(......r...p.o....,...(....`.+..r...p.o....,...(....`..(......0............i...-.(....~....o............r...p.o....-..r...p.o....+..-.(....r...p.(....o......`..(......(....-.(....r...p.(....o......`......0..]........(....,..*..(....-..

C:\Users\user\AppData\Local\Programs\Fiddler\Telerik.NetworkConnections.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35464
Entropy (8bit):	6.453233280342992
Encrypted:	false
SSDEEP:	768:GfDHRLnD0jEGs7UUe7DZXKNT8NTcYfKal:SHZgZ6F8Fctal
MD5:	798D6938CEAB9271CDC532C0943E19DC
SHA1:	5F86B4CD45D2F1FFAE1153683CE50BC1FB0CD2E3
SHA-256:	FB90B6E76FDC617EC4EBF3544DA668B1F6B06C1DEBDBA369641C3950CAB73DD2
SHA-512:	644FDE362F032E6E479750696F62E535F3E712540840C4CA27E10BDFB79B2E5277C82A6D8F55F678E223E45F883776E7F39264C234BC6062FC1865AF088C0C31
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....X.].........." ..0..L..........>j... ........... ..............................o.....@..................................i..O....................V...4...........h............................................... ............... ..H............text...DJ... ...L.................. ..`.rsrc................N..............@..@.reloc...............T..............@..B................ j......H...........`9..................4h......................................b.( .....r...p(...+}........0............o.......(.........................0..)........{.........(!...t......\|......(...+...3.....0..)........{.........(#...t......\|......(...+...3...{.......3...,..($....o$...(%...,...(.....o....(....6..u....(....F.(....(...+(O...:..o.....(&...N.{....%-.&..o'......( .....r...p(L...o(...}......r'..p(L...o(...}......{......{.......3...-..*.(.....o....()...

C:\Users\user\AppData\Local\Programs\Fiddler\Tools\Brotli.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	749771
Entropy (8bit):	6.0532628201503185
Encrypted:	false
SSDEEP:	12288:I3H2D06ndyrxxCP9myHMfAHhlyVM1o/5XTw05nmZfRR8cdMnXFb:GH2D06ndM2Vmy2AOKAmZfR2cdMnXFb
MD5:	E57E9ADB99414CF052CD9C90205BFE3D
SHA1:	5765B48637395C48AC839BB31C0842E90EAFFD90
SHA-256:	BDF333EBAD3C91E5280755C07AB6EB4E8FFD4463F96617F33C25F66EF82B341F
SHA-512:	2F1A75DE7B49BC150DEAA28C99B9C970C02E1D562598097E64E5128613DC79DCFBA2A6F9D948FDA9DBF5C5363C842FA7C5DADE51475751DE91A005683DA3B9AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....$X..................................... ....@..........................`................ ..............................0..0............................................................P.......................1..D............................text...$...........................`.P`.data...,.... ......................@.0..rdata..p....0......................@.`@.eh_fram.E.......F..................@.0@.bss....4.... ........................`..idata..0....0......................@.0..CRT.........@......................@.0..tls.... ....P......................@.0.................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\Tools\JXR2PNG.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14296
Entropy (8bit):	6.2892904031397325
Encrypted:	false
SSDEEP:	192:62ma8AyahFW1zxM7x0tbKktMhDWpHeLWwsU7K6CY1PK:wAHhFW1gzzDGNMK6j
MD5:	1BA9AD64054A370E87D4F50B8C66572D
SHA1:	C78EB09DB64F8414274AEF95C5133095FD35A776
SHA-256:	B210D589290A6364A9E303C2F72831C9F6A303B73F898E9AE4AEC961E61DF875
SHA-512:	7DC88886C6D67251546301C6064FD0465A29AA7D1709D979590B004E7433AF5BF78E0210CB93D9B919B55EE079A1AF4481101375DE9F752B0348904A04B6A312
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....T.............................-... ...@....@.. ...............................N....@..................................,..S....@.......................`.......+............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......h!..(............................................................0..M.......s......o......s....o.....o......s.....s.......o.....o.....(....o......o.........0............i./.r...p(..........(....-.(.....(.......i.1.....+..r...p( .....(....-.(.....(......(!...-.r...p.("......)..(....,........r...p.o#...( ...($...............j\|..#.....(%...*BSJB............v2.0.50727......l.......#~..l...(...#Strings........4...#US.........#GUID.......P...#Blob...........G.........%3

C:\Users\user\AppData\Local\Programs\Fiddler\Tools\JXR2PNG.exe.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.874729609699232
Encrypted:	false
SSDEEP:	6:TMVBd1II5KNZk2ygAyONw5KqfVKNC7VrfC7VNQlcXuAW4QIm:TMHdGzNZoE0w0OVO+Qr93xm
MD5:	F7CEF9EF7B7B0D5D17E496A0AA5EF753
SHA1:	26605124011AE156EE2687B7973F95C1862F6106
SHA-256:	EAAEBA1A6B05A4091D7271DA8B8A7BD0C3F39B73968C50287267A78D60E0FDD2
SHA-512:	76B0FAE88A24B1ED5A5B03DB672CF2D3B0B44DC515ECA5EE0AA631C7D30DC825BB964017DDE131BE72424EE958311AC346047D8EBF20B7E2BD65125AC5E86C0B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <generatePublisherEvidence enabled="false"/>.. </runtime>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" sku="Client"/>.. </startup>..</configuration>..

C:\Users\user\AppData\Local\Programs\Fiddler\Tools\PngDistill.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	47680
Entropy (8bit):	5.518745143321989
Encrypted:	false
SSDEEP:	768:ZkIVnY1p6yMxzph6akvzGTF0U0QwvI1KmwDx8cNCxf1mlD09:ZLnYTgpdkvSZ6vi9wDxAfII9
MD5:	F8294E5C0BB977D765C7D7A814AD3FBC
SHA1:	9EB8265A33A41024742108124C1D9FA6A01E8B7D
SHA-256:	AE32E1F31A22CE473AD5E9E6B865E9D10D321E34EE76B5DD84942563B83147A4
SHA-512:	6B098FD6974A12B40AF6A775D45A413863257B95D59552476B8567BA64DB9DD203141CB738E6ADFAE057BFF094BD2682821BF100102B1ABC79352BA3163AB089
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#..g.........."...0..H...P.......f... ........@.. ...................................`..................................f..O.......,L..............@ ..........Le............................................... ............... ..H............text....G... ...H.................. ..`.rsrc...,L.......N...J..............@..@.reloc..............................@..B.................f......H....... 6..,/...........................................................0...........,...-...........i.1....._.3.... ....Z...X..]-.......i.Ys......is......s..... .............+......o.........io....%...0....,..o......o..........N.-{.......0..7.........i...i.....i.Y./....3.....X...%.X........X.....Y1....0...........(.....~......(.......<....r...p(....(...........%.....(........X(.......X1$rI..p..&...(....~.......X(.....8..........%.....(........X(......./.r...p..&...(...

C:\Users\user\AppData\Local\Programs\Fiddler\Tools\PngDistill.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	MSVC program database ver 7.00, 512*51 bytes
Category:	dropped
Size (bytes):	26112
Entropy (8bit):	3.1182610507436137
Encrypted:	false
SSDEEP:	192:6APNAPAAPOKZnwKpuCYbIHYTr9dYLWAyy3UOx9T8xweKOCBz31UO4eC5acXNwwLm:Vm/7iIAYWAyy3UOx906r1QCzm
MD5:	CE7FF68343825B2844DDFD04C1230B29
SHA1:	1D74A1AF0F3D76656C02D1523E701950A403D3BF
SHA-256:	3290569230B85D908CB10FF937EFEA102F89F3F0E4B62679C6B5A400BF94C267
SHA-512:	30F5BAD56417B05BCC544AC53848488C64372FAE0607FB4A5C9D3AA829E1E103059AEBF8C81ABBF9E4B916F7B38A011AB5BD230A7721CE69F81DD0FB906D8761
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........3...........2...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\Tools\Zopfli.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	166232
Entropy (8bit):	6.613517009682869
Encrypted:	false
SSDEEP:	3072:WQBil5nSdPza27aZK4zFD6bLIuEke1KsXL4PoYmopuJQ74PoXh:WQAlUdL3mF+LIWC5kd7f
MD5:	9C8CC053CE3163BDC94258DF6FAC1419
SHA1:	98ADC48ACA53CA5C6C90B9AA3DFBB60DB57FCE76
SHA-256:	FF6B47EE6165F4E10D450C96C1875D932B8E7FE788D0F53E615F2F25558DB06B
SHA-512:	099A6ACAEC501462702A33EE9A2C2A7B5E2BB91B7BB77E4E762E50166BC4AF3EA8CDE675289ED7769981627664D7161FD4E1F7EB711B91A57B6FCC550B338077
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>R.._<.._<.._<._..._<._..m_<._..._<...?.._<...9.._<...8.._<..'..._<.._=.._<...1.._<....._<.._..._<...>.._<.Rich._<.........................PE..L.....VW.............................o............@.......................................@.................................\>..<.......8............V..X3..............T............................ ..@............... ............................text.............................. ..`.rdata.............................@..@.data...0....P.......0..............@....gfids.......p.......:..............@..@.rsrc...8............<..............@..@.reloc...............B..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\Tools\dwebp.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	232448
Entropy (8bit):	6.736426607587925
Encrypted:	false
SSDEEP:	3072:quomVW49bB0zguJ25uPpHbbaa3TlO78fn0HZ3mHWqnaSBuPJ31T6+/zdqH:qunZb78f0wHWqD+Z1
MD5:	20E8776B40C1AE01526DF9D629A8976B
SHA1:	34045F876B75B178C706E7D2B5CFC7DB636835C0
SHA-256:	7230212A8242F90A518B5282717CCE125C06599D52274547657491C848334867
SHA-512:	97F9EE3DA84851668B12449F003B9C7CFC03CFBC7D8F77FF549DD8817DE357BD292C9DEFEEF094BC91CCF2210B47DEBDD249FA4BA7A2A5CFAD2E6237B2EB9380
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b..#&..p&..p&..p8.lp...p8.}p8..p/.lp'..p/.{p!..p&..pM..p8.kp...p8.yp'..pRich&..p........................PE..L......R.........."...............................@.......................... ............@..................................[..P...............................H....................................U..@...............x............................text...T........................... ..`.rdata...d.......f..................@..@.data....s...p.......T..............@....rsrc................l..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\TrustCert.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22968
Entropy (8bit):	6.4437329367080745
Encrypted:	false
SSDEEP:	384:4cfsyZmstjYgixVTvCaTjdAA1m5wMAvru4LTAVVz+4E2k:n06jYLxdvCaTxf1mlA6NVVq
MD5:	AEAAFB82C9DA482EBD353FEDE1DA1C59
SHA1:	5325056E13CBCEE94398FAF93B0194C00753C2E8
SHA-256:	0AAD2EF66EAF23C20B46E129E8E6B84B4920C910BB3070242BC2031A71A0BBC4
SHA-512:	F5211C8B89C10D1703B92648C2413CEBAA8A80ACEA2664E6ADA60FA791E79D27B238D7E7CD530BCB78CB4767C34208D7B23E3F58AF8A0C460D43BD86440403F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..g.........."...0..............8... ...@....@.. ..............................x.....`.................................48..O....@...............6...#...`.......6............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......4..............@..B................h8......H........#..D............................................................0..$.........s.......o.....o.......o.....o.....0...........-...,R.r...p.-.r...p+.r...p.-.r...p+.r...p.o....o....r...pr...po....(....r...p.(..........s.......o.....,...o....+...o.......o........+..o....r0..p(....&rR..p.o....(....(................j...........[./..+.....0..........( .....i./.r...pr]..p(....&.*...(.................(!................(!...,T.-..+........(........o"..../+r...p.-.r...p+.r...

C:\Users\user\AppData\Local\Programs\Fiddler\TrustCert.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	MSVC program database ver 7.00, 512*35 bytes
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	2.2569357293523504
Encrypted:	false
SSDEEP:	192:nAAPZFAPAAPrTFBzK3tfxWtEf4zVt31SFz97uhR:/s/efM3h
MD5:	546D55D915E55FF503C3FE6082C7EF98
SHA1:	C2FBA2B250B92F0F7671CE8E2401E42FDF07E72B
SHA-256:	64C9312EED203CDCBC621BF97A8D2406152010ECAF53296740B455210BB09B6C
SHA-512:	6E8A5E2115F65BEFB87F2D115EE7EFAB89238AD8778CA59FFC48E5A1B7560054E52D723102F37477C6C9CC9740203BE8424B0C8B8F3F0F8206516B1C7A7ADCB8
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........#........... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\credits.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2952
Entropy (8bit):	5.171880854375289
Encrypted:	false
SSDEEP:	48:1x62jjbSHhot5YZLblQuDuyPc+E4ja9OOrYJCrYJzbdopPD0432sOys3Etm13c6j:142PeHhobYZLblQuDuyEkjawOrYJCrYp
MD5:	622517E6D7A15A9950C8BE105F25039C
SHA1:	EF98484F96BBC6440D9515D6F1048DC62A8E961F
SHA-256:	0B63B836496CE758C4A84B175EAC7DB0A0DBB1104DAC33D1F97A71703E5146C6
SHA-512:	039870CC4AA92931BCD4C002669E129BAB004A0C311654551B802A1EC35BB20AF007437DCC7752459D1DF7C6168233F9AAE413AAC18D61A1996F79D2995567B8
Malicious:	false
Preview:	Find the online version of this document here: https://fiddler2.com/r/?credits....Fiddler depends on the work of a number of other companies and individuals:....Some of Fiddler's icons were generously provided by the FatCow.com free icon set, licensed under Creative Commons. http://www.fatcow.com/free-icons..Fiddler is installed using the excellent freeware NSIS Installer. http://nsis.sourceforge.net/Main_Page ..Fiddler's HexView inspector uses an early fork of what is now the HexEditor control http://sourceforge.net/projects/hexbox/ Copyright (c) 2011 Bernhard Elbl - Licensed under the MIT License. http://www.opensource.org/licenses/mit-license.php..Fiddler's JSON parsing support is based on a sample Copyright (c)2008 Patrick van Bergen - Licensed under the MIT License...Fiddler's JavaScript formatting code is based on a sample .2012 Jonathan Wood - Licensed under the Microsoft Public License. http://www.microsoft.com/opensource/licenses.mspx..Fiddler uses the DotNetZip NuGet package

C:\Users\user\AppData\Local\Programs\Fiddler\license.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	ISO-8859 text, with very long lines (1954), with CRLF line terminators
Category:	dropped
Size (bytes):	5041
Entropy (8bit):	4.5341491364928475
Encrypted:	false
SSDEEP:	96:z220PCCe4nnikZsB1d/+DYw6Roh5RY4uYNoizT:zZmvPnnikyB1dmR6ezRYzKTT
MD5:	DA2C3104A5797F34948F766C8BACBC28
SHA1:	1C5AA77277B7178ABE2FA0938C78FB64682497CA
SHA-256:	53B68DFC6F203A233364DC18C550F3DDF5FF224D922177F119EAE47B97F3D797
SHA-512:	5A997268DE9B1FBBE19B267A83B32341C8462B620DA6FB57B05D3B0AAB5E652007255BE8D1B966CB0D54F768B5EEF19FA3CCA4EDED50614E16D1A967A9BB6C31
Malicious:	false
Preview:	Progress Telerik Fiddler Classic..(Last Updated June 15, 2021)....The following terms and conditions govern the use of Progress Telerik Fiddler Classic (the "Software"). By using any of the Software and/or any updates to it, you indicate your acceptance of these terms. If you do not accept these terms, do not install or use the software.....The Software and any updates to it are provided "as is" and you bear the risk of using it. In no event shall Progress Software Corporation ("Progress"), its affiliates, or its licensors, be liable for any consequential, special, incidental or indirect damages of any kind arising out of the delivery, performance or use of the Software. The Software was written with care, but no one warrants that the Software is error-free. Your sole remedy for any failure or any form of damage caused by the Software is a full refund of the license fee we have received from you, which in all cases is $0.....On startup, the Software anonymously checks for new versions;

C:\Users\user\AppData\Local\Programs\Fiddler\makecert.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	55632
Entropy (8bit):	6.11762484164107
Encrypted:	false
SSDEEP:	1536:Mh3UWxHO1W7R//8XfpenTJ42aar/dN1Eq52:MhEWRz7Rn8PpenTJ42aUfEq52
MD5:	3DA54BD90C1A4EF9A12270102C047FC5
SHA1:	F1633906D490813514621DE980E12E4B4B9FBA0E
SHA-256:	61D76327DE227AE8F15AFBB0F99C1DF6152061855DF7B35DBD6FF7329FC1BA4D
SHA-512:	90161AA69D9B59E6A5864B61237DD00BEC121B24607BC8DCB3184159E42ECA81FDE64E68E4CAE2F8EE7E798A6051AFFCE8AF47B005883ADF23F73BEEFBA9A66D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............A...A...A..`A...A..vA...A..fA...A...A...A..qA...A.j.A...A..aA...A..dA...ARich...A........PE..L.....[J.................r...n......._..............................................SF....@...... ..........................du...........9..............P........... ...................................@............................................text...Zq.......r.................. ..`.data...0&...........v..............@....rsrc....9.......:...\|..............@..@.reloc..`...........................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\saz.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 24 bits/pixel, 32x32, 24 bits/pixel
Category:	dropped
Size (bytes):	11502
Entropy (8bit):	4.9151297452603355
Encrypted:	false
SSDEEP:	48:uy2FX87Vo3+Qzm0atW7NZ5hwpwk+3Z4VaR2TLPv/i0S3duwR/O0YUIemJojskYt5:LUT3+Qz3aY7NfhSpwZ4VaRC60jUmOjsx
MD5:	A1D6A5FF94FEFBEF1D05BCBCED52126C
SHA1:	4E6B230E29EA4B73CA8FC6B4AB8E433BB10B97C8
SHA-256:	6D0E756D6EF91EE4A45A55857DC473CA8E4FCC2D47BB3285CB6BE9B52BF9D239
SHA-512:	45D44046B6FFBFEFD8151908B252FBB799415718108B99EFAC8E3008CF97F62E288FBFB5617AC26D85D75BFEAB7BD8A1248F69C27577CA52DBEEAB12EBB7F110
Malicious:	false
Preview:	......00..........6... ......................h....)..(...0...`......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................yy.h...............................................................................................................

C:\Users\user\AppData\Local\Programs\Fiddler\uninst.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	108072
Entropy (8bit):	5.271335896339067
Encrypted:	false
SSDEEP:	1536:3fHLrLkSRoybCQUZsrs0DC1cuGwwwwwwIwwwwwwwwOwwwwwwwwwwIwwwwwwwwwwa:3fr3k+o5buDC1cuis7ouiSUK9
MD5:	E00ADF1DA1A9C01AB40C6B264BA629E2
SHA1:	6D518D25E93F18020F11D8EFD72C771E41ECEA26
SHA-256:	488A1936AE37A1AD1916004CDA6FF1737DA0C040180AB2A4E9ED2D3C4075E05F
SHA-512:	AFC9B72FC74D47223A4C7EF6412A0520AD3BD2267F54F233CDB0BFC4A3BBB8F142EFE695A70969D35D911C2D0B1E96C42D7A62E54EF60C83E1BC5E6F43D00A3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN.s~..PN..VH..PN.Rich.PN.........................PE..L....C.f.................j..........R5............@................................. .....@..............................................Y..............H ...........................................................................................text....h.......j.................. ..`.rdata..d............n..............@..@.data...............................@....ndata...@...P...........................rsrc....Y.......Z..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsbEF3C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	15161250
Entropy (8bit):	5.9934234548140655
Encrypted:	false
SSDEEP:	196608:Ijgf+VOG5vbSgwAD+4RGRTeGr6VOtMsYz9x:khSgvD+4RG1n+Vkrg9
MD5:	D0D8C0D7B8C7727EDB4BABD3B9915E9C
SHA1:	ECDF9AA683F7C5D7661FBC8363D7516EB2AFBBB6
SHA-256:	74D80C4811B400CCED8C11422FD054D07284858E4AA339600EE1916B3D69B9DC
SHA-512:	5868FB680B2DA0FEB1070A01F16042A060E7199DB7DABB1ACB6107587E6327A5A56A8CD6683BEF9337583C8BFE04E8E6CE42CDE4F04E98D930E77413BF72885F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Temp\nsbEF3C.tmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\nsbEF3C.tmp, Author: Joe Security
Preview:	D.......,.......,.......D...............N.......D...............................................................2...........................................................................................................................................................................................H8..f...............................................................g...............................................................j....................................................................................................................................................:..................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe

Download File

Process:	C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	4583304
Entropy (8bit):	7.997484800525797
Encrypted:	true
SSDEEP:	98304:KgxyUnSAaB1eXq8yOkLiGXv72Qomw6pvtFIAwdaRdAM:KoWvePjqHv72Qo96pvtF5wHM
MD5:	C2A0EB6F104EACEC3F39581451EE208F
SHA1:	9AE7D02AEB640FBD090DFC01885B98DD5DD0B6CC
SHA-256:	1F926CC353301E547E76C6D2EFF23FCBE85495BA0292174CC6344FAC26457AF8
SHA-512:	8B062E4F0AF1DCE3A12B5776646FE8C235F30DE6772F579DA1A6AB2BB559ED69B3BD32AF95EEE248C48008DDCBD40A7E49EAE722A44BC9B49DD13FE38113A3CA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN.s~..PN..VH..PN.Rich.PN.........................PE..L....C.f.................h..."......e6............@..........................@......).F...@..............................................Y............E..#...........................................................................................text....f.......h.................. ..`.rdata..X............l..............@..@.data...x...........................@....ndata...@...............................rsrc....Y.......Z..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsu12C2.tmp\System.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.804946284177748
Encrypted:	false
SSDEEP:	192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
MD5:	192639861E3DC2DC5C08BB8F8C7260D5
SHA1:	58D30E460609E22FA0098BC27D928B689EF9AF78
SHA-256:	23D618A0293C78CE00F7C6E6DD8B8923621DA7DD1F63A070163EF4C0EC3033D6
SHA-512:	6E573D8B2EF6ED719E271FD0B2FD9CD451F61FC9A9459330108D6D7A65A0F64016303318CAD787AA1D5334BA670D8F1C7C13074E1BE550B4A316963ECC465CDC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....C.f...........!....."..................@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 15 13:59:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9605987231638786
Encrypted:	false
SSDEEP:	48:88d7Tj3XHtidAKZdA19ehwiZUklqehiy+3:84Pfhy
MD5:	09CB55776DAA977DBC425D9895E06BCF
SHA1:	68D086F00770F52B1BA55B8F2B4CA40E61212AE4
SHA-256:	A86817349372DCA597ACCC5B775B9503D2C870459E3A88CEEB56CA23489F412D
SHA-512:	41E4EA2B60BF293004CB4A2FAD727C05519834CDD4956589118475CBDF0C29327FF1A221F5A1A1898D66F1EE31C8F627C4D7702B2A3487EBDEA92DCF92FF44E9
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....g..n7..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IoYew....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoYew....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoYew....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoYew..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VoYgw...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............w.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 15 13:59:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9785054962547126
Encrypted:	false
SSDEEP:	48:8Zd7Tj3XHtidAKZdA1weh/iZUkAQkqehRy+2:8/Pl9QAy
MD5:	4236990495A8DC77252D0D5BDB11D572
SHA1:	F0A905B9580C9A8CBEF0C7AA26E50E21093A2F65
SHA-256:	276E526EB9BCDEE05A0DC4AC24D2AEEC98C2307375690D9DAF8A22852B4633AF
SHA-512:	882E87B965086DD08ABC03C9C8F09916E4AD7781A158FE08CDF156B8619384D3983EE1ADB3F0D7CC3F88ABA0ABEA854AE685AFA5611050BCEED649A8A7A8497A
Malicious:	false
Preview:	L..................F.@.. ...$+.,....U]..n7..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IoYew....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoYew....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoYew....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoYew..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VoYgw...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............w.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	3.9936848948967723
Encrypted:	false
SSDEEP:	48:8xwd7Tj3sHtidAKZdA14tseh7sFiZUkmgqeh7sXy+BX:8x0PMnVy
MD5:	E54180047EC20E1EA8F3CA4D5576C940
SHA1:	9C0EC425B4C31D2F5D8EB1960093DA625598A177
SHA-256:	3E6E33E11ED8A96FB88026266AB8349F528414EE84132E7D9F57FBA73A4E5074
SHA-512:	DF16D853196630E8E01D59E141F72455A515CB5C25010D4C8773DAC1EB4D975027EDC53F0CB9A1930EFD236229A476F6CF852003D8EB79ADBD42E5885A715D0F
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IoYew....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoYew....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoYew....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoYew..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............w.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 15 13:59:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9766959207701618
Encrypted:	false
SSDEEP:	48:8cd7Tj3XHtidAKZdA1vehDiZUkwqehty+R:8YPmvy
MD5:	DD04500612F017556E0ABD224B8F09CF
SHA1:	6E38FCAC32557B94794E13AD20F567B168CF2169
SHA-256:	C994AA9D73DA3351A8D0CA9FCBE7DDC184F18C3E489384D26E7D8CBA1E9BA58C
SHA-512:	A74F8B4C1A71D609E285C1DC379A84438B9D8DDAB6EA0A0ECF9770B8F10EC4C49910622F0D41FB715FACA45D79618CDD86A281A6221483C0E0C1470ED58CEF15
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....a.n7..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IoYew....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoYew....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoYew....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoYew..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VoYgw...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............w.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 15 13:59:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9667430597830498
Encrypted:	false
SSDEEP:	48:8Ywd7Tj3XHtidAKZdA1hehBiZUk1W1qeh7y+C:8Y0Pm9by
MD5:	EF2FC98D8749BC3A290C10B1C3C6843F
SHA1:	F59E1EE7D55ECDC2A655C8BDE91ADE9F58C12803
SHA-256:	2D14C433D01CABE84061F860A75871645B20509475BA9C85148B42A3363AE0E4
SHA-512:	F477F3F55E6FC45CE173A85A70C3606D8E1E4160CC7EBC26F34FEFA3240E2D5DB77C1848AB21397CCFEFDC0F1C628DC908FFB04E6947422872C32E35BC47BD73
Malicious:	false
Preview:	L..................F.@.. ...$+.,....y..n7..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IoYew....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoYew....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoYew....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoYew..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VoYgw...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............w.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 15 13:59:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9745086767572073
Encrypted:	false
SSDEEP:	48:8Td7Tj3XHtidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbVy+yT+:8hP4T/TbxWOvTbVy7T
MD5:	986A7E13A786C2425580761B779D1640
SHA1:	8751A883C77984B395F0DE97E11415062F6D0A7E
SHA-256:	D84621338A400BC34AE359836E36BC747472948827B3016A93E2F37C3E1D3114
SHA-512:	29C1F3371836621E33FFF02E029B8EFAFA0D0DFABD7D0F5E133565CFA00461224F017E86F693A9B8A2D166C56072695B1093A7E004F32BBC58237709B875A1B1
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....DK.n7..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IoYew....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoYew....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoYew....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoYew..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VoYgw...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............w.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fiddler Classic.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Wed Oct 16 13:44:22 2024, mtime=Fri Nov 15 13:59:05 2024, atime=Wed Oct 16 13:44:22 2024, length=3668408, window=hide
Category:	dropped
Size (bytes):	2165
Entropy (8bit):	3.686513787832474
Encrypted:	false
SSDEEP:	24:81GK+Gfc284kROvqnjwCA/nqGzGZGpO4ZnJqGYPd9iiqygm:8MaILROvikh/qGzGZGpZJqGVyg
MD5:	FDFB3C23946793DC50BCB8D111E1A2B9
SHA1:	C3BA17B9853EDC58F9609A6B0010B7178A8884AA
SHA-256:	32D80F995CA95DFEBDB6E69E592039FC76C50D7ACA8C382366E6F7F676BDA303
SHA-512:	BBA0DE607596E0A5EBE7EA6B52B4AEFDD82155DBE9E10206445AB1840FD63A4E9C66A35B0439204A596845E6BBDB19E7C58E43CD9E662D0E053220B337A49E56
Malicious:	false
Preview:	L..................F.@.. ....'V.....K.T.n7...'V.......7..................... .:..DG..Yr?.D..U..k0.&...&...... M.....\. .n7..+u..n7......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSloY\w....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....oYcw..Local.<......DWSloYcw....V.....................ZAc.L.o.c.a.l.....Z.1.....oYcw..Programs..B......oYcwoYcw....v.....................ZAc.P.r.o.g.r.a.m.s.....V.1.....oYdw..Fiddler.@......oYcwoYdw....)........................F.i.d.d.l.e.r.....b.2...7.PY.u .Fiddler.exe.H......PY.uoYcw....*.........................F.i.d.d.l.e.r...e.x.e.......i...............-.......h..............w.....C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe..1.....\.....\.....\.....\.....\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.F.i.d.d.l.e.r.\.F.i.d.d.l.e.r...e.x.e...C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.F.i.d.d.l.e.r.:.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fiddler ScriptEditor.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Wed Oct 16 13:43:48 2024, mtime=Fri Nov 15 13:59:06 2024, atime=Wed Oct 16 13:43:48 2024, length=51712, window=hide
Category:	dropped
Size (bytes):	2305
Entropy (8bit):	3.7765334886763626
Encrypted:	false
SSDEEP:	48:8+EILROviqwWrbFt2G3isGasG3ikZvqG3iKyg:82FXqwWrbaMkfKy
MD5:	B48FB0572E5962D05C854D3BB3D55779
SHA1:	C2FDFF8AFF3C6A17ED9953143E684F705A5E9506
SHA-256:	F9E6F5A205916E4A58E5317DD38A9C567B186ED47FA61E074061FA8C9120A897
SHA-512:	723B94A8DB842F3164FB8091466523B6C64F5788195DD44C70ECF3747488792AF97E1E26D6DF98855DEC4211D559093E102D9F4DCDE963CD547FEECA8E7855CA
Malicious:	false
Preview:	L..................F.@.. ...........!..n7.................................z.:..DG..Yr?.D..U..k0.&...&...... M.....\. .n7..+u..n7......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSloY\w....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....oYcw..Local.<......DWSloYcw....V.....................ZAc.L.o.c.a.l.....Z.1.....oYcw..Programs..B......oYcwoYcw....v.....................ZAc.P.r.o.g.r.a.m.s.....V.1.....oYdw..Fiddler.@......oYcwoYdw....)........................F.i.d.d.l.e.r.....b.1.....oYdw..SCRIPT~1..J......oYdwoYdw..........................(Q..S.c.r.i.p.t.E.d.i.t.o.r.....Z.2.....PYxu .FSE2.exe..B......PYxuoYdw..............................F.S.E.2...e.x.e.......s...............-.......r..............w.....C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\FSE2.exe..;.....\.....\.....\.....\.....\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.F.i.d.d.l.e.r.\.S.c.r.i.p.t.E.d.i.t.o.r.\.F.S.E.2...e.x.e...C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	modified
Size (bytes):	369784
Entropy (8bit):	5.368743386306262
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauB:zTtbmkExhMJCIpEm
MD5:	3ED6837AC9B1268D0A37E13C846BF139
SHA1:	B7666076DA3A227CF4570944516D6AE1BB3E13D0
SHA-256:	5F3DD1ADF97BD1082A3F2BEC2840BF7E07569A45E4AD1A78FA7F7888F992B257
SHA-512:	C79A7191DE09CF201BEAD6E919808EDE5612F92DD1E21D6E808ADFFE1FFCD0F9130AADBC286A118E8DD662620488B28A422390FB2BBAC7387683AC412D5D53AA
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\assembly\NativeImages_v4.0.30319_64\EnableLoopback\656decbd27699754c5f7dcdf8abebd4d\EnableLoopback.ni.exe (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	164352
Entropy (8bit):	5.7260151113427815
Encrypted:	false
SSDEEP:	3072:tB+gFm8M56yjvmXrISaRUoP+hXOleEMzfJE8yA:tB+joXrkRAhXOleEMzfudA
MD5:	1A09EF838B88621FC1797A18D755B6FD
SHA1:	33576757652AD0DA4E35D631D52AC0C9DFBC53A2
SHA-256:	D9DDE1A37F72EECA29C0D9B9700F4B887837ECB7ED91ADDDB78FEE630B0A60AD
SHA-512:	2B9C0ED8D98F612405D9B8BD11FCA8A84BA92CBA12E303ECD50A7F1A6E861A19D250334A7A4A1E6139FE0E4FDCC5CD031800F0DD81243C8120649BB594CF3064
Malicious:	false
Preview:	MZ......................@.......................................................................................................PE..d...#..g.........." ............................D.........................................`.................................................................@...........................8..............................................................H............data...............................@....text............................... ..`.reloc...............n..............@..B....................................~5...........................................................................................................................................................................................................................................................................................................................................................i..D....................................i..D...(...........................D...........................

C:\Windows\assembly\NativeImages_v4.0.30319_64\EnableLoopback\656decbd27699754c5f7dcdf8abebd4d\EnableLoopback.ni.exe.aux (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) H, rows 848, columns 11, imaginary
Category:	dropped
Size (bytes):	856
Entropy (8bit):	5.51065593799833
Encrypted:	false
SSDEEP:	24:R/3nQPfHhE4TE4IfE4nK41qE48gdKDE4w:R/3nQPpHTHCHnK41qHbYHw
MD5:	EE8E5BA8472454F04E4859709B67566D
SHA1:	B9D5C56FD6F53C6C11AD970D71849361ACE1304D
SHA-256:	EC9BD1B6C3651FBED9E42A242F789F883ED869CA4F314605B6370654BE12B0D4
SHA-512:	32C0A2F57A0CED3D835E2981F554A5A434002FBC8B37CA7D8034EE556B3862AD1950BF3B7246DCDB9A53C9F2F6623B3795BFEB4C05A21D83BD5F5668157BAFE0
Malicious:	false
Preview:	....P...............H...EnableLoopback, Version=1.4.3.0, Culture=neutral, PublicKeyToken=null.......................................HH......................t.G...I..H..i......l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l..............X...System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089............+/...........H]Z...................... ..a..M...F.F......l.......L...System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.................>..l..S$.............T...System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a..............+/....................................]H.a.F..Du.k+.....p.......P...System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........12f.`.i%O2..G..

C:\Windows\assembly\NativeImages_v4.0.30319_64\EnableLoopback\656decbd27699754c5f7dcdf8abebd4d\EnableLoopback.ni.exe.aux.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) H, rows 848, columns 11, imaginary
Category:	dropped
Size (bytes):	856
Entropy (8bit):	5.51065593799833
Encrypted:	false
SSDEEP:	24:R/3nQPfHhE4TE4IfE4nK41qE48gdKDE4w:R/3nQPpHTHCHnK41qHbYHw
MD5:	EE8E5BA8472454F04E4859709B67566D
SHA1:	B9D5C56FD6F53C6C11AD970D71849361ACE1304D
SHA-256:	EC9BD1B6C3651FBED9E42A242F789F883ED869CA4F314605B6370654BE12B0D4
SHA-512:	32C0A2F57A0CED3D835E2981F554A5A434002FBC8B37CA7D8034EE556B3862AD1950BF3B7246DCDB9A53C9F2F6623B3795BFEB4C05A21D83BD5F5668157BAFE0
Malicious:	false
Preview:	....P...............H...EnableLoopback, Version=1.4.3.0, Culture=neutral, PublicKeyToken=null.......................................HH......................t.G...I..H..i......l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l..............X...System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089............+/...........H]Z...................... ..a..M...F.F......l.......L...System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.................>..l..S$.............T...System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a..............+/....................................]H.a.F..Du.k+.....p.......P...System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........12f.`.i%O2..G..

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\8e9f4b8ba90f0dd7ead0f6d3724d12f0\Microsoft.JScript.ni.dll (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2844160
Entropy (8bit):	6.62746694654847
Encrypted:	false
SSDEEP:	49152:Kd6HVKGum20+06HDN/fPwDbEgqVUa3UFFx3x6/OwH9u6wAZj8dl6e4sK:KwHVKqsHRwDbEgqVUa3UFFx3b68l63s
MD5:	B5199F7B846A2F8DFA05CE43F61175D6
SHA1:	432DF95A7EF646CC814B1BED52938E3880B59240
SHA-256:	0EE39143B7EEA8EFD91304C0636A6535B92F50AA802F447D692C21497594720B
SHA-512:	59B9884F87AAF458BAF4B38A521B1EC812A232100C65C7898B4497ACF96A1EE200CF732E41485EFE8FFBB4B35DE3FA83D0196E684F9D6C9DB32497E5A12C3565
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d....>.].........." ...........................<D.............................+...........`..........................................................P.......]..L.............+..n....+.8............................................................S..H............data....<.......>..................@....text.....&..P....&..@.............. ..`.reloc...n....+..p....*.............@..B....................................~=.............................................................................................................................................................................................................................................................................................................................................................<D...c...............................L..<D...-........................+.<D...o.......................

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\8e9f4b8ba90f0dd7ead0f6d3724d12f0\Microsoft.JScript.ni.dll.aux (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) X, rows 572, columns 11, imaginary
Category:	dropped
Size (bytes):	580
Entropy (8bit):	5.45218215817954
Encrypted:	false
SSDEEP:	12:zkrfPn4Mshnu9onmOU2DLI4MWh+eDLI4MWXb/S/oDLI4MWNnr:gr34BguhE4FfE4nkAE4d
MD5:	AB6DBF5FD77B230F09422CF42E01C45C
SHA1:	47F02FE4F799F47A882C1618666EF07251E97F85
SHA-256:	2C955F26CF47A4B1283CF68A07B104771AE05F1D88C5D906B47E9B219E6475E5
SHA-512:	9EAB974CD1BF0B1F81962325E107BF44C4AEC1C7ADD496D4619AB97EE0F075CCC9187E923181DE8D8DD5626EB07D20ED7FEAB5675896C5A761DAB1604D41B84F
Malicious:	false
Preview:	....<...............X...Microsoft.JScript, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a..............................................................X..`.O...ZC.r.....l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l......l.......L...System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.................>..l..S$.............P...System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089...........Gu.0............f(.......................%...K... ...

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\8e9f4b8ba90f0dd7ead0f6d3724d12f0\Microsoft.JScript.ni.dll.aux.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) X, rows 572, columns 11, imaginary
Category:	dropped
Size (bytes):	580
Entropy (8bit):	5.45218215817954
Encrypted:	false
SSDEEP:	12:zkrfPn4Mshnu9onmOU2DLI4MWh+eDLI4MWXb/S/oDLI4MWNnr:gr34BguhE4FfE4nkAE4d
MD5:	AB6DBF5FD77B230F09422CF42E01C45C
SHA1:	47F02FE4F799F47A882C1618666EF07251E97F85
SHA-256:	2C955F26CF47A4B1283CF68A07B104771AE05F1D88C5D906B47E9B219E6475E5
SHA-512:	9EAB974CD1BF0B1F81962325E107BF44C4AEC1C7ADD496D4619AB97EE0F075CCC9187E923181DE8D8DD5626EB07D20ED7FEAB5675896C5A761DAB1604D41B84F
Malicious:	false
Preview:	....<...............X...Microsoft.JScript, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a..............................................................X..`.O...ZC.r.....l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l......l.......L...System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.................>..l..S$.............P...System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089...........Gu.0............f(.......................%...K... ...

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\78d6922d3a02a93359e189f060d76f47\System.Data.SqlXml.ni.dll (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3152896
Entropy (8bit):	6.29515288331552
Encrypted:	false
SSDEEP:	49152:EIU0dluLBG8h0GOPNMuC+0WH7ph+7VaDzTKktX9:EtCl+RE/Ga
MD5:	4030102C5FF5DFF4B96DBFADDE92E6D7
SHA1:	38CEB414A87C65B7D9C76F931EAF671648F89D77
SHA-256:	1FF3C397F1C738A84075707B34E3A217177438055BA4A8E76E206940044B3CBC
SHA-512:	74D824227D3C591FE6B32660CBDC5016B1D664DCBFE1C9E46A179B33764C12830D7F48E40E57D178074F654CFD9BD9B5733F34C286BC217856079F044410E05E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d....>.].........." ...........................ED............................@0...........`..........................................................P..L.......x............ /......./.8...........................................................PT..H............data....3.......4..................@....text...G.$..P....$..6.............. ..`.reloc....... /......./.............@..B....................................~=..........................................................................................................................................................................................................................................................................................................................................................PzEED...........................P..ED....}EED...-........................F"ED...e.......................

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\78d6922d3a02a93359e189f060d76f47\System.Data.SqlXml.ni.dll.aux (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) X, rows 700, columns 11, imaginary
Category:	dropped
Size (bytes):	708
Entropy (8bit):	5.524147255924777
Encrypted:	false
SSDEEP:	12:zk+wKDLI4MWTthnFhU2DLI4MWh+eDLI4MWXb/aH/oDLI4MWXsvyq+6K9eDLI4Mpc:g+E4ftRhE4FfE4nifAE4uKIE4nH
MD5:	3039E3D048781184B67148A421D2F7AC
SHA1:	D12F00D6F6001AE79D7C9C0EE6AAB08E2927BED2
SHA-256:	FD6F5D26392A5084024946247521BC8E33E593404CCE0FBE29B9928C18924590
SHA-512:	D19E6410C4BB89F8762B198B4A1C0E10582407D8DEAD8EE60ABB81B50DED62CB67816D9F810A7AF26D092C34D21AB7DF2043C38D035288ACDC38A18F25CEBF1F
Malicious:	false
Preview:	....................X...System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........................0...........(6.......................rwB.PA.z.$.......l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l......l.......L...System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.................>..l..S$.....p.......P...System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089............=.U......D..l.............X...System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a...........+/............n......................i..VdqF...\|...

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\78d6922d3a02a93359e189f060d76f47\System.Data.SqlXml.ni.dll.aux.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) X, rows 700, columns 11, imaginary
Category:	dropped
Size (bytes):	708
Entropy (8bit):	5.524147255924777
Encrypted:	false
SSDEEP:	12:zk+wKDLI4MWTthnFhU2DLI4MWh+eDLI4MWXb/aH/oDLI4MWXsvyq+6K9eDLI4Mpc:g+E4ftRhE4FfE4nifAE4uKIE4nH
MD5:	3039E3D048781184B67148A421D2F7AC
SHA1:	D12F00D6F6001AE79D7C9C0EE6AAB08E2927BED2
SHA-256:	FD6F5D26392A5084024946247521BC8E33E593404CCE0FBE29B9928C18924590
SHA-512:	D19E6410C4BB89F8762B198B4A1C0E10582407D8DEAD8EE60ABB81B50DED62CB67816D9F810A7AF26D092C34D21AB7DF2043C38D035288ACDC38A18F25CEBF1F
Malicious:	false
Preview:	....................X...System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........................0...........(6.......................rwB.PA.z.$.......l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l......l.......L...System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.................>..l..S$.....p.......P...System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089............=.U......D..l.............X...System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a...........+/............n......................i..VdqF...\|...

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\4fa111e50d95d3e08c2d856a5394af3b\System.Deployment.ni.dll (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3131904
Entropy (8bit):	6.11376661230697
Encrypted:	false
SSDEEP:	24576:z8Zs7WSTYOk6X5XZOa9gwlmZhnjYnIBuU8vAHD0a+4jsDY9d/DBuI:z87+EZhjYnIBuU8vYD0a+4jM
MD5:	BB1EB29E13AF480E895544B82B26C087
SHA1:	86C739642878AF3B1FA8C612535167647B470849
SHA-256:	E905E1AC5B9582207004FF4F595F28B164631E5090048103706A203D93B1E1EF
SHA-512:	70B0A46DFE099F93C56095FD9BBEE994A23DF92EE96A055A6F1058DD7DA5230D19B7FC22EC205913A19DBF1344B9EC0E3ACE5F9D7A922EF510C48D18EF6183B4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d.....R_.........." ..........................2ED............................./...........`.............................................................\...`................P/.@....D/.8...........................................................`...H............data...............................@....text.....).......)................. ..`.reloc..@....P/......:/.............@..B....................................~=..........................................................................................................................................................................................................................................................................................................................................................t.^ED...+...............................\|.^ED.............................6ED...........................

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\4fa111e50d95d3e08c2d856a5394af3b\System.Deployment.ni.dll.aux (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) X, rows 1356, columns 11, imaginary
Category:	dropped
Size (bytes):	1364
Entropy (8bit):	5.544973760390818
Encrypted:	false
SSDEEP:	24:LwXE4198vhE4dtJE4pVsAE4mfE4nGE4w41qE48gdKDE4UAKIE4nH:LWH19SHdtJHpVsAHgHnGHw41qHbYH9tn
MD5:	81E356F831F195D32CE7D6322FD9DBDF
SHA1:	824433DD5F27091333FED52724B0E58FE1742253
SHA-256:	C38B07B4C8DA246B312D823E12F8533E2C1133546B0ADC2A9A2E50BD2EBA0D3F
SHA-512:	ACE595016C59CB4FE230948EA8F9FB312FB0FF0F33B309EE63F221611D2AEB1CDC4DA7187B61EC3C64BE887173F7E68C3AC9BC4584D04BD5A545BDC1DAF66E79
Malicious:	false
Preview:	....L...............X...System.Deployment, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a...........................+/............Q.........................\J.C.;.gW.......l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l..............T...System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a.............+/.......................................=.@G..?...o.............P...System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089...........Gu.0............f(.......................%...K... .......l.......L...System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.................>..l..S$.............X...System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089............+/...........H]Z...................... ..a..M...F.F..............T...System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\4fa111e50d95d3e08c2d856a5394af3b\System.Deployment.ni.dll.aux.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) X, rows 1356, columns 11, imaginary
Category:	dropped
Size (bytes):	1364
Entropy (8bit):	5.544973760390818
Encrypted:	false
SSDEEP:	24:LwXE4198vhE4dtJE4pVsAE4mfE4nGE4w41qE48gdKDE4UAKIE4nH:LWH19SHdtJHpVsAHgHnGHw41qHbYH9tn
MD5:	81E356F831F195D32CE7D6322FD9DBDF
SHA1:	824433DD5F27091333FED52724B0E58FE1742253
SHA-256:	C38B07B4C8DA246B312D823E12F8533E2C1133546B0ADC2A9A2E50BD2EBA0D3F
SHA-512:	ACE595016C59CB4FE230948EA8F9FB312FB0FF0F33B309EE63F221611D2AEB1CDC4DA7187B61EC3C64BE887173F7E68C3AC9BC4584D04BD5A545BDC1DAF66E79
Malicious:	false
Preview:	....L...............X...System.Deployment, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a...........................+/............Q.........................\J.C.;.gW.......l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l..............T...System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a.............+/.......................................=.@G..?...o.............P...System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089...........Gu.0............f(.......................%...K... .......l.......L...System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.................>..l..S$.............X...System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089............+/...........H]Z...................... ..a..M...F.F..............T...System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Design\e6264fe3334740cf9e7da3afc7d524cc\System.Design.ni.dll (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12967936
Entropy (8bit):	6.234468979744749
Encrypted:	false
SSDEEP:	98304:84hgEL2Xe6Bp7xHc+d52QeZkM3DxmrctbK9TVTyPY:8DECXe6BZ2PiMzxmrPTtyPY
MD5:	5037EB4274F960C7D3DF42EC86F13CC9
SHA1:	B2E4C4278E0FAEEE804C3949F878B8045071B255
SHA-256:	B4A14A1736596C5E34D6D808111BF915F2BEFA91D19626131628D51FAB05A8D2
SHA-512:	13C78C2AF35CCF4887A1205AD137D80156102317DACC2B1C1EB3B29EEBCA7B830E5960336EE989474ACE7ED336D30698DB3F83D4C183A56F1D9C2908CCF00497
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d...3>.].........." ..........................fED.........................................`........................................................... .4....C .P...................(p..8...........................................................@. .H............data...H...........................@....text....q.... ..r.................. ..`.reloc...............`..............@..B....................................~=...........................................................................................................................................................................................................................................................................................................................................................p.FD............................dpED...x..FD.../.......4................F.ED...................2.......

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Design\e6264fe3334740cf9e7da3afc7d524cc\System.Design.ni.dll.aux (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) T, rows 2388, columns 11, imaginary
Category:	dropped
Size (bytes):	2396
Entropy (8bit):	5.579022055117571
Encrypted:	false
SSDEEP:	48:jH1eOHlHnK41qHlHCHeH+ttH6AHXOH3M0H+5HVUYE3HnH/YHw:jRFHbwFi+0tF3O/e59mHfYQ
MD5:	35D56E8D14BC605EB20F90F0795222A0
SHA1:	28D8583F56FF6E4A39E847AE25BD63D17A54F336
SHA-256:	A1D145A216755E3E4E7EACEE0644B121E43241338BE33B6BC1DE54F6B243BCFA
SHA-512:	D60E4315AA69FB398CB13B90489DEBC2EF578F6E7992C343592538E059BDBC2BE467A0E487505E6FFA6C2B6C4C9410EFC78F6B7628D8CA772F788BC15E9EBCEE
Malicious:	false
Preview:	....T...............T...System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a.........................................L.....................I...s\@.N.xK8C.....l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l......l.......L...System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.................>..l..S$.............T...System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a..............+/...................................*.]H.a.F..Du.k+.............P...System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a..............+/............_R.......................~G.?.H.9.r>..x............X...System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089............+/...........H]Z...................... ..a..M...F.F..............P...System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e0

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Design\e6264fe3334740cf9e7da3afc7d524cc\System.Design.ni.dll.aux.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) T, rows 2388, columns 11, imaginary
Category:	dropped
Size (bytes):	2396
Entropy (8bit):	5.579022055117571
Encrypted:	false
SSDEEP:	48:jH1eOHlHnK41qHlHCHeH+ttH6AHXOH3M0H+5HVUYE3HnH/YHw:jRFHbwFi+0tF3O/e59mHfYQ
MD5:	35D56E8D14BC605EB20F90F0795222A0
SHA1:	28D8583F56FF6E4A39E847AE25BD63D17A54F336
SHA-256:	A1D145A216755E3E4E7EACEE0644B121E43241338BE33B6BC1DE54F6B243BCFA
SHA-512:	D60E4315AA69FB398CB13B90489DEBC2EF578F6E7992C343592538E059BDBC2BE467A0E487505E6FFA6C2B6C4C9410EFC78F6B7628D8CA772F788BC15E9EBCEE
Malicious:	false
Preview:	....T...............T...System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a.........................................L.....................I...s\@.N.xK8C.....l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l......l.......L...System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.................>..l..S$.............T...System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a..............+/...................................*.]H.a.F..Du.k+.............P...System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a..............+/............_R.......................~G.?.H.9.r>..x............X...System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089............+/...........H]Z...................... ..a..M...F.F..............P...System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e0

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\cbb85b2c3ecfe129570a8c187041de31\System.EnterpriseServices.Wrapper.dll (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	350208
Entropy (8bit):	5.360984736881725
Encrypted:	false
SSDEEP:	3072:OhE8gQgd1a+JaRp7+1+aCfXliDapJjIz5oWM+VqFIuKxWZjWLHrKy8Y9WyafZiBj:OU+hKOWM+VqFIuKY1s9Wd8BkQP
MD5:	231B6E73760607A712F05F54052EE2A1
SHA1:	0FCE19AFDA7E30F43835E07B2DCCE6C0EBCE1ECC
SHA-256:	9C6C6F2D33CBB2B5A2E7E92634B0014771F3A4989D260400965A0396D4243B22
SHA-512:	E599EAF22F95D44B8CF6FC34A0692B0EE7EB622690FDF25B79E03AC4E9BEABCA3D078AD6AC3294DFD712AE0EC14D269126C89035B4441109EE07F743291F9148
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d...\|A.].........." .........................................................p............`.................................................................T................@..\...5..p...............................................................H............data...8m.......n..................@....text................p.............. ..`.reloc..\...@...,...,..............@..B....................................~=..................................................................................................................................................................................................................................................................................................................................................................................................T.......-.......................(S......U.......................

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\cbb85b2c3ecfe129570a8c187041de31\System.EnterpriseServices.ni.dll (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1016832
Entropy (8bit):	6.340122325887443
Encrypted:	false
SSDEEP:	12288:sUiQLhc+zmU0Z1XbQuPnQfPCbSa3H/H92nVnRs3OdZmFlCdzgr9NPDzjc3i:snQI1LPnQH4SihpDE3
MD5:	9D234EF1B5DE22E0AC4EF0DAD58536A4
SHA1:	172F24A4403F11407C77BFC47E1B4A7681E39FCB
SHA-256:	AF11FE05876110ADDD9721C43DA6AB53D404B9B39954631DC5B08C8EAD89F933
SHA-512:	51B36D47B006D46271F7D07577C74A212B17AC5DEA14AC126C4FD6F1744F021A311F1CD60277945C896B44600D44D1F894AB73E809325C40F8ADC78A78700889
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d....C.].........." ............................D.........................................`.................................................................(...4h...........`..\D...W..8...............................................................H............data...............................@....text....Y.......Z.................. ..`.reloc..\D...`...F...>..............@..B....................................~=............................................................................................................................................................................................................................................................................................................................................................!.D...............................D.....!.D...-.......\...................D...!.......................

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\cbb85b2c3ecfe129570a8c187041de31\System.EnterpriseServices.ni.dll.aux (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) `, rows 1092, columns 11, imaginary
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	5.501252273343023
Encrypted:	false
SSDEEP:	24:z63uayE41IPhE4LmE4rpZfE4nkAE4uWE44rmKAmE471+:BayH1IHLmHrphHnkAH5H4jAmHU
MD5:	0CF4437E0E8A9A6B2DC3F491570595DF
SHA1:	7AC2B7D7347811F0F4059CC78BE43A0A26AC6C7A
SHA-256:	52DD5D3003E7E548F4E899442C20A8A5EDDA0C8DEDD29D389C043EA0C999CA12
SHA-512:	3B73BD99465F8E03F25E5C14D4F7FBD7F314D2114859AE639BA24833DD1E3DA9466E0A78BB5116BAA043439F55C1A57715E016B4125038E4BA4EF34C9F1B4FDE
Malicious:	false
Preview:	....D...............`...System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a.........................2.....................................%.':IQlK.#P........l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l..............X...System.Transactions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089...........m./....................................$@...J....M+.B....l.......L...System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.................>..l..S$.............P...System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089...........Gu.0............f(.......................%...K... ...............\...System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a.........I..+/...........Ha.......................z.U..G...5.f.1............\...System.Runtime.Remoting, Version=4.0.0.0, Culture=neutra

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\cbb85b2c3ecfe129570a8c187041de31\System.EnterpriseServices.ni.dll.aux.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) `, rows 1092, columns 11, imaginary
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	5.501252273343023
Encrypted:	false
SSDEEP:	24:z63uayE41IPhE4LmE4rpZfE4nkAE4uWE44rmKAmE471+:BayH1IHLmHrphHnkAH5H4jAmHU
MD5:	0CF4437E0E8A9A6B2DC3F491570595DF
SHA1:	7AC2B7D7347811F0F4059CC78BE43A0A26AC6C7A
SHA-256:	52DD5D3003E7E548F4E899442C20A8A5EDDA0C8DEDD29D389C043EA0C999CA12
SHA-512:	3B73BD99465F8E03F25E5C14D4F7FBD7F314D2114859AE639BA24833DD1E3DA9466E0A78BB5116BAA043439F55C1A57715E016B4125038E4BA4EF34C9F1B4FDE
Malicious:	false
Preview:	....D...............`...System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a.........................2.....................................%.':IQlK.#P........l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l..............X...System.Transactions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089...........m./....................................$@...J....M+.B....l.......L...System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.................>..l..S$.............P...System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089...........Gu.0............f(.......................%...K... ...............\...System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a.........I..+/...........Ha.......................z.U..G...5.f.1............\...System.Runtime.Remoting, Version=4.0.0.0, Culture=neutra

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\ce1e4670373608336100bea63bbc8990\System.Numerics.ni.dll (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	322048
Entropy (8bit):	6.392891962546257
Encrypted:	false
SSDEEP:	6144:hBDpWyVMldpnhY1sjSVQOFHpXZjXnZXG:jDpnM3nYGjSfdZ
MD5:	F4A8B8C2D4902B5FB537A3FDB0CEFF02
SHA1:	81FC51BF1BDF00E98EC99DBE45B663ABBAF63A3D
SHA-256:	70BA7B8E7F6901FB1B0DF6D0AD19A9499B204EA296E665D150AEB3B13B74E5D8
SHA-512:	A07B89F0E503A0A62C9C95CAA5C87B4EE6A66C08FE2BC7122A1A0E7D720ACDC2A57EA47B1F29B09275F10D02B5657B6AF337D936A24F5E00AF4932CA702DD133
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d....>.].........." ...........................CD.........................................`.............................................................<......................L.......8...........................................................@...H............data... ...........................@....text...pQ.......R.................. ..`.reloc..L...........................@..B....................................~=...........................................................................................................................................................................................................................................................................................................................................................y.CD..............................CD....y.CD...)...,....................r.CD...G.......................

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\ce1e4670373608336100bea63bbc8990\System.Numerics.ni.dll.aux (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) T, rows 292, columns 11, imaginary
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.271548538365068
Encrypted:	false
SSDEEP:	6:gWc/w7ZDLIP12MUAvvR+vlzkclntlkyYo9clATrKDLIP12MUAvvR+8V:z7ZDLI4MW3nXPYoWlU2DLI4MWa
MD5:	ECDEF013168988E142051C4E6AAFF8C7
SHA1:	736AD3731FF7C69DADE3D5A1E3678C132B7734B0
SHA-256:	DB0D9B0AC9F411E7884D3FBD70A800EB32611261CB9C10ADABA8CF72722B765A
SHA-512:	D2A30C213949F14F16C5FF9F56B8D8F511129D28A2E5F1B3EA05B790CE61DADC3F599F9304AC6009C90A2323F5B682C3A1F1A8D3AFDDABA13396F8DC3E3F2828
Malicious:	false
Preview:	....$...............T...System.Numerics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089......................!..0...........H".........................1...L..U;V.<}....l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l..

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\ce1e4670373608336100bea63bbc8990\System.Numerics.ni.dll.aux.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) T, rows 292, columns 11, imaginary
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.271548538365068
Encrypted:	false
SSDEEP:	6:gWc/w7ZDLIP12MUAvvR+vlzkclntlkyYo9clATrKDLIP12MUAvvR+8V:z7ZDLI4MW3nXPYoWlU2DLI4MWa
MD5:	ECDEF013168988E142051C4E6AAFF8C7
SHA1:	736AD3731FF7C69DADE3D5A1E3678C132B7734B0
SHA-256:	DB0D9B0AC9F411E7884D3FBD70A800EB32611261CB9C10ADABA8CF72722B765A
SHA-512:	D2A30C213949F14F16C5FF9F56B8D8F511129D28A2E5F1B3EA05B790CE61DADC3F599F9304AC6009C90A2323F5B682C3A1F1A8D3AFDDABA13396F8DC3E3F2828
Malicious:	false
Preview:	....$...............T...System.Numerics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089......................!..0...........H".........................1...L..U;V.<}....l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l..

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt19c51595#\b5d4608754b2d1d4f1d2d3c00cbcdfe0\System.Runtime.Caching.ni.dll (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	305664
Entropy (8bit):	6.094303618906386
Encrypted:	false
SSDEEP:	3072:d5GBn2kdsVADZBWTe3xNArJpjdhd9X0spSMehIpUkF5Gqildq06/E3fzkBotD8/o:d5GBn2FmDh3yDoMeqByM066zIeQC
MD5:	DEB2C19197E42EDDC1636E8D069EAFFE
SHA1:	862ACCF42F307FC39B2C7A472415194F4AD88BFB
SHA-256:	FAD873D6DB1B3043A3EF804C08549FB9F74BE615FF2D452C820050CACED8BC19
SHA-512:	92408CBB745129D280D883E5F7D0F0CDE92D3D4A40C53D449CD28841D0B35BE0191E2BEA21F1F2040EB31137A6954EEF07208C38B6318A94B1B29887561502F8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d....>.].........." ..........................\|ID.........................................`.............................................................l....... ...............$......8...........................................................p...H............data...............................@....text...w........................... ..`.reloc..$...........................@..B....................................~=...........................................................................................................................................................................................................................................................................................................................................................G.ID...F........................R\|ID....G.ID...*...\|...................(.\|ID...........................

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt19c51595#\b5d4608754b2d1d4f1d2d3c00cbcdfe0\System.Runtime.Caching.ni.dll.aux (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) \, rows 744, columns 11, imaginary
Category:	dropped
Size (bytes):	752
Entropy (8bit):	5.5317115078392485
Encrypted:	false
SSDEEP:	12:ncRYDLI4MshntDm4U2DLI4MWZ+6K9eDLI4MpgJ+7T+eDLI4MWXb/SBDLI4MWmKbj:TE4BJhE4jKIE4nAfE4nQE4lAA
MD5:	FE5C30197910CEB71625638E73F98ECE
SHA1:	48F0F76F8E616A077A1700955A3876CB320D54A4
SHA-256:	878D2BE02C92CE4A21FBE213F1E1DD7829E8C47B1F95EE86AC9C10980D437B2B
SHA-512:	670E4D61CCE9C2E30EF671F4D566FB9A06A0D7E1393CAC3B6318CC09F7659DB1757E256D063F89D4197CF297AC65EC85B7DE215760F4E0EDE16B24B476F580DB
Malicious:	false
Preview:	....................\...System.Runtime.Caching, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a........................]...........................................O..&W........l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l..............X...System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a...........+/............n......................i..VdqF...\|.......l.......L...System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.................>..l..S$.............P...System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.............+/.............6.......................0..~.J.R...L

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt19c51595#\b5d4608754b2d1d4f1d2d3c00cbcdfe0\System.Runtime.Caching.ni.dll.aux.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) \, rows 744, columns 11, imaginary
Category:	dropped
Size (bytes):	752
Entropy (8bit):	5.5317115078392485
Encrypted:	false
SSDEEP:	12:ncRYDLI4MshntDm4U2DLI4MWZ+6K9eDLI4MpgJ+7T+eDLI4MWXb/SBDLI4MWmKbj:TE4BJhE4jKIE4nAfE4nQE4lAA
MD5:	FE5C30197910CEB71625638E73F98ECE
SHA1:	48F0F76F8E616A077A1700955A3876CB320D54A4
SHA-256:	878D2BE02C92CE4A21FBE213F1E1DD7829E8C47B1F95EE86AC9C10980D437B2B
SHA-512:	670E4D61CCE9C2E30EF671F4D566FB9A06A0D7E1393CAC3B6318CC09F7659DB1757E256D063F89D4197CF297AC65EC85B7DE215760F4E0EDE16B24B476F580DB
Malicious:	false
Preview:	....................\...System.Runtime.Caching, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a........................]...........................................O..&W........l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l..............X...System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a...........+/............n......................i..VdqF...\|.......l.......L...System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.................>..l..S$.............P...System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.............+/.............6.......................0..~.J.R...L

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\f975db3abcedde8df2408b15e2c6dd09\System.Runtime.Serialization.Formatters.Soap.ni.dll (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	353280
Entropy (8bit):	6.425396368012398
Encrypted:	false
SSDEEP:	6144:BZMm4oCgyJkTtlMmd0b6xOzens3mz13yN6F:Bb4oHYotl9dY6QzeQmRiwF
MD5:	FC1D15780A9C0DDDDF0612A01F5B7261
SHA1:	9BEC1F5F382227FA702C37C8E40ED46D0D95B59B
SHA-256:	DED32C661E8505F76AB0D65368A7293D6EC9A2FECA0A9075EF5A6550162EC98D
SHA-512:	39BE1B4923048A436032EAC10537A003FEF9A682698837D5BFF7AE353DD83C93AB09902B66D76C1F8211CA49A7515267EB88318537AD0C209F97F29DCA5BB44D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d....>.].........." ...........................ID.........................................`.................................................................h...0............p.......f..8...............................................................H............data...............................@....text...Q........................... ..`.reloc.......p.......X..............@..B....................................~=..........................................................................................................................................................................................................................................................................................................................................................8.ID...1.................................ID...*...P....................m.ID...........................

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\f975db3abcedde8df2408b15e2c6dd09\System.Runtime.Serialization.Formatters.Soap.ni.dll.aux (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) p, rows 636, columns 11, imaginary
Category:	dropped
Size (bytes):	644
Entropy (8bit):	5.401621204939633
Encrypted:	false
SSDEEP:	12:zk+hWDLI4MKnBxiU2DLI4MWJ/oDLI4MWNnE+eDLI4MWMRm4R:gNE4VshE41AE4ufE4VA
MD5:	20C1A566AF6A1E27709BB3E5A7792856
SHA1:	4B79A34B13490DAB06E2738EF8D6138F69CCDDFD
SHA-256:	8F34E999C237ABA240744C3F9249D4347A017571D2CFEA376ED32EAC8F0ABF25
SHA-512:	989AF675192682B549F1944F19EA8737BD385CEEF0DA32B2E8F3312B5A6AD17D8958F6F3146139B1DE15DDC2EC7ABB9980388D52E7CA8AF6E5D38540454801CC
Malicious:	false
Preview:	....\|...............p...System.Runtime.Serialization.Formatters.Soap, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a......................B./...........0,....................... .a.gH.5v...k,....l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l..............P...System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089...........Gu.0............f(.......................%...K... ...............L...System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089............F.+/...........HE6............................C.l]..7.s

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\f975db3abcedde8df2408b15e2c6dd09\System.Runtime.Serialization.Formatters.Soap.ni.dll.aux.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) p, rows 636, columns 11, imaginary
Category:	dropped
Size (bytes):	644
Entropy (8bit):	5.401621204939633
Encrypted:	false
SSDEEP:	12:zk+hWDLI4MKnBxiU2DLI4MWJ/oDLI4MWNnE+eDLI4MWMRm4R:gNE4VshE41AE4ufE4VA
MD5:	20C1A566AF6A1E27709BB3E5A7792856
SHA1:	4B79A34B13490DAB06E2738EF8D6138F69CCDDFD
SHA-256:	8F34E999C237ABA240744C3F9249D4347A017571D2CFEA376ED32EAC8F0ABF25
SHA-512:	989AF675192682B549F1944F19EA8737BD385CEEF0DA32B2E8F3312B5A6AD17D8958F6F3146139B1DE15DDC2EC7ABB9980388D52E7CA8AF6E5D38540454801CC
Malicious:	false
Preview:	....\|...............p...System.Runtime.Serialization.Formatters.Soap, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a......................B./...........0,....................... .a.gH.5v...k,....l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l..............P...System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089...........Gu.0............f(.......................%...K... ...............L...System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089............F.+/...........HE6............................C.l]..7.s

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\bde2021ecdaa53585a395f095971633c\System.Security.ni.dll (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1010176
Entropy (8bit):	6.390647351452728
Encrypted:	false
SSDEEP:	12288:MsieoGzXs1r/4M7Km80TR+m1ML71n6VS3fQoL1iqqkQyW:MFqur980Twm1MN13YC
MD5:	F1F2CE62E1C36B6EB1E64FA2085D738E
SHA1:	299A4D69367A2F96571976EB0A6A8D3C9727F870
SHA-256:	967DD73C7EE643E2D03F8F82F8EFF0712CA8AA71AD1E5EBF1D89EA2C7BEDF1E0
SHA-512:	716D0B81FECB9F20CE8124DB49B9CBF95A19330912BBA5FC21FA4A72FB24F9259A2A2AE19D00AA6A334F1AEE4632DA0AFAC5A35A14825338D5DCC4A0897B70A3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d...p.O_.........." ...........................ID.........................................`.............................................................P........S...........@...:...9..8...........................................................P...H............data...H...........................@....text............................... ..`.reloc...:...@...<..................@..B....................................~=...........................................................................................................................................................................................................................................................................................................................................................+.ID...........................Hv.ID...L-.ID...,.......T...............`.ID... .......................

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\bde2021ecdaa53585a395f095971633c\System.Security.ni.dll.aux (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) T, rows 904, columns 11, imaginary
Category:	dropped
Size (bytes):	912
Entropy (8bit):	5.497390555517323
Encrypted:	false
SSDEEP:	12:l7tNDLI4MaHnz+0GD7OU2DLI4MWJ/oDLI4MWNnc+eDLI4MWXb/C+wKDLI4MWmZ+c:PJE4Hi0hE41AE4mfE4n5E4SKIE4nH
MD5:	FDB0F1BA5BBA5D0EA74B60B634040E4D
SHA1:	8E409B07301EE4BE1C2CD1A9814509C3B5BB2520
SHA-256:	2700D644DC14100DF8D95FBF534B35F9D4090FD65E526A818679B46096D3A060
SHA-512:	F64A77874E97EF3BC530F318F7FA08D7A772F60FA2D038B851BBED62873D6E336876943F72EB07791259031AA1993295811330303A277BEDD8CEB4615DD2A300
Malicious:	false
Preview:	....................T...System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a.........................+/.......................................=.@G..?...o.....l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l..............P...System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089...........Gu.0............f(.......................%...K... .......l.......L...System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.................>..l..S$.............X...System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..............0...........(6.......................rwB.PA.z.$...............X...System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a...........+/............n......................i..VdqF...\|...

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\bde2021ecdaa53585a395f095971633c\System.Security.ni.dll.aux.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) T, rows 904, columns 11, imaginary
Category:	dropped
Size (bytes):	912
Entropy (8bit):	5.497390555517323
Encrypted:	false
SSDEEP:	12:l7tNDLI4MaHnz+0GD7OU2DLI4MWJ/oDLI4MWNnc+eDLI4MWXb/C+wKDLI4MWmZ+c:PJE4Hi0hE41AE4mfE4n5E4SKIE4nH
MD5:	FDB0F1BA5BBA5D0EA74B60B634040E4D
SHA1:	8E409B07301EE4BE1C2CD1A9814509C3B5BB2520
SHA-256:	2700D644DC14100DF8D95FBF534B35F9D4090FD65E526A818679B46096D3A060
SHA-512:	F64A77874E97EF3BC530F318F7FA08D7A772F60FA2D038B851BBED62873D6E336876943F72EB07791259031AA1993295811330303A277BEDD8CEB4615DD2A300
Malicious:	false
Preview:	....................T...System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a.........................+/.......................................=.@G..?...o.....l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l..............P...System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089...........Gu.0............f(.......................%...K... .......l.......L...System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.................>..l..S$.............X...System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..............0...........(6.......................rwB.PA.z.$...............X...System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a...........+/............n......................i..VdqF...\|...

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\9c63130543c9d395491387159924bf83\System.Web.RegularExpressions.ni.dll (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	309248
Entropy (8bit):	6.360685980376763
Encrypted:	false
SSDEEP:	3072:pMAUITIKRnpXiQ3pRsKh7jfg6WF4E4AZGmMZB9HCCD2A/MAkbm4j8W+4sIf8E:WQfRpiQ3pRsv4AXE9iCy1msL+4t
MD5:	CB84F8E411AC71C2D0EECA37723AD451
SHA1:	56FA220966B27EF79896658546E61931A1D84D9A
SHA-256:	C497D8E3EC0480F1407E192888AB274F76B3BC0C0DC9457FDEB5DADA132FB257
SHA-512:	3A18B54BC9D0F5D6C9F6F9500C923F0605C77F7A72600524DAEC38E5A6C1EE38F9C401AF8898D718F21A97A91D20F4322EED98683ACF171C2A6317E0826F3C41
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d...?>.].........." ..........................4ID.........................................`.................................................................\|... .......................8...............................................................H............data...8e.......f..................@....text...BE.......F...h.............. ..`.reloc..............................@..B....................................~=...........................................................................................................................................................................................................................................................................................................................................................J8ID...S........................+4ID....J8ID...*...p... ................f4ID...".......................

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\9c63130543c9d395491387159924bf83\System.Web.RegularExpressions.ni.dll.aux (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) d, rows 424, columns 11, imaginary
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.476990368312239
Encrypted:	false
SSDEEP:	12:b+uWNOoDLI4MehnXHQUwfU2DLI4MWh+eDLI4MWXF:o3E411qfhE4FfE4x
MD5:	F5A05D84AD0AC7215429DB2B08E30BF8
SHA1:	AC942D8C7EE7BBE0714A38F9A59165132776D9D6
SHA-256:	EA30242D8C4B072E18BB7BBFCE98FF061646AFA8672B561ABFDB9C3A6B271122
SHA-512:	10677178A61AA35B15511982584D0ABB764D62C9A7EBDAF6AD57C568464228A665DF59F671E4987CD7C3E213E31E8EA8ED7BE0C0BB9FDC07A9DCAB4F82529820
Malicious:	false
Preview:	....................d...System.Web.RegularExpressions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a........................sA./...................................Nf.%BS.E.....$......l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l......l.......L...System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.................>..l..S$.

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\9c63130543c9d395491387159924bf83\System.Web.RegularExpressions.ni.dll.aux.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) d, rows 424, columns 11, imaginary
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.476990368312239
Encrypted:	false
SSDEEP:	12:b+uWNOoDLI4MehnXHQUwfU2DLI4MWh+eDLI4MWXF:o3E411qfhE4FfE4x
MD5:	F5A05D84AD0AC7215429DB2B08E30BF8
SHA1:	AC942D8C7EE7BBE0714A38F9A59165132776D9D6
SHA-256:	EA30242D8C4B072E18BB7BBFCE98FF061646AFA8672B561ABFDB9C3A6B271122
SHA-512:	10677178A61AA35B15511982584D0ABB764D62C9A7EBDAF6AD57C568464228A665DF59F671E4987CD7C3E213E31E8EA8ED7BE0C0BB9FDC07A9DCAB4F82529820
Malicious:	false
Preview:	....................d...System.Web.RegularExpressions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a........................sA./...................................Nf.%BS.E.....$......l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l......l.......L...System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.................>..l..S$.

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\0bc179a6f5376dabed45d64773e7a963\System.Web.ni.dll (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16944640
Entropy (8bit):	6.423837005716663
Encrypted:	false
SSDEEP:	98304:8SziAtOTrARuiqZmUifJaj3KyEGx6gIavGM5UTvCYiko5NGcFCCUL9npKP/5UUD2:r2yuiqEZfJo6jPmYikovGYP/HYIRj
MD5:	E9E08604934E84C7EDE246B2102A3DD1
SHA1:	63F2ECA3AE7BAA5C8970AC904EC648C42041555A
SHA-256:	A3F31A910EA9AAB8D60E92BAD40D0E66031E067DF6DA4A25BFB5093485991B65
SHA-512:	1C5C2E6FD1AE6785C5A35A2288215677A8130F97C1BB1C07F7DFC3185283784DBFD6B28DACC466E7927CE583BE18273C7527E19DD40027516B83FBB23C14E383
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d......b.........." ............................D.........................................`..........................................................P..8.....=..c...........p.../..pi..8...........................................................@T..H............data....?.......@..................@....text........P.......B.............. ..`.reloc.../...p...0...^..............@..B....................................~=..........................................................................................................................................................................................................................................................................................................................................................D...D...........................h6..D.......D...0....................... .0.D...A...............`.......

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\0bc179a6f5376dabed45d64773e7a963\System.Web.ni.dll.aux (copy)

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) P, rows 3964, columns 11, imaginary
Category:	dropped
Size (bytes):	3972
Entropy (8bit):	5.614306212114042
Encrypted:	false
SSDEEP:	96:JbDt6HQcYnmSwtjNh0jLmYqrguI7cDymh08nalp7zmtLr:JbDt6HQcYmSwtjT0jLmYq8uTmmh08naa
MD5:	5472088733A43AD02685E8DADDED319A
SHA1:	0B5CB2363ABE05A5D7D8C0BA590E10223C4AF0AB
SHA-256:	99F9457E5953614D88DF5EE88D5E420BC25E803FC51870E09BEF976658B06BB7
SHA-512:	C3DF09F63A51CAA3537DEFD8012D632F93B50FCC8FBE918C6EA3C4D392C9A849050E43C7230FF49A07077A6FC164F6DD7951EB1297EA79F18CC7702D7F42F82B
Malicious:	false
Preview:	....\|...............P...System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a..........................+/............_R.......................~G.?.H.9.r>..x....l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l..............X...System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a...........+/............n......................i..VdqF...\|.......l.......L...System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.................>..l..S$.............P...System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.............+/.............6.......................0..~.J.R...L....p.......P...System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........12f.`.i%O2..G..............`...System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a.............2.................

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\0bc179a6f5376dabed45d64773e7a963\System.Web.ni.dll.aux.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	Matlab v4 mat-file (little endian) P, rows 3964, columns 11, imaginary
Category:	dropped
Size (bytes):	3972
Entropy (8bit):	5.614306212114042
Encrypted:	false
SSDEEP:	96:JbDt6HQcYnmSwtjNh0jLmYqrguI7cDymh08nalp7zmtLr:JbDt6HQcYmSwtjT0jLmYq8uTmmh08naa
MD5:	5472088733A43AD02685E8DADDED319A
SHA1:	0B5CB2363ABE05A5D7D8C0BA590E10223C4AF0AB
SHA-256:	99F9457E5953614D88DF5EE88D5E420BC25E803FC51870E09BEF976658B06BB7
SHA-512:	C3DF09F63A51CAA3537DEFD8012D632F93B50FCC8FBE918C6EA3C4D392C9A849050E43C7230FF49A07077A6FC164F6DD7951EB1297EA79F18CC7702D7F42F82B
Malicious:	false
Preview:	....\|...............P...System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a..........................+/............_R.......................~G.?.H.9.r>..x....l.......L...mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........I;.:.......l..............X...System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a...........+/............n......................i..VdqF...\|.......l.......L...System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.................>..l..S$.............P...System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.............+/.............6.......................0..~.J.R...L....p.......P...System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089..........12f.`.i%O2..G..............`...System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a.............2.................

C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1d18-0\System.Web.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16944640
Entropy (8bit):	6.423837005716663
Encrypted:	false
SSDEEP:	98304:8SziAtOTrARuiqZmUifJaj3KyEGx6gIavGM5UTvCYiko5NGcFCCUL9npKP/5UUD2:r2yuiqEZfJo6jPmYikovGYP/HYIRj
MD5:	E9E08604934E84C7EDE246B2102A3DD1
SHA1:	63F2ECA3AE7BAA5C8970AC904EC648C42041555A
SHA-256:	A3F31A910EA9AAB8D60E92BAD40D0E66031E067DF6DA4A25BFB5093485991B65
SHA-512:	1C5C2E6FD1AE6785C5A35A2288215677A8130F97C1BB1C07F7DFC3185283784DBFD6B28DACC466E7927CE583BE18273C7527E19DD40027516B83FBB23C14E383
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d......b.........." ............................D.........................................`..........................................................P..8.....=..c...........p.../..pi..8...........................................................@T..H............data....?.......@..................@....text........P.......B.............. ..`.reloc.../...p...0...^..............@..B....................................~=..........................................................................................................................................................................................................................................................................................................................................................D...D...........................h6..D.......D...0....................... .0.D...A...............`.......

C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1d60-0\EnableLoopback.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	164352
Entropy (8bit):	5.7260151113427815
Encrypted:	false
SSDEEP:	3072:tB+gFm8M56yjvmXrISaRUoP+hXOleEMzfJE8yA:tB+joXrkRAhXOleEMzfudA
MD5:	1A09EF838B88621FC1797A18D755B6FD
SHA1:	33576757652AD0DA4E35D631D52AC0C9DFBC53A2
SHA-256:	D9DDE1A37F72EECA29C0D9B9700F4B887837ECB7ED91ADDDB78FEE630B0A60AD
SHA-512:	2B9C0ED8D98F612405D9B8BD11FCA8A84BA92CBA12E303ECD50A7F1A6E861A19D250334A7A4A1E6139FE0E4FDCC5CD031800F0DD81243C8120649BB594CF3064
Malicious:	false
Preview:	MZ......................@.......................................................................................................PE..d...#..g.........." ............................D.........................................`.................................................................@...........................8..............................................................H............data...............................@....text............................... ..`.reloc...............n..............@..B....................................~5...........................................................................................................................................................................................................................................................................................................................................................i..D....................................i..D...(...........................D...........................

C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1d70-0\System.Numerics.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	322048
Entropy (8bit):	6.392891962546257
Encrypted:	false
SSDEEP:	6144:hBDpWyVMldpnhY1sjSVQOFHpXZjXnZXG:jDpnM3nYGjSfdZ
MD5:	F4A8B8C2D4902B5FB537A3FDB0CEFF02
SHA1:	81FC51BF1BDF00E98EC99DBE45B663ABBAF63A3D
SHA-256:	70BA7B8E7F6901FB1B0DF6D0AD19A9499B204EA296E665D150AEB3B13B74E5D8
SHA-512:	A07B89F0E503A0A62C9C95CAA5C87B4EE6A66C08FE2BC7122A1A0E7D720ACDC2A57EA47B1F29B09275F10D02B5657B6AF337D936A24F5E00AF4932CA702DD133
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d....>.].........." ...........................CD.........................................`.............................................................<......................L.......8...........................................................@...H............data... ...........................@....text...pQ.......R.................. ..`.reloc..L...........................@..B....................................~=...........................................................................................................................................................................................................................................................................................................................................................y.CD..............................CD....y.CD...)...,....................r.CD...G.......................

C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1d80-0\System.Data.SqlXml.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3152896
Entropy (8bit):	6.29515288331552
Encrypted:	false
SSDEEP:	49152:EIU0dluLBG8h0GOPNMuC+0WH7ph+7VaDzTKktX9:EtCl+RE/Ga
MD5:	4030102C5FF5DFF4B96DBFADDE92E6D7
SHA1:	38CEB414A87C65B7D9C76F931EAF671648F89D77
SHA-256:	1FF3C397F1C738A84075707B34E3A217177438055BA4A8E76E206940044B3CBC
SHA-512:	74D824227D3C591FE6B32660CBDC5016B1D664DCBFE1C9E46A179B33764C12830D7F48E40E57D178074F654CFD9BD9B5733F34C286BC217856079F044410E05E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d....>.].........." ...........................ED............................@0...........`..........................................................P..L.......x............ /......./.8...........................................................PT..H............data....3.......4..................@....text...G.$..P....$..6.............. ..`.reloc....... /......./.............@..B....................................~=..........................................................................................................................................................................................................................................................................................................................................................PzEED...........................P..ED....}EED...-........................F"ED...e.......................

C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1e14-0\System.Deployment.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3131904
Entropy (8bit):	6.11376661230697
Encrypted:	false
SSDEEP:	24576:z8Zs7WSTYOk6X5XZOa9gwlmZhnjYnIBuU8vAHD0a+4jsDY9d/DBuI:z87+EZhjYnIBuU8vYD0a+4jM
MD5:	BB1EB29E13AF480E895544B82B26C087
SHA1:	86C739642878AF3B1FA8C612535167647B470849
SHA-256:	E905E1AC5B9582207004FF4F595F28B164631E5090048103706A203D93B1E1EF
SHA-512:	70B0A46DFE099F93C56095FD9BBEE994A23DF92EE96A055A6F1058DD7DA5230D19B7FC22EC205913A19DBF1344B9EC0E3ACE5F9D7A922EF510C48D18EF6183B4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d.....R_.........." ..........................2ED............................./...........`.............................................................\...`................P/.@....D/.8...........................................................`...H............data...............................@....text.....).......)................. ..`.reloc..@....P/......:/.............@..B....................................~=..........................................................................................................................................................................................................................................................................................................................................................t.^ED...+...............................\|.^ED.............................6ED...........................

C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1e7c-0\System.Data.SqlXml.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3152896
Entropy (8bit):	6.29515288331552
Encrypted:	false
SSDEEP:	49152:EIU0dluLBG8h0GOPNMuC+0WH7ph+7VaDzTKktX9:EtCl+RE/Ga
MD5:	4030102C5FF5DFF4B96DBFADDE92E6D7
SHA1:	38CEB414A87C65B7D9C76F931EAF671648F89D77
SHA-256:	1FF3C397F1C738A84075707B34E3A217177438055BA4A8E76E206940044B3CBC
SHA-512:	74D824227D3C591FE6B32660CBDC5016B1D664DCBFE1C9E46A179B33764C12830D7F48E40E57D178074F654CFD9BD9B5733F34C286BC217856079F044410E05E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d....>.].........." ...........................ED............................@0...........`..........................................................P..L.......x............ /......./.8...........................................................PT..H............data....3.......4..................@....text...G.$..P....$..6.............. ..`.reloc....... /......./.............@..B....................................~=..........................................................................................................................................................................................................................................................................................................................................................PzEED...........................P..ED....}EED...-........................F"ED...e.......................

C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1e8c-0\System.Security.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1010176
Entropy (8bit):	6.390647351452728
Encrypted:	false
SSDEEP:	12288:MsieoGzXs1r/4M7Km80TR+m1ML71n6VS3fQoL1iqqkQyW:MFqur980Twm1MN13YC
MD5:	F1F2CE62E1C36B6EB1E64FA2085D738E
SHA1:	299A4D69367A2F96571976EB0A6A8D3C9727F870
SHA-256:	967DD73C7EE643E2D03F8F82F8EFF0712CA8AA71AD1E5EBF1D89EA2C7BEDF1E0
SHA-512:	716D0B81FECB9F20CE8124DB49B9CBF95A19330912BBA5FC21FA4A72FB24F9259A2A2AE19D00AA6A334F1AEE4632DA0AFAC5A35A14825338D5DCC4A0897B70A3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d...p.O_.........." ...........................ID.........................................`.............................................................P........S...........@...:...9..8...........................................................P...H............data...H...........................@....text............................... ..`.reloc...:...@...<..................@..B....................................~=...........................................................................................................................................................................................................................................................................................................................................................+.ID...........................Hv.ID...L-.ID...,.......T...............`.ID... .......................

C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1e94-0\System.Deployment.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3131904
Entropy (8bit):	6.11376661230697
Encrypted:	false
SSDEEP:	24576:z8Zs7WSTYOk6X5XZOa9gwlmZhnjYnIBuU8vAHD0a+4jsDY9d/DBuI:z87+EZhjYnIBuU8vYD0a+4jM
MD5:	BB1EB29E13AF480E895544B82B26C087
SHA1:	86C739642878AF3B1FA8C612535167647B470849
SHA-256:	E905E1AC5B9582207004FF4F595F28B164631E5090048103706A203D93B1E1EF
SHA-512:	70B0A46DFE099F93C56095FD9BBEE994A23DF92EE96A055A6F1058DD7DA5230D19B7FC22EC205913A19DBF1344B9EC0E3ACE5F9D7A922EF510C48D18EF6183B4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d.....R_.........." ..........................2ED............................./...........`.............................................................\...`................P/.@....D/.8...........................................................`...H............data...............................@....text.....).......)................. ..`.reloc..@....P/......:/.............@..B....................................~=..........................................................................................................................................................................................................................................................................................................................................................t.^ED...+...............................\|.^ED.............................6ED...........................

C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1f44-0\System.Web.RegularExpressions.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	309248
Entropy (8bit):	6.360685980376763
Encrypted:	false
SSDEEP:	3072:pMAUITIKRnpXiQ3pRsKh7jfg6WF4E4AZGmMZB9HCCD2A/MAkbm4j8W+4sIf8E:WQfRpiQ3pRsv4AXE9iCy1msL+4t
MD5:	CB84F8E411AC71C2D0EECA37723AD451
SHA1:	56FA220966B27EF79896658546E61931A1D84D9A
SHA-256:	C497D8E3EC0480F1407E192888AB274F76B3BC0C0DC9457FDEB5DADA132FB257
SHA-512:	3A18B54BC9D0F5D6C9F6F9500C923F0605C77F7A72600524DAEC38E5A6C1EE38F9C401AF8898D718F21A97A91D20F4322EED98683ACF171C2A6317E0826F3C41
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d...?>.].........." ..........................4ID.........................................`.................................................................\|... .......................8...............................................................H............data...8e.......f..................@....text...BE.......F...h.............. ..`.reloc..............................@..B....................................~=...........................................................................................................................................................................................................................................................................................................................................................J8ID...S........................+4ID....J8ID...*...p... ................f4ID...".......................

C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1f7c-0\System.Runtime.Serialization.Formatters.Soap.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	353280
Entropy (8bit):	6.425396368012398
Encrypted:	false
SSDEEP:	6144:BZMm4oCgyJkTtlMmd0b6xOzens3mz13yN6F:Bb4oHYotl9dY6QzeQmRiwF
MD5:	FC1D15780A9C0DDDDF0612A01F5B7261
SHA1:	9BEC1F5F382227FA702C37C8E40ED46D0D95B59B
SHA-256:	DED32C661E8505F76AB0D65368A7293D6EC9A2FECA0A9075EF5A6550162EC98D
SHA-512:	39BE1B4923048A436032EAC10537A003FEF9A682698837D5BFF7AE353DD83C93AB09902B66D76C1F8211CA49A7515267EB88318537AD0C209F97F29DCA5BB44D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d....>.].........." ...........................ID.........................................`.................................................................h...0............p.......f..8...............................................................H............data...............................@....text...Q........................... ..`.reloc.......p.......X..............@..B....................................~=..........................................................................................................................................................................................................................................................................................................................................................8.ID...1.................................ID...*...P....................m.ID...........................

C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1f84-0\Microsoft.JScript.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2844160
Entropy (8bit):	6.62746694654847
Encrypted:	false
SSDEEP:	49152:Kd6HVKGum20+06HDN/fPwDbEgqVUa3UFFx3x6/OwH9u6wAZj8dl6e4sK:KwHVKqsHRwDbEgqVUa3UFFx3b68l63s
MD5:	B5199F7B846A2F8DFA05CE43F61175D6
SHA1:	432DF95A7EF646CC814B1BED52938E3880B59240
SHA-256:	0EE39143B7EEA8EFD91304C0636A6535B92F50AA802F447D692C21497594720B
SHA-512:	59B9884F87AAF458BAF4B38A521B1EC812A232100C65C7898B4497ACF96A1EE200CF732E41485EFE8FFBB4B35DE3FA83D0196E684F9D6C9DB32497E5A12C3565
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d....>.].........." ...........................<D.............................+...........`..........................................................P.......]..L.............+..n....+.8............................................................S..H............data....<.......>..................@....text.....&..P....&..@.............. ..`.reloc...n....+..p....*.............@..B....................................~=.............................................................................................................................................................................................................................................................................................................................................................<D...c...............................L..<D...-........................+.<D...o.......................

C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\300-0\System.Design.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12967936
Entropy (8bit):	6.234468979744749
Encrypted:	false
SSDEEP:	98304:84hgEL2Xe6Bp7xHc+d52QeZkM3DxmrctbK9TVTyPY:8DECXe6BZ2PiMzxmrPTtyPY
MD5:	5037EB4274F960C7D3DF42EC86F13CC9
SHA1:	B2E4C4278E0FAEEE804C3949F878B8045071B255
SHA-256:	B4A14A1736596C5E34D6D808111BF915F2BEFA91D19626131628D51FAB05A8D2
SHA-512:	13C78C2AF35CCF4887A1205AD137D80156102317DACC2B1C1EB3B29EEBCA7B830E5960336EE989474ACE7ED336D30698DB3F83D4C183A56F1D9C2908CCF00497
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d...3>.].........." ..........................fED.........................................`........................................................... .4....C .P...................(p..8...........................................................@. .H............data...H...........................@....text....q.... ..r.................. ..`.reloc...............`..............@..B....................................~=...........................................................................................................................................................................................................................................................................................................................................................p.FD............................dpED...x..FD.../.......4................F.ED...................2.......

C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\b4c-0\System.Runtime.Serialization.Formatters.Soap.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	353280
Entropy (8bit):	6.425396368012398
Encrypted:	false
SSDEEP:	6144:BZMm4oCgyJkTtlMmd0b6xOzens3mz13yN6F:Bb4oHYotl9dY6QzeQmRiwF
MD5:	FC1D15780A9C0DDDDF0612A01F5B7261
SHA1:	9BEC1F5F382227FA702C37C8E40ED46D0D95B59B
SHA-256:	DED32C661E8505F76AB0D65368A7293D6EC9A2FECA0A9075EF5A6550162EC98D
SHA-512:	39BE1B4923048A436032EAC10537A003FEF9A682698837D5BFF7AE353DD83C93AB09902B66D76C1F8211CA49A7515267EB88318537AD0C209F97F29DCA5BB44D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d....>.].........." ...........................ID.........................................`.................................................................h...0............p.......f..8...............................................................H............data...............................@....text...Q........................... ..`.reloc.......p.......X..............@..B....................................~=..........................................................................................................................................................................................................................................................................................................................................................8.ID...1.................................ID...*...P....................m.ID...........................

C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\d1c-0\System.Security.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1010176
Entropy (8bit):	6.390647351452728
Encrypted:	false
SSDEEP:	12288:MsieoGzXs1r/4M7Km80TR+m1ML71n6VS3fQoL1iqqkQyW:MFqur980Twm1MN13YC
MD5:	F1F2CE62E1C36B6EB1E64FA2085D738E
SHA1:	299A4D69367A2F96571976EB0A6A8D3C9727F870
SHA-256:	967DD73C7EE643E2D03F8F82F8EFF0712CA8AA71AD1E5EBF1D89EA2C7BEDF1E0
SHA-512:	716D0B81FECB9F20CE8124DB49B9CBF95A19330912BBA5FC21FA4A72FB24F9259A2A2AE19D00AA6A334F1AEE4632DA0AFAC5A35A14825338D5DCC4A0897B70A3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d...p.O_.........." ...........................ID.........................................`.............................................................P........S...........@...:...9..8...........................................................P...H............data...H...........................@....text............................... ..`.reloc...:...@...<..................@..B....................................~=...........................................................................................................................................................................................................................................................................................................................................................+.ID...........................Hv.ID...L-.ID...,.......T...............`.ID... .......................

C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\d90-0\System.Runtime.Caching.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	305664
Entropy (8bit):	6.094303618906386
Encrypted:	false
SSDEEP:	3072:d5GBn2kdsVADZBWTe3xNArJpjdhd9X0spSMehIpUkF5Gqildq06/E3fzkBotD8/o:d5GBn2FmDh3yDoMeqByM066zIeQC
MD5:	DEB2C19197E42EDDC1636E8D069EAFFE
SHA1:	862ACCF42F307FC39B2C7A472415194F4AD88BFB
SHA-256:	FAD873D6DB1B3043A3EF804C08549FB9F74BE615FF2D452C820050CACED8BC19
SHA-512:	92408CBB745129D280D883E5F7D0F0CDE92D3D4A40C53D449CD28841D0B35BE0191E2BEA21F1F2040EB31137A6954EEF07208C38B6318A94B1B29887561502F8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d....>.].........." ..........................\|ID.........................................`.............................................................l....... ...............$......8...........................................................p...H............data...............................@....text...w........................... ..`.reloc..$...........................@..B....................................~=...........................................................................................................................................................................................................................................................................................................................................................G.ID...F........................R\|ID....G.ID...*...\|...................(.\|ID...........................

C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\d98-0\System.EnterpriseServices.Wrapper.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	350208
Entropy (8bit):	5.360984736881725
Encrypted:	false
SSDEEP:	3072:OhE8gQgd1a+JaRp7+1+aCfXliDapJjIz5oWM+VqFIuKxWZjWLHrKy8Y9WyafZiBj:OU+hKOWM+VqFIuKY1s9Wd8BkQP
MD5:	231B6E73760607A712F05F54052EE2A1
SHA1:	0FCE19AFDA7E30F43835E07B2DCCE6C0EBCE1ECC
SHA-256:	9C6C6F2D33CBB2B5A2E7E92634B0014771F3A4989D260400965A0396D4243B22
SHA-512:	E599EAF22F95D44B8CF6FC34A0692B0EE7EB622690FDF25B79E03AC4E9BEABCA3D078AD6AC3294DFD712AE0EC14D269126C89035B4441109EE07F743291F9148
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d...\|A.].........." .........................................................p............`.................................................................T................@..\...5..p...............................................................H............data...8m.......n..................@....text................p.............. ..`.reloc..\...@...,...,..............@..B....................................~=..................................................................................................................................................................................................................................................................................................................................................................................................T.......-.......................(S......U.......................

C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\d98-0\System.EnterpriseServices.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1016832
Entropy (8bit):	6.340122325887443
Encrypted:	false
SSDEEP:	12288:sUiQLhc+zmU0Z1XbQuPnQfPCbSa3H/H92nVnRs3OdZmFlCdzgr9NPDzjc3i:snQI1LPnQH4SihpDE3
MD5:	9D234EF1B5DE22E0AC4EF0DAD58536A4
SHA1:	172F24A4403F11407C77BFC47E1B4A7681E39FCB
SHA-256:	AF11FE05876110ADDD9721C43DA6AB53D404B9B39954631DC5B08C8EAD89F933
SHA-512:	51B36D47B006D46271F7D07577C74A212B17AC5DEA14AC126C4FD6F1744F021A311F1CD60277945C896B44600D44D1F894AB73E809325C40F8ADC78A78700889
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@.......................................................................................................PE..d....C.].........." ............................D.........................................`.................................................................(...4h...........`..\D...W..8...............................................................H............data...............................@....text....Y.......Z.................. ..`.reloc..\D...`...F...>..............@..B....................................~=............................................................................................................................................................................................................................................................................................................................................................!.D...............................D.....!.D...-.......\...................D...!.......................

Chrome Cache Entry: 275

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (51384), with no line terminators
Category:	downloaded
Size (bytes):	51385
Entropy (8bit):	5.293328685395304
Encrypted:	false
SSDEEP:	768:IaOFhhRC5JFhLjfRysgLzQynDw5YyDMFW8KQ:IaOFnR2DRszQKaoWtQ
MD5:	6626C1362840EBFC8F48294E8F023E18
SHA1:	4EC0DFB37C3E536C1B5EC04B68C9846FDBAF9EEF
SHA-256:	AABC88A6DB8B22022F96CA88E4F0A7BE426ABEF2B35169A71515A2D55246402A
SHA-512:	B037A19B52C1047198EC7F19E99066054E454964380E2354239834260D11248E617D6759B944DDF39A25B883C8F430603D8E13097396E2DEDA9BB6905C1CD42A
Malicious:	false
URL:	https://bat.bing.com/bat.js
Preview:	function UET(o){this.stringExists=function(n){return n&&n.length>0};this.domain="bat.bing.com";this.domainCl="bat.bing.net";this.URLLENGTHLIMIT=4096;this.pageLoadEvt="pageLoad";this.customEvt="custom";this.pageViewEvt="page_view";o.Ver=o.Ver!==undefined&&(o.Ver==="1"\|\|o.Ver===1)?1:2;this.uetConfig={};this.uetConfig.consent={enabled:!1,adStorageAllowed:!0,adStorageUpdated:!1,hasWaited:!1,waitForUpdate:0,enforced:!1};this.uetConfig.tcf={enabled:!1,vendorId:1126,hasLoaded:!1,timeoutId:null,gdprApplies:undefined,adStorageAllowed:undefined,measurementAllowed:undefined,personalizationAllowed:undefined};this.uetConfig.cusig={hasLoaded:!1,timeoutId:null,blob:{}};this.beaconParams={};this.supportsCORS=this.supportsXDR=!1;this.paramValidations={string_currency:{type:"regex",regex:/^[a-zA-Z]{3}$/,error:"{p} value must be ISO standard currency code"},number:{type:"num",digits:3,max:999999999999},integer:{type:"num",digits:0,max:999999999999},hct_los:{type:"num",digits:0,max:30},date:{type:"regex",

Chrome Cache Entry: 276

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14592)
Category:	dropped
Size (bytes):	436468
Entropy (8bit):	5.63645624542014
Encrypted:	false
SSDEEP:	6144:YwiJFjxYhz0t1tO/Zs6X+QFd/knHHyG55t3SDY9lgRR:R6Fj2Oz4/J+/rtDKR
MD5:	F3B67AF3211E2EF80910FB946830AE96
SHA1:	6541B0ADA67EBDB63A845EB3D6634F2AAA29D0B0
SHA-256:	FE78AB376C9892239116A49D0020783C6E992B1D02175824C27F7A2CF1461B89
SHA-512:	952B782BD51732977974B80620A09627040C6902937F2EBCA9A033A0A3B4931FFFC0FD7BBF7869C7B635D85AD55054010F6CA04FD7B09E43EBF6D0A292CEB573
Malicious:	false
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"16",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":28,"vtp_rules":["list","^(?!downloads\\.cdn)[^.]\\.?telerik\\.com$","whatsupgold\\.com","^chef\\.io$\|^www.chef\\.io$","^kemp\\.ax$\|^kemptechnologies\\.com$\|^freeloadbalancer\\.com$\|^exchangeloadbalancer\\.com$","flowmon\\.com","^(?!abldojo\\.services\|community\|secure\|documentation)[^.]\\.?progress.com$","kinvey\\.com","imacros\\.net","^(?!docs)[^.]*\\.?Ips

Chrome Cache Entry: 277

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (998), with no line terminators
Category:	downloaded
Size (bytes):	998
Entropy (8bit):	5.119771745601176
Encrypted:	false
SSDEEP:	12:6UMQEIMQYCdNLTkNTTiFBosOUurwaN7M8oVaXCOOCKX6DRNLnQBpNfTEcvrh4dMT:nvREiFBofUc1wc14X6DRdnWpdhLG13PK
MD5:	959C200967948C8EC962676FDE1CD9C9
SHA1:	8626BF3AD64D707210C2186366C3CAB3D1B218F6
SHA-256:	BAC4CC121D2E4DD1351588F7107E42C595E4E5A03828E5321452110875499306
SHA-512:	A37FBA2D6D9730EF331F196A1517B51A8C68067A2E9675A3497A3D90097A70D66F61DA4D11D44713AFBE5A075B1DB90479A9F740B04F6AD6B90DEC280247A49E
Malicious:	false
URL:	https://d585tldpucybw.cloudfront.net/Frontend-Assembly/Web.SitefinityExtensions.EloquaConnector/Scripts/SetBrowserSessionStorage.min.js?package=PureMvc&v=SURNTlNWL0Q2UU9sSFp4Z2dmYnp0UT09)
Preview:	window.invokeTrackingScript(this,OptanonGroups.PerformanceCookies,function(){var i="adWordsData",n="expTracking";function e(){dataLayer.push(arguments)}window.browserSessionStorage.read(n);function o(t,i){var r=window.browserSessionStorage.read(n);r=r?r:{};r[i]=t;window.browserSessionStorage.write(n,r);const u=document.createEvent("Event");u.initEvent("onOptimizeCallbackTriggered",!0,!0);window.dispatchEvent(u)}e("event","optimize.callback",{callback:o});function r(n,t){for(var u=null,e=t.split("&"),f=0;f<e.length;f++){var i=e[f].split("=");if(i[0]===n)return i[1];i[0]==="ReturnUrl"&&(u=i[1])}if(u){var s=unescape(u),o=s.split("?");if(o.length>1)return r(n,o[1])}}if(!window.browserSessionStorage.read(i)){var t={},u=!1,f=window.location.search.substring(1);f&&["ad_group","ad_type","utm_term","utm_content","ad_size","ad_placement","gclid","msclkid","ad_copy"].forEach(function(n){var i=r(n,f);i&&(t[n]=i,u=!0)});u&&(t.lp_url=window.location.href,window.browserSessionStorage.write(i,t))}})

Chrome Cache Entry: 278

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (2614), with no line terminators
Category:	downloaded
Size (bytes):	2617
Entropy (8bit):	4.970472526953817
Encrypted:	false
SSDEEP:	48:F22U1cLU0b+k2mvPqy+XWojZRe1HvBTy7JSr7su74nP7:oHTm+k/vCy+XC1HpTy7Jc4j
MD5:	81AE5B21D1531D21E927D41D7E83E63C
SHA1:	4153155654A7E2F2C77BB5F483CB4A04FEC279A6
SHA-256:	62147DC8ADC902A9953B2AD5182B769C8DDB3A3C966BFC17F1A198687F2260AC
SHA-512:	3FE8D3762FA50FAF6BC849F796FB3494FDEEE86306D4C6E934CA7EB46C4B2959EB429628C0663E563EC16470461C52792AFA0B42E528F6B1A0157548F32CB6FF
Malicious:	false
URL:	https://www.telerik.com/WebResource.axd?d=HtQyXelCu6mzSPcVcvK_BiMPfgaXcXtBpU_p4oPRWdaaTkgqeBOpXuu1TRv9pAGD-FAzjGGeBeqirrj8SJpv3YU7eO6rv9kziBqvktqcdZzC15nZHrag4kg_mMMtSYLloBTL1HIRNuD4Iepyub_zCpOjm9RyH4DXkI1YDpCN_mnfRNsYUjpSNKzgKVak4AN3FQYzZOcP1Z4PmfVVfM_48qg3YrI1&t=638646398980000000
Preview:	.InsightInitScript = { _settings: null, _client: null, _createClient: function (t) { InsightInitScript._client = new sfDataIntell.Client({ apiKey: InsightInitScript._settings.apiKey, source: InsightInitScript._settings.applicationName, apiServerUrl: InsightInitScript._settings.apiServerUrl, trackingCookieDomain: InsightInitScript._settings.trackingCookieDomain, maxAgeForTrackingCookieInDays: InsightInitScript._settings.maxAgeForTrackingCookieInDays, slidingExpirationForTrackingCookie: InsightInitScript._settings.slidingExpirationForTrackingCookie, trackYouTubeVideos: InsightInitScript._settings.trackYouTubeVideos, crossDomainTrackingEntries: InsightInitScript._settings.crossDomainTrackingEntries, trackPageVisits: !0, trackVideos: !0, instrument: !0, trackBrowserInformation: !0, trackDocuments: !0, docsHrefTestExpressions: InsightInitScript._settings.docsHrefTestExpressions, enableTracking: t }); var n = InsightInitScript._settings.keepDecTrackingCookieOnTrackingConsentRejection \|\| !1

Chrome Cache Entry: 279

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4943
Entropy (8bit):	4.970799505980531
Encrypted:	false
SSDEEP:	96:npyIN40w/1OxWRs+6upiyCBHxYa6AyghjYjNjJjFZZ2p0F:Fk/1M4sVSiyM6vgBgVJpIS
MD5:	8051B9723C99EAEECE1753B7F22E931A
SHA1:	8B352743705C6AB78EEC91FA42CB54737C701C4C
SHA-256:	9BD8DF065E42D6FC4FD72C7C14A211BD70903B89214A6B8687957A20A5B57B75
SHA-512:	7D87D7DFDB26FEBDA03E09F08DCC28E022C685A3012DCABAF70D96B79BA81654B3AC5D87BDD772B54CB87108B547D5CA525BF893E3A768CF6A70400C880CC9D9
Malicious:	false
Preview:	{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202401.2.0","OptanonDataJSON":"3dfce4f2-dab6-4128-9f33-df7e0597da82","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","BulkDomainCheckUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"018f398d-ea8e-74a2-a6c4-3960ac2e46da","Name":"EU","Countries":["de","no","be","fi","pt","bg","dk","lt","lu","lv","hr","fr","hu","se","mc","si","sk","mf","sm","gb","yt","ie","gf","ee","mq","ch","mt","gp","is","it","gr","es","re","at","cy","cz","ax","pl","li","ro","nl"],"States":{},"LanguageSwitcherPlaceholder":{"default":"en"},"BannerPushesDown":false,"Default":false,"Global":false,"Type":"GDPR","UseGoogleVendors":false,"VariantEnabled":false,"TestEndTime":null,"Variants":[],"TemplateName":"GDPR Template - Telerik.Com - EU"

Chrome Cache Entry: 280

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (58876), with no line terminators
Category:	downloaded
Size (bytes):	58876
Entropy (8bit):	5.405683338218142
Encrypted:	false
SSDEEP:	1536:buY9NdAkLYPFvFkxF94zPnSJpSFDKNo5/H:buQdApFoF94zPnSJpSFDP5/H
MD5:	4328E910DE583AD53B3A7A76455AF005
SHA1:	E040010E5EF4121A3A163AACDC664D6AA4AFEC74
SHA-256:	D4963B8AFEBFA0063B5D17B4C80F49BCE702A37EA5C9B91BB3C996BB9DEA4B60
SHA-512:	F807BA8B0AE2D5387E93E292918EEB4D7D1AC7635566A38EE2E101FBE8A7C6C23E704770EFCB1401EB5D1385605CBFB15F0A840AC150770049D2A4D6CA9A0DFA
Malicious:	false
URL:	https://static.ads-twitter.com/uwt.js
Preview:	!function(){var t={6173:function(t,e,n){var r;t.exports=(r=r\|\|function(t,e){var r;if("undefined"!=typeof window&&window.crypto&&(r=window.crypto),"undefined"!=typeof self&&self.crypto&&(r=self.crypto),"undefined"!=typeof globalThis&&globalThis.crypto&&(r=globalThis.crypto),!r&&"undefined"!=typeof window&&window.msCrypto&&(r=window.msCrypto),!r&&void 0!==n.g&&n.g.crypto&&(r=n.g.crypto),!r)try{r=n(2480)}catch(t){}var i=function(){if(r){if("function"==typeof r.getRandomValues)try{return r.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof r.randomBytes)try{return r.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")},o=Object.create\|\|function(){function t(){}return function(e){var n;return t.prototype=e,n=new t,t.prototype=null,n}}(),a={},c=a.lib={},u=c.Base={extend:function(t){var e=o(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply

Chrome Cache Entry: 281

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	363
Entropy (8bit):	4.55972645456488
Encrypted:	false
SSDEEP:	6:2LGa3ymyCE//MzGCFiM1wBJPwcQK5DrIt6xfeGYqX3OLGhw47Jsr4z+LibIEBE7g:2f3ymyCEIiMRhykgIaOEsrq1EiE7Dmyu
MD5:	A1AB0546CD0209ECAF9D81C1EC431E9B
SHA1:	A35F658C7DF8BE35A1BABAF39998CFB23419E994
SHA-256:	4922A8859B315C354C23AD278E35483C6CF29AEBF1C509C2C928C1F41634FE43
SHA-512:	9EE64BAEBD84174ED337F668C90E3679B37FF57857AF64C2B07D9D8FC1A722BF0C097F9C4B6B902F6F2BE66443E37D7EBE9ED24F03006124C3321B68C8E0CAB5
Malicious:	false
Preview:	(function(w,d,c,k,a,b,t,e) {. var cs = d.currentScript;. if (cs) {. var uo = cs.getAttribute('data-ueto');. if (uo && w[uo] && typeof w[uo].setUserSignals === 'function') {. w[uo].setUserSignals({'ea': c, 'kc': k, 'at': a, 'bi': b, 'dt': t, 'ec': e});. }. }.})(window, document, false, true, false, false, false, false);..

Chrome Cache Entry: 282

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (16015)
Category:	downloaded
Size (bytes):	16055
Entropy (8bit):	5.197709873158673
Encrypted:	false
SSDEEP:	384:oOLmo6BNdc4cwcIPq2CtCAGBb15WNWeRJz2G/pdCInMHycnSP6897QGbeb/FCXvS:ogmoMdcVIPxKdOBKWoFR/pdCInMH8C8I
MD5:	AB8444FA0426D72715572333D271C2E8
SHA1:	9A60F1E3B28B8BA953BE4A896F60D8033E4BCDAA
SHA-256:	ECF99B2AD192294C5E5233731A54FD2A3CFF26E1B79C852EFF39DAC531E5F119
SHA-512:	BEF8AA205194EB269278294690ACA2CA4CCEDFC54EF0191C8FDCE5F425DD6C34440283198E725EFB03063C73CB63A85B96320B0487F8FC6DC37086F71DA3A272
Malicious:	false
URL:	https://d6vtbcy3ong79.cloudfront.net/telerik-navigation/3.5.50/js/index.min.mjs
Preview:	!function(){"use strict";const t={activeClass:"TK-Nav-Overlay--Active"};class e{constructor(e,n){this.options=Object.assign({},t,n),this.element=e,this.activeClass=this.options.activeClass,this.hidden=!0}show(){this.hidden&&this.element&&(this.element.classList.add(this.activeClass),this.hidden=!1)}hide(){!this.hidden&&this.element&&(this.element.classList.remove(this.activeClass),this.hidden=!0)}addEventListener(t,e,n=!1){this.element&&this.element.addEventListener(t,e,n)}}const n="transition"in document.documentElement.style,s=t=>"function"==typeof t,o={hover:!1,click:!1,activeClass:"TK-Dropdown--Active",beforeOpenHook:()=>{},beforeCloseHook:()=>{}};class i{constructor(t,e){t&&(this.element=t,this.options=Object.assign({},o,e),this.closed=!0,this.running=!1,this.parent=this.options.parent\|\|t.parentElement,this.button=this.options.button\|\|this.parent.firstElementChild,this.beforeOpenHook=this.options.beforeOpenHook,this.beforeCloseHook=this.options.beforeCloseHook,this.init())}run(){i

Chrome Cache Entry: 283

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 4 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	21142
Entropy (8bit):	4.720363217360017
Encrypted:	false
SSDEEP:	192:z/tKZVrFfgcFi1eq3rrwyRKDtVjFe8XyLIfYwHdJc3EKlVnD:TEzrF/i8qXfRKyLNWuD
MD5:	12649F4E0C5A37D4A41CBCA768C8E7E0
SHA1:	1257DD7949F4AA81C8F791DCEEEDD66E486DC3A0
SHA-256:	7B990B226FB3E8970B750DEC91D4E8B9B59B2B7B069D0243D7BF70FEBE8EDE53
SHA-512:	A0F96E89664C938ED38B33A127EF56B882F2EF3A60A4E01324602905B054C50A0AB87A725A21E61C3C60B5225E8825CBEAB8C5664C2E59BE168071F1CE1EEED4
Malicious:	false
Preview:	............ .....F......... .h....... .... .....F...00.... ..%...,...PNG........IHDR.............\r.f..._IDATx..y...O.T..hiji...Q./.T3h;.Z...b..R..A..DEi.5.".BMG..$HgF3.1C3.iU...zr..'o..y..>...~>..x..>I.....6d.yB.)..x.@....\|.~O.i...<K..R...j.....U.R]....4..+W..T.. ...B....o...}U...S..i....y...v.....f6P..F....".@..'......#=\|?B..N...H.0..CTg...W.q..`.1.)}~......a....7.... .S..C.^..%.@..>......b...V5Su...>...C.t...x.Tok.G.>.:QuI..%.@..&...M....WMR.....;.A..!@Z.......{.....n.".......H....W.V..lK'.T.F,,..TB0......V..3....X..a..}.!.@o./.V..R......!.....l.Y.t....wU..6v.......j.X.C".!@\.+v.^......9.8.....:.8.I.[oMoC..:.......C....n.....r}.......U+;.B.......[..x........g.....s..\.j..A..].....N#r..=6...s.......j<Ul2.i.:..A.{...........U.:.R...............#T?.'6.4..0...z.[..D.H3...n.P..#.....n..b.z\|..g.....D.R..t.a@Z...n.1.....T_.....!@. .w.pLV.`:.i..TG..A.7...6. ...=V.K.NS.......{U.,.@cCg[Jf...b..0g[..!@...z..d.[/u.....e..mI.:...;.D..

Chrome Cache Entry: 284

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (41169)
Category:	downloaded
Size (bytes):	41172
Entropy (8bit):	5.505998162296305
Encrypted:	false
SSDEEP:	768:j21xCdwV69Odf9dk1fV8iWUwcb9x8cvgBhpU9yC8IEVDlbth3Ia8DdEN:iP3kr8V8vShi98Iiph3IbC
MD5:	0AA5002702487976D570A640C408EBA5
SHA1:	48930F22A2396DF313CCDFCB91CAC20E38F2B06B
SHA-256:	4E8276AEA0A3C7FE3600E6718C7F484D49C347C8D5763D89BE95900D526A14DA
SHA-512:	37A9D609DB21EE1E696CB437C02F0F6410925EB10B6353C0CDF95DB265E342F0BC3D2AE1851D209E4517D978B7CCBE8AD56F98247FA865AE405FAFD4D2E62CDA
Malicious:	false
URL:	https://snap.licdn.com/li.lms-analytics/insight.min.js
Preview:	!function(){"use strict";function n(n,t,e){return t in n?Object.defineProperty(n,t,{value:e,enumerable:!0,configurable:!0,writable:!0}):n[t]=e,n}var t,e,r,i,o={ADVERTISING:"ADVERTISING",ANALYTICS_AND_RESEARCH:"ANALYTICS_AND_RESEARCH",FUNCTIONAL:"FUNCTIONAL"},a="GUEST",u="MEMBER",c=0,l=1,d=2,s=(n(t={},a,"li_gc"),n(t,u,"li_mc"),t),f=function vr(){var n=arguments.length>0&&arguments[0]!==undefined?arguments[0]:null,t=arguments.length>1&&arguments[1]!==undefined?arguments[1]:null,e=arguments.length>2&&arguments[2]!==undefined?arguments[2]:null,r=arguments.length>3&&arguments[3]!==undefined?arguments[3]:null;for(var i in function(n,t){if(!(n instanceof t))throw new TypeError("Cannot call a class as a function")}(this,vr),n=n\|\|{},this.consentAvailable=!1,this.issuedAt=t,this.userMode=e,this.optedInConsentMap={},o)n[i]=n[i]\|\|c,n[i]!==c&&(this.consentAvailable=!0),this.optedInConsentMap[i]=n[i]===l\|\|n[i]===c&&r===l},v=(e=[o.ADVERTISING,o.ANALYTICS_AND_RESEARCH,o.FUNCTIONAL],r=[c,l,d,c],i=new R

Chrome Cache Entry: 285

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	87533
Entropy (8bit):	5.262536918435756
Encrypted:	false
SSDEEP:	1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr
MD5:	2C872DBE60F4BA70FB85356113D8B35E
SHA1:	EE48592D1FFF952FCF06CE0B666ED4785493AFDC
SHA-256:	FC9A93DD241F6B045CBFF0481CF4E1901BECD0E12FB45166A8F17F95823F0B1A
SHA-512:	BF6089ED4698CB8270A8B0C8AD9508FF886A7A842278E98064D5C1790CA3A36D5D69D9F047EF196882554FC104DA2C88EB5395F1EE8CF0F3F6FF8869408350FE
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Chrome Cache Entry: 286

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Preview:	{}

Chrome Cache Entry: 287

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1139), with CRLF line terminators
Category:	dropped
Size (bytes):	13911
Entropy (8bit):	5.591691392743421
Encrypted:	false
SSDEEP:	384:iuLISgE0cE0//E06E0cE0KE0ZKSf6XBxeYOQM10:iuLINE3/yUCgBrtMO
MD5:	4FFC5AD488B152DA7328DD575150F5A5
SHA1:	3FC01F49176FFD034BA40401FE7ABFFFA2D760A5
SHA-256:	F17561AF7644A4EB68C977E976E8C7EC81F837262DDA0C5DDC89B264698B5427
SHA-512:	3DB5BE63A152397ADE0A445F6F08FD596B35FF0D15C54A14FFA1FDCD6E71F48F744690E2CB533F066226B52227AC2B38B231D499D74F31A3A244825B3A2EB71E
Malicious:	false
Preview:	<!doctype html>..<html lang="en-us">..<head>..<title>ControlDataMessage Snapshot of 11/15/2024 2:59:35 PM</title>..<meta http-equiv="Content-Type" content="text/html; charset=utf-8">..<style type="text/css">..BODY, H1, H2, H3, H4, H5, H6, DL, DT, DD {.. margin: 0;.. padding: 0;.. color: #444;.. font: 13px/15px Arial, Verdana, Helvetica;..}..H1 {.. text-align: center;.. font: 24px Helvetica, Verdana, Arial;.. padding: 20px 0 10px 0;.. background: #FBFBFB;.. border-bottom: solid 1px #fff;..}..#lnks {.. border-top: solid 1px #dfdfdf;.. border-bottom: solid 1px #dfdfdf;.. margin: 0 0 10px 0;.. padding: 5px;.. background: #f1f1f1;.. line-height: 20px;.. text-align: center;..}..#lnks B {.. padding: 0 3px;..}..#body {.. padding: 20px;..}..H1 B {.. font-weight: normal;.. color: #069;..}..H1 A {.. color: #0E8F13;.. text-decoration: underline;..}..H1 I {.. font-style: normal;.. color: #0E8F13;..}..A {.. color: #337ab7;.. text-decoration: none;..}..A:hover {.. text-deco

Chrome Cache Entry: 288

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.261301029168016
Encrypted:	false
SSDEEP:	3:LUfQ2pHWiR8HVjROE9HSxmQqyRHfHyI:x2pHDKcElSDPyI
MD5:	806699ED4BB65178112F5BAD2242C52D
SHA1:	F44771599DB97A9EA255845DC886AE69EC293024
SHA-256:	6595E4AA67EA4D50268F53193CBE84B2201B3130DC15F690165007BDB829E068
SHA-512:	01FD5927CB4F6A6C1EA7B91F9ADD3F39AB3CC936FC06D806BF0A7A656E008F4281A96B7F8A850D8D470E8DF832B95A539836D734DC19D33B9946C31C948839FA
Malicious:	false
Preview:	jsonFeed({"country":"US","state":"TX","stateName":"Texas","continent":"NA"});

Chrome Cache Entry: 289

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/ga/rul?tid=G-9JSNBCSF54&gacid=146950673.1731682778&gtm=45je4bc0h1v9167661709z8536291za200zb536291&dma=0&gcs=G111&gcd=13v3v3v3v5l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067554~102067808~102077855&z=903480811
Preview:	<html></html>

Chrome Cache Entry: 290

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (638)
Category:	dropped
Size (bytes):	20822
Entropy (8bit):	5.395404473632203
Encrypted:	false
SSDEEP:	384:fJ1a/swXKlwWlaNhe5h6OL1+oDGvvWBlNRX2sZZg72d+U:CexaNhe5h6OR+oDkubNR7Zi6
MD5:	DB9C55B3FEDAC8D10BD097E9AA4A6B43
SHA1:	D48DD7450E3C03B2042F9D7F39080B4AC70567C5
SHA-256:	8C1D20EEDDA5C5FD996D82D5D3B87A3A6DA24735FE96458BFF21D13D3CC1D1E1
SHA-512:	D7BECD817E352245213190C1A722DEDB453A78262833210DC921F30BDFA8FBAFB2853549E687EACA4A4840A389337701DDDF3F8AF665150E2F64161EFC91DA43
Malicious:	false
Preview:	(function(w){function x(){var a=this;this.implementThePolyfill=function(){var b=Element.prototype.setAttribute;Element.prototype.setAttribute=function(c,d){if("style"!==c.toLowerCase()&&b.apply(this,[c,d]),"style"!==c.toLowerCase()\|\|d\|\|this.removeAttribute("style"),"style"===c.toLowerCase()&&d){this.removeAttribute("style");var f;c=a.strToObj(d);for(f in c)this.style[f]=c[f]}}}}function A(a,b,c){function d(l){return l?(";"!==(l=l.trim()).charAt(l.length-1)&&(l+=";"),l.trim()):null}void 0===c&&(c=.!1);var f=d(a.getAttribute("style")),g=d(b);b="";b=c&&f?function(){for(var l=f.split(";").concat(g.split(";")).filter(function(B){return 0!==B.length}),m="",n="",r=l.length-1;0<=r;r--){var y=l[r].substring(0,l[r].indexOf(":")+1).trim();0>m.indexOf(y)&&(m+=y,n+=l[r]+";")}return n}():g;a.setAttribute("style",b)}function k(){var a=this;this.iabType=null;this.iabTypeAdded=!0;this.crossOrigin=null;this.isAmp=!1;this.domainId="";this.isPreview=this.isReset=!1;this.nonce=this.geoFromUrl="";this.setAt

Chrome Cache Entry: 291

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (4188), with no line terminators
Category:	dropped
Size (bytes):	4191
Entropy (8bit):	5.114302743441512
Encrypted:	false
SSDEEP:	48:xvTmCcxNDbT2g03nkfmTHqsk04CoDAL1iQBq/cS5gsT+iS+VQEM4SSF4grqam1:BKH5MNk04CorzTXLF4aqv
MD5:	58340F3121BDBB73645B3E9C55FF5AC2
SHA1:	CBC7F40A0251F2ADF86C4049948D2F89ADF749F2
SHA-256:	6399AB4770551E8F40E94D5030C29AF730CEC63C52088C032A7AAB25AF070D85
SHA-512:	97EAF9D52458D843438C0F3BD3A3D23A4E169F29215A0A32A3E456281F8CFB214358818E1537D8F875CAE18FF79DE4F1E4502CB0276C687D13DFD0C1425BD944
Malicious:	false
Preview:	.var PersonalizationTracker = null; !function () { "use strict"; PersonalizationTracker = { _canTrack: !1, _pageId: null, _url: !1, track: function (e) { if (PersonalizationTracker._canTrack = e, PersonalizationTracker._canTrack) { if (!PersonalizationTracker._readCookie("sf-prs-ss")) { var r = 1e4 * Date.now() + 621355968e9; PersonalizationTracker._createCookie("sf-prs-ss", r) } if (!PersonalizationTracker._readCookie("sf-prs-lu")) { var a = window.top \|\| window; PersonalizationTracker._createCookie("sf-prs-lu", a.location.href) } PersonalizationTracker._pageId && PersonalizationTracker.trackPage(PersonalizationTracker._pageId), PersonalizationTracker._url && PersonalizationTracker.trackUrl() } else PersonalizationTracker._createCookie("sf-prs-ss", "", -1), PersonalizationTracker._createCookie("sf-prs-lu", "", -1), PersonalizationTracker._createCookie("sf-prs-vp", "", -1), PersonalizationTracker._createCookie("sf-prs-vu", "", -1) }, trackPage: function (e) { if (this._pageId = e.rep

Chrome Cache Entry: 292

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64030)
Category:	dropped
Size (bytes):	152698
Entropy (8bit):	5.474458044579754
Encrypted:	false
SSDEEP:	3072:za6Iq5E6wGi3wqdX1jFE5Pr6iUnqMg2Qncx7xT69BAtc7anA9pu+b7hdmDYCb+hW:JA1jmRr6iUnvg2Qncx7yBAa79+2Azx
MD5:	494B30D61A1D9180BA79AFE62744588D
SHA1:	2B51D06D2C65083FD73FB3A8A901B7CFB2F28C15
SHA-256:	EB5779B31CA9EE68014DF1A8B4082E0B253494AD3616073F2FA272997F0C90E3
SHA-512:	1DD18727E12076CDFF3CD036618846785A997D11A23784D1835320CA92002967A08ADCD7C7B915681FB6C577240DE7E5C4DC586369061D4050BE99A0E9B3B797
Malicious:	false
Preview:	(()=>{"use strict";var e,r={},t={};function o(e){var n=t[e];if(void 0!==n)return n.exports;var i=t[e]={exports:{}};return r[e].call(i.exports,i,i.exports,o),i.exports}o.m=r,e=[],o.O=(r,t,n,i)=>{if(!t){var l=1/0;for(s=0;s<e.length;s++){for(var[t,n,i]=e[s],a=!0,u=0;u<t.length;u++)(!1&i\|\|l>=i)&&Object.keys(o.O).every((e=>o.O[e](t[u])))?t.splice(u--,1):(a=!1,i<l&&(l=i));if(a){e.splice(s--,1);var f=n();void 0!==f&&(r=f)}}return r}i=i\|\|0;for(var s=e.length;s>0&&e[s-1][2]>i;s--)e[s]=e[s-1];e[s]=[t,n,i]},o.n=e=>{var r=e&&e.__esModule?()=>e.default:()=>e;return o.d(r,{a:r}),r},o.d=(e,r)=>{for(var t in r)o.o(r,t)&&!o.o(e,t)&&Object.defineProperty(e,t,{enumerable:!0,get:r[t]})},o.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window)return window}}(),o.o=(e,r)=>Object.prototype.hasOwnProperty.call(e,r),o.r=e=>{"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:

Chrome Cache Entry: 293

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (7348), with no line terminators
Category:	downloaded
Size (bytes):	7351
Entropy (8bit):	5.020040458057364
Encrypted:	false
SSDEEP:	192:Ix8uzi47xx4UNaRAJCJgJWJ04J7KJGboJFJG/bglt7kD5mcg+8N78+fm0KbeCkhj:4ipUXGIqfiRToglY1gNI+fm9KCklB1
MD5:	21F1464D7F87F6B19A753002C187706A
SHA1:	7C9380F15A38FC33B5BD5F21FD4E82F3163D9B97
SHA-256:	F1C215360C8E09CC98F925710D8D70664022EF9F2A3FBDD657ECB408836F3683
SHA-512:	76B2D6D861993C910F3E8C181CB096376BD53805E7A4B026866C87543D76FB046E9E99A41C696CE474219EA35DA473B9F975008236E7F6DCB185F0EF785735B0
Malicious:	false
URL:	https://www.telerik.com/WebResource.axd?d=wnB2OjhYopty-dCFa4b2kKCIWGgLoaj0QQ4I7F_PiSysmtqnVBUtsGpmlAymZDgXEXdRjhe5BdfNkuyybLSHMhRnbzI9oh6WXC-y-EwOrJPY0qCvfWaOo0ltV4TVm8apzRlzF5O244Y4u7-m5V8Vv2yC1Tun7PurVRoOxfv28sPwY-isOJNAi7MSqc1tycGYAkqZXHU_zlVNorSTBDv4W4jemDM1&t=638646398980000000
Preview:	.var personalizationManager = null; window.sfCorrelationId = Date.now().toString(36) + Math.random().toString(36).substring(2), function () { "use strict"; var PersonalizationManager = function () { this.personalizedContainers = [], this.personalizedContent = [], this._personalizedContentLoadedHandlers = [] }; if (PersonalizationManager.prototype = { initialize: function () { var e = this; e.IEVersion = this.detectIE(), this.loadPersonalizableContainers(), this.personalizedContainers.length > 0 && this.loadPersonalizedContent() }, loadPersonalizableContainers: function () { this.personalizedContainers = this.getScriptElementsWithAttribute("data-sf-pers-id") }, loadPersonalizedContent: function () { for (var firstPersonalizedContainer = this.personalizedContainers[0], pageNodeId = firstPersonalizedContainer.getAttribute("data-sf-pers-page-node-id"), pageDataId = firstPersonalizedContainer.getAttribute("data-sf-pers-page-data-id"), pageNodeKey = firstPersonalizedContainer.getAttribute(

Chrome Cache Entry: 294

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20618), with no line terminators
Category:	downloaded
Size (bytes):	20618
Entropy (8bit):	5.406502281835522
Encrypted:	false
SSDEEP:	384:oyP9GRmPA0s+xigucsnGDEk44rCj/f1v+nBdEaAWrreJvj/ala0kJo0kMDcQhD3D:oyP9aT0sEinTrx4rCjn5WeaprreJvj/1
MD5:	A83E8AAB183BDE1ADC71796C528AE03F
SHA1:	D76A9C58FCEC8C25F984203BAC09D6BDC29A7989
SHA-256:	2371B74E57F4690CC3EA0847772618A505FC224FCBADA874B4F181DCC8C00A9E
SHA-512:	90CF5473339EF0C56829C81E77466CFA9B0A4B5DA0E08A70C05B56645C86712E06926E2656AE672E76A63C605EFA3F54FCC1672F4D0CFCB82269D9325E5B7042
Malicious:	false
URL:	https://script.crazyegg.com/pages/versioned/trackingpagestate-scripts/cdc746c62076757bb4e3133b83f84f01.js
Preview:	(globalThis.webpackChunkCE2=globalThis.webpackChunkCE2\|\|[]).push([[202,848],{9948:(e,t,r)=>{"use strict";r.r(t),r.d(t,{pageState:()=>T});const n={tagsOfIgnoredDocHeadElements:["script","noscript"],tagsOfIgnoredDocBodyElements:["script","meta","noscript"]};var s=r(5512),a=r.n(s);function o(){return a()('/! For license information please see diff.worker.worker.js.LICENSE.txt /\n(()=>{var e={22:()=>{!function(e){var t=e.CE2BH={};function r(){return t.extends=r=Object.assign?Object.assign.bind():function(e){for(var t=1;t<arguments.length;t++){var r=arguments[t];for(var n in r)Object.prototype.hasOwnProperty.call(r,n)&&(e[n]=r[n])}return e},r.apply(this,arguments)}t.defineProperty=function(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e},t.extends=r,t.objectWithoutPropertiesLoose=function(e,t){if(null==e)return{};var r,n,s={},a=Object.keys(e);for(n=0;n<a.length;n++)r=a[n],t.indexOf(r)>=0\|\|(s[r]=e[r]);return s}}("undefined"==type

Chrome Cache Entry: 295

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	4.036006945330954
Encrypted:	false
SSDEEP:	3:YGKad20bAn:YGK+o
MD5:	7D18C0226B08F68EC83126F32344634B
SHA1:	F7B593CCD626C52A16C8DEAA638F77D722A9BB85
SHA-256:	4AF2CD82560041DB5DCCDDC690E3019B57703A96345DC27C796B3AF9BCBED2A2
SHA-512:	72C2672467426052694DD2C7FA3F28111BDC16AD14EB3D0BA4EDBAF7E96C0293B1103ACD86D1ED4B4D6492750893D34BC837564EAF5795772223B50548CE5010
Malicious:	false
URL:	https://www.telerik.com/webapi/Announcements/GetPromo?url=https://www.telerik.com/download/fiddler/first-run
Preview:	{"content":{"promoViewModel":null}}

Chrome Cache Entry: 296

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (47111), with NEL line terminators
Category:	downloaded
Size (bytes):	259466
Entropy (8bit):	5.326073090066559
Encrypted:	false
SSDEEP:	3072:cWywk6oYxnDGClfU489fRHvA5Kqkp2wIb+qAPvIEfzOSzleg:9oSGClfd89fR/qWIuqg
MD5:	B769087322B93C679C97949B413BDC51
SHA1:	5466ECB2C23EAFCE4B55AB412DEC4FC40C31ABE5
SHA-256:	32C23E7DF80AEB4A2105BA9B3A182F95F273797CA3A05B7ECBEB35386D2F7220
SHA-512:	6C1F176344D4A64DAC70D1E926EE2C03EE940298AA752104FC1B55C25A534900F56F7CEDFE5167A0FCAC6700407676E0796E6B412F70A821B747FA80CCA13C35
Malicious:	false
URL:	https://dtzbdy9anri2p.cloudfront.net/cache/5466ecb2c23eafce4b55ab412dec4fc40c31abe5/telerik/js/dist/all.min.js
Preview:	(O=>{var U,e,D,V,N,B,H,q,W,F,K="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function z(t){var e=7.5625,n=2.75;return t<1/n?ett:t<2/n?e(t-=1.5/n)t+.75:t<2.5/n?e(t-=2.25/n)t+.9375:e(t-=2.625/n)t+.984375}(U=O).easing.jswing=U.easing.swing,e=Math.pow,D=Math.sqrt,V=Math.sin,N=Math.cos,q=1.525(H=1.70158),W=2(B=Math.PI)/3,F=2B/4.5,U.extend(U.easing,{def:"easeOutQuad",swing:function(t){return U.easing[U.easing.def](t)},easeInQuad:function(t){return tt},easeOutQuad:function(t){return 1-(1-t)(1-t)},easeInOutQuad:function(t){return t<.5?2tt:1-e(-2t+2,2)/2},easeInCubic:function(t){return ttt},easeOutCubic:function(t){return 1-e(1-t,3)},easeInOutCubic:function(t){return t<.5?4ttt:1-e(-2t+2,3)/2},easeInQuart:function(t){return tttt},easeOutQuart:function(t){return 1-e(1-t,4)},easeInOutQuart:function(t){return t<.5?8tttt:1-e(-2t+2,4)/2},easeInQuint:function(t){return ttt*t

Chrome Cache Entry: 297

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (58876), with no line terminators
Category:	dropped
Size (bytes):	58876
Entropy (8bit):	5.405683338218142
Encrypted:	false
SSDEEP:	1536:buY9NdAkLYPFvFkxF94zPnSJpSFDKNo5/H:buQdApFoF94zPnSJpSFDP5/H
MD5:	4328E910DE583AD53B3A7A76455AF005
SHA1:	E040010E5EF4121A3A163AACDC664D6AA4AFEC74
SHA-256:	D4963B8AFEBFA0063B5D17B4C80F49BCE702A37EA5C9B91BB3C996BB9DEA4B60
SHA-512:	F807BA8B0AE2D5387E93E292918EEB4D7D1AC7635566A38EE2E101FBE8A7C6C23E704770EFCB1401EB5D1385605CBFB15F0A840AC150770049D2A4D6CA9A0DFA
Malicious:	false
Preview:	!function(){var t={6173:function(t,e,n){var r;t.exports=(r=r\|\|function(t,e){var r;if("undefined"!=typeof window&&window.crypto&&(r=window.crypto),"undefined"!=typeof self&&self.crypto&&(r=self.crypto),"undefined"!=typeof globalThis&&globalThis.crypto&&(r=globalThis.crypto),!r&&"undefined"!=typeof window&&window.msCrypto&&(r=window.msCrypto),!r&&void 0!==n.g&&n.g.crypto&&(r=n.g.crypto),!r)try{r=n(2480)}catch(t){}var i=function(){if(r){if("function"==typeof r.getRandomValues)try{return r.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof r.randomBytes)try{return r.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")},o=Object.create\|\|function(){function t(){}return function(e){var n;return t.prototype=e,n=new t,t.prototype=null,n}}(),a={},c=a.lib={},u=c.Base={extend:function(t){var e=o(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply

Chrome Cache Entry: 298

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20618), with no line terminators
Category:	dropped
Size (bytes):	20618
Entropy (8bit):	5.406502281835522
Encrypted:	false
SSDEEP:	384:oyP9GRmPA0s+xigucsnGDEk44rCj/f1v+nBdEaAWrreJvj/ala0kJo0kMDcQhD3D:oyP9aT0sEinTrx4rCjn5WeaprreJvj/1
MD5:	A83E8AAB183BDE1ADC71796C528AE03F
SHA1:	D76A9C58FCEC8C25F984203BAC09D6BDC29A7989
SHA-256:	2371B74E57F4690CC3EA0847772618A505FC224FCBADA874B4F181DCC8C00A9E
SHA-512:	90CF5473339EF0C56829C81E77466CFA9B0A4B5DA0E08A70C05B56645C86712E06926E2656AE672E76A63C605EFA3F54FCC1672F4D0CFCB82269D9325E5B7042
Malicious:	false
Preview:	(globalThis.webpackChunkCE2=globalThis.webpackChunkCE2\|\|[]).push([[202,848],{9948:(e,t,r)=>{"use strict";r.r(t),r.d(t,{pageState:()=>T});const n={tagsOfIgnoredDocHeadElements:["script","noscript"],tagsOfIgnoredDocBodyElements:["script","meta","noscript"]};var s=r(5512),a=r.n(s);function o(){return a()('/! For license information please see diff.worker.worker.js.LICENSE.txt /\n(()=>{var e={22:()=>{!function(e){var t=e.CE2BH={};function r(){return t.extends=r=Object.assign?Object.assign.bind():function(e){for(var t=1;t<arguments.length;t++){var r=arguments[t];for(var n in r)Object.prototype.hasOwnProperty.call(r,n)&&(e[n]=r[n])}return e},r.apply(this,arguments)}t.defineProperty=function(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e},t.extends=r,t.objectWithoutPropertiesLoose=function(e,t){if(null==e)return{};var r,n,s={},a=Object.keys(e);for(n=0;n<a.length;n++)r=a[n],t.indexOf(r)>=0\|\|(s[r]=e[r]);return s}}("undefined"==type

Chrome Cache Entry: 299

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (723)
Category:	downloaded
Size (bytes):	7076
Entropy (8bit):	5.52488676121649
Encrypted:	false
SSDEEP:	192:bttd4a6O1T6ahNU3dJ+SrM0hjUYIW2WX8ISlY:bBJ1T9UNJ+SrM0lXV2WXXSlY
MD5:	88A2E0A522036C0B87E03552E56629AA
SHA1:	EC9D1157518E753A84DBDE1333A29B34CF776D63
SHA-256:	788AFB96F2DA68E8729EC35F3D5E381FAD3482D37C54C2195C7311440EE4C27E
SHA-512:	44B953878BD650FE2BCC8B6904620955C3E396B7DC8F41F85D021A8E0404DA41DB15C5499A03F7D4FE9129BB340AA3F6782942CF5327502FD4569BEBBB17073F
Malicious:	false
URL:	https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fwww.telerik.com
Preview:	'use strict';var k=function(a){function b(c){return a.next(c)}function e(c){return a.throw(c)}return new Promise(function(c,d){function f(h){h.done?c(h.value):Promise.resolve(h.value).then(b,e).then(f,d)}f(a.next())})};/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var m=this\|\|self;var u,v;a:{for(var x=["CLOSURE_FLAGS"],B=m,C=0;C<x.length;C++)if(B=B[x[C]],B==null){v=null;break a}v=B}var G=v&&v[610401301];u=G!=null?G:!1;var H;const I=m.navigator;H=I?I.userAgentData\|\|null:null;function J(a){return u?H?H.brands.some(({brand:b})=>b&&b.indexOf(a)!=-1):!1:!1}function K(a){var b;a:{const e=m.navigator;if(e){const c=e.userAgent;if(c){b=c;break a}}b=""}return b.indexOf(a)!=-1};function L(){return u?!!H&&H.brands.length>0:!1}function O(){return L()?J("Chromium"):(K("Chrome")\|\|K("CriOS"))&&!(L()?0:K("Edge"))\|\|K("Silk")};!K("Android")\|\|O();O();!K("Safari")\|\|O()\|\|(L()?0:K("Coast"))\|\|(L()?0:K("Opera"))\|\|(L()?0:K("Edge"))\|\|(L()?J("Microsoft Edge"):K("Edg/"))\|\|L()&

Chrome Cache Entry: 300

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 301

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1504), with no line terminators
Category:	dropped
Size (bytes):	1504
Entropy (8bit):	5.220464607812732
Encrypted:	false
SSDEEP:	24:cjXz2YRhXVdpJnNjxdTPVyp0QRXKvbtJlNnTiBiDQfHEhOlrI3oG5t:YaShldJxdTPVyi1vHvsfHEQVI31t
MD5:	40722D9E1D8FAEF94FF280942C4195EF
SHA1:	022EAFFDD04D6434AE9D98E787BB8B3E7B9BDEE1
SHA-256:	99351CD9107CB14F24DB794523F2F01ADA5D93853BFA5717121AE353336FE49E
SHA-512:	F940281F35000E0144DF891354A4BCF69F1A131BC4C8AD766E149107DF53531C5B4573FE1FDAB57EFC2D8C743068A44B32FB27F7085926240954F9DBBA6ECC42
Malicious:	false
Preview:	!function(){"use strict";function a(e,h){for(var c=null,f=h.split("&"),d=0;d<f.length;d++){var b=f[d].split("=");if(b[0]===e)return b[1];"ReturnUrl"===b[0]&&(c=b[1])}if(c){var g=unescape(c).split("?");if(g.length>1)return a(e,g[1])}}var j=function(){for(var b=[".telerik.com",".ipswitch.com",".whatsupgold.com",".progress.com",".chef.io",".kemptechnologies.com","kemptechnologies.com",".flowmon.com", "freeloadbalancer.com"],c=window.location.hostname,a=0;a<b.length;a++)if(-1!=c.indexOf(b[a]))return b[a];return null}();if(!function(e){for(var c=e+"=",d=decodeURIComponent(document.cookie).split(";"),b=0;b<d.length;b++){for(var a=d[b];" "===a.charAt(0);)a=a.substring(1);if(0===a.indexOf(c))return a.substring(c.length,a.length)}return null}("prgs_utm")&&j){var b=window.location.search.substring(1),d=a("utm_source",b),e=a("utm_medium",b),f=a("utm_campaign",b),g=a("utm_content",b),h=a("utm_term",b),i=document.referrer?document.referrer:void 0;if(d\|\|e\|\|f\|\|g\|\|h\|\|i){if(!d&&!e&&!f&&!g&&!h){var c=ne

Chrome Cache Entry: 302

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 65 x 65, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2588
Entropy (8bit):	7.896800194253122
Encrypted:	false
SSDEEP:	48:z7FMMvnQwgeHOHCvG8ksYB6kQ+oORe+Orj4pdOzukUdZ6F1IcUC+SxoYXv:dRPQwgeuDfl6kBoO8+e4pdOzAudYSCM
MD5:	43D1CF4ABA38E6A2E4917698EB629712
SHA1:	DC3014AAD2A95FD450E3F86765A6349434147860
SHA-256:	3DCDE7CAF6DE5F14BAC67A471AECAEB492D1DCE03A3E6A6DB8A234B97C4CFBE2
SHA-512:	7A6E0BAF22876CBDBCD61A0202F41A2728BEFC3CEA55936EA6BA24B572AD92978BE630AC0831D578149B816B318A29C64FCF00B3713FEDAA75D30980A8893855
Malicious:	false
Preview:	.PNG........IHDR...A...A........E....pHYs...#...#.x.?v....tEXtSoftware.Adobe ImageReadyq.e<....IDATx....Uc...d5.$....(..cZ...".Vy,....X.<2.G..2.G.hFf..R....h..L..\..~_.=.s.9.17kZ...s.........;ed...1c..z...&...%.2A. .g..(7.zM2...d..1.E.&./.h..fG.x....PP...\|.H.t.d.Z.....y/..SO.SK.=M.;......V9.l.z..]..."G...q..p.`.......UMQ.F[F.....%..o&. .c ..#.j.S.Y.....8.q..:..V+1U.O.4q...c1...N.....A..;.k.Ga.0......)......(U./.t.Z.z.D+.e.....F..s.,.<.Q.......O.P.T........._...u.....S.,....~Nph..1<i....,...1n.^.bE..].............o#....M....\.....B... ...\e,;..l3...S....`.......!.P..>...Ak.M,T.Y..NPn.U=......c..8.(.}~W6.....^...a...0T.hN.).....Y..%...~T.Y9.........1d6....D./........,w.]..O:4g..$G.SU....*.H..>L...(...g....~Ta'.X/R.m...3..m]t_?..pxD..`......f.Ao....[.P...F...].S..n....4m.O.@1.}O.`5c{...a[<&xXp......v..{D.6...6..J.H...E.g...^d.+Yuc.:......L.......-'h.\v.......-.....[.l......).~~..cSum..4z......,.p>....l......;...<...........4.......

Chrome Cache Entry: 303

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9217)
Category:	downloaded
Size (bytes):	244531
Entropy (8bit):	5.4538573889137245
Encrypted:	false
SSDEEP:	3072:8FLeYH8AtPJ137OeR8NteqZEbkxZNsucrl0xYurPK713E3:8FLeYc+PJxH8NNfFcrHurPK7136
MD5:	36E181233B4F306FA5B8DDA3B15201E2
SHA1:	FDCCF3ABC17A9DE5CE2DBB5AD888C9698C7D2E13
SHA-256:	43A683165A27224EF2D2717BD57C8C203AA570CE39140504D086562EEFBB0F1F
SHA-512:	C754FC2C7B366E4475EFB11CF5C8F4F64427E00D7149F7DC10C7E4A726674335143F155F429ACF44210E93F8AA356E06879219E21A6AABE6AF92981E5C905348
Malicious:	false
URL:	https://connect.facebook.net/en_US/fbevents.js
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 304

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3300
Entropy (8bit):	5.041409827065832
Encrypted:	false
SSDEEP:	96:Fra4M0rAzNrSny1aRzqJRC424+/AD/APe7:Fs0kzNrSyARIRCHU7
MD5:	76CA1CA8B2D96CF16DA3E2140D5DFB56
SHA1:	03C052A880926A8411E76A18AA63E91C7CF5A16F
SHA-256:	02DA51970F2808353C5D402B60067ECBCA43E3F84DBF782C1AD1A2781320E56F
SHA-512:	6AB8C4F5EE9ECDE494CF61C895F30502E61DED69168847606FC86C1B60D16610E9E63F056448A6D1C2AD2B459D406FEF983106E28B010CC27CC30A823FC95C94
Malicious:	false
Preview:	TrackingConsentManager=(function(){var consentCookieName="sf-tracking-consent";.var consentDialogHtml="";.var consentDialog=null;.var eventListeners={AfterDialogDisplayed:[],BeforeDialogClosed:[],ConsentChanged:[],};.function closeConsentDialog(){if(consentDialog==null){return;.}invokeEventListeners("BeforeDialogClosed",[consentDialog]);.document.body.removeChild(consentDialog);.consentDialog=null;.}function openConsentDialog(){if(!document.body){return;.}closeConsentDialog();.consentDialog=document.createElement("div");.var dialogHtml=document.getElementById("sf-tracking-consent-manager");.if(dialogHtml){consentDialogHtml=dialogHtml.textContent;.consentDialog.innerHTML=consentDialogHtml;.document.body.insertBefore(consentDialog,document.body.childNodes[0]);.}var scripts=consentDialog.getElementsByTagName("script");.for(var idx=0;.idx<scripts.length;.idx++){try{eval(scripts[idx].textContent);.}catch(err){console.error(err);.}}invokeEventListeners("AfterDialogDisplayed",[consentDialog])

Chrome Cache Entry: 305

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5552)
Category:	downloaded
Size (bytes):	79439
Entropy (8bit):	5.337893965244746
Encrypted:	false
SSDEEP:	1536:RJeUwT76HXhpwPCHM9ZVK01QqSYTZ02LKVsdmpyKcicgo:RIT7OXVs9ZVKBvYj8wKcHgo
MD5:	98E39581AC2B644DAC590FE37D11DF1D
SHA1:	63145EEA21301D1D79BA659E65B1ACFCBD272676
SHA-256:	B2F74846F20EF6B9ADA51AFC57BC9634C8D9591F6B6904EA7E18BA1F099C721F
SHA-512:	DB7AD43DA641D039522F6C147FA31A543E9A3DE50F023A495E383A824408659FE569C57804088CC9D9175C6E38F83C961C64CFFE4269FDB10EFFB71D94B1AC2C
Malicious:	false
URL:	https://connect.facebook.net/signals/config/1444093252502226?v=2.9.177&r=stable&domain=www.telerik.com&hme=c3e4904c1dde42d643265ef909b9e193c41cedcd6f559a3ff5e1b178e36647fa&ex_m=70%2C121%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C172%2C175%2C187%2C183%2C184%2C186%2C29%2C101%2C53%2C77%2C185%2C167%2C170%2C180%2C181%2C188%2C131%2C41%2C189%2C190%2C34%2C143%2C15%2C50%2C195%2C194%2C133%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C168%2C171%2C140%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 306

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
Category:	downloaded
Size (bytes):	145222
Entropy (8bit):	5.2670517262784315
Encrypted:	false
SSDEEP:	3072:2qDBtbotYFCFFhwaBCs5wEuIVoz8mAyfPYiHF:2qDBdot1rhTCsaSVCAiHF
MD5:	E112B8BF96F23BC2970347A3C98E37FC
SHA1:	CE2408E32AEA3F8323ECEE9B7E4338A943667950
SHA-256:	889794FD02992011C4B843A05190531656D4C6148E6D4375BE6BAB3432B580D0
SHA-512:	AA43C0276A8E03B9C45479D7B7D286EA4648C355977D9742F14E8CCB22CF301ED7890330B39DAFB2D9EC26B6B233F4BCEFC6D231430F3CBA924DEDD13431CEF4
Malicious:	false
URL:	https://www.clickcease.com/monitor/stat.js
Preview:	!function(){"use strict";function k(){k=function(){return a};var c,a={},e=Object.prototype,l=e.hasOwnProperty,u=Object.defineProperty\|\|function(e,t,n){e[t]=n.value},t="function"==typeof Symbol?Symbol:{},r=t.iterator\|\|"@@iterator",n=t.asyncIterator\|\|"@@asyncIterator",o=t.toStringTag\|\|"@@toStringTag";function i(e,t,n){return Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}),e[t]}try{i({},"")}catch(c){i=function(e,t,n){return e[t]=n}}function s(e,t,n,r){var o,i,a,s,t=t&&t.prototype instanceof y?t:y,t=Object.create(t.prototype),r=new C(r\|\|[]);return u(t,"_invoke",{value:(o=e,i=n,a=r,s=f,function(e,t){if(s===h)throw new Error("Generator is already running");if(s===m){if("throw"===e)throw t;return{value:c,done:!0}}for(a.method=e,a.arg=t;;){var n=a.delegate;if(n){n=function e(t,n){var r=n.method,o=t.iterator[r];if(o===c)return n.delegate=null,"throw"===r&&t.iterator.return&&(n.method="return",n.arg=c,e(t,n),"throw"===n.method)\|\|"return"!==r&&(n.method="throw",n.ar

Chrome Cache Entry: 307

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (38861)
Category:	dropped
Size (bytes):	555018
Entropy (8bit):	5.711794560747648
Encrypted:	false
SSDEEP:	6144:qoTCnvQGk2AfiWb2V27YhzhtrO/JsB4+0KY/knHHFDVJc:qoTCvQG2Vb2Vbzc/b+75c
MD5:	24C38C282B9E155B9065C4157C5D351F
SHA1:	02D7D3D13871CCE7D9CB3C20A074CF6B9761136A
SHA-256:	9BD46FC7CA6E494E70E09AD3B670DC511C0CAACF2412C117F5B4869D1D98327E
SHA-512:	CA73990DEBC215E6D4DF44F4A86AA7A2FCBD78F5719BA6FA8B0C8A78379AD59AFD3E361889771CBB4B8E25FB59EEFE651B7E1A5D9233C29DB54712F8AAE94EC2
Malicious:	false
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. . (function(w,g){w[g]=w[g]\|\|{};. w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');. .(function(){..var data = {."resource": {. "version":"1146",. . "macros":[{"function":"__u","vtp_component":"URL","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__jsm","vtp_javascript":["template","(function(){return\/Android\|webOS\|iPhone\|iPad\|iPod\|BlackBerry\|IEMobile\|Opera Mini\/i.test(navigator.userAgent)?\"true\":\"false\"})();"]},{"function":"__e"},{"function":"__u","vtp_component":"URL","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__aev","vtp_setDefaultValue":false,"vtp_varType":"ELEMENT"},{"function":"__v","vtp_name":"gtm.triggers","vtp_dataLayerVersion":2,"vtp_setDefaultValue":true,"vtp_defaultValue":""},{"function":"__u","vtp_stripWww":true,"vtp_component":"HOST","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"fun

Chrome Cache Entry: 308

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	953
Entropy (8bit):	5.264600346715705
Encrypted:	false
SSDEEP:	24:5o7iEfbRklr3w9lT91toiQ/+OV7e7hbu+jomm2Y:+LfM091t9Q/Va7o+8mPY
MD5:	5BC6618FDAF65ED3A23E5EE17295291B
SHA1:	EA8A4B57D04B932C6C3EA7627EEB2BD6D3F26A47
SHA-256:	2BA36D93F77475018B08244FF704D516FE68D980D92638849A008F731B6438B5
SHA-512:	D76BBA5E2D3B550A86AA7B2CAE88E2659EF65877830A5F70FD1A9827763E3D46F223A4BF46FF0E0A7E5A10C1662E71E25D3A7AF0B3629119AD6C9B9753B9FB86
Malicious:	false
URL:	"https://www.telerik.com/RestApi/personalizations/render?pageNodeId=5ceb4be1-05bd-4c69-892a-2c2bbd37538b&pageDataId=1f960fad-aef2-4475-8978-52fb7a29dbc9&pageNodeKey=5CEB4BE1-05BD-4C69-892A-2C2BBD37538B/b31ca85c-a1c5-4a9d-8b5d-e7b0736a8b16/SitefinitySiteMap&url=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&controls=09f9bb4f-5990-40af-b361-7849c73c9604_1,0cd3f511-e7d9-4e23-8773-26005ae09893_1,25637a62-a321-49a0-8b7e-5962dc977e95_1,6b5ac4dc-8fd0-4043-bd0a-e9ffd31e3bc8_1&correlationId=m3iv7avxzpfywghsi2"
Preview:	[{"ControlId":"09f9bb4f-5990-40af-b361-7849c73c9604","Content":"<hr class=\"u-mt4 u-mb6\" /><h2>Do you need to build complex UI fast? </h2>"},{"ControlId":"0cd3f511-e7d9-4e23-8773-26005ae09893","Content":"\r\n\r\n <div class=\"u-tar\">\r\n <img src=\"https://www.telerik.com/sfimages/default-source/productsimages/kendo-ui-complete/kendoka_icon.png?sfvrsn=922435fb_2\" />\r\n </div>\r\n"},{"ControlId":"25637a62-a321-49a0-8b7e-5962dc977e95","Content":"\r\n\r\n<p class=\"u-fs20\"><a href=\"https://www.telerik.com/kendo-ui\">Try Kendo UI</a>: a complete JavaScript UI component library that allows you to quickly build eye-catching, responsive and performant web apps using jQuery, Angular, React or Vue. Speed up your development: access this large library of high-quality components, from sophisticated grids and charts to buttons and menus!</p>"},{"ControlId":"6b5ac4dc-8fd0-4043-bd0a-e9ffd31e3bc8","Content":""}]

Chrome Cache Entry: 309

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65441), with CRLF line terminators
Category:	downloaded
Size (bytes):	67359
Entropy (8bit):	5.352035171848617
Encrypted:	false
SSDEEP:	768:oDR8aeY7IeuemSlrl6JoUXXRuoBMALCYdPRJ2Op/Xnum7xX/FA1pFwmv6SKbyGl6:oDR+cASlrlerNjxp/Xnum7zlEb
MD5:	0018B2947487CCA1596BA00A9D80130C
SHA1:	F701C05D59788094B38DC8FCBBBB24219F903845
SHA-256:	DC1DA692990307185621FD661B7305E29D3A0A5BA0F0D998E5A1463A17C57044
SHA-512:	4411B4512287790F763F84B4C5FAE7FBF08AC6FEA39111964FA5AABB31EC7EE5051F3AF434103379A37148A65E1B354F0967AA27FD5844C4D5C7DFD416E49AA4
Malicious:	false
URL:	https://www.clarity.ms/s/0.7.56/clarity.js
Preview:	/* clarity-js v0.7.56: https://github.com/microsoft/clarity (License: MIT) */..!function(){"use strict";var t=Object.freeze({__proto__:null,get queue(){return dr},get start(){return lr},get stop(){return fr},get track(){return ir}}),e=Object.freeze({__proto__:null,get clone(){return Ar},get compute(){return jr},get data(){return Tr},get keys(){return Nr},get reset(){return Rr},get start(){return Cr},get stop(){return zr},get trigger(){return Dr},get update(){return Lr}}),n=Object.freeze({__proto__:null,get check(){return qr},get compute(){return Fr},get data(){return Or},get start(){return Yr},get stop(){return Vr},get trigger(){return Ur}}),a=Object.freeze({__proto__:null,get compute(){return $r},get data(){return Br},get log(){return Qr},get reset(){return ti},get start(){return Kr},get stop(){return Zr},get updates(){return Jr}}),r=Object.freeze({__proto__:null,get callback(){return fi},get callbacks(){return ai},get clear(){return di},get consent(){return li},get data(){return ni},

Chrome Cache Entry: 310

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 12144, version 1.0
Category:	downloaded
Size (bytes):	12144
Entropy (8bit):	7.980552002775052
Encrypted:	false
SSDEEP:	192:pRJ+h/2kOtAg8NmPp8hxGJ5TjD7MfPWmvnPCWqhu0E7VJorHuQzDKC/BO:0hOksn8gRMWTPsPPNqUP7Vk1ZO
MD5:	6FA17321361D5FB09342033C174E9FB7
SHA1:	ED487A69738A124AD6ADAC255F6E72B1A0201307
SHA-256:	E76475ABFF5091156791E3DB575BDE86CE6D4AC3DAB8496F8763D0531D05DD90
SHA-512:	43DF78DF82C35B9EE58D8E3E2B5D46F6F63F8582E6549C5CE11FA595D051B7DA99D26668E9D71E17B4ADE7DCC9F0DB1A1C5CA5E1E6DEBEF0208474290C0EECBF
Malicious:	false
URL:	https://dtzbdy9anri2p.cloudfront.net/cache/3771543484f465487bb9712eed986edeb1f314a2/telerik/iconfont/tlrk-icon-font-dc6cff9dd8.woff2
Preview:	wOF2....../p......l.../..........................T.V.. ...T....6.$..(..V.. ..^..-..^u..l.0 ."V.(J.........q..`... dP...M..j...CoJ........i...1.~......{KT"zR......ayc..1.....^v{<d.F....M....w.o.1I.@2.$...(.....O.Wr>..m3.......v#.X.%.{..M.._....1W.0=...Wl%.Q,?I........~[L.u..i...Dd.U.NR........C..........\|D.....Es......0.6NkkK[.}6..K.7Z..F.\|..q.g.v.d.[............W.%C`...P..1..{..M....N.K.Cc.Z.......L...........t.=..@...@.=.y.....\|..F]X.]%.eXZ.d.96.SSj..N..b........./.>}.r,..k.[+..g_....mg.%e+..rv.....A-`...."X.!.,,,...e..P.'......m{.........ri}..O....+....%.......&.....@.l.,..7.......yf ..s.A.f...o.../2.W...w.0`....\..9.h%..x..u0.....SGV[.a...6{........6...G......ua...$...Id..Fg0Yl.....Eb.T&W(Uj.V.7.Mf..fw8]n?.:..bs.<.@(.K.2.B.Rk.:..h2[.6...r{....Xz9.../...5.b.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.................................................................q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q...................

Chrome Cache Entry: 311

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	235
Entropy (8bit):	5.101641299344094
Encrypted:	false
SSDEEP:	6:hxuJzhqIzyYk+qRU4zEdxXZiqd6AAldgWJpEH6RyB5Lis8K34QL:hYXc4xXgqSGWJpu6RQ8sbIQL
MD5:	B112D8E1D41CE53E89D42E6B6FAEFD57
SHA1:	73D71526C722F7348597B8BB028BDAFD408C4236
SHA-256:	2AD5E0E760760530A731FB54BB2A7D34B637865F4E82DB7FAE2976A5374D3C3E
SHA-512:	CF22177AD8B824EF58C457656D356DCB4942592AF28AA976196871D39941D0E2323FA78A2018A11DB8F0167804B6C2B71978B439CFDAE998B7A0BB1AE927A03C
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="en">.<head>.<meta charset="utf-8">.<title>Error</title>.</head>.<body>.<pre>Cannot GET /collect/v2/data-centers/76766c2b-82f4-2453-81e5-fd840f3b455b/datasources/TelerikCom/interactions</pre>.</body>.</html>.

Chrome Cache Entry: 312

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21756), with no line terminators
Category:	downloaded
Size (bytes):	21756
Entropy (8bit):	4.769122522678095
Encrypted:	false
SSDEEP:	384:ud8C4hGojhmCy7qGAVsq1nwGfg4xqsQMPNE:/6J
MD5:	C925A552257F078897064317827D0BC7
SHA1:	091963D2C8C8D7301932F1BFB38BED997108AD18
SHA-256:	29733CA80FAD429EB7E4BB7F028CD176D9EE5A5427D09CAEC143E5030CB1005F
SHA-512:	8E26FC9B12F420E40E3D1D6F422AAD760F9E7C39DE7031987BB36294427E0513DC10A0E40D82187157E664DE875F8224AF94F24FA895F85D2D2889201723868D
Malicious:	false
URL:	https://cdn.cookielaw.org/scripttemplates/202401.2.0/assets/otCommonStyles.css
Preview:	#onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:700;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .onetrust-vendors-list-handler:hover{color:#1f96db}#onetrust-banner-sdk:focus{outline:2px solid #000;outline-offset:-2px}#onetrust-banner-sdk a:focus{outline:2px solid #000}#onetrust-banner-sdk #onetrust-accept-btn-handler,#onetrust-banner-sdk #onetrust-reject-all-handler,#onetrust-banner-sdk #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-tcf2-vendor-count.ot-text-bold{font-weight:700}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-size:contain;background-repeat:no-repeat;background-position:center;height:12px;width:12px}#onetrust-banner-sdk .powered-by-logo,#onetrust-banner-sdk .ot-pc-foot

Chrome Cache Entry: 313

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	439670
Entropy (8bit):	5.3569659190408
Encrypted:	false
SSDEEP:	6144:jrBf/xkaXxsE7qj2qSI2Ka3iD0kBNOxgzn3EcWhqlSftZ9z+C:vVxkaXKE7qnNOY2D7
MD5:	887F06FA484FB81EE2C33E58A23E19FB
SHA1:	0D37F173732694757CE708DA8DA87EC46EDFA502
SHA-256:	8B57A1C1ACD19F2FC4862A87E6D92F96D9F863A7162E4B67EEF894FD36E21D65
SHA-512:	8ABF41EE1D2B87B9EA4A235061B971CCA3E12AA62CD75FC1C5E9E7418CF8EB7A9FE204BBF7FB758C5AF9839637AB4100AFC7760EAD3A1D15A68B6B21BA1C3875
Malicious:	false
Preview:	!function(){"use strict";var N=function(e,t){return(N=Object.setPrototypeOf\|\|({__proto__:[]}instanceof Array?function(e,t){e.__proto__=t}:function(e,t){for(var o in t)Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o])}))(e,t)};function D(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");function o(){this.constructor=e}N(e,t),e.prototype=null===t?Object.create(t):(o.prototype=t.prototype,new o)}var H,R=function(){return(R=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this,arguments)};function F(e,s,a,l){return new(a=a\|\|Promise)(function(o,t){function n(e){try{i(l.next(e))}catch(e){t(e)}}function r(e){try{i(l.throw(e))}catch(e){t(e)}}function i(e){var t;e.done?o(e.value):((t=e.value)instanceof a?t:new a(function(e){e(t)})).then(n,r)}i((l=l.apply(e,s\|\|[])).next())})}function M(n,r){var i,s,a

Chrome Cache Entry: 314

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	6595
Entropy (8bit):	4.737803605759065
Encrypted:	false
SSDEEP:	96:12oZc5WT9BvpXKZhUyXuXsk8hLb3Dhm2ykOooZHoruMLAluOXGpEeiDR2CnoPe+:12oZc5WNXK3XuXW5UC0lLqEeiDQCqe+
MD5:	CBBB012923B40C4EC9BD81FF238D69C2
SHA1:	6A0FDE1FCCF345F111D77C1C4FE0E9B38F71D94B
SHA-256:	0AEA1D68873E3D3174E468D241717A11A3C09D5DA6CCC9CCC97A8944F8F6BB74
SHA-512:	FF4C8280C169E04838091213CD8EB0A0043829587684A01C4F46ADBFEB74D595845047F3B69045A91007548325B78ACB1F87EE0AE1BAE931757E7C59B76CC0D5
Malicious:	false
URL:	https://bat.bing.com/p/action/223000243.js
Preview:	(function(w,d,c,k,a,b,t,e) {. var cs = d.currentScript;. if (cs) {. var uo = cs.getAttribute('data-ueto');. if (uo && w[uo] && typeof w[uo].setUserSignals === 'function') {. w[uo].setUserSignals({'ea': c, 'kc': k, 'at': a, 'bi': b, 'dt': t, 'ec': e});. }. }.})(window, document, false, true, false, false, false, false);..(function(w,d,s,i) {.. var c=d.currentScript;.. if (c) {.. var uo = c.getAttribute('data-ueto');.. if (uo && w[uo] && w[uo].uetConfig && w[uo].uetConfig.deBlock === true).. return;.. }.. var f,j; f=d.getElementsByTagName(s)[0]; j=d.createElement(s); j.async=true;.. j.src='https://www.clarity.ms/tag/uet/'+i+'';.. j.onload = function () {.. if (!c) return;.. var co = function(u) { return u && typeof u === 'object' && !(u instanceof Array) && u.beaconParams && u.beaconParams.mid && w.clarity; };.. var r = 40;.. var cl = function() {.. if (r-- < 1) retu

Chrome Cache Entry: 315

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 65 x 65, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2588
Entropy (8bit):	7.896800194253122
Encrypted:	false
SSDEEP:	48:z7FMMvnQwgeHOHCvG8ksYB6kQ+oORe+Orj4pdOzukUdZ6F1IcUC+SxoYXv:dRPQwgeuDfl6kBoO8+e4pdOzAudYSCM
MD5:	43D1CF4ABA38E6A2E4917698EB629712
SHA1:	DC3014AAD2A95FD450E3F86765A6349434147860
SHA-256:	3DCDE7CAF6DE5F14BAC67A471AECAEB492D1DCE03A3E6A6DB8A234B97C4CFBE2
SHA-512:	7A6E0BAF22876CBDBCD61A0202F41A2728BEFC3CEA55936EA6BA24B572AD92978BE630AC0831D578149B816B318A29C64FCF00B3713FEDAA75D30980A8893855
Malicious:	false
URL:	https://www.telerik.com/sfimages/default-source/productsimages/kendo-ui-complete/kendoka_icon.png?sfvrsn=922435fb_2
Preview:	.PNG........IHDR...A...A........E....pHYs...#...#.x.?v....tEXtSoftware.Adobe ImageReadyq.e<....IDATx....Uc...d5.$....(..cZ...".Vy,....X.<2.G..2.G.hFf..R....h..L..\..~_.=.s.9.17kZ...s.........;ed...1c..z...&...%.2A. .g..(7.zM2...d..1.E.&./.h..fG.x....PP...\|.H.t.d.Z.....y/..SO.SK.=M.;......V9.l.z..]..."G...q..p.`.......UMQ.F[F.....%..o&. .c ..#.j.S.Y.....8.q..:..V+1U.O.4q...c1...N.....A..;.k.Ga.0......)......(U./.t.Z.z.D+.e.....F..s.,.<.Q.......O.P.T........._...u.....S.,....~Nph..1<i....,...1n.^.bE..].............o#....M....\.....B... ...\e,;..l3...S....`.......!.P..>...Ak.M,T.Y..NPn.U=......c..8.(.}~W6.....^...a...0T.hN.).....Y..%...~T.Y9.........1d6....D./........,w.]..O:4g..$G.SU....*.H..>L...(...g....~Ta'.X/R.m...3..m]t_?..pxD..`......f.Ao....[.P...F...].S..n....4m.O.@1.}O.`5c{...a[<&xXp......v..{D.6...6..J.H...E.g...^d.+Yuc.:......L.......-'h.\v.......-.....[.l......).~~..cSum..4z......,.p>....l......;...<...........4.......

Chrome Cache Entry: 316

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.366091329119193
Encrypted:	false
SSDEEP:	3:a2yb1tMn:aN1tM
MD5:	D06F04FCCF68D0B228A5923187CE1AFD
SHA1:	5DE9DF9FDD66A91EED06E31981553D4AB9CCF490
SHA-256:	830E67BDA2532CD5880EE86E3B33E69721082F8458BB0DF0CD4EDBB1577FD375
SHA-512:	9888104E0C9311D58B52A9B7030725C8BDFBE54F581246E4DDE0366F046671B3CE6838D09DDB4A384C6145248D4AB46D16BAE8E92F943488E2888982D6DB0D3A
Malicious:	false
Preview:	{ "status": "ok" }.

Chrome Cache Entry: 317

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6595
Entropy (8bit):	4.737803605759065
Encrypted:	false
SSDEEP:	96:12oZc5WT9BvpXKZhUyXuXsk8hLb3Dhm2ykOooZHoruMLAluOXGpEeiDR2CnoPe+:12oZc5WNXK3XuXW5UC0lLqEeiDQCqe+
MD5:	CBBB012923B40C4EC9BD81FF238D69C2
SHA1:	6A0FDE1FCCF345F111D77C1C4FE0E9B38F71D94B
SHA-256:	0AEA1D68873E3D3174E468D241717A11A3C09D5DA6CCC9CCC97A8944F8F6BB74
SHA-512:	FF4C8280C169E04838091213CD8EB0A0043829587684A01C4F46ADBFEB74D595845047F3B69045A91007548325B78ACB1F87EE0AE1BAE931757E7C59B76CC0D5
Malicious:	false
Preview:	(function(w,d,c,k,a,b,t,e) {. var cs = d.currentScript;. if (cs) {. var uo = cs.getAttribute('data-ueto');. if (uo && w[uo] && typeof w[uo].setUserSignals === 'function') {. w[uo].setUserSignals({'ea': c, 'kc': k, 'at': a, 'bi': b, 'dt': t, 'ec': e});. }. }.})(window, document, false, true, false, false, false, false);..(function(w,d,s,i) {.. var c=d.currentScript;.. if (c) {.. var uo = c.getAttribute('data-ueto');.. if (uo && w[uo] && w[uo].uetConfig && w[uo].uetConfig.deBlock === true).. return;.. }.. var f,j; f=d.getElementsByTagName(s)[0]; j=d.createElement(s); j.async=true;.. j.src='https://www.clarity.ms/tag/uet/'+i+'';.. j.onload = function () {.. if (!c) return;.. var co = function(u) { return u && typeof u === 'object' && !(u instanceof Array) && u.beaconParams && u.beaconParams.mid && w.clarity; };.. var r = 40;.. var cl = function() {.. if (r-- < 1) retu

Chrome Cache Entry: 318

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14592)
Category:	downloaded
Size (bytes):	436468
Entropy (8bit):	5.636425516552873
Encrypted:	false
SSDEEP:	6144:YwiJFjxYhz0t1tO/6s6X+QFd/knHHyG55t3SDY9lgRR:R6Fj2Oz4/A+/rtDKR
MD5:	0D9155563F6BAB13C4D2D089C48E5455
SHA1:	860560B7E8C81924ADA2CBC3BC694FC280889B1F
SHA-256:	F62DB2E1FE4E9D874687A68D13670D1F265F31BF94ADACDE563EA32A6340D8D5
SHA-512:	FD68A4C99BE70EA56A406161FD3E306106CAD99F3A3753340F8306C9AA940D8212DF49E1B3E73F745AB5F47A37ED9FDAD5E6CF60DE0BDFF7EEC58A4395418A41
Malicious:	false
URL:	https://www.googletagmanager.com/gtag/js?id=G-9JSNBCSF54&l=dataLayer&cx=c&gtm=45He4bc0h1v536291za200
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"16",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":28,"vtp_rules":["list","^(?!downloads\\.cdn)[^.]\\.?telerik\\.com$","whatsupgold\\.com","^chef\\.io$\|^www.chef\\.io$","^kemp\\.ax$\|^kemptechnologies\\.com$\|^freeloadbalancer\\.com$\|^exchangeloadbalancer\\.com$","flowmon\\.com","^(?!abldojo\\.services\|community\|secure\|documentation)[^.]\\.?progress.com$","kinvey\\.com","imacros\\.net","^(?!docs)[^.]*\\.?Ips

Chrome Cache Entry: 319

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	439670
Entropy (8bit):	5.3569659190408
Encrypted:	false
SSDEEP:	6144:jrBf/xkaXxsE7qj2qSI2Ka3iD0kBNOxgzn3EcWhqlSftZ9z+C:vVxkaXKE7qnNOY2D7
MD5:	887F06FA484FB81EE2C33E58A23E19FB
SHA1:	0D37F173732694757CE708DA8DA87EC46EDFA502
SHA-256:	8B57A1C1ACD19F2FC4862A87E6D92F96D9F863A7162E4B67EEF894FD36E21D65
SHA-512:	8ABF41EE1D2B87B9EA4A235061B971CCA3E12AA62CD75FC1C5E9E7418CF8EB7A9FE204BBF7FB758C5AF9839637AB4100AFC7760EAD3A1D15A68B6B21BA1C3875
Malicious:	false
URL:	https://cdn.cookielaw.org/scripttemplates/202401.2.0/otBannerSdk.js
Preview:	!function(){"use strict";var N=function(e,t){return(N=Object.setPrototypeOf\|\|({__proto__:[]}instanceof Array?function(e,t){e.__proto__=t}:function(e,t){for(var o in t)Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o])}))(e,t)};function D(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");function o(){this.constructor=e}N(e,t),e.prototype=null===t?Object.create(t):(o.prototype=t.prototype,new o)}var H,R=function(){return(R=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this,arguments)};function F(e,s,a,l){return new(a=a\|\|Promise)(function(o,t){function n(e){try{i(l.next(e))}catch(e){t(e)}}function r(e){try{i(l.throw(e))}catch(e){t(e)}}function i(e){var t;e.done?o(e.value):((t=e.value)instanceof a?t:new a(function(e){e(t)})).then(n,r)}i((l=l.apply(e,s\|\|[])).next())})}function M(n,r){var i,s,a

Chrome Cache Entry: 320

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (667), with no line terminators
Category:	dropped
Size (bytes):	667
Entropy (8bit):	5.00765779851988
Encrypted:	false
SSDEEP:	12:2Qb9Radth1mvgfYf5j7OlowvEoAdieE/4A7lEcIetD:2Qb9RytJAcHcoHb/p6cBD
MD5:	852912622073373B3811CD4CE08A2D0A
SHA1:	649C7C03E26E56A33B08A3C592EDE4D3AE720336
SHA-256:	4B8940BEC0467D78E75C7EAAF08B998C9CFBC4297E06490B1BEE1267A4649C04
SHA-512:	B7B94FEA330A78C14E75285EF8285DD1DACA09837B37FE74EC2790DACE047D7BAD92E6B75547EB8540F84FA0AB9A0A168EB1ADEDF9D7646418CC1A7B6D5F8B45
Malicious:	false
Preview:	(function(){var n="bsc";function i(n){for(var r=n+"=",f=decodeURIComponent(document.cookie),u=f.split(";"),i=0;i<u.length;i++){for(var t=u[i];t.charAt(0)===" ";)t=t.substring(1);if(t.indexOf(r)===0)return t.substring(r.length,t.length)}return null}function t(){var t=i(n);return t\|\|(t=Date.now().toString(),document.cookie=n+"="+t+";path=/;SameSite=Lax;"),t}function r(n){var i=localStorage.getItem(n);if(i){var u=JSON.parse(i),f=t(),r=u[f];return r?r:(localStorage.removeItem(n),null)}return null}function u(n,i){var u=t(),r={};r[u]=i;localStorage.setItem(n,JSON.stringify(r))}var f={read:r,write:u};window.browserSessionStorage\|\|(window.browserSessionStorage=f)})()

Chrome Cache Entry: 321

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5087), with no line terminators
Category:	dropped
Size (bytes):	5087
Entropy (8bit):	5.902633585924439
Encrypted:	false
SSDEEP:	96:1gWUfvlcY021mvXElnxad7OIJoodnbUCJdEjkRU/EeD6JPSyF:1DY0h8Rx47OIqWbZdeQaO
MD5:	9BABF56EC5D4FE605B7E29AB1BC7F844
SHA1:	8BC8A805E73C713E05DA2D3D03C7AD6810F40596
SHA-256:	9F9CAE180C24B48AF178CEC435539B6107ED5F0C25A82C4B8A430A67BE3C0EC3
SHA-512:	8313E50BB08A586F4FA503BCC1DB181A6B93649F7359F0A70938D8E74DB1BEAC21126779B60E59E2683A37D238E58E3B15916DBE6206A65D81C01ADA2A814076
Malicious:	false
Preview:	(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d\|\|a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

Chrome Cache Entry: 322

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	97929
Entropy (8bit):	5.415004441761732
Encrypted:	false
SSDEEP:	1536:lSRktpnYKatB8ZDTobZEyMZs5A+TAUXxcOwL0/EFzH1Kdn9vYXfAauLDm:lykCsZ4baytBXxcZAQcSILDm
MD5:	E733D1F391A0DBED45E60AFD4FD760EF
SHA1:	CECCFB3FFBE715FF1E8DABF61328DC0A069E487F
SHA-256:	E9B834587661F12A32B0F9B6BF0FE1B2895E7C62E8B2B28FA76E91605AFD5EA4
SHA-512:	A2D4550D8893594962A7E69A46C9B773515788CCCB4F7E4172391B32996E8AED2334583D913FCF09BCF7AD1B5E59CE964A0A887E8D08BBBECFB575AB191C09E6
Malicious:	false
Preview:	(globalThis.webpackChunkCE2=globalThis.webpackChunkCE2\|\|[]).push([[806,60],{9307:(e,t,s)=>{"use strict";s.r(t),s.d(t,{EventHandlers:()=>Os,V11Tracker:()=>xt,compress:()=>Is,fp:()=>Ns,getCensoredElements:()=>Bt,timing:()=>nt});const r="[\\s\\u00a0\\u2028\\u2029]+";let i;if("undefined"!=typeof Intl&&Intl.Segmenter)try{i=new Intl.Segmenter}catch(e){}const n={whitespace:new RegExp(r,"g"),strip:new RegExp(`^${r}\|${r}$`,"g"),href:/\bhref="(.?)"/i,ipHost:/^([\d\.]+\|\[[a-f\d:]+\])$/i,allChars:/\p{RI}\p{RI}\|\p{Emoji}(\p{EMod}\|\u{FE0F}\u{20E3}?\|[\u{E0020}-\u{E007E}]+\u{E007F})?(\u{200D}\p{Emoji}(\p{EMod}\|\u{FE0F}\u{20E3}?\|[\u{E0020}-\u{E007E}]+\u{E007F})?)\|./gsu};function o(e,t){const s=e.replace(n.strip,"");return t?s.replace(n.whitespace," "):s}const a=2048,c=65535-a;const l=`cesrk${Math.random().toString().replace(/\D/g,"")}`;function h(e){let t;const s=(e=e\|\|window).document;return e[`${l}_path`]!==e.location.pathname&&(e[l]=function(e){const t=e.defaultView,s=e.documentElement;if(s.scroll

Chrome Cache Entry: 323

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7225)
Category:	downloaded
Size (bytes):	7226
Entropy (8bit):	5.164466139256297
Encrypted:	false
SSDEEP:	192:HA1SI+LtL9xW+XUB1SAfQu+BzaNPQznTjdNs8L:g1SIaxWLym+TDJ
MD5:	54271D5DAAE8F6236DE59D2C16896D14
SHA1:	2DE502EACFC6724A34C2C72AE4D14919F3B2F588
SHA-256:	F759996A85B1DDF539EF3F16FDCA3D39E48F670AEF69E82C6200CC2B5F9F47BD
SHA-512:	3A5973551FD25752C6E3F8EDC16F82BC508AA93A067C17316B773609AB7C43E1E0320EBBA2FBBF53181B7DC1E8322C3FFB49C9C571CB86B5A6CE316C58F12241
Malicious:	false
URL:	https://unpkg.com/web-vitals@4.2.4/dist/web-vitals.iife.js
Preview:	var webVitals=function(e){"use strict";var n,t,r,i,o,a=-1,c=function(e){addEventListener("pageshow",(function(n){n.persisted&&(a=n.timeStamp,e(n))}),!0)},u=function(){var e=self.performance&&performance.getEntriesByType&&performance.getEntriesByType("navigation")[0];if(e&&e.responseStart>0&&e.responseStart<performance.now())return e},s=function(){var e=u();return e&&e.activationStart\|\|0},f=function(e,n){var t=u(),r="navigate";a>=0?r="back-forward-cache":t&&(document.prerendering\|\|s()>0?r="prerender":document.wasDiscarded?r="restore":t.type&&(r=t.type.replace(/_/g,"-")));return{name:e,value:void 0===n?-1:n,rating:"good",delta:0,entries:[],id:"v4-".concat(Date.now(),"-").concat(Math.floor(8999999999999*Math.random())+1e12),navigationType:r}},d=function(e,n,t){try{if(PerformanceObserver.supportedEntryTypes.includes(e)){var r=new PerformanceObserver((function(e){Promise.resolve().then((function(){n(e.getEntries())}))}));return r.observe(Object.assign({type:e,buffered:!0},t\|\|{})),r}}catch(e

Chrome Cache Entry: 324

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.366091329119193
Encrypted:	false
SSDEEP:	3:a2yb1tMn:aN1tM
MD5:	D06F04FCCF68D0B228A5923187CE1AFD
SHA1:	5DE9DF9FDD66A91EED06E31981553D4AB9CCF490
SHA-256:	830E67BDA2532CD5880EE86E3B33E69721082F8458BB0DF0CD4EDBB1577FD375
SHA-512:	9888104E0C9311D58B52A9B7030725C8BDFBE54F581246E4DDE0366F046671B3CE6838D09DDB4A384C6145248D4AB46D16BAE8E92F943488E2888982D6DB0D3A
Malicious:	false
Preview:	{ "status": "ok" }.

Chrome Cache Entry: 325

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 34640, version 1.131
Category:	downloaded
Size (bytes):	34640
Entropy (8bit):	7.993552732594365
Encrypted:	true
SSDEEP:	768:1C366zXS9YQvaE7gAKd/Gc7voTQhJVgp42h042JfdKrSm:MqgXRQvaE7WZrYpzibqSm
MD5:	4562882014F7DF38316D04C4D89475EA
SHA1:	B56BD842693D3C17A9B09AF5A89100144D1CE88A
SHA-256:	5D80735B48C0F39F70E37251A2861D5470B765FB662213DA3A88D1C25867A440
SHA-512:	7D1CE83B4F217C8FF5C5B25D389C1475EFD5264C01638EBD4899B90AC560F06E8BEB3FFB962EA6C118AC5C819E7D74C97FD0F91BA43F2E03146401E5219D6124
Malicious:	false
URL:	https://d6vtbcy3ong79.cloudfront.net/fonts/2.2.7/metric/Metric-Regular.woff2
Preview:	wOF2.......P.......................8...:...........>.....R.`..`....R..s.....`..t..X.6.$........ ..I.....V[M.q...T..]...p..W..\|..n.....r..D..U..p.........1..}....RDR++p.Y@..K......%...1...\|T.g/[-. .......d..-..N{.......!.F[7}I....h...\|..z.K.......p..j.s(Z.0..1.......$.n.4?....oE...R.e...^3...X....... ......&oy...7........F...>YM.?\|....-.-.1..w..<&[.&r..l92re<_....z. ..$..J......s...x.......E..L;gF.J{...J..,..h.5..3....O..?..P...I..w.R.1.I9...T...b....fN.M.m. .."(...w.q... 6.....N.EZ....e.+.Q??..~..>..}.Q.D....F....x.....y...2.h..DK.L..E...LIsu..IZ.....^.M:.L...........M..E...y.......?.U.0.1... !$.....)....{.].../.A....&.;FB.Uj....r.3.:.%.,.v.....\..,cv.\....w.....q^..0.........h.)...iU[.."Z....<....I...4.a....".-X.^H3.....!......n.....~..8....g.2(p._.F-..... N.....;p....0.s.{..._v.dk......H@a.."...j.k0.../u..e.?...9..;.@s...!=..3^D.}.5c8.....,.H.c.Q]....1$...".g.m@....r..Y.w...U8.V....**.V\...D.=_..?..E ...\|.....jl.8.$.w..c...5 !.L.!9v.kw

Chrome Cache Entry: 326

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (38861)
Category:	downloaded
Size (bytes):	555025
Entropy (8bit):	5.711806549675355
Encrypted:	false
SSDEEP:	6144:qoTCnvQGk2AfiWb2V27YhzhtrOEJsB4+0KY/knHHFDVJc:qoTCvQG2Vb2VbzcEb+75c
MD5:	E46FAC40EC502A20DB12B48655A4C76B
SHA1:	1D2913FF6364C0A7472FADF2F88C27F8B5F50AA4
SHA-256:	116BC87DC8A2C5457B50EFA8D8F2896F7D6F6AFE94840EBB0A24402CCB5EDF6A
SHA-512:	712BD7AA0633D12AC2B596C2E6B02923F51E3C14B4562309876713DD0DAF165815BAB3461366703462FC2B01C11AFCB4D0EF24399E49C31EA7694E4FF3B5FEBD
Malicious:	false
URL:	https://www.googletagmanager.com/gtm.js?id=GTM-6X92
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. . (function(w,g){w[g]=w[g]\|\|{};. w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');. .(function(){..var data = {."resource": {. "version":"1146",. . "macros":[{"function":"__u","vtp_component":"URL","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__jsm","vtp_javascript":["template","(function(){return\/Android\|webOS\|iPhone\|iPad\|iPod\|BlackBerry\|IEMobile\|Opera Mini\/i.test(navigator.userAgent)?\"true\":\"false\"})();"]},{"function":"__e"},{"function":"__u","vtp_component":"URL","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__aev","vtp_setDefaultValue":false,"vtp_varType":"ELEMENT"},{"function":"__v","vtp_name":"gtm.triggers","vtp_dataLayerVersion":2,"vtp_setDefaultValue":true,"vtp_defaultValue":""},{"function":"__u","vtp_stripWww":true,"vtp_component":"HOST","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"fun

Chrome Cache Entry: 327

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	101932
Entropy (8bit):	5.377676026270363
Encrypted:	false
SSDEEP:	1536:AbB8CVPp3Vi8bgLTknkqJM3vRuSSlYRqp027B:IB8CJiknkLOlYQ77B
MD5:	19AD77CAB71BAC40FB159D247A30FE86
SHA1:	FC2692670EF9316166EEA517F8F090D3D2BBE52F
SHA-256:	253DF3AABDF0F3571800385A5A8C03EBE2547AF91EAC033078A6599B3726EC33
SHA-512:	D9CB9667213C2949E9EA02118E87F01FA34C5417D93059273763AF6B57AB9EEB07A7BC35D6BB331A0741546B5C18E952252D2D85F31D2B388DB4051B6FB2D711
Malicious:	false
Preview:	{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","pccloseButtonType":"Icon","MainText":"Privacy Preference Center","MainInfoText":"When you visit any web site, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalised web experience.\n\nBecause we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.","AboutText":"More information","AboutCookiesText":"Your

Chrome Cache Entry: 328

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	284715
Entropy (8bit):	5.2338063431508
Encrypted:	false
SSDEEP:	1536:XZ6Mv2/dXPYQDir0Y128GfhmagqhrV4ecCArMM1IvGoVOdNV9NN+xiYDqSqxUqAG:XZE/E0Y0LOdNV9NNGjqA6KxFjVsoV9t+
MD5:	64F84853D393558F3155E3DD8DAB0737
SHA1:	3771543484F465487BB9712EED986EDEB1F314A2
SHA-256:	1DC9690F175E5D3C9EFE4794FF37107478B86A1E08021017DE6852CA3B577EB0
SHA-512:	7A80F9C99CE5941D083D1B6C48E0AF598B0CFDFB914A6255FF509F546DE4D26E24C02FACF4C381BC6E214D4CB9D243484501736BF406632BD60C27133F7EC294
Malicious:	false
URL:	https://dtzbdy9anri2p.cloudfront.net/cache/3771543484f465487bb9712eed986edeb1f314a2/telerik/css/style.css
Preview:	@charset "UTF-8";.BlockLinks--buttons a,.Btn,.PageWrapper,.PanelChoice label,.RadEditor iframe,.SearchResults ,.Section-banner,.Section-cover,.Slider-slide,.TK-Tag-Input-Button,.TimeLine :after,.TimeLine :before,.col-1,.col-10,.col-11,.col-12,.col-2,.col-3,.col-4,.col-5,.col-6,.col-7,.col-8,.col-9,.col-common,.col-five,.container,.field,.sfFormSubmit.sfSubmitBtnSmall>input,.sfforumSubscribeBtn,.sfforumUnsubscribeBtn,.sfreContentArea,input,input[type=checkbox],input[type=radio],select,textarea,tk-site-search {-webkit-box-sizing:border-box;box-sizing:border-box}.Features-Slider-Header,.List--horizontal,.List-item,.Nav,.NavAlt,.QuickLinks,.QuickLinks .sftaxonHorizontalList,.Section-controlHeadingMenu,.container,.row,.u-cf,dl{*zoom:1}.Features-Slider-Header:after,.List--horizontal:after,.List-item:after,.Nav:after,.NavAlt:after,.QuickLinks .sftaxonHorizontalList:after,.QuickLinks:after,.Section-controlHeadingMenu:after,.container:after,.row:after,.u-cf:after,dl:after{clear:both;content:"

Chrome Cache Entry: 329

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	66
Entropy (8bit):	3.9721077567347134
Encrypted:	false
SSDEEP:	3:YGKeMfQ2pHWiR8HVjROE9HSxmQqyRHfHyY:YGKed2pHDKcElSDPyY
MD5:	A20F61BBF661147FA65EC1ABF4093AED
SHA1:	C7306A9A3F8224E2E564FD170242E4B26BBA7047
SHA-256:	EFA3DA3BC784514C792213E4B3C842CF4DA752C0EC3EF14F4592A6A849DBEFCA
SHA-512:	1BD4A45DC90A18265C78720955D80FCAC6A3656C23BBC0C480078D9407ACF205399FBDD22942242642D20EC73759DF5613620BFC27084C71AF448CC2F36D55F6
Malicious:	false
URL:	https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Preview:	{"country":"US","state":"TX","stateName":"Texas","continent":"NA"}

Chrome Cache Entry: 330

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (507)
Category:	downloaded
Size (bytes):	508
Entropy (8bit):	4.923119236427323
Encrypted:	false
SSDEEP:	12:T+3+gdIbB9wniD+3+gdIMqB9NV0DiD+3+gdIQTB9biD+3+gdIsB9CJ:TVXB22VAqBJV2BIVwBA
MD5:	71013E9167AEAE887FCF49619715FE65
SHA1:	E81BD3ADCA65F075440D835F87409743119EB609
SHA-256:	D1566F3154CF309A6C04053F6F3B8B5FF4DA438F62A071F1C26A6007C036E76A
SHA-512:	3F1BF101CE89FFE10ADBDBDFEBC3F43D53C3A001154E6D491B7832857827DCB469EDECF4A16B9E156C748535E188E75D9325192D446406278796975182194603
Malicious:	false
URL:	https://d6vtbcy3ong79.cloudfront.net/fonts/2.2.7/css/metric.min.css
Preview:	@charset "utf-8";@font-face{font-family:Metric;src:url("../metric/Metric-Light.woff2") format("woff2");font-weight:100 300;font-display:swap}@font-face{font-family:Metric;src:url("../metric/Metric-Regular.woff2") format("woff2");font-weight:400;font-display:swap}@font-face{font-family:Metric;src:url("../metric/Metric-Medium.woff2") format("woff2");font-weight:500;font-display:swap}@font-face{font-family:Metric;src:url("../metric/Metric-Semibold.woff2") format("woff2");font-weight:600;font-display:swap}.

Chrome Cache Entry: 331

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (47111), with NEL line terminators
Category:	dropped
Size (bytes):	259466
Entropy (8bit):	5.326073090066559
Encrypted:	false
SSDEEP:	3072:cWywk6oYxnDGClfU489fRHvA5Kqkp2wIb+qAPvIEfzOSzleg:9oSGClfd89fR/qWIuqg
MD5:	B769087322B93C679C97949B413BDC51
SHA1:	5466ECB2C23EAFCE4B55AB412DEC4FC40C31ABE5
SHA-256:	32C23E7DF80AEB4A2105BA9B3A182F95F273797CA3A05B7ECBEB35386D2F7220
SHA-512:	6C1F176344D4A64DAC70D1E926EE2C03EE940298AA752104FC1B55C25A534900F56F7CEDFE5167A0FCAC6700407676E0796E6B412F70A821B747FA80CCA13C35
Malicious:	false
Preview:	(O=>{var U,e,D,V,N,B,H,q,W,F,K="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function z(t){var e=7.5625,n=2.75;return t<1/n?ett:t<2/n?e(t-=1.5/n)t+.75:t<2.5/n?e(t-=2.25/n)t+.9375:e(t-=2.625/n)t+.984375}(U=O).easing.jswing=U.easing.swing,e=Math.pow,D=Math.sqrt,V=Math.sin,N=Math.cos,q=1.525(H=1.70158),W=2(B=Math.PI)/3,F=2B/4.5,U.extend(U.easing,{def:"easeOutQuad",swing:function(t){return U.easing[U.easing.def](t)},easeInQuad:function(t){return tt},easeOutQuad:function(t){return 1-(1-t)(1-t)},easeInOutQuad:function(t){return t<.5?2tt:1-e(-2t+2,2)/2},easeInCubic:function(t){return ttt},easeOutCubic:function(t){return 1-e(1-t,3)},easeInOutCubic:function(t){return t<.5?4ttt:1-e(-2t+2,3)/2},easeInQuart:function(t){return tttt},easeOutQuart:function(t){return 1-e(1-t,4)},easeInOutQuart:function(t){return t<.5?8tttt:1-e(-2t+2,4)/2},easeInQuint:function(t){return ttt*t

Chrome Cache Entry: 332

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65441), with CRLF line terminators
Category:	dropped
Size (bytes):	67359
Entropy (8bit):	5.352035171848617
Encrypted:	false
SSDEEP:	768:oDR8aeY7IeuemSlrl6JoUXXRuoBMALCYdPRJ2Op/Xnum7xX/FA1pFwmv6SKbyGl6:oDR+cASlrlerNjxp/Xnum7zlEb
MD5:	0018B2947487CCA1596BA00A9D80130C
SHA1:	F701C05D59788094B38DC8FCBBBB24219F903845
SHA-256:	DC1DA692990307185621FD661B7305E29D3A0A5BA0F0D998E5A1463A17C57044
SHA-512:	4411B4512287790F763F84B4C5FAE7FBF08AC6FEA39111964FA5AABB31EC7EE5051F3AF434103379A37148A65E1B354F0967AA27FD5844C4D5C7DFD416E49AA4
Malicious:	false
Preview:	/* clarity-js v0.7.56: https://github.com/microsoft/clarity (License: MIT) */..!function(){"use strict";var t=Object.freeze({__proto__:null,get queue(){return dr},get start(){return lr},get stop(){return fr},get track(){return ir}}),e=Object.freeze({__proto__:null,get clone(){return Ar},get compute(){return jr},get data(){return Tr},get keys(){return Nr},get reset(){return Rr},get start(){return Cr},get stop(){return zr},get trigger(){return Dr},get update(){return Lr}}),n=Object.freeze({__proto__:null,get check(){return qr},get compute(){return Fr},get data(){return Or},get start(){return Yr},get stop(){return Vr},get trigger(){return Ur}}),a=Object.freeze({__proto__:null,get compute(){return $r},get data(){return Br},get log(){return Qr},get reset(){return ti},get start(){return Kr},get stop(){return Zr},get updates(){return Jr}}),r=Object.freeze({__proto__:null,get callback(){return fi},get callbacks(){return ai},get clear(){return di},get consent(){return li},get data(){return ni},

Chrome Cache Entry: 333

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11811)
Category:	downloaded
Size (bytes):	13103
Entropy (8bit):	5.395292738783993
Encrypted:	false
SSDEEP:	192:cbnLzF5tmjHCR/UeHjXWb2pTOnstdo5CpcNddwWqRObyAzJ3N4:cbnLzQjURHjXo2BtcC4KOby0J3N4
MD5:	B1CC08F7E26DFBAEDD1F3546A4061FCF
SHA1:	37A70CD88975C184CC4E96C49A8C3FAA8B72946B
SHA-256:	A102AF1633278368902D508A0DB8C164B7E1A9AA4C9A4D709C8184277CA28154
SHA-512:	B483831931A7E7ED055CAB38F33B1ECA48774F69D15C36424C2D79EF0EF0828674F172414087C45D0D982495FD1C1E6910E7E7737320660B854C6B0F04E1B3D5
Malicious:	false
URL:	https://static.hotjar.com/c/hotjar-66905.js?sv=7
Preview:	window.hjSiteSettings = window.hjSiteSettings \|\| {"site_id":66905,"rec_value":0.0,"state_change_listen_mode":"manual","record":true,"continuous_capture_enabled":true,"recording_capture_keystrokes":false,"session_capture_console_consent":false,"anonymize_digits":true,"anonymize_emails":true,"suppress_all":false,"suppress_all_on_specific_pages":[],"suppress_text":true,"suppress_location":false,"user_attributes_enabled":false,"legal_name":null,"privacy_policy_url":null,"deferred_page_contents":[],"record_targeting_rules":[],"feedback_widgets":[],"heatmaps":[],"polls":[],"integrations":{"optimizely":{"tag_recordings":false},"abtasty":{"tag_recordings":false},"kissmetrics":{"send_user_id":false},"mixpanel":{"send_events":false},"unbounce":{"tag_recordings":false},"hubspot":{"enabled":false,"send_recordings":false,"send_surveys":false}},"features":["ask.popover_redesign","client_script.compression.pc","csq_theme","error_reporting","feedback.embeddable_widget","feedback.widgetV2","feedback.wi

Chrome Cache Entry: 334

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (638)
Category:	downloaded
Size (bytes):	20822
Entropy (8bit):	5.395404473632203
Encrypted:	false
SSDEEP:	384:fJ1a/swXKlwWlaNhe5h6OL1+oDGvvWBlNRX2sZZg72d+U:CexaNhe5h6OR+oDkubNR7Zi6
MD5:	DB9C55B3FEDAC8D10BD097E9AA4A6B43
SHA1:	D48DD7450E3C03B2042F9D7F39080B4AC70567C5
SHA-256:	8C1D20EEDDA5C5FD996D82D5D3B87A3A6DA24735FE96458BFF21D13D3CC1D1E1
SHA-512:	D7BECD817E352245213190C1A722DEDB453A78262833210DC921F30BDFA8FBAFB2853549E687EACA4A4840A389337701DDDF3F8AF665150E2F64161EFC91DA43
Malicious:	false
URL:	https://cdn.cookielaw.org/consent/3dfce4f2-dab6-4128-9f33-df7e0597da82/otSDKStub.js
Preview:	(function(w){function x(){var a=this;this.implementThePolyfill=function(){var b=Element.prototype.setAttribute;Element.prototype.setAttribute=function(c,d){if("style"!==c.toLowerCase()&&b.apply(this,[c,d]),"style"!==c.toLowerCase()\|\|d\|\|this.removeAttribute("style"),"style"===c.toLowerCase()&&d){this.removeAttribute("style");var f;c=a.strToObj(d);for(f in c)this.style[f]=c[f]}}}}function A(a,b,c){function d(l){return l?(";"!==(l=l.trim()).charAt(l.length-1)&&(l+=";"),l.trim()):null}void 0===c&&(c=.!1);var f=d(a.getAttribute("style")),g=d(b);b="";b=c&&f?function(){for(var l=f.split(";").concat(g.split(";")).filter(function(B){return 0!==B.length}),m="",n="",r=l.length-1;0<=r;r--){var y=l[r].substring(0,l[r].indexOf(":")+1).trim();0>m.indexOf(y)&&(m+=y,n+=l[r]+";")}return n}():g;a.setAttribute("style",b)}function k(){var a=this;this.iabType=null;this.iabTypeAdded=!0;this.crossOrigin=null;this.isAmp=!1;this.domainId="";this.isPreview=this.isReset=!1;this.nonce=this.geoFromUrl="";this.setAt

Chrome Cache Entry: 335

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11811)
Category:	dropped
Size (bytes):	13103
Entropy (8bit):	5.395292738783993
Encrypted:	false
SSDEEP:	192:cbnLzF5tmjHCR/UeHjXWb2pTOnstdo5CpcNddwWqRObyAzJ3N4:cbnLzQjURHjXo2BtcC4KOby0J3N4
MD5:	B1CC08F7E26DFBAEDD1F3546A4061FCF
SHA1:	37A70CD88975C184CC4E96C49A8C3FAA8B72946B
SHA-256:	A102AF1633278368902D508A0DB8C164B7E1A9AA4C9A4D709C8184277CA28154
SHA-512:	B483831931A7E7ED055CAB38F33B1ECA48774F69D15C36424C2D79EF0EF0828674F172414087C45D0D982495FD1C1E6910E7E7737320660B854C6B0F04E1B3D5
Malicious:	false
Preview:	window.hjSiteSettings = window.hjSiteSettings \|\| {"site_id":66905,"rec_value":0.0,"state_change_listen_mode":"manual","record":true,"continuous_capture_enabled":true,"recording_capture_keystrokes":false,"session_capture_console_consent":false,"anonymize_digits":true,"anonymize_emails":true,"suppress_all":false,"suppress_all_on_specific_pages":[],"suppress_text":true,"suppress_location":false,"user_attributes_enabled":false,"legal_name":null,"privacy_policy_url":null,"deferred_page_contents":[],"record_targeting_rules":[],"feedback_widgets":[],"heatmaps":[],"polls":[],"integrations":{"optimizely":{"tag_recordings":false},"abtasty":{"tag_recordings":false},"kissmetrics":{"send_user_id":false},"mixpanel":{"send_events":false},"unbounce":{"tag_recordings":false},"hubspot":{"enabled":false,"send_recordings":false,"send_surveys":false}},"features":["ask.popover_redesign","client_script.compression.pc","csq_theme","error_reporting","feedback.embeddable_widget","feedback.widgetV2","feedback.wi

Chrome Cache Entry: 336

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 34032, version 1.131
Category:	downloaded
Size (bytes):	34032
Entropy (8bit):	7.992900407271375
Encrypted:	true
SSDEEP:	768:O0klUTIlUaWqtEfQVDW97f/4JjD3Mqbl+t3lxfUX6G7H8:OflUT+Wqt1AL/4JjD39blAzUXVc
MD5:	249B877FDD0EB071E09DF73645C12B71
SHA1:	344CB223DB5C230194D475800A9DDD02BACDE734
SHA-256:	9642881515BD7496BC1EBB7BAB132D109E109614E36D8ACC6731633D03797050
SHA-512:	4A2604164DBEB42878DA36E7D7EEAFE8EB12678E8410983D36C9CA10BD259299B5262EA19D9AA47EA64986BCC6EB40E78754BE434D0A595FE29ACDAAF22D3780
Malicious:	false
URL:	https://d6vtbcy3ong79.cloudfront.net/fonts/2.2.7/metric/Metric-Light.woff2
Preview:	wOF2...................J...........<...6...........>.....R.`..`....R..s..... ..3..X.6.$........ ..5.....V[x~...n..........Z......n.....]\F..t...'.u.o......vR.C..i........bBe....z.d..t`.. ..&.......`.p.V..>.D....s....'oB..^.H9.s2...2.(.b.;.4u.6..AHf;..Z.S=.....O.u.....nuHG..#u-&.=.J2l..S.........._..3..1..y..u....Gw.+3..{.R...........l....!..;.p....l.Q..0X....9.{I...,..../qD!..r.v.5y..(..#..;.$+_..~..}.J..D'\|(........../...$.3.......H.....Q.8.By..T..Vn...6~.G].....,.A2..=.0.{.....o.T!u..cEX..X.J.27..j..EH.L:MO..O...6..q...2BrT...[.><.z.....\..@".3...b[.....f......`(.h.D.......4.h?B.!.V.\|\..T.k.......I.I.}h.....z^./...2.p..F.......G7.......8.<3i..."Z.-. @Hr...m..!."..%...]...?..f.Fb0* ...60... X..(......a-.XZl).h.i.4......v.fw.&}.'..ll,#.2.oNT.W..?a46f@R.....H..B.K^.Mn.f....F.[..I.ty ...`L.].gQ@...u.+...t.<IO.iH.......+@..............CwQ...CL......]N..Q.?W.txtR.\|...#g..{....U..@}........ .=...L.]..H.J.0...n!.....0.E..............

Chrome Cache Entry: 337

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65376)
Category:	downloaded
Size (bytes):	169122
Entropy (8bit):	5.743020256980256
Encrypted:	false
SSDEEP:	1536:FnlD7l1Evkge6STiydO90X6AfKcPbJWYiGE5nkbDd2bsvpsebA3G3DHnx/w/Sf3A:Flffd79fvLq5isFWLxOSf3efei
MD5:	AA0A02BA268AC6B889AD8993EAE85014
SHA1:	BB312560F6AE025DAF1140B2EF1AE2839FA9C399
SHA-256:	B212B0CF050110B2A4CE71B0D26CD5A17A300CD4E6593A10CEEB7C16153E65CB
SHA-512:	2678049828B7E1858DAD5EF901C693F5C1039A2FCAF878F74E75FD24A546E4B8DE2C5A66BA196086BD368271CFC2BAC1CDFF6A430E9BA986E738A6B4BB830C2B
Malicious:	false
URL:	https://cl.qualaroo.com/ki.js/24100/4Nr.js
Preview:	// Qualaroo for telerik.com.// (C) 2024 Qualaroo. All rights reserved..// qualaroo.com..//$ site: 19547, generated: 2024-11-08 08:00:01 UTC.//$ client: 2.0.70..if(typeof KI == 'undefined'){KI=function(){"use strict";function C(_){return typeof _}var u,d_,c_,n,p_,h,r,b,a,l,m,H,u_,k,m_,d,E,k_,X,V,g,c,p,W,N,F,Z,e,i,t,f,v,h_,g_,f_,b_,x,v_,_,w,y,q,s,o,$,z,S,j,__,I,A,T,O,L,P,G,Y,R,M,K,D,B,U,Q,J,e_,i_,t_,s_,o_,n_,r_,a_,l_,x_,w_,y_,q_,z_,S_,C_,j_,I_,A_,T_,O_,L_,E_,V_,N_,F_,P_,R_,M_,D_,B_,U_,H_,X_,W_,G_,Y_,K_,Q_,J_,Z_,$_,_e,ee,ie,te,se,oe,ne,re,ae,le,de,ce,pe,ue,me,ke,he,ge,fe,be,ve,xe,we,ye,qe,ze,Se,Ce,je,Ie,Ae,Te,Oe,Le,Ee,Ve,Ne,Fe,Pe,Re,Me,De,Be,Ue,He,Xe,We=window,Ge=We.document,Ye=Ge.documentElement,Ke=Ge.location,Qe=We.navigator,Je=We.screen,Ze=We.getComputedStyle,$e=void 0,_i=Array,ei=Date,ii=Number,ti=Object,si=String,oi=We.JSON,ni=clearTimeout,ri=setTimeout,ai="",li=" ",di="  ",ci=null,pi=4294967295,ui=1,mi=1.091,ki=2,hi=3,gi=4,fi=5,bi=6,vi=10,xi=12,wi=15,yi=16,qi=20,zi=30,Si=60,Ci=

Chrome Cache Entry: 338

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	19
Entropy (8bit):	3.366091329119193
Encrypted:	false
SSDEEP:	3:a2yb1tMn:aN1tM
MD5:	D06F04FCCF68D0B228A5923187CE1AFD
SHA1:	5DE9DF9FDD66A91EED06E31981553D4AB9CCF490
SHA-256:	830E67BDA2532CD5880EE86E3B33E69721082F8458BB0DF0CD4EDBB1577FD375
SHA-512:	9888104E0C9311D58B52A9B7030725C8BDFBE54F581246E4DDE0366F046671B3CE6838D09DDB4A384C6145248D4AB46D16BAE8E92F943488E2888982D6DB0D3A
Malicious:	false
URL:	https://pagestates-tracking.crazyegg.com/healthcheck
Preview:	{ "status": "ok" }.

Chrome Cache Entry: 339

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (2614), with no line terminators
Category:	dropped
Size (bytes):	2617
Entropy (8bit):	4.970472526953817
Encrypted:	false
SSDEEP:	48:F22U1cLU0b+k2mvPqy+XWojZRe1HvBTy7JSr7su74nP7:oHTm+k/vCy+XC1HpTy7Jc4j
MD5:	81AE5B21D1531D21E927D41D7E83E63C
SHA1:	4153155654A7E2F2C77BB5F483CB4A04FEC279A6
SHA-256:	62147DC8ADC902A9953B2AD5182B769C8DDB3A3C966BFC17F1A198687F2260AC
SHA-512:	3FE8D3762FA50FAF6BC849F796FB3494FDEEE86306D4C6E934CA7EB46C4B2959EB429628C0663E563EC16470461C52792AFA0B42E528F6B1A0157548F32CB6FF
Malicious:	false
Preview:	.InsightInitScript = { _settings: null, _client: null, _createClient: function (t) { InsightInitScript._client = new sfDataIntell.Client({ apiKey: InsightInitScript._settings.apiKey, source: InsightInitScript._settings.applicationName, apiServerUrl: InsightInitScript._settings.apiServerUrl, trackingCookieDomain: InsightInitScript._settings.trackingCookieDomain, maxAgeForTrackingCookieInDays: InsightInitScript._settings.maxAgeForTrackingCookieInDays, slidingExpirationForTrackingCookie: InsightInitScript._settings.slidingExpirationForTrackingCookie, trackYouTubeVideos: InsightInitScript._settings.trackYouTubeVideos, crossDomainTrackingEntries: InsightInitScript._settings.crossDomainTrackingEntries, trackPageVisits: !0, trackVideos: !0, instrument: !0, trackBrowserInformation: !0, trackDocuments: !0, docsHrefTestExpressions: InsightInitScript._settings.docsHrefTestExpressions, enableTracking: t }); var n = InsightInitScript._settings.keepDecTrackingCookieOnTrackingConsentRejection \|\| !1

Chrome Cache Entry: 340

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6995)
Category:	downloaded
Size (bytes):	6996
Entropy (8bit):	5.561565592655271
Encrypted:	false
SSDEEP:	192:K/l9vCl2YqXoBRpJry6ov0r6PeHYKCUAQBTyJs4oKvu7S/tT:2v1Y/H0esgTyJsYbT
MD5:	74B63954B07AC783C3819EB01384E75E
SHA1:	9922C98EECE047007F999290827ABF42F2C903F9
SHA-256:	4DBFE5095AC48222345BE81F07FA808C5F0B9CA4EC020B288EA2C18725AA3643
SHA-512:	F31513DB78DAC9734C496DC2A0434DA9B5E557D5987FBB068D14ADA4600708220D34ECD82791D969A824A6771B64BFDE3BDF2E43D9694039DD5C227595E0885D
Malicious:	false
URL:	https://script.crazyegg.com/pages/scripts/0087/4351.js
Preview:	if(CE_USER_SCRIPT=!0,"object"==typeof CE2&&(CE2.uid\|\|CE2.data))throw Error("CE: multiple userscripts installed");if((CE2="undefined"==typeof CE2?{}:CE2).userDataToJs=function(t){for(var e=[["uid","uid"],["snapshots","snapshots"],["status","status"],["flows","flows"],["sites","sites"],["USER_SCRIPT_VERSION","updated_at"],["__CE_HOST__","ce_app_url"],["COMMON_SCRIPT","common_script_url"],["COMMON_SCRIPT_SECURE","common_script_url"],["TRACKING_SCRIPT","tracking_script_url"],["TRACKING_SCRIPT_SECURE","tracking_script_url"],["AUTH_KEY","hud_auth_key"],["HUD","hud"],["GLOBAL_IP_BLOCK_LIST","global_ip_block_list"],["IS_USING_IP_BLOCKING","is_using_ip_blocking"],["TRACKING_DEST_NEW","v6_tracking_dest"],["TRACKING_DEST_NEW_SECURE","v6_secure_tracking_dest"],["DEST_V11","v11_tracking_dest"],["FT_DEST","flow_tracking_dest"],["PAGE_VIEWS_LIMIT_REACHED","page_views_limit_reached"],["NUMBER_OF_RECORDINGS","recordings_number"],["RECORDINGS_ACTIVATION","recordings_activation"],["ERROR_TRACKING","error

Chrome Cache Entry: 341

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	101932
Entropy (8bit):	5.377676026270363
Encrypted:	false
SSDEEP:	1536:AbB8CVPp3Vi8bgLTknkqJM3vRuSSlYRqp027B:IB8CJiknkLOlYQ77B
MD5:	19AD77CAB71BAC40FB159D247A30FE86
SHA1:	FC2692670EF9316166EEA517F8F090D3D2BBE52F
SHA-256:	253DF3AABDF0F3571800385A5A8C03EBE2547AF91EAC033078A6599B3726EC33
SHA-512:	D9CB9667213C2949E9EA02118E87F01FA34C5417D93059273763AF6B57AB9EEB07A7BC35D6BB331A0741546B5C18E952252D2D85F31D2B388DB4051B6FB2D711
Malicious:	false
URL:	https://cdn.cookielaw.org/consent/3dfce4f2-dab6-4128-9f33-df7e0597da82/018f398d-e7fe-774d-a988-aae80a524894/en.json
Preview:	{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","pccloseButtonType":"Icon","MainText":"Privacy Preference Center","MainInfoText":"When you visit any web site, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalised web experience.\n\nBecause we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.","AboutText":"More information","AboutCookiesText":"Your

Chrome Cache Entry: 342

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6216)
Category:	downloaded
Size (bytes):	6217
Entropy (8bit):	5.146261761606895
Encrypted:	false
SSDEEP:	192:xELuE2KC/lIfYj0wMKOHOMAGIvjG5BoAKK5rHjnuodO9k:x+xe0hKOuMA57Gjoo5rD3dO9k
MD5:	1D75EFAB0FFDF8A025BD7C15E886C753
SHA1:	B89CE8787FD8B4C4F87F97901B28D42F696FC605
SHA-256:	1D5CFE14D65ACCC4BD1DF0D7C3BB65BE70D0F4E94A5F9D40465343A2807548AE
SHA-512:	BE556C42FD60C566D8364F8922C9545E49BB48B8AB2B39ADD30D67F6831FC03C135EF0603B488FCE486D54161063F59150327FAF09E72A64B920D40A3F039624
Malicious:	false
URL:	https://rum-static.pingdom.net/prum.min.js
Preview:	!function(){"use strict";function t(t,e){return Object.keys(t).map((function(n){return n+"="+(e?t[n]:encodeURIComponent(t[n]))})).join("&")}function e(t,e){var n,o,r={};return t&&"string"==typeof t?(t.trim().split("&").forEach((function(t){n=t.indexOf("="),o=t.substring(n+1),r[t.substr(0,n)]=e?o:decodeURIComponent(o)})),r):r}function n(t){return t instanceof Date&&(t=t.valueOf()),"number"==typeof t&&parseInt(t.toString().substring(0,10),10)}function o(){var t={},e=arguments;e[0]instanceof Array&&(e=e[0]);for(var n=0,a=e.length;n<a;n++){var s=e[n];if(r(s))s=o(s);else if(!i(s))continue;Object.keys(s).forEach((function(e){s.hasOwnProperty(e)&&(t[e]=s[e])}))}return t}function r(t){return"[object Array]"===Object.prototype.toString.call(t)}function i(t){return"[object Object]"===Object.prototype.toString.call(t)}function a(e,n,r,a){function s(s,c){var u=a\|\|!1;if(i(c)&&(c=o({id:n.getSiteID()},c)),"GET"===s&&(r=function(e){return r+"?"+t(e)}(c)),-1!==e.navigator.appName.indexOf("Internet Expl

Chrome Cache Entry: 343

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64030)
Category:	downloaded
Size (bytes):	152698
Entropy (8bit):	5.474458044579754
Encrypted:	false
SSDEEP:	3072:za6Iq5E6wGi3wqdX1jFE5Pr6iUnqMg2Qncx7xT69BAtc7anA9pu+b7hdmDYCb+hW:JA1jmRr6iUnvg2Qncx7yBAa79+2Azx
MD5:	494B30D61A1D9180BA79AFE62744588D
SHA1:	2B51D06D2C65083FD73FB3A8A901B7CFB2F28C15
SHA-256:	EB5779B31CA9EE68014DF1A8B4082E0B253494AD3616073F2FA272997F0C90E3
SHA-512:	1DD18727E12076CDFF3CD036618846785A997D11A23784D1835320CA92002967A08ADCD7C7B915681FB6C577240DE7E5C4DC586369061D4050BE99A0E9B3B797
Malicious:	false
URL:	https://script.crazyegg.com/pages/versioned/commontransformations-scripts/5989f4f38b109f72f83c8abf4a188e65.js
Preview:	(()=>{"use strict";var e,r={},t={};function o(e){var n=t[e];if(void 0!==n)return n.exports;var i=t[e]={exports:{}};return r[e].call(i.exports,i,i.exports,o),i.exports}o.m=r,e=[],o.O=(r,t,n,i)=>{if(!t){var l=1/0;for(s=0;s<e.length;s++){for(var[t,n,i]=e[s],a=!0,u=0;u<t.length;u++)(!1&i\|\|l>=i)&&Object.keys(o.O).every((e=>o.O[e](t[u])))?t.splice(u--,1):(a=!1,i<l&&(l=i));if(a){e.splice(s--,1);var f=n();void 0!==f&&(r=f)}}return r}i=i\|\|0;for(var s=e.length;s>0&&e[s-1][2]>i;s--)e[s]=e[s-1];e[s]=[t,n,i]},o.n=e=>{var r=e&&e.__esModule?()=>e.default:()=>e;return o.d(r,{a:r}),r},o.d=(e,r)=>{for(var t in r)o.o(r,t)&&!o.o(e,t)&&Object.defineProperty(e,t,{enumerable:!0,get:r[t]})},o.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window)return window}}(),o.o=(e,r)=>Object.prototype.hasOwnProperty.call(e,r),o.r=e=>{"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:

Chrome Cache Entry: 344

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3835)
Category:	downloaded
Size (bytes):	257552
Entropy (8bit):	5.558419452212178
Encrypted:	false
SSDEEP:	3072:AHII4PXhz039EO/oHq0oLSNEidT6BIClJUHZ1abRn0KY/knHH8Eq3R:iYhz0tEO/ysB4+0KY/knHHGR
MD5:	EFFE58ECE6D71E2EC4746E04AF2664DA
SHA1:	3B5CEC82EDF2CCE762F9127CE474C870AE327E50
SHA-256:	0DBDBF4B26E19F44D30995757239D866AA5DFE5185332554E236FDBF49BB034A
SHA-512:	384AD7BB1F61AC95CDF6B7A2E7CF26397A448173C9C5115B1E041DD1CCD3BF9681D144C49C5D1B12CC61D5A6BC878A40A0449FE17678438A55DFCDF95A99BFB2
Malicious:	false
URL:	https://www.googletagmanager.com/gtag/js?id=AW-975652292&l=dataLayer&cx=c&gtm=45He4bc0h1v536291za200
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_1p_data_v2","priority":0,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_lastNameType":"CSS_SELECTOR","vtp_autoAddressEnabled":false,"vtp_regionValue":"","vtp_countryValue":"","vtp_isAutoCollectPiiEnabledFlag":false,"tag_id":2}],. "predicates"

Chrome Cache Entry: 345

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6995)
Category:	dropped
Size (bytes):	6996
Entropy (8bit):	5.561565592655271
Encrypted:	false
SSDEEP:	192:K/l9vCl2YqXoBRpJry6ov0r6PeHYKCUAQBTyJs4oKvu7S/tT:2v1Y/H0esgTyJsYbT
MD5:	74B63954B07AC783C3819EB01384E75E
SHA1:	9922C98EECE047007F999290827ABF42F2C903F9
SHA-256:	4DBFE5095AC48222345BE81F07FA808C5F0B9CA4EC020B288EA2C18725AA3643
SHA-512:	F31513DB78DAC9734C496DC2A0434DA9B5E557D5987FBB068D14ADA4600708220D34ECD82791D969A824A6771B64BFDE3BDF2E43D9694039DD5C227595E0885D
Malicious:	false
Preview:	if(CE_USER_SCRIPT=!0,"object"==typeof CE2&&(CE2.uid\|\|CE2.data))throw Error("CE: multiple userscripts installed");if((CE2="undefined"==typeof CE2?{}:CE2).userDataToJs=function(t){for(var e=[["uid","uid"],["snapshots","snapshots"],["status","status"],["flows","flows"],["sites","sites"],["USER_SCRIPT_VERSION","updated_at"],["__CE_HOST__","ce_app_url"],["COMMON_SCRIPT","common_script_url"],["COMMON_SCRIPT_SECURE","common_script_url"],["TRACKING_SCRIPT","tracking_script_url"],["TRACKING_SCRIPT_SECURE","tracking_script_url"],["AUTH_KEY","hud_auth_key"],["HUD","hud"],["GLOBAL_IP_BLOCK_LIST","global_ip_block_list"],["IS_USING_IP_BLOCKING","is_using_ip_blocking"],["TRACKING_DEST_NEW","v6_tracking_dest"],["TRACKING_DEST_NEW_SECURE","v6_secure_tracking_dest"],["DEST_V11","v11_tracking_dest"],["FT_DEST","flow_tracking_dest"],["PAGE_VIEWS_LIMIT_REACHED","page_views_limit_reached"],["NUMBER_OF_RECORDINGS","recordings_number"],["RECORDINGS_ACTIVATION","recordings_activation"],["ERROR_TRACKING","error

Chrome Cache Entry: 346

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13479)
Category:	dropped
Size (bytes):	13620
Entropy (8bit):	5.274037253238212
Encrypted:	false
SSDEEP:	192:5rprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORw:5rprxaefKI0LP19m4q1WW+h4Mjx
MD5:	111591E189E063B051299EEF353DB9BA
SHA1:	3459F31CACF4CEDF6818B52AF372155DD7BB9C44
SHA-256:	148A74B0921AD78021D716E8032EDE1CDAF7ED7279CEFD7D2ACBE906ADD12A68
SHA-512:	2A07DFBA52F79B1ACEB0389C810580D753BAABAA0A796715D3457181F270E1370CF174504FC0DFF44B2B6310DFEEDA55A5F977A9C603F7A069C8FBC0E1DD450D
Malicious:	false
Preview:	/! jQuery Migrate v3.4.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /."undefined"==typeof jQuery.migrateMute&&(jQuery.migrateMute=!0),function(t){"use strict";"function"==typeof define&&define.amd?define(["jquery"],function(e){return t(e,window)}):"object"==typeof module&&module.exports?module.exports=t(require("jquery"),window):t(jQuery,window)}(function(s,n){"use strict";function e(e){return 0<=function(e,t){for(var r=/^(\d+)\.(\d+)\.(\d+)/,n=r.exec(e)\|\|[],o=r.exec(t)\|\|[],a=1;a<=3;a++){if(+o[a]<+n[a])return 1;if(+n[a]<+o[a])return-1}return 0}(s.fn.jquery,e)}s.migrateVersion="3.4.1";var t=Object.create(null);s.migrateDisablePatches=function(){for(var e=0;e<arguments.length;e++)t[arguments[e]]=!0},s.migrateEnablePatches=function(){for(var e=0;e<arguments.length;e++)delete t[arguments[e]]},s.migrateIsPatchEnabled=function(e){return!t[e]},n.console&&n.console.log&&(s&&e("3.0.0")&&!e("5.0.0")\|\|n.console.log("JQMIGRATE: jQuery 3.x-4.x REQUIRED"),s.migrateWarnings

Chrome Cache Entry: 347

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 32412, version 1.131
Category:	downloaded
Size (bytes):	32412
Entropy (8bit):	7.993015655514893
Encrypted:	true
SSDEEP:	768:CTRE0P8rgUJNQIdN8Z5W/A1aRndBnwESJjs2gnXs2XZTpzQ:CTZP9UjTPIW/A0RndBwBjsxXfl8
MD5:	C8B62860D3E187860F9EB25AE4B5EA0E
SHA1:	426F75FE868E4ED43556000FD2ADB28C112114FE
SHA-256:	E8DFD28C31CD9887ABF07A330C4066D42653792733222E1D7508B4F6AC25B446
SHA-512:	E97A9152952C4812C8C7E6C0D00FBE11B62FE849C565493C7353B9EA0861729E6290AE7CE4625800AB9A5DB215405DC7019A8056F65D078A81CC9C04DD94A422
Malicious:	false
URL:	https://d6vtbcy3ong79.cloudfront.net/fonts/2.2.7/metric/Metric-Medium.woff2
Preview:	wOF2......~.......jX..\|.......}d...8...8...........$.....[.`..`..6.4..s.....d.....$.6.$..>..0.. ..?..X..O[.O...n..7H....f...%x...z....A...Aw.{J.{........Td.&..............p...6...Q..@.1n.....+.F....mT.-..r.G.9.l5.....q..E1....z..Z...Qb..M-.b0..f>=..p.[......O..d...L....".P.3D....$=<.rd.'...p..8.9.jX....2Qu........N2.E/....../t....}M{Q.srOE....Y...s.0k.V.^..Nx.t...b.....j4b.o.m...<FD.^U.?}g..k.......#M&.d......a.}...?._..a..d..v..`....W.......U.l\.FKF.2Sc........f..@..#k...c.....#.E..D...H\.>6Faa``..=...........Q3.?M.>.....~.@.Q........''S.!o..t:.,/.<J..;........3&.-.L....=(.`l...B.\B.>.2.hF.....V..,C..M.s}....\G...R..........j..nPh...[...f..5C.(....i.X4.h......<.e)...K..q.J.1.8..s,..P.^y.(...:...o..:.....r9@....?@{`k.5.+W.$I.$I.$......dV...<...T>...J...p.e...K..p.n....,.E...K........@.H.\].........O{.x..V}1"1;........._...U. t.}.v18..!...V!.sdJ.0r..u..@.nU.-r.....pbZ....&.\|.s).....BE....[....itW..k......._.N[.8...N2.m......MlQ..

Chrome Cache Entry: 348

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 35758, version 1.131
Category:	downloaded
Size (bytes):	35758
Entropy (8bit):	7.99380899225104
Encrypted:	true
SSDEEP:	768:WSQZ2UeSOE1Qp25f31PGFL/NXUrwRzkgy3JHzgM3sAHXSS:bQZReSn1VtPclXUrS+JHzgMcAHp
MD5:	EDBB294CE5BB567F873A96D00F1F8813
SHA1:	3ADD27C280D1C5E3804D453ACC1A5FD86D805094
SHA-256:	30C970EED7BC24DBD036EBF22B16FECF9E5DFFFC1442C3379236C43D3797A596
SHA-512:	2B701736491E4FDB9308E5285C2FE279729579FA8EBACE7BAED3504A7023EF8AAFA27CABA5F89C14EF7380CDA74973AA9A67F1512C5621EDE9333A09ED695BD2
Malicious:	false
URL:	https://d6vtbcy3ong79.cloudfront.net/fonts/2.2.7/metric/Metric-Semibold.woff2
Preview:	wOF2...............`...........p...>...<...........^..<..Y.`..`..,.F..s.....h..Y..`.6.$..6..,.. ..S..m...[.....=-..6..U=......... .fI.\7..[.Yx.v..-......._.Td..i...!......yH..D.. b.N.LA9T.....(].k.j.5 x......R..}..\..r.F....M._.3.>q.]6..k.j.O..;..4....J.Ap..U.v.p....k...!...0..7.8.J.M.U..A..]...0\q:.:S.B 7..!9C/E...7N.9.o....{.j.....d..+..9......+.x..kqX..]`....#....Fk...')..r..$T]u..RT..C....V.G.{.W..,....T.:.&...U7....2...#.b.U.W...?...JP#..v{9..A.../.......M.#/.D..A..fH-.H..f....fi^.j..3bg.j..T&..)...P-......].9.....#...d.B.$.Q-...v.......{..... ..6b.....x.8+...........02..b&_....z...E....!....)`.....SHB.:E...~.....R$.o..J\.M......sO...YU.._......!n<.t..{.F.^..c........)<.V........t/.9...k.B.%....&..JS...m.6.q............jtJd....@2..I...m.[.SI.).n._.....W....Q.1L....d...r...\|p..C..K.L...%<...kh.<.$..8U6.U...... .J...!4R,..f.&{Y(.b#e..0..(....n;?.P..x......Ls...... Kt.e,'..q....g.U..3.WZ..l[...gu.u.._u..}...O..Fm.L......2B.Q...c...j.

Chrome Cache Entry: 349

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1504), with no line terminators
Category:	downloaded
Size (bytes):	1504
Entropy (8bit):	5.220464607812732
Encrypted:	false
SSDEEP:	24:cjXz2YRhXVdpJnNjxdTPVyp0QRXKvbtJlNnTiBiDQfHEhOlrI3oG5t:YaShldJxdTPVyi1vHvsfHEQVI31t
MD5:	40722D9E1D8FAEF94FF280942C4195EF
SHA1:	022EAFFDD04D6434AE9D98E787BB8B3E7B9BDEE1
SHA-256:	99351CD9107CB14F24DB794523F2F01ADA5D93853BFA5717121AE353336FE49E
SHA-512:	F940281F35000E0144DF891354A4BCF69F1A131BC4C8AD766E149107DF53531C5B4573FE1FDAB57EFC2D8C743068A44B32FB27F7085926240954F9DBBA6ECC42
Malicious:	false
URL:	https://d6vtbcy3ong79.cloudfront.net/external-assets/1.0.22/utils/store-lead-data.min.js
Preview:	!function(){"use strict";function a(e,h){for(var c=null,f=h.split("&"),d=0;d<f.length;d++){var b=f[d].split("=");if(b[0]===e)return b[1];"ReturnUrl"===b[0]&&(c=b[1])}if(c){var g=unescape(c).split("?");if(g.length>1)return a(e,g[1])}}var j=function(){for(var b=[".telerik.com",".ipswitch.com",".whatsupgold.com",".progress.com",".chef.io",".kemptechnologies.com","kemptechnologies.com",".flowmon.com", "freeloadbalancer.com"],c=window.location.hostname,a=0;a<b.length;a++)if(-1!=c.indexOf(b[a]))return b[a];return null}();if(!function(e){for(var c=e+"=",d=decodeURIComponent(document.cookie).split(";"),b=0;b<d.length;b++){for(var a=d[b];" "===a.charAt(0);)a=a.substring(1);if(0===a.indexOf(c))return a.substring(c.length,a.length)}return null}("prgs_utm")&&j){var b=window.location.search.substring(1),d=a("utm_source",b),e=a("utm_medium",b),f=a("utm_campaign",b),g=a("utm_content",b),h=a("utm_term",b),i=document.referrer?document.referrer:void 0;if(d\|\|e\|\|f\|\|g\|\|h\|\|i){if(!d&&!e&&!f&&!g&&!h){var c=ne

Chrome Cache Entry: 350

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (35526), with NEL line terminators
Category:	downloaded
Size (bytes):	94660
Entropy (8bit):	5.326943116342795
Encrypted:	false
SSDEEP:	768:qx2LXx38FgcQ/CscrsyhvB2zR3mix2fBG2Yxsj6p4egnlGJEE3ViqnsHe33OCHZs:qx2VjiXrL2T+V0QGeMnmY3vVaq6SQtk4
MD5:	06FF9A1F9EC9B3530181DEB602734487
SHA1:	B3485D7DDE1EC57A3915D1079237C8C34A5198C1
SHA-256:	3A6010648EF6C726A291C5471AA8BDB555904B0639BE98A7F159F8752F1A2F5D
SHA-512:	15681CF8EE2D7A67312F46C137C2CA3B98ADA59BEA3FA623248453634FC3DF851888134E86E73C7E6DF339E5163F930B8ECC4ADAD5C3D51F0A0EBFA0A750BF32
Malicious:	false
URL:	https://dtzbdy9anri2p.cloudfront.net/cache/b3485d7dde1ec57a3915d1079237c8c34a5198c1/telerik/js/dist/polyfills.min.js
Preview:	!function(){"use strict";var L="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function t(t,e){return t(e={exports:{}},e.exports),e.exports}function e(t){return t&&t.Math==Math&&t}function y(t){try{return!!t()}catch(t){return!0}}function o(t,e){return{enumerable:!(1&t),configurable:!(2&t),writable:!(4&t),value:e}}function i(t){return j(x(t),8,-1)}function d(t){if(null==t)throw R("Can't call method on "+t);return t}function s(t){return P(d(t))}function O(t){return"function"==typeof t}function g(t){return"object"==typeof t?null!==t:O(t)}function n(t,e){return arguments.length<2?function(t){return O(t)?t:void 0}(b[t]):b[t]&&b[t][e]}var r,a,b=e("object"==typeof globalThis&&globalThis)\|\|e("object"==typeof window&&window)\|\|e("object"==typeof self&&self)\|\|e("object"==typeof L&&L)\|\|function(){return this}()\|\|Function("return this")(),h=!y(function(){return 7!=Object.defineProperty({},1,{get:function(

Chrome Cache Entry: 351

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (31968)
Category:	downloaded
Size (bytes):	53449
Entropy (8bit):	5.207291309972639
Encrypted:	false
SSDEEP:	1536:JWoeU8Edp6kJnaR49DefwM4eA7Erwf3zapyTwhOB:coeU8Yp6kJnaR49DefwM4/7Ers9B
MD5:	F59081902C40DD03031B8C9641DAF5AF
SHA1:	DEE6F40237E10E8FDF3BCBE85F46AB53132D8744
SHA-256:	6ED4B8C931A6E99222E5BAC9A4C3F03A411BC58BECBB981F27711A058684781C
SHA-512:	19F47D1C6566F6B97F8CB185B562F962431FD32858E4823F940808CD854E4CC6EC6360D904491E6CD0A446B113CE840F8763A47C75E58B4DCCEAFDB5022F26C7
Malicious:	false
URL:	https://cdn.insight.sitefinity.com/sdk/sitefinity-insight-client.min.3.1.13.js
Preview:	var sfDataIntell=sfDataIntell\|\|{};sfDataIntell.constants={sdkVersion:"js-3.1.41",cookieName:"sf-data-intell-subject",docsCookieName:"sf-ins-lst-doc-trckd",sessionCookieName:"sf-ins-ssid",pageVisitIdCookieName:"sf-ins-pv-id",sfTrackingIdsStorageKey:"sf-tr-ids-storage",sfSessionIdsStorageKey:"sf-ss-ids-storage",endpoints:{apiServer:"https://api.insight.sitefinity.com"},headers:{authorization:"Authorization",datacenterkey:"x-dataintelligence-datacenterkey",subject:"x-dataintelligence-subject",ids:"x-dataintelligence-ids",datasource:"x-dataintelligence-datasource",contacts:"x-dataintelligence-contacts",sdkVersion:"x-dataintelligence-sdk-version"},crossDomainTrackingMessages:{getClientGroup:"getClientGroup",setClientTestGroup:"setClientTestGroup",getClientJourney:"getClientJourney",setClientJourney:"setClientJourney",hubReady:"hubReady"},crossDomainTrackingQueryParamKey:"instrck",crossDomainTrackingParams:{apiKeyParam:"a",subjectIdParam:"s",dataSourceParam:"d",timeCreatedParam:"t",sessionId

Chrome Cache Entry: 352

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7225)
Category:	dropped
Size (bytes):	7226
Entropy (8bit):	5.164466139256297
Encrypted:	false
SSDEEP:	192:HA1SI+LtL9xW+XUB1SAfQu+BzaNPQznTjdNs8L:g1SIaxWLym+TDJ
MD5:	54271D5DAAE8F6236DE59D2C16896D14
SHA1:	2DE502EACFC6724A34C2C72AE4D14919F3B2F588
SHA-256:	F759996A85B1DDF539EF3F16FDCA3D39E48F670AEF69E82C6200CC2B5F9F47BD
SHA-512:	3A5973551FD25752C6E3F8EDC16F82BC508AA93A067C17316B773609AB7C43E1E0320EBBA2FBBF53181B7DC1E8322C3FFB49C9C571CB86B5A6CE316C58F12241
Malicious:	false
Preview:	var webVitals=function(e){"use strict";var n,t,r,i,o,a=-1,c=function(e){addEventListener("pageshow",(function(n){n.persisted&&(a=n.timeStamp,e(n))}),!0)},u=function(){var e=self.performance&&performance.getEntriesByType&&performance.getEntriesByType("navigation")[0];if(e&&e.responseStart>0&&e.responseStart<performance.now())return e},s=function(){var e=u();return e&&e.activationStart\|\|0},f=function(e,n){var t=u(),r="navigate";a>=0?r="back-forward-cache":t&&(document.prerendering\|\|s()>0?r="prerender":document.wasDiscarded?r="restore":t.type&&(r=t.type.replace(/_/g,"-")));return{name:e,value:void 0===n?-1:n,rating:"good",delta:0,entries:[],id:"v4-".concat(Date.now(),"-").concat(Math.floor(8999999999999*Math.random())+1e12),navigationType:r}},d=function(e,n,t){try{if(PerformanceObserver.supportedEntryTypes.includes(e)){var r=new PerformanceObserver((function(e){Promise.resolve().then((function(){n(e.getEntries())}))}));return r.observe(Object.assign({type:e,buffered:!0},t\|\|{})),r}}catch(e

Chrome Cache Entry: 353

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5181), with no line terminators
Category:	downloaded
Size (bytes):	5181
Entropy (8bit):	5.920246638997596
Encrypted:	false
SSDEEP:	96:1gWUfvlcY021mvXElnxad7OIJoodnbUCJdEjkRU/EeX6JPgmf:1DY0h8Rx47OIqWbZdeUlf
MD5:	EE975F1EE5D7E435DB08F397B88950C3
SHA1:	55DCC90824AD123EED14D9C12A854A666BAD32FB
SHA-256:	A45A07142D29C2C583FD012EF5A5648741F44E0CFEB1F259185B9952A03BB93A
SHA-512:	3F0F9EBFB7BA3619B250C08E909889076DDE0D0862424F8688017ACFFCCC2015313871B9202B6B1EF1E9C51861163E69AC43FB0728F5FAFFC1A95D2DDA84283F
Malicious:	false
URL:	https://www.googleadservices.com/pagead/conversion/975652292/?random=1731682780912&cv=11&fst=1731682780912&bg=ffffff&guid=ON&async=1&gtm=45je4bc0h1v9167661709za200zb536291&gcs=G111&gcd=13v3v3v3v5l1&dma=0&tag_exp=101925629~102067554~102067808~102077855&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&label=p4zxCNq_8IkYEMSLndED&hn=www.googleadservices.com&frm=0&tiba=First%20run&gtm_ee=1&npa=0&pscdl=noapi&auid=816168706.1731682775&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&data=event%3Dconversion&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d\|\|a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

Chrome Cache Entry: 354

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (51384), with no line terminators
Category:	dropped
Size (bytes):	51385
Entropy (8bit):	5.293328685395304
Encrypted:	false
SSDEEP:	768:IaOFhhRC5JFhLjfRysgLzQynDw5YyDMFW8KQ:IaOFnR2DRszQKaoWtQ
MD5:	6626C1362840EBFC8F48294E8F023E18
SHA1:	4EC0DFB37C3E536C1B5EC04B68C9846FDBAF9EEF
SHA-256:	AABC88A6DB8B22022F96CA88E4F0A7BE426ABEF2B35169A71515A2D55246402A
SHA-512:	B037A19B52C1047198EC7F19E99066054E454964380E2354239834260D11248E617D6759B944DDF39A25B883C8F430603D8E13097396E2DEDA9BB6905C1CD42A
Malicious:	false
Preview:	function UET(o){this.stringExists=function(n){return n&&n.length>0};this.domain="bat.bing.com";this.domainCl="bat.bing.net";this.URLLENGTHLIMIT=4096;this.pageLoadEvt="pageLoad";this.customEvt="custom";this.pageViewEvt="page_view";o.Ver=o.Ver!==undefined&&(o.Ver==="1"\|\|o.Ver===1)?1:2;this.uetConfig={};this.uetConfig.consent={enabled:!1,adStorageAllowed:!0,adStorageUpdated:!1,hasWaited:!1,waitForUpdate:0,enforced:!1};this.uetConfig.tcf={enabled:!1,vendorId:1126,hasLoaded:!1,timeoutId:null,gdprApplies:undefined,adStorageAllowed:undefined,measurementAllowed:undefined,personalizationAllowed:undefined};this.uetConfig.cusig={hasLoaded:!1,timeoutId:null,blob:{}};this.beaconParams={};this.supportsCORS=this.supportsXDR=!1;this.paramValidations={string_currency:{type:"regex",regex:/^[a-zA-Z]{3}$/,error:"{p} value must be ISO standard currency code"},number:{type:"num",digits:3,max:999999999999},integer:{type:"num",digits:0,max:999999999999},hct_los:{type:"num",digits:0,max:30},date:{type:"regex",

Chrome Cache Entry: 355

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (31968)
Category:	dropped
Size (bytes):	53449
Entropy (8bit):	5.207291309972639
Encrypted:	false
SSDEEP:	1536:JWoeU8Edp6kJnaR49DefwM4eA7Erwf3zapyTwhOB:coeU8Yp6kJnaR49DefwM4/7Ers9B
MD5:	F59081902C40DD03031B8C9641DAF5AF
SHA1:	DEE6F40237E10E8FDF3BCBE85F46AB53132D8744
SHA-256:	6ED4B8C931A6E99222E5BAC9A4C3F03A411BC58BECBB981F27711A058684781C
SHA-512:	19F47D1C6566F6B97F8CB185B562F962431FD32858E4823F940808CD854E4CC6EC6360D904491E6CD0A446B113CE840F8763A47C75E58B4DCCEAFDB5022F26C7
Malicious:	false
Preview:	var sfDataIntell=sfDataIntell\|\|{};sfDataIntell.constants={sdkVersion:"js-3.1.41",cookieName:"sf-data-intell-subject",docsCookieName:"sf-ins-lst-doc-trckd",sessionCookieName:"sf-ins-ssid",pageVisitIdCookieName:"sf-ins-pv-id",sfTrackingIdsStorageKey:"sf-tr-ids-storage",sfSessionIdsStorageKey:"sf-ss-ids-storage",endpoints:{apiServer:"https://api.insight.sitefinity.com"},headers:{authorization:"Authorization",datacenterkey:"x-dataintelligence-datacenterkey",subject:"x-dataintelligence-subject",ids:"x-dataintelligence-ids",datasource:"x-dataintelligence-datasource",contacts:"x-dataintelligence-contacts",sdkVersion:"x-dataintelligence-sdk-version"},crossDomainTrackingMessages:{getClientGroup:"getClientGroup",setClientTestGroup:"setClientTestGroup",getClientJourney:"getClientJourney",setClientJourney:"setClientJourney",hubReady:"hubReady"},crossDomainTrackingQueryParamKey:"instrck",crossDomainTrackingParams:{apiKeyParam:"a",subjectIdParam:"s",dataSourceParam:"d",timeCreatedParam:"t",sessionId

Chrome Cache Entry: 356

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23541
Entropy (8bit):	5.079372254244878
Encrypted:	false
SSDEEP:	384:ygvobYmNMh3J3iCj2ApMNZNQlNyNeYxQkNbdNSNYNCN4NINNjxNMNvNHON5NWNqA:rvDjfLAPD6dF6kK84
MD5:	28029455EDEE3DB0DC70E3B937B6BBB0
SHA1:	90318C65855872EBC829EC4A4F7F79C4E9C7E6A2
SHA-256:	8B1795F89F8A37F25BCBC79BF3223A6CB87D9288A497EABA3FCFC6FAC3726D55
SHA-512:	C9A30D409E404F6280EEE82F5A0DB22BAA0948FD64EA2072E851C3405F593E4029B60EC686F6EB7E3B7DEA02FB4FE9D195EF5495498357EF7611D038FA83ED14
Malicious:	false
Preview:	{"uid":874351,"dkey":"c49bcc456f5a54681f71a652c6c489bc","updated_at":1731681923,"version":"11.5.319","site_data_url_template":"https://script.crazyegg.com/pages/data-scripts/0087/4351/site/SITENAME.json","site_sampling_url_template":"https://script.crazyegg.com/pages/data-scripts/0087/4351/sampling/SITENAME.json","status_data_url":"https://script.crazyegg.com/pages/data-scripts/0087/4351/status.json","hud":{"host":"https://hud.crazyegg.com","script_url":"https://script.crazyegg.com/scripts/hud","core_api_auth_key":"adb693747633c0e711b3972bb1348c001dc3462d5a33a863d1eb288f26ee4421","launch_origins":["https://core.crazyegg.com"]},"survey_preview_dest":"https://api.crazyegg.com/surveys/preview","survey_launch_origins":["https://app.crazyegg.com","https://core.crazyegg.com"],"addon_preview_dest":"https://api.crazyegg.com/surveys/preview","addon_launch_origins":["https://app.crazyegg.com","https://core.crazyegg.com"],"ce_app_url":"https://app.crazyegg.com","flow_preview_url":"https://api.cra

Chrome Cache Entry: 357

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65450)
Category:	dropped
Size (bytes):	226966
Entropy (8bit):	5.37858105337111
Encrypted:	false
SSDEEP:	1536:EwmvhwvwV1UMwl+0G+ZBTr9ix6HeTX0XLDDDbGw5wyPybFkK8yDaIG+UNM3VBYG3:MhwvwVGMwHZXixont8Fk9KRUytxYScY7
MD5:	4EEC238587F7F82D91A29F25D83A5FB6
SHA1:	8F443236A805D1A5F7DE04D07F1BF0331B63C70D
SHA-256:	F0A9B19D1615E0E2AFDCA507D4C7CBE384B0BDFAD5CBAF63C14A386DF33A62D7
SHA-512:	35E407C0B077E2B066F53E5B0A83194F28B29F249E7A0440B89A475EE654E7E004F3F1FF759F0444F1E4931B06237BC440062C9496B52A4E3C4F5C6CF4EDEE85
Malicious:	false
Preview:	/! For license information please see modules.6f60e575cf8ad7cb10f7.js.LICENSE.txt /.!function(){var e={4788:function(e,t,n){"use strict";n.d(t,{s:function(){return r}});const r=Object.freeze({IDENTIFY_USER:"identify_user",AUTOTAG_RECORDING:"autotag_recording",TAG_RECORDING:"tag_recording",HEATMAP_HELO:"heatmap_helo",RECORDING_HELO:"recording_helo",REPORT_USER_ID:"report_user_id",MUTATION:"mutation",MOUSE_CLICK:"mouse_click",INPUT_CHOICE_CHANGE:"input_choice_change",KEY_PRESS:"key_press",MOUSE_MOVE:"mouse_move",RELATIVE_MOUSE_MOVE:"relative_mouse_move",CLIPBOARD:"clipboard",PAGE_VISIBILITY:"page_visibility",SCROLL_REACH:"scroll_reach",SCROLL:"scroll",SELECT_CHANGE:"select_change",VIEWPORT_RESIZE:"viewport_resize",SCRIPT_PERFORMANCE:"script_performance",REPORT_CONTENT:"report_content",INSERTED_RULE:"inserted_rule",DELETED_RULE:"deleted_rule"})},6939:function(e,t,n){"use strict";n.d(t,{f:function(){return f},W:function(){return g}});const r=Object.freeze({LIVE:"LIVE",REVIEW_WEBAPP:"REVI

Chrome Cache Entry: 358

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65376)
Category:	dropped
Size (bytes):	169122
Entropy (8bit):	5.743020256980256
Encrypted:	false
SSDEEP:	1536:FnlD7l1Evkge6STiydO90X6AfKcPbJWYiGE5nkbDd2bsvpsebA3G3DHnx/w/Sf3A:Flffd79fvLq5isFWLxOSf3efei
MD5:	AA0A02BA268AC6B889AD8993EAE85014
SHA1:	BB312560F6AE025DAF1140B2EF1AE2839FA9C399
SHA-256:	B212B0CF050110B2A4CE71B0D26CD5A17A300CD4E6593A10CEEB7C16153E65CB
SHA-512:	2678049828B7E1858DAD5EF901C693F5C1039A2FCAF878F74E75FD24A546E4B8DE2C5A66BA196086BD368271CFC2BAC1CDFF6A430E9BA986E738A6B4BB830C2B
Malicious:	false
Preview:	// Qualaroo for telerik.com.// (C) 2024 Qualaroo. All rights reserved..// qualaroo.com..//$ site: 19547, generated: 2024-11-08 08:00:01 UTC.//$ client: 2.0.70..if(typeof KI == 'undefined'){KI=function(){"use strict";function C(_){return typeof _}var u,d_,c_,n,p_,h,r,b,a,l,m,H,u_,k,m_,d,E,k_,X,V,g,c,p,W,N,F,Z,e,i,t,f,v,h_,g_,f_,b_,x,v_,_,w,y,q,s,o,$,z,S,j,__,I,A,T,O,L,P,G,Y,R,M,K,D,B,U,Q,J,e_,i_,t_,s_,o_,n_,r_,a_,l_,x_,w_,y_,q_,z_,S_,C_,j_,I_,A_,T_,O_,L_,E_,V_,N_,F_,P_,R_,M_,D_,B_,U_,H_,X_,W_,G_,Y_,K_,Q_,J_,Z_,$_,_e,ee,ie,te,se,oe,ne,re,ae,le,de,ce,pe,ue,me,ke,he,ge,fe,be,ve,xe,we,ye,qe,ze,Se,Ce,je,Ie,Ae,Te,Oe,Le,Ee,Ve,Ne,Fe,Pe,Re,Me,De,Be,Ue,He,Xe,We=window,Ge=We.document,Ye=Ge.documentElement,Ke=Ge.location,Qe=We.navigator,Je=We.screen,Ze=We.getComputedStyle,$e=void 0,_i=Array,ei=Date,ii=Number,ti=Object,si=String,oi=We.JSON,ni=clearTimeout,ri=setTimeout,ai="",li=" ",di="  ",ci=null,pi=4294967295,ui=1,mi=1.091,ki=2,hi=3,gi=4,fi=5,bi=6,vi=10,xi=12,wi=15,yi=16,qi=20,zi=30,Si=60,Ci=

Chrome Cache Entry: 359

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	97929
Entropy (8bit):	5.415004441761732
Encrypted:	false
SSDEEP:	1536:lSRktpnYKatB8ZDTobZEyMZs5A+TAUXxcOwL0/EFzH1Kdn9vYXfAauLDm:lykCsZ4baytBXxcZAQcSILDm
MD5:	E733D1F391A0DBED45E60AFD4FD760EF
SHA1:	CECCFB3FFBE715FF1E8DABF61328DC0A069E487F
SHA-256:	E9B834587661F12A32B0F9B6BF0FE1B2895E7C62E8B2B28FA76E91605AFD5EA4
SHA-512:	A2D4550D8893594962A7E69A46C9B773515788CCCB4F7E4172391B32996E8AED2334583D913FCF09BCF7AD1B5E59CE964A0A887E8D08BBBECFB575AB191C09E6
Malicious:	false
URL:	https://script.crazyegg.com/pages/versioned/tracking-scripts/12ea412648d1035437916ed41b2a74c7.js
Preview:	(globalThis.webpackChunkCE2=globalThis.webpackChunkCE2\|\|[]).push([[806,60],{9307:(e,t,s)=>{"use strict";s.r(t),s.d(t,{EventHandlers:()=>Os,V11Tracker:()=>xt,compress:()=>Is,fp:()=>Ns,getCensoredElements:()=>Bt,timing:()=>nt});const r="[\\s\\u00a0\\u2028\\u2029]+";let i;if("undefined"!=typeof Intl&&Intl.Segmenter)try{i=new Intl.Segmenter}catch(e){}const n={whitespace:new RegExp(r,"g"),strip:new RegExp(`^${r}\|${r}$`,"g"),href:/\bhref="(.?)"/i,ipHost:/^([\d\.]+\|\[[a-f\d:]+\])$/i,allChars:/\p{RI}\p{RI}\|\p{Emoji}(\p{EMod}\|\u{FE0F}\u{20E3}?\|[\u{E0020}-\u{E007E}]+\u{E007F})?(\u{200D}\p{Emoji}(\p{EMod}\|\u{FE0F}\u{20E3}?\|[\u{E0020}-\u{E007E}]+\u{E007F})?)\|./gsu};function o(e,t){const s=e.replace(n.strip,"");return t?s.replace(n.whitespace," "):s}const a=2048,c=65535-a;const l=`cesrk${Math.random().toString().replace(/\D/g,"")}`;function h(e){let t;const s=(e=e\|\|window).document;return e[`${l}_path`]!==e.location.pathname&&(e[l]=function(e){const t=e.defaultView,s=e.documentElement;if(s.scroll

Chrome Cache Entry: 360

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
Category:	dropped
Size (bytes):	145222
Entropy (8bit):	5.2670517262784315
Encrypted:	false
SSDEEP:	3072:2qDBtbotYFCFFhwaBCs5wEuIVoz8mAyfPYiHF:2qDBdot1rhTCsaSVCAiHF
MD5:	E112B8BF96F23BC2970347A3C98E37FC
SHA1:	CE2408E32AEA3F8323ECEE9B7E4338A943667950
SHA-256:	889794FD02992011C4B843A05190531656D4C6148E6D4375BE6BAB3432B580D0
SHA-512:	AA43C0276A8E03B9C45479D7B7D286EA4648C355977D9742F14E8CCB22CF301ED7890330B39DAFB2D9EC26B6B233F4BCEFC6D231430F3CBA924DEDD13431CEF4
Malicious:	false
Preview:	!function(){"use strict";function k(){k=function(){return a};var c,a={},e=Object.prototype,l=e.hasOwnProperty,u=Object.defineProperty\|\|function(e,t,n){e[t]=n.value},t="function"==typeof Symbol?Symbol:{},r=t.iterator\|\|"@@iterator",n=t.asyncIterator\|\|"@@asyncIterator",o=t.toStringTag\|\|"@@toStringTag";function i(e,t,n){return Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}),e[t]}try{i({},"")}catch(c){i=function(e,t,n){return e[t]=n}}function s(e,t,n,r){var o,i,a,s,t=t&&t.prototype instanceof y?t:y,t=Object.create(t.prototype),r=new C(r\|\|[]);return u(t,"_invoke",{value:(o=e,i=n,a=r,s=f,function(e,t){if(s===h)throw new Error("Generator is already running");if(s===m){if("throw"===e)throw t;return{value:c,done:!0}}for(a.method=e,a.arg=t;;){var n=a.delegate;if(n){n=function e(t,n){var r=n.method,o=t.iterator[r];if(o===c)return n.delegate=null,"throw"===r&&t.iterator.return&&(n.method="return",n.arg=c,e(t,n),"throw"===n.method)\|\|"return"!==r&&(n.method="throw",n.ar

Chrome Cache Entry: 361

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3300
Entropy (8bit):	5.041409827065832
Encrypted:	false
SSDEEP:	96:Fra4M0rAzNrSny1aRzqJRC424+/AD/APe7:Fs0kzNrSyARIRCHU7
MD5:	76CA1CA8B2D96CF16DA3E2140D5DFB56
SHA1:	03C052A880926A8411E76A18AA63E91C7CF5A16F
SHA-256:	02DA51970F2808353C5D402B60067ECBCA43E3F84DBF782C1AD1A2781320E56F
SHA-512:	6AB8C4F5EE9ECDE494CF61C895F30502E61DED69168847606FC86C1B60D16610E9E63F056448A6D1C2AD2B459D406FEF983106E28B010CC27CC30A823FC95C94
Malicious:	false
URL:	https://www.telerik.com/WebResource.axd?d=DzHrpQl5URXarFHAtrmzFsPwWIExaUeLHf3gTuslFxiRsjc9gU89IWbLw9lFnSTXl5qZVz-0iBHHB3aQBiGWPYzKfk3ndhT8iH1RSf_M6Sk7X3EWbQzPMVpb-rxAUHFQlncyLjOo3RP6E9HfRXn18roSCYCGCRaVqv9jyNWgJTH95Urh0&t=638646398980000000
Preview:	TrackingConsentManager=(function(){var consentCookieName="sf-tracking-consent";.var consentDialogHtml="";.var consentDialog=null;.var eventListeners={AfterDialogDisplayed:[],BeforeDialogClosed:[],ConsentChanged:[],};.function closeConsentDialog(){if(consentDialog==null){return;.}invokeEventListeners("BeforeDialogClosed",[consentDialog]);.document.body.removeChild(consentDialog);.consentDialog=null;.}function openConsentDialog(){if(!document.body){return;.}closeConsentDialog();.consentDialog=document.createElement("div");.var dialogHtml=document.getElementById("sf-tracking-consent-manager");.if(dialogHtml){consentDialogHtml=dialogHtml.textContent;.consentDialog.innerHTML=consentDialogHtml;.document.body.insertBefore(consentDialog,document.body.childNodes[0]);.}var scripts=consentDialog.getElementsByTagName("script");.for(var idx=0;.idx<scripts.length;.idx++){try{eval(scripts[idx].textContent);.}catch(err){console.error(err);.}}invokeEventListeners("AfterDialogDisplayed",[consentDialog])

Chrome Cache Entry: 362

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (41169)
Category:	dropped
Size (bytes):	41172
Entropy (8bit):	5.505998162296305
Encrypted:	false
SSDEEP:	768:j21xCdwV69Odf9dk1fV8iWUwcb9x8cvgBhpU9yC8IEVDlbth3Ia8DdEN:iP3kr8V8vShi98Iiph3IbC
MD5:	0AA5002702487976D570A640C408EBA5
SHA1:	48930F22A2396DF313CCDFCB91CAC20E38F2B06B
SHA-256:	4E8276AEA0A3C7FE3600E6718C7F484D49C347C8D5763D89BE95900D526A14DA
SHA-512:	37A9D609DB21EE1E696CB437C02F0F6410925EB10B6353C0CDF95DB265E342F0BC3D2AE1851D209E4517D978B7CCBE8AD56F98247FA865AE405FAFD4D2E62CDA
Malicious:	false
Preview:	!function(){"use strict";function n(n,t,e){return t in n?Object.defineProperty(n,t,{value:e,enumerable:!0,configurable:!0,writable:!0}):n[t]=e,n}var t,e,r,i,o={ADVERTISING:"ADVERTISING",ANALYTICS_AND_RESEARCH:"ANALYTICS_AND_RESEARCH",FUNCTIONAL:"FUNCTIONAL"},a="GUEST",u="MEMBER",c=0,l=1,d=2,s=(n(t={},a,"li_gc"),n(t,u,"li_mc"),t),f=function vr(){var n=arguments.length>0&&arguments[0]!==undefined?arguments[0]:null,t=arguments.length>1&&arguments[1]!==undefined?arguments[1]:null,e=arguments.length>2&&arguments[2]!==undefined?arguments[2]:null,r=arguments.length>3&&arguments[3]!==undefined?arguments[3]:null;for(var i in function(n,t){if(!(n instanceof t))throw new TypeError("Cannot call a class as a function")}(this,vr),n=n\|\|{},this.consentAvailable=!1,this.issuedAt=t,this.userMode=e,this.optedInConsentMap={},o)n[i]=n[i]\|\|c,n[i]!==c&&(this.consentAvailable=!0),this.optedInConsentMap[i]=n[i]===l\|\|n[i]===c&&r===l},v=(e=[o.ADVERTISING,o.ANALYTICS_AND_RESEARCH,o.FUNCTIONAL],r=[c,l,d,c],i=new R

Chrome Cache Entry: 363

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21756), with no line terminators
Category:	dropped
Size (bytes):	21756
Entropy (8bit):	4.769122522678095
Encrypted:	false
SSDEEP:	384:ud8C4hGojhmCy7qGAVsq1nwGfg4xqsQMPNE:/6J
MD5:	C925A552257F078897064317827D0BC7
SHA1:	091963D2C8C8D7301932F1BFB38BED997108AD18
SHA-256:	29733CA80FAD429EB7E4BB7F028CD176D9EE5A5427D09CAEC143E5030CB1005F
SHA-512:	8E26FC9B12F420E40E3D1D6F422AAD760F9E7C39DE7031987BB36294427E0513DC10A0E40D82187157E664DE875F8224AF94F24FA895F85D2D2889201723868D
Malicious:	false
Preview:	#onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:700;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .onetrust-vendors-list-handler:hover{color:#1f96db}#onetrust-banner-sdk:focus{outline:2px solid #000;outline-offset:-2px}#onetrust-banner-sdk a:focus{outline:2px solid #000}#onetrust-banner-sdk #onetrust-accept-btn-handler,#onetrust-banner-sdk #onetrust-reject-all-handler,#onetrust-banner-sdk #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-tcf2-vendor-count.ot-text-bold{font-weight:700}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-size:contain;background-repeat:no-repeat;background-position:center;height:12px;width:12px}#onetrust-banner-sdk .powered-by-logo,#onetrust-banner-sdk .ot-pc-foot

Chrome Cache Entry: 364

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (4870), with no line terminators
Category:	downloaded
Size (bytes):	4870
Entropy (8bit):	5.733503296888527
Encrypted:	false
SSDEEP:	96:YyRkckywg3Q09CZuqNsbMZuqm/ssCZC325lU1bMZC3mJgU1XPZuqrsXPZC398U1Q:yhywg3lGuqNsbkuqm0sGC325lU1bkC3N
MD5:	C06DEE0C0781E98E01E38435C896827F
SHA1:	CC6815BB7A4EC35A5F3DB30958777EB1F45AEFA0
SHA-256:	C46CDB041E207863FDDA7611D219FCB407DDCC6F76DEFA554FAECE01A858F919
SHA-512:	6BEE5FF2FFEC2DE8F86E052FD43A3FC320F5FEC1C18E786D77511D71249B4E825DE75A8C8F94F6D9E5096AC8196C043EF40C7C93C6FE253D34CC8C126062918B
Malicious:	false
URL:	https://td.doubleclick.net/td/rul/975652292?random=1731682780912&cv=11&fst=1731682780912&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45je4bc0h1v9167661709za200zb536291&gcs=G111&gcd=13v3v3v3v5l1&dma=0&tag_exp=101925629~102067554~102067808~102077855&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&label=p4zxCNq_8IkYEMSLndED&hn=www.googleadservices.com&frm=0&tiba=First%20run&gtm_ee=1&npa=0&pscdl=noapi&auid=816168706.1731682775&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&data=event%3Dconversion&ct_cookie_present=0
Preview:	<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":2592000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s816168706.1731682775","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s816168706.1731682775\u0026ig_key=1sNHM4MTYxNjg3MDYuMTczMTY4Mjc3NQ!2sZ17u3g!3sAAptDV5nq4fs\u0026tag_eid=44800267","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1sSSgJ-Q!2sZ17u3g!3sAAptDV5nq4fs","1i44800267"],"userBiddingSignals":[["597463345","452806886"],null,1731682782973533],"ads":[{"renderUrl":"https://tdsf.doubleclick.net/td/adfetch/gd

Chrome Cache Entry: 365

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
URL:	https://q.quora.com/_/ad/f3942e2f1f7d449b81784d171e274880/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 366

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (16015)
Category:	dropped
Size (bytes):	16055
Entropy (8bit):	5.197709873158673
Encrypted:	false
SSDEEP:	384:oOLmo6BNdc4cwcIPq2CtCAGBb15WNWeRJz2G/pdCInMHycnSP6897QGbeb/FCXvS:ogmoMdcVIPxKdOBKWoFR/pdCInMH8C8I
MD5:	AB8444FA0426D72715572333D271C2E8
SHA1:	9A60F1E3B28B8BA953BE4A896F60D8033E4BCDAA
SHA-256:	ECF99B2AD192294C5E5233731A54FD2A3CFF26E1B79C852EFF39DAC531E5F119
SHA-512:	BEF8AA205194EB269278294690ACA2CA4CCEDFC54EF0191C8FDCE5F425DD6C34440283198E725EFB03063C73CB63A85B96320B0487F8FC6DC37086F71DA3A272
Malicious:	false
Preview:	!function(){"use strict";const t={activeClass:"TK-Nav-Overlay--Active"};class e{constructor(e,n){this.options=Object.assign({},t,n),this.element=e,this.activeClass=this.options.activeClass,this.hidden=!0}show(){this.hidden&&this.element&&(this.element.classList.add(this.activeClass),this.hidden=!1)}hide(){!this.hidden&&this.element&&(this.element.classList.remove(this.activeClass),this.hidden=!0)}addEventListener(t,e,n=!1){this.element&&this.element.addEventListener(t,e,n)}}const n="transition"in document.documentElement.style,s=t=>"function"==typeof t,o={hover:!1,click:!1,activeClass:"TK-Dropdown--Active",beforeOpenHook:()=>{},beforeCloseHook:()=>{}};class i{constructor(t,e){t&&(this.element=t,this.options=Object.assign({},o,e),this.closed=!0,this.running=!1,this.parent=this.options.parent\|\|t.parentElement,this.button=this.options.button\|\|this.parent.firstElementChild,this.beforeOpenHook=this.options.beforeOpenHook,this.beforeCloseHook=this.options.beforeCloseHook,this.init())}run(){i

Chrome Cache Entry: 367

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	19
Entropy (8bit):	3.366091329119193
Encrypted:	false
SSDEEP:	3:a2yb1tMn:aN1tM
MD5:	D06F04FCCF68D0B228A5923187CE1AFD
SHA1:	5DE9DF9FDD66A91EED06E31981553D4AB9CCF490
SHA-256:	830E67BDA2532CD5880EE86E3B33E69721082F8458BB0DF0CD4EDBB1577FD375
SHA-512:	9888104E0C9311D58B52A9B7030725C8BDFBE54F581246E4DDE0366F046671B3CE6838D09DDB4A384C6145248D4AB46D16BAE8E92F943488E2888982D6DB0D3A
Malicious:	false
URL:	https://assets-tracking.crazyegg.com/healthcheck
Preview:	{ "status": "ok" }.

Chrome Cache Entry: 368

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
URL:	https://px.ads.linkedin.com/attribution_trigger?pid=2392561%2C3477010&time=1731682776819&url=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run
Preview:	{}

Chrome Cache Entry: 369

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13614
Entropy (8bit):	5.21163185311822
Encrypted:	false
SSDEEP:	384:7Iy0clDjbn42OXOw85csXf1NFyNg/OoH6iAHyPtJJAR:7Iy5F/i
MD5:	9B1F8DDF85FB0CBFD926FAACB1FC0405
SHA1:	ADE7F952C70F07FD3497CD3E8656CA1F28C78633
SHA-256:	F4AAA18C55C90588C5E828E56DCC6B2CB0ACF9A4280494C7D1A53FC5E3669112
SHA-512:	E4459B7442F642BAB997BCA930530D2353ED53E24CA0F7D7A6ADED68CF6852693EEDFBC4594FEB4D80BBA779F566BA8918D3462C690F70D277D3E2C155C02280
Malicious:	false
Preview:	. {. "name": "otFlat",. "html": "PGRpdiBpZD0ib25ldHJ1c3QtYmFubmVyLXNkayIgY2xhc3M9Im90RmxhdCI+PGRpdiByb2xlPSJhbGVydGRpYWxvZyIgYXJpYS1kZXNjcmliZWRieT0ib25ldHJ1c3QtcG9saWN5LXRleHQiPjxkaXYgY2xhc3M9Im90LXNkay1jb250YWluZXIiPjxkaXYgY2xhc3M9Im90LXNkay1yb3ciPjxkaXYgaWQ9Im9uZXRydXN0LWdyb3VwLWNvbnRhaW5lciIgY2xhc3M9Im90LXNkay1laWdodCBvdC1zZGstY29sdW1ucyI+PGRpdiBjbGFzcz0iYmFubmVyX2xvZ28iPjwvZGl2PjxkaXYgaWQ9Im9uZXRydXN0LXBvbGljeSI+PGgyIGlkPSJvbmV0cnVzdC1wb2xpY3ktdGl0bGUiPlRpdGxlPC9oMj48ZGl2IGlkPSJvbmV0cnVzdC1wb2xpY3ktdGV4dCI+dGl0bGU8YSBocmVmPSIjIj5wb2xpY3k8L2E+PC9kaXY+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRhaW5lciI+PGgzIGNsYXNzPSJvdC1kcGQtdGl0bGUiPldlIGNvbGxlY3QgZGF0YSBpbiBvcmRlciB0byBwcm92aWRlOjwvaDM+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRlbnQiPjxwIGNsYXNzPSJvdC1kcGQtZGVzYyI+ZGVzY3JpcHRpb248L3A+PC9kaXY+PC9kaXY+PC9kaXY+PC9kaXY+PGRpdiBpZD0ib25ldHJ1c3QtYnV0dG9uLWdyb3VwLXBhcmVudCIgY2xhc3M9Im90LXNkay10aHJlZSBvdC1zZGstY29sdW1ucyI+PGRpdiBpZD0ib25ldHJ1c3QtYnV0dG9uLWdyb3VwIj48YnV0dG

Chrome Cache Entry: 370

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65450)
Category:	downloaded
Size (bytes):	226966
Entropy (8bit):	5.37858105337111
Encrypted:	false
SSDEEP:	1536:EwmvhwvwV1UMwl+0G+ZBTr9ix6HeTX0XLDDDbGw5wyPybFkK8yDaIG+UNM3VBYG3:MhwvwVGMwHZXixont8Fk9KRUytxYScY7
MD5:	4EEC238587F7F82D91A29F25D83A5FB6
SHA1:	8F443236A805D1A5F7DE04D07F1BF0331B63C70D
SHA-256:	F0A9B19D1615E0E2AFDCA507D4C7CBE384B0BDFAD5CBAF63C14A386DF33A62D7
SHA-512:	35E407C0B077E2B066F53E5B0A83194F28B29F249E7A0440B89A475EE654E7E004F3F1FF759F0444F1E4931B06237BC440062C9496B52A4E3C4F5C6CF4EDEE85
Malicious:	false
URL:	https://script.hotjar.com/modules.6f60e575cf8ad7cb10f7.js
Preview:	/! For license information please see modules.6f60e575cf8ad7cb10f7.js.LICENSE.txt /.!function(){var e={4788:function(e,t,n){"use strict";n.d(t,{s:function(){return r}});const r=Object.freeze({IDENTIFY_USER:"identify_user",AUTOTAG_RECORDING:"autotag_recording",TAG_RECORDING:"tag_recording",HEATMAP_HELO:"heatmap_helo",RECORDING_HELO:"recording_helo",REPORT_USER_ID:"report_user_id",MUTATION:"mutation",MOUSE_CLICK:"mouse_click",INPUT_CHOICE_CHANGE:"input_choice_change",KEY_PRESS:"key_press",MOUSE_MOVE:"mouse_move",RELATIVE_MOUSE_MOVE:"relative_mouse_move",CLIPBOARD:"clipboard",PAGE_VISIBILITY:"page_visibility",SCROLL_REACH:"scroll_reach",SCROLL:"scroll",SELECT_CHANGE:"select_change",VIEWPORT_RESIZE:"viewport_resize",SCRIPT_PERFORMANCE:"script_performance",REPORT_CONTENT:"report_content",INSERTED_RULE:"inserted_rule",DELETED_RULE:"deleted_rule"})},6939:function(e,t,n){"use strict";n.d(t,{f:function(){return f},W:function(){return g}});const r=Object.freeze({LIVE:"LIVE",REVIEW_WEBAPP:"REVI

Chrome Cache Entry: 371

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4943
Entropy (8bit):	4.970799505980531
Encrypted:	false
SSDEEP:	96:npyIN40w/1OxWRs+6upiyCBHxYa6AyghjYjNjJjFZZ2p0F:Fk/1M4sVSiyM6vgBgVJpIS
MD5:	8051B9723C99EAEECE1753B7F22E931A
SHA1:	8B352743705C6AB78EEC91FA42CB54737C701C4C
SHA-256:	9BD8DF065E42D6FC4FD72C7C14A211BD70903B89214A6B8687957A20A5B57B75
SHA-512:	7D87D7DFDB26FEBDA03E09F08DCC28E022C685A3012DCABAF70D96B79BA81654B3AC5D87BDD772B54CB87108B547D5CA525BF893E3A768CF6A70400C880CC9D9
Malicious:	false
URL:	https://cdn.cookielaw.org/consent/3dfce4f2-dab6-4128-9f33-df7e0597da82/3dfce4f2-dab6-4128-9f33-df7e0597da82.json
Preview:	{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202401.2.0","OptanonDataJSON":"3dfce4f2-dab6-4128-9f33-df7e0597da82","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","BulkDomainCheckUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"018f398d-ea8e-74a2-a6c4-3960ac2e46da","Name":"EU","Countries":["de","no","be","fi","pt","bg","dk","lt","lu","lv","hr","fr","hu","se","mc","si","sk","mf","sm","gb","yt","ie","gf","ee","mq","ch","mt","gp","is","it","gr","es","re","at","cy","cz","ax","pl","li","ro","nl"],"States":{},"LanguageSwitcherPlaceholder":{"default":"en"},"BannerPushesDown":false,"Default":false,"Global":false,"Type":"GDPR","UseGoogleVendors":false,"VariantEnabled":false,"TestEndTime":null,"Variants":[],"TemplateName":"GDPR Template - Telerik.Com - EU"

Chrome Cache Entry: 372

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	156
Entropy (8bit):	4.647633743765406
Encrypted:	false
SSDEEP:	3:YTyLSMjRMf884i2Q9AdA7EEJet7TRb9n9KYM2ZD9DXgj8n:YWLSIji2QmdA1YRN9Ddbgj8
MD5:	94AC74D17DFC933B3E5B18748A9C4AD4
SHA1:	7613F8398CDAE58482CAA0AB0B2D1CE79AE807AD
SHA-256:	85D8397CDDF41FD05355E1475989F9DE056C0AC29A49100B118700E5AF2FC381
SHA-512:	8EC9816FFA4EFB23E1054222055C8C3CC6F318D87936325A885AD972C104FDF8C1381D17A5098AE60878D9C96BE061579004CB0AF2C74F5E6468B696D293A3B2
Malicious:	false
URL:	https://script.crazyegg.com/pages/data-scripts/0087/4351/sampling/www.telerik.com.json?t=1
Preview:	{"version":"11.5.319","sites_sampling":"%8&4!}%\|%]!}$<$5$5$;$1$5$5$,!}&%%?&$%^!}$<!}&,%^&!%^&%\|%~$.%[&&&$!}$,!}&%^%[&&&%]%\|&%%`%=&%?&,%\|&&!}$<$4$2&6%;"}

Chrome Cache Entry: 373

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (19476), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	64896
Entropy (8bit):	5.570568702267381
Encrypted:	false
SSDEEP:	768:xvM0BBw4DFAzx39N2tHV9O6AE9n0jNaPi7BxABxf/EFRZA3/03C3C38X3W3G3qmv:xvM94uVkqB7BxABxEFqnliY92Cf/r
MD5:	A867E88000DDADC69FB093C2D9DF0882
SHA1:	72EDED08E9CC1FC4530A6A788A286C1191A87D49
SHA-256:	230528D2907F8E100C5B03D8185DCC9960359700674396D8B9277A9D9C90D07D
SHA-512:	6059EEC284C155F2B4E0F3169FA5A30D5F464F1401A209A5E88DA5FEC46212CAA5F29B6E4F0981E1132C414EF8B9C21A22A96A54DC06976F575CDD3268F8E740
Malicious:	false
URL:	https://www.telerik.com/download/fiddler/first-run
Preview:	<!doctype html> <html id="html" lang="en"> <head> <meta charset="utf-8" /><script type="text/html" id="sf-tracking-consent-manager">...<div id="tracking-consent-dialog" style="display:none" />..</script><script type="text/javascript" src="/WebResource.axd?d=DzHrpQl5URXarFHAtrmzFsPwWIExaUeLHf3gTuslFxiRsjc9gU89IWbLw9lFnSTXl5qZVz-0iBHHB3aQBiGWPYzKfk3ndhT8iH1RSf_M6Sk7X3EWbQzPMVpb-rxAUHFQlncyLjOo3RP6E9HfRXn18roSCYCGCRaVqv9jyNWgJTH95Urh0&t=638646398980000000">....</script> <meta http-equiv="X-UA-Compatible" content="IE=edge" /> <meta name="viewport" content="width=device-width, initial-scale=1" /> <link rel="shortcut icon" href="/favicon.ico?v=rebv1" /> <link href="https://dtzbdy9anri2p.cloudfront.net/cache/3771543484f465487bb9712eed986edeb1f314a2/telerik/css/style.css" rel="stylesheet" type="text/css"> <title>...First run..</title> <meta name="robots" content="noindex" /><meta property="og:title" content="First run" /><meta property="og:url" content="https://www.telerik.com/download/fi

Chrome Cache Entry: 374

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5552)
Category:	dropped
Size (bytes):	79439
Entropy (8bit):	5.337893965244746
Encrypted:	false
SSDEEP:	1536:RJeUwT76HXhpwPCHM9ZVK01QqSYTZ02LKVsdmpyKcicgo:RIT7OXVs9ZVKBvYj8wKcHgo
MD5:	98E39581AC2B644DAC590FE37D11DF1D
SHA1:	63145EEA21301D1D79BA659E65B1ACFCBD272676
SHA-256:	B2F74846F20EF6B9ADA51AFC57BC9634C8D9591F6B6904EA7E18BA1F099C721F
SHA-512:	DB7AD43DA641D039522F6C147FA31A543E9A3DE50F023A495E383A824408659FE569C57804088CC9D9175C6E38F83C961C64CFFE4269FDB10EFFB71D94B1AC2C
Malicious:	false
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 375

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	23541
Entropy (8bit):	5.079372254244878
Encrypted:	false
SSDEEP:	384:ygvobYmNMh3J3iCj2ApMNZNQlNyNeYxQkNbdNSNYNCN4NINNjxNMNvNHON5NWNqA:rvDjfLAPD6dF6kK84
MD5:	28029455EDEE3DB0DC70E3B937B6BBB0
SHA1:	90318C65855872EBC829EC4A4F7F79C4E9C7E6A2
SHA-256:	8B1795F89F8A37F25BCBC79BF3223A6CB87D9288A497EABA3FCFC6FAC3726D55
SHA-512:	C9A30D409E404F6280EEE82F5A0DB22BAA0948FD64EA2072E851C3405F593E4029B60EC686F6EB7E3B7DEA02FB4FE9D195EF5495498357EF7611D038FA83ED14
Malicious:	false
URL:	https://script.crazyegg.com/pages/data-scripts/0087/4351/site/www.telerik.com.json?t=1
Preview:	{"uid":874351,"dkey":"c49bcc456f5a54681f71a652c6c489bc","updated_at":1731681923,"version":"11.5.319","site_data_url_template":"https://script.crazyegg.com/pages/data-scripts/0087/4351/site/SITENAME.json","site_sampling_url_template":"https://script.crazyegg.com/pages/data-scripts/0087/4351/sampling/SITENAME.json","status_data_url":"https://script.crazyegg.com/pages/data-scripts/0087/4351/status.json","hud":{"host":"https://hud.crazyegg.com","script_url":"https://script.crazyegg.com/scripts/hud","core_api_auth_key":"adb693747633c0e711b3972bb1348c001dc3462d5a33a863d1eb288f26ee4421","launch_origins":["https://core.crazyegg.com"]},"survey_preview_dest":"https://api.crazyegg.com/surveys/preview","survey_launch_origins":["https://app.crazyegg.com","https://core.crazyegg.com"],"addon_preview_dest":"https://api.crazyegg.com/surveys/preview","addon_launch_origins":["https://app.crazyegg.com","https://core.crazyegg.com"],"ce_app_url":"https://app.crazyegg.com","flow_preview_url":"https://api.cra

Chrome Cache Entry: 376

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	110668
Entropy (8bit):	5.445513288438355
Encrypted:	false
SSDEEP:	1536:wFb5Xyuw2fOjlZUU/KiXsxaI2hxFjYtZFl0W8Tdw9GpRcFkeuWSyNSjx50cFuQvF:6mcUbZVn7wNUyPQt
MD5:	61897AD921958D48FEEF31C296ACB8D2
SHA1:	8D33159B9977B4AB924D39E287C9D9D5A36805C7
SHA-256:	B10751FEFBD2F122C8D0806967A780BE715D96E99DEC9DD0E8A1DF507298FA69
SHA-512:	15C6E9405AB5DB912C992D5CAF0DE813175301A60CD2BF4A0D7B8502CA08753D1BEA7CEA7A13C040F8377F9D401EEC3DBB1F600B29D7EDCFF16B2E51DCCEC7C5
Malicious:	false
Preview:	!function(t){var n={};function r(e){if(n[e])return n[e].exports;var i=n[e]={i:e,l:!1,exports:{}};return t[e].call(i.exports,i,i.exports,r),i.l=!0,i.exports}r.m=t,r.c=n,r.d=function(t,n,e){r.o(t,n)\|\|Object.defineProperty(t,n,{enumerable:!0,get:e})},r.r=function(t){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(t,"_",{value:!0})},r.t=function(t,n){if(1&n&&(t=r(t)),8&n)return t;if(4&n&&"object"==typeof t&&t&&t._)return t;var e=Object.create(null);if(r.r(e),Object.defineProperty(e,"default",{enumerable:!0,value:t}),2&n&&"string"!=typeof t)for(var i in t)r.d(e,i,function(n){return t[n]}.bind(null,i));return e},r.n=function(t){var n=t&&t._?function(){return t.default}:function(){return t};return r.d(n,"a",n),n},r.o=function(t,n){return Object.prototype.hasOwnProperty.call(t,n)},r.p="",r(r.s=5)}([function(t,n,r){var e=r(1),i=window,a=i.document,o=i.location,c=encodeURIComponent,u=decodeURIComponent,f=i.navigat

Chrome Cache Entry: 377

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (998), with no line terminators
Category:	dropped
Size (bytes):	998
Entropy (8bit):	5.119771745601176
Encrypted:	false
SSDEEP:	12:6UMQEIMQYCdNLTkNTTiFBosOUurwaN7M8oVaXCOOCKX6DRNLnQBpNfTEcvrh4dMT:nvREiFBofUc1wc14X6DRdnWpdhLG13PK
MD5:	959C200967948C8EC962676FDE1CD9C9
SHA1:	8626BF3AD64D707210C2186366C3CAB3D1B218F6
SHA-256:	BAC4CC121D2E4DD1351588F7107E42C595E4E5A03828E5321452110875499306
SHA-512:	A37FBA2D6D9730EF331F196A1517B51A8C68067A2E9675A3497A3D90097A70D66F61DA4D11D44713AFBE5A075B1DB90479A9F740B04F6AD6B90DEC280247A49E
Malicious:	false
Preview:	window.invokeTrackingScript(this,OptanonGroups.PerformanceCookies,function(){var i="adWordsData",n="expTracking";function e(){dataLayer.push(arguments)}window.browserSessionStorage.read(n);function o(t,i){var r=window.browserSessionStorage.read(n);r=r?r:{};r[i]=t;window.browserSessionStorage.write(n,r);const u=document.createEvent("Event");u.initEvent("onOptimizeCallbackTriggered",!0,!0);window.dispatchEvent(u)}e("event","optimize.callback",{callback:o});function r(n,t){for(var u=null,e=t.split("&"),f=0;f<e.length;f++){var i=e[f].split("=");if(i[0]===n)return i[1];i[0]==="ReturnUrl"&&(u=i[1])}if(u){var s=unescape(u),o=s.split("?");if(o.length>1)return r(n,o[1])}}if(!window.browserSessionStorage.read(i)){var t={},u=!1,f=window.location.search.substring(1);f&&["ad_group","ad_type","utm_term","utm_content","ad_size","ad_placement","gclid","msclkid","ad_copy"].forEach(function(n){var i=r(n,f);i&&(t[n]=i,u=!0)});u&&(t.lp_url=window.location.href,window.browserSessionStorage.write(i,t))}})

Chrome Cache Entry: 378

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (35526), with NEL line terminators
Category:	dropped
Size (bytes):	94660
Entropy (8bit):	5.326943116342795
Encrypted:	false
SSDEEP:	768:qx2LXx38FgcQ/CscrsyhvB2zR3mix2fBG2Yxsj6p4egnlGJEE3ViqnsHe33OCHZs:qx2VjiXrL2T+V0QGeMnmY3vVaq6SQtk4
MD5:	06FF9A1F9EC9B3530181DEB602734487
SHA1:	B3485D7DDE1EC57A3915D1079237C8C34A5198C1
SHA-256:	3A6010648EF6C726A291C5471AA8BDB555904B0639BE98A7F159F8752F1A2F5D
SHA-512:	15681CF8EE2D7A67312F46C137C2CA3B98ADA59BEA3FA623248453634FC3DF851888134E86E73C7E6DF339E5163F930B8ECC4ADAD5C3D51F0A0EBFA0A750BF32
Malicious:	false
Preview:	!function(){"use strict";var L="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function t(t,e){return t(e={exports:{}},e.exports),e.exports}function e(t){return t&&t.Math==Math&&t}function y(t){try{return!!t()}catch(t){return!0}}function o(t,e){return{enumerable:!(1&t),configurable:!(2&t),writable:!(4&t),value:e}}function i(t){return j(x(t),8,-1)}function d(t){if(null==t)throw R("Can't call method on "+t);return t}function s(t){return P(d(t))}function O(t){return"function"==typeof t}function g(t){return"object"==typeof t?null!==t:O(t)}function n(t,e){return arguments.length<2?function(t){return O(t)?t:void 0}(b[t]):b[t]&&b[t][e]}var r,a,b=e("object"==typeof globalThis&&globalThis)\|\|e("object"==typeof window&&window)\|\|e("object"==typeof self&&self)\|\|e("object"==typeof L&&L)\|\|function(){return this}()\|\|Function("return this")(),h=!y(function(){return 7!=Object.defineProperty({},1,{get:function(

Chrome Cache Entry: 379

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	156
Entropy (8bit):	4.647633743765406
Encrypted:	false
SSDEEP:	3:YTyLSMjRMf884i2Q9AdA7EEJet7TRb9n9KYM2ZD9DXgj8n:YWLSIji2QmdA1YRN9Ddbgj8
MD5:	94AC74D17DFC933B3E5B18748A9C4AD4
SHA1:	7613F8398CDAE58482CAA0AB0B2D1CE79AE807AD
SHA-256:	85D8397CDDF41FD05355E1475989F9DE056C0AC29A49100B118700E5AF2FC381
SHA-512:	8EC9816FFA4EFB23E1054222055C8C3CC6F318D87936325A885AD972C104FDF8C1381D17A5098AE60878D9C96BE061579004CB0AF2C74F5E6468B696D293A3B2
Malicious:	false
Preview:	{"version":"11.5.319","sites_sampling":"%8&4!}%\|%]!}$<$5$5$;$1$5$5$,!}&%%?&$%^!}$<!}&,%^&!%^&%\|%~$.%[&&&$!}$,!}&%^%[&&&%]%\|&%%`%=&%?&,%\|&&!}$<$4$2&6%;"}

Chrome Cache Entry: 380

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3835)
Category:	dropped
Size (bytes):	259034
Entropy (8bit):	5.559045020639413
Encrypted:	false
SSDEEP:	3072:AlJI6PFDXBd+d7+0FSH54P7o7U4RPzRoDV77yTQqU7B7mP9bxDPP:INDXB0dePdIqU7B7mP9N
MD5:	332F4B918C2D992AC296E79762F39183
SHA1:	6A9C38EB64901DF59EFB05E65373015CCB338F02
SHA-256:	21A8D82E53051041CD5BC72D4923EEA8487D205281E7AA8FA8D22D8A0956A012
SHA-512:	D29EB139238ABCA4134A4BD3D5551EAA54638BFDB7BCDCECBCA0ADC5D79355146BFDCE67B772EAFA08A0D7E17D76C2A4137A1EE5E28084A48A7091AC212C40E3
Malicious:	false
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_1p_data_v2","priority":0,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_lastNameType":"CSS_SELECTOR","vtp_autoAddressEnabled":false,"vtp_regionValue":"","vtp_countryValue":"","vtp_isAutoCollectPiiEnabledFlag":false,"tag_id":2}],. "predicates"

Chrome Cache Entry: 381

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (667), with no line terminators
Category:	downloaded
Size (bytes):	667
Entropy (8bit):	5.00765779851988
Encrypted:	false
SSDEEP:	12:2Qb9Radth1mvgfYf5j7OlowvEoAdieE/4A7lEcIetD:2Qb9RytJAcHcoHb/p6cBD
MD5:	852912622073373B3811CD4CE08A2D0A
SHA1:	649C7C03E26E56A33B08A3C592EDE4D3AE720336
SHA-256:	4B8940BEC0467D78E75C7EAAF08B998C9CFBC4297E06490B1BEE1267A4649C04
SHA-512:	B7B94FEA330A78C14E75285EF8285DD1DACA09837B37FE74EC2790DACE047D7BAD92E6B75547EB8540F84FA0AB9A0A168EB1ADEDF9D7646418CC1A7B6D5F8B45
Malicious:	false
URL:	https://d585tldpucybw.cloudfront.net/Frontend-Assembly/Web.SitefinityExtensions.EloquaConnector/Scripts/BrowserSessionStorage.min.js?package=PureMvc&v=Q2NzWmRUZmg5UHpIS3RyRDhtYkJmUT09
Preview:	(function(){var n="bsc";function i(n){for(var r=n+"=",f=decodeURIComponent(document.cookie),u=f.split(";"),i=0;i<u.length;i++){for(var t=u[i];t.charAt(0)===" ";)t=t.substring(1);if(t.indexOf(r)===0)return t.substring(r.length,t.length)}return null}function t(){var t=i(n);return t\|\|(t=Date.now().toString(),document.cookie=n+"="+t+";path=/;SameSite=Lax;"),t}function r(n){var i=localStorage.getItem(n);if(i){var u=JSON.parse(i),f=t(),r=u[f];return r?r:(localStorage.removeItem(n),null)}return null}function u(n,i){var u=t(),r={};r[u]=i;localStorage.setItem(n,JSON.stringify(r))}var f={read:r,write:u};window.browserSessionStorage\|\|(window.browserSessionStorage=f)})()

Chrome Cache Entry: 382

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.036006945330954
Encrypted:	false
SSDEEP:	3:YGKad20bAn:YGK+o
MD5:	7D18C0226B08F68EC83126F32344634B
SHA1:	F7B593CCD626C52A16C8DEAA638F77D722A9BB85
SHA-256:	4AF2CD82560041DB5DCCDDC690E3019B57703A96345DC27C796B3AF9BCBED2A2
SHA-512:	72C2672467426052694DD2C7FA3F28111BDC16AD14EB3D0BA4EDBAF7E96C0293B1103ACD86D1ED4B4D6492750893D34BC837564EAF5795772223B50548CE5010
Malicious:	false
Preview:	{"content":{"promoViewModel":null}}

Chrome Cache Entry: 383

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	13614
Entropy (8bit):	5.21163185311822
Encrypted:	false
SSDEEP:	384:7Iy0clDjbn42OXOw85csXf1NFyNg/OoH6iAHyPtJJAR:7Iy5F/i
MD5:	9B1F8DDF85FB0CBFD926FAACB1FC0405
SHA1:	ADE7F952C70F07FD3497CD3E8656CA1F28C78633
SHA-256:	F4AAA18C55C90588C5E828E56DCC6B2CB0ACF9A4280494C7D1A53FC5E3669112
SHA-512:	E4459B7442F642BAB997BCA930530D2353ED53E24CA0F7D7A6ADED68CF6852693EEDFBC4594FEB4D80BBA779F566BA8918D3462C690F70D277D3E2C155C02280
Malicious:	false
URL:	https://cdn.cookielaw.org/scripttemplates/202401.2.0/assets/otFlat.json
Preview:	. {. "name": "otFlat",. "html": "PGRpdiBpZD0ib25ldHJ1c3QtYmFubmVyLXNkayIgY2xhc3M9Im90RmxhdCI+PGRpdiByb2xlPSJhbGVydGRpYWxvZyIgYXJpYS1kZXNjcmliZWRieT0ib25ldHJ1c3QtcG9saWN5LXRleHQiPjxkaXYgY2xhc3M9Im90LXNkay1jb250YWluZXIiPjxkaXYgY2xhc3M9Im90LXNkay1yb3ciPjxkaXYgaWQ9Im9uZXRydXN0LWdyb3VwLWNvbnRhaW5lciIgY2xhc3M9Im90LXNkay1laWdodCBvdC1zZGstY29sdW1ucyI+PGRpdiBjbGFzcz0iYmFubmVyX2xvZ28iPjwvZGl2PjxkaXYgaWQ9Im9uZXRydXN0LXBvbGljeSI+PGgyIGlkPSJvbmV0cnVzdC1wb2xpY3ktdGl0bGUiPlRpdGxlPC9oMj48ZGl2IGlkPSJvbmV0cnVzdC1wb2xpY3ktdGV4dCI+dGl0bGU8YSBocmVmPSIjIj5wb2xpY3k8L2E+PC9kaXY+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRhaW5lciI+PGgzIGNsYXNzPSJvdC1kcGQtdGl0bGUiPldlIGNvbGxlY3QgZGF0YSBpbiBvcmRlciB0byBwcm92aWRlOjwvaDM+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRlbnQiPjxwIGNsYXNzPSJvdC1kcGQtZGVzYyI+ZGVzY3JpcHRpb248L3A+PC9kaXY+PC9kaXY+PC9kaXY+PC9kaXY+PGRpdiBpZD0ib25ldHJ1c3QtYnV0dG9uLWdyb3VwLXBhcmVudCIgY2xhc3M9Im90LXNkay10aHJlZSBvdC1zZGstY29sdW1ucyI+PGRpdiBpZD0ib25ldHJ1c3QtYnV0dG9uLWdyb3VwIj48YnV0dG

Chrome Cache Entry: 384

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9217)
Category:	dropped
Size (bytes):	244531
Entropy (8bit):	5.4538573889137245
Encrypted:	false
SSDEEP:	3072:8FLeYH8AtPJ137OeR8NteqZEbkxZNsucrl0xYurPK713E3:8FLeYc+PJxH8NNfFcrHurPK7136
MD5:	36E181233B4F306FA5B8DDA3B15201E2
SHA1:	FDCCF3ABC17A9DE5CE2DBB5AD888C9698C7D2E13
SHA-256:	43A683165A27224EF2D2717BD57C8C203AA570CE39140504D086562EEFBB0F1F
SHA-512:	C754FC2C7B366E4475EFB11CF5C8F4F64427E00D7149F7DC10C7E4A726674335143F155F429ACF44210E93F8AA356E06879219E21A6AABE6AF92981E5C905348
Malicious:	false
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 385

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	110668
Entropy (8bit):	5.445513288438355
Encrypted:	false
SSDEEP:	1536:wFb5Xyuw2fOjlZUU/KiXsxaI2hxFjYtZFl0W8Tdw9GpRcFkeuWSyNSjx50cFuQvF:6mcUbZVn7wNUyPQt
MD5:	61897AD921958D48FEEF31C296ACB8D2
SHA1:	8D33159B9977B4AB924D39E287C9D9D5A36805C7
SHA-256:	B10751FEFBD2F122C8D0806967A780BE715D96E99DEC9DD0E8A1DF507298FA69
SHA-512:	15C6E9405AB5DB912C992D5CAF0DE813175301A60CD2BF4A0D7B8502CA08753D1BEA7CEA7A13C040F8377F9D401EEC3DBB1F600B29D7EDCFF16B2E51DCCEC7C5
Malicious:	false
URL:	https://euob.ytwohlcq.telerik.com/sxp/i/940047942047f9f048d2c1e1f6b78492.js
Preview:	!function(t){var n={};function r(e){if(n[e])return n[e].exports;var i=n[e]={i:e,l:!1,exports:{}};return t[e].call(i.exports,i,i.exports,r),i.l=!0,i.exports}r.m=t,r.c=n,r.d=function(t,n,e){r.o(t,n)\|\|Object.defineProperty(t,n,{enumerable:!0,get:e})},r.r=function(t){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(t,"_",{value:!0})},r.t=function(t,n){if(1&n&&(t=r(t)),8&n)return t;if(4&n&&"object"==typeof t&&t&&t._)return t;var e=Object.create(null);if(r.r(e),Object.defineProperty(e,"default",{enumerable:!0,value:t}),2&n&&"string"!=typeof t)for(var i in t)r.d(e,i,function(n){return t[n]}.bind(null,i));return e},r.n=function(t){var n=t&&t._?function(){return t.default}:function(){return t};return r.d(n,"a",n),n},r.o=function(t,n){return Object.prototype.hasOwnProperty.call(t,n)},r.p="",r(r.s=5)}([function(t,n,r){var e=r(1),i=window,a=i.document,o=i.location,c=encodeURIComponent,u=decodeURIComponent,f=i.navigat

Chrome Cache Entry: 386

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (4188), with no line terminators
Category:	downloaded
Size (bytes):	4191
Entropy (8bit):	5.114302743441512
Encrypted:	false
SSDEEP:	48:xvTmCcxNDbT2g03nkfmTHqsk04CoDAL1iQBq/cS5gsT+iS+VQEM4SSF4grqam1:BKH5MNk04CorzTXLF4aqv
MD5:	58340F3121BDBB73645B3E9C55FF5AC2
SHA1:	CBC7F40A0251F2ADF86C4049948D2F89ADF749F2
SHA-256:	6399AB4770551E8F40E94D5030C29AF730CEC63C52088C032A7AAB25AF070D85
SHA-512:	97EAF9D52458D843438C0F3BD3A3D23A4E169F29215A0A32A3E456281F8CFB214358818E1537D8F875CAE18FF79DE4F1E4502CB0276C687D13DFD0C1425BD944
Malicious:	false
URL:	https://www.telerik.com/WebResource.axd?d=NjxTqR2bqTw1rewxxlkHPoKtHrXAWC0HAaoiA_KkRcUyXkV02CSw2viy3BbwqQQWnOeUM4JljOrJ6SdN8P6xkcmc02D5IE0_hoR3ujKOHMUMV0D80Ax-2HQgUBn3JFGVcQMIptO-sbrJg4UhPcfKleFkBd3KXta5g771qRLz1--cqQWHZet4VERXE7zwP_V-_reX4bmQVhWS6yxLXOsj2Tnqll01&t=638646398980000000
Preview:	.var PersonalizationTracker = null; !function () { "use strict"; PersonalizationTracker = { _canTrack: !1, _pageId: null, _url: !1, track: function (e) { if (PersonalizationTracker._canTrack = e, PersonalizationTracker._canTrack) { if (!PersonalizationTracker._readCookie("sf-prs-ss")) { var r = 1e4 * Date.now() + 621355968e9; PersonalizationTracker._createCookie("sf-prs-ss", r) } if (!PersonalizationTracker._readCookie("sf-prs-lu")) { var a = window.top \|\| window; PersonalizationTracker._createCookie("sf-prs-lu", a.location.href) } PersonalizationTracker._pageId && PersonalizationTracker.trackPage(PersonalizationTracker._pageId), PersonalizationTracker._url && PersonalizationTracker.trackUrl() } else PersonalizationTracker._createCookie("sf-prs-ss", "", -1), PersonalizationTracker._createCookie("sf-prs-lu", "", -1), PersonalizationTracker._createCookie("sf-prs-vp", "", -1), PersonalizationTracker._createCookie("sf-prs-vu", "", -1) }, trackPage: function (e) { if (this._pageId = e.rep

Chrome Cache Entry: 387

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 4 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	downloaded
Size (bytes):	21142
Entropy (8bit):	4.720363217360017
Encrypted:	false
SSDEEP:	192:z/tKZVrFfgcFi1eq3rrwyRKDtVjFe8XyLIfYwHdJc3EKlVnD:TEzrF/i8qXfRKyLNWuD
MD5:	12649F4E0C5A37D4A41CBCA768C8E7E0
SHA1:	1257DD7949F4AA81C8F791DCEEEDD66E486DC3A0
SHA-256:	7B990B226FB3E8970B750DEC91D4E8B9B59B2B7B069D0243D7BF70FEBE8EDE53
SHA-512:	A0F96E89664C938ED38B33A127EF56B882F2EF3A60A4E01324602905B054C50A0AB87A725A21E61C3C60B5225E8825CBEAB8C5664C2E59BE168071F1CE1EEED4
Malicious:	false
URL:	https://www.telerik.com/favicon.ico?v=rebv1
Preview:	............ .....F......... .h....... .... .....F...00.... ..%...,...PNG........IHDR.............\r.f..._IDATx..y...O.T..hiji...Q./.T3h;.Z...b..R..A..DEi.5.".BMG..$HgF3.1C3.iU...zr..'o..y..>...~>..x..>I.....6d.yB.)..x.@....\|.~O.i...<K..R...j.....U.R]....4..+W..T.. ...B....o...}U...S..i....y...v.....f6P..F....".@..'......#=\|?B..N...H.0..CTg...W.q..`.1.)}~......a....7.... .S..C.^..%.@..>......b...V5Su...>...C.t...x.Tok.G.>.:QuI..%.@..&...M....WMR.....;.A..!@Z.......{.....n.".......H....W.V..lK'.T.F,,..TB0......V..3....X..a..}.!.@o./.V..R......!.....l.Y.t....wU..6v.......j.X.C".!@\.+v.^......9.8.....:.8.I.[oMoC..:.......C....n.....r}.......U+;.B.......[..x........g.....s..\.j..A..].....N#r..=6...s.......j<Ul2.i.:..A.{...........U.:.R...............#T?.'6.4..0...z.[..D.H3...n.P..#.....n..b.z\|..g.....D.R..t.a@Z...n.1.....T_.....!@. .w.pLV.`:.i..TG..A.7...6. ...=V.K.NS.......{U.,.@cCg[Jf...b..0g[..!@...z..d.[/u.....e..mI.:...;.D..

Chrome Cache Entry: 388

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6216)
Category:	dropped
Size (bytes):	6217
Entropy (8bit):	5.146261761606895
Encrypted:	false
SSDEEP:	192:xELuE2KC/lIfYj0wMKOHOMAGIvjG5BoAKK5rHjnuodO9k:x+xe0hKOuMA57Gjoo5rD3dO9k
MD5:	1D75EFAB0FFDF8A025BD7C15E886C753
SHA1:	B89CE8787FD8B4C4F87F97901B28D42F696FC605
SHA-256:	1D5CFE14D65ACCC4BD1DF0D7C3BB65BE70D0F4E94A5F9D40465343A2807548AE
SHA-512:	BE556C42FD60C566D8364F8922C9545E49BB48B8AB2B39ADD30D67F6831FC03C135EF0603B488FCE486D54161063F59150327FAF09E72A64B920D40A3F039624
Malicious:	false
Preview:	!function(){"use strict";function t(t,e){return Object.keys(t).map((function(n){return n+"="+(e?t[n]:encodeURIComponent(t[n]))})).join("&")}function e(t,e){var n,o,r={};return t&&"string"==typeof t?(t.trim().split("&").forEach((function(t){n=t.indexOf("="),o=t.substring(n+1),r[t.substr(0,n)]=e?o:decodeURIComponent(o)})),r):r}function n(t){return t instanceof Date&&(t=t.valueOf()),"number"==typeof t&&parseInt(t.toString().substring(0,10),10)}function o(){var t={},e=arguments;e[0]instanceof Array&&(e=e[0]);for(var n=0,a=e.length;n<a;n++){var s=e[n];if(r(s))s=o(s);else if(!i(s))continue;Object.keys(s).forEach((function(e){s.hasOwnProperty(e)&&(t[e]=s[e])}))}return t}function r(t){return"[object Array]"===Object.prototype.toString.call(t)}function i(t){return"[object Object]"===Object.prototype.toString.call(t)}function a(e,n,r,a){function s(s,c){var u=a\|\|!1;if(i(c)&&(c=o({id:n.getSiteID()},c)),"GET"===s&&(r=function(e){return r+"?"+t(e)}(c)),-1!==e.navigator.appName.indexOf("Internet Expl

Chrome Cache Entry: 389

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (321), with CRLF line terminators
Category:	downloaded
Size (bytes):	323
Entropy (8bit):	5.315753207603095
Encrypted:	false
SSDEEP:	6:hax/XXFTUil+KfHWIw7ANRNHU1BwQLhH3Uz4JlU2GoJOYuB96I:hax/XXpj1fFRN0nwehH3A4JlZtPI
MD5:	A174CF61C6699EA2E03CE5A2882F8ECC
SHA1:	D6CCB2A2A8C8F234A97567FAA50A219D38CFDC48
SHA-256:	2E8900BA4A5768754DE4FC21BCDDE72BDCAFA25C6C766A7F3BC44BF6C21FC412
SHA-512:	88EE44FF730EAC38F52B063AF0D9F062BF568C997B23287D61B21CD574D12C056BD411CB192F7E0AB17612314B81EEEF4BCD0946AE6C196466E63E5710DA884E
Malicious:	false
URL:	https://dntcl.qualaroo.com/frame.html
Preview:	<!DOCTYPE html><html><head><script>function getCookie(e){var o="; "+document.cookie,t=o.split("; "+e+"=");return 2==t.length?t.pop().split(";").shift():void 0}window.parent&&"undefined"!=typeof window.parent.postMessage&&getCookie("DNT")&&window.parent.postMessage("QUALAROO_DNT","*");</script></head><body></body></html>..

Chrome Cache Entry: 390

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	87533
Entropy (8bit):	5.262536918435756
Encrypted:	false
SSDEEP:	1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr
MD5:	2C872DBE60F4BA70FB85356113D8B35E
SHA1:	EE48592D1FFF952FCF06CE0B666ED4785493AFDC
SHA-256:	FC9A93DD241F6B045CBFF0481CF4E1901BECD0E12FB45166A8F17F95823F0B1A
SHA-512:	BF6089ED4698CB8270A8B0C8AD9508FF886A7A842278E98064D5C1790CA3A36D5D69D9F047EF196882554FC104DA2C88EB5395F1EE8CF0F3F6FF8869408350FE
Malicious:	false
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Chrome Cache Entry: 391

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13479)
Category:	downloaded
Size (bytes):	13620
Entropy (8bit):	5.274037253238212
Encrypted:	false
SSDEEP:	192:5rprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORw:5rprxaefKI0LP19m4q1WW+h4Mjx
MD5:	111591E189E063B051299EEF353DB9BA
SHA1:	3459F31CACF4CEDF6818B52AF372155DD7BB9C44
SHA-256:	148A74B0921AD78021D716E8032EDE1CDAF7ED7279CEFD7D2ACBE906ADD12A68
SHA-512:	2A07DFBA52F79B1ACEB0389C810580D753BAABAA0A796715D3457181F270E1370CF174504FC0DFF44B2B6310DFEEDA55A5F977A9C603F7A069C8FBC0E1DD450D
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/jquery-migrate/3.4.1/jquery-migrate.min.js
Preview:	/! jQuery Migrate v3.4.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /."undefined"==typeof jQuery.migrateMute&&(jQuery.migrateMute=!0),function(t){"use strict";"function"==typeof define&&define.amd?define(["jquery"],function(e){return t(e,window)}):"object"==typeof module&&module.exports?module.exports=t(require("jquery"),window):t(jQuery,window)}(function(s,n){"use strict";function e(e){return 0<=function(e,t){for(var r=/^(\d+)\.(\d+)\.(\d+)/,n=r.exec(e)\|\|[],o=r.exec(t)\|\|[],a=1;a<=3;a++){if(+o[a]<+n[a])return 1;if(+n[a]<+o[a])return-1}return 0}(s.fn.jquery,e)}s.migrateVersion="3.4.1";var t=Object.create(null);s.migrateDisablePatches=function(){for(var e=0;e<arguments.length;e++)t[arguments[e]]=!0},s.migrateEnablePatches=function(){for(var e=0;e<arguments.length;e++)delete t[arguments[e]]},s.migrateIsPatchEnabled=function(e){return!t[e]},n.console&&n.console.log&&(s&&e("3.0.0")&&!e("5.0.0")\|\|n.console.log("JQMIGRATE: jQuery 3.x-4.x REQUIRED"),s.migrateWarnings

Chrome Cache Entry: 392

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (7348), with no line terminators
Category:	dropped
Size (bytes):	7351
Entropy (8bit):	5.020040458057364
Encrypted:	false
SSDEEP:	192:Ix8uzi47xx4UNaRAJCJgJWJ04J7KJGboJFJG/bglt7kD5mcg+8N78+fm0KbeCkhj:4ipUXGIqfiRToglY1gNI+fm9KCklB1
MD5:	21F1464D7F87F6B19A753002C187706A
SHA1:	7C9380F15A38FC33B5BD5F21FD4E82F3163D9B97
SHA-256:	F1C215360C8E09CC98F925710D8D70664022EF9F2A3FBDD657ECB408836F3683
SHA-512:	76B2D6D861993C910F3E8C181CB096376BD53805E7A4B026866C87543D76FB046E9E99A41C696CE474219EA35DA473B9F975008236E7F6DCB185F0EF785735B0
Malicious:	false
Preview:	.var personalizationManager = null; window.sfCorrelationId = Date.now().toString(36) + Math.random().toString(36).substring(2), function () { "use strict"; var PersonalizationManager = function () { this.personalizedContainers = [], this.personalizedContent = [], this._personalizedContentLoadedHandlers = [] }; if (PersonalizationManager.prototype = { initialize: function () { var e = this; e.IEVersion = this.detectIE(), this.loadPersonalizableContainers(), this.personalizedContainers.length > 0 && this.loadPersonalizedContent() }, loadPersonalizableContainers: function () { this.personalizedContainers = this.getScriptElementsWithAttribute("data-sf-pers-id") }, loadPersonalizedContent: function () { for (var firstPersonalizedContainer = this.personalizedContainers[0], pageNodeId = firstPersonalizedContainer.getAttribute("data-sf-pers-page-node-id"), pageDataId = firstPersonalizedContainer.getAttribute("data-sf-pers-page-data-id"), pageNodeKey = firstPersonalizedContainer.getAttribute(

Chrome Cache Entry: 393

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (815)
Category:	downloaded
Size (bytes):	3501
Entropy (8bit):	5.383873370647921
Encrypted:	false
SSDEEP:	96:EI5cZUiKliCJ86U+QTEVWfeLwTauSEegdkZ5edOIC:EI5hiWNJ8kQTEVWfeUauRfdkZ5edO1
MD5:	147FD3B00C22BA9C939712E9213C24CA
SHA1:	3B48369B86FA0574F35379AACD1F42CC9C98A52B
SHA-256:	70F5B11C1870CF90201A6D5F770CA318A3FA5827C74A8765EDE22B487F7D4532
SHA-512:	E8419A71232EDAC8FD131446777F7D034B3171EFE07B3267479B439E4982650DB65A0D1DDC9F516315D5ED1B01ECFD2F7EB55D75D44AA51EE0AD494D441586D2
Malicious:	false
URL:	https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fwww.telerik.com
Preview:	<!DOCTYPE html>.<html>.<head>. <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon">.</head>.<body>. <script>.'use strict';class m{constructor(a){this.j=a;this.g={};this.h={};this.i=0;this.id=String(Math.floor(Number.MAX_SAFE_INTEGERMath.random()))}}function n(a){return a.performance&&a.performance.now()\|\|Date.now()}.var p=function(a,b){class d{constructor(c,g,f){this.failureType=c;this.data=g;this.g=f;this.h=new m(n(f))}s(c,g){const f=c.clientId;if(c.type===0){c.isDead=!0;var e=this.h,h=n(this.g);e.g[f]==null&&(e.g[f]=0,e.h[f]=h,e.i++);e.g[f]++;c.stats={targetId:e.id,clientCount:e.i,totalLifeMs:Math.round(h-e.j),heartbeatCount:e.g[f],clientLifeMs:Math.round(h-e.h[f])}}c.failure={failureType:this.failureType,data:this.data};g(c)}}return new d(5,a,b)};/.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0.*/.let q=globalThis.trustedTypes,r;function t(){let a=null;if(!q)return a;try{const b=d=>d;a=q.createPolicy("goog#html",{createHTML:b,createScript:b,crea

Chrome Cache Entry: 394

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32694), with no line terminators
Category:	downloaded
Size (bytes):	32694
Entropy (8bit):	5.30321147386255
Encrypted:	false
SSDEEP:	192:r21WzQNY6Y6YKYqsYfLL2fxnslA8w05qhvU3Haq6N3MUyIrfIrc+yAieLWIr0+yS:lQsYf+fxoAlQnroEPfMXP5jA/pLeD1py
MD5:	A8D503CA8A575A7F2002CB6DBA0E44AB
SHA1:	A2A651DCBA901CF6034DFA778A2CA2B3FAE8FFC5
SHA-256:	4B3AB9F99E4AEE32D1631D97F0B490B145F15F3BAC55E258F5586460421DCA14
SHA-512:	5B3920BCFF20D68A798D6534AA9A55A26492070BA093C8748D3DE3790FFA45A7449B4DAF2B801B2E514F45611EE8BFD2DCD2D38D13207593F63CAB8FC27C33EF
Malicious:	false
URL:	https://d6vtbcy3ong79.cloudfront.net/telerik-navigation/3.5.50/css/index.min.css
Preview:	.TK-Aside:after,.TK-Drawer:after,.TK-Hat-Aside:after,.TK-container:after,.TK-row:after{clear:both;content:"";display:table}.TK-Nav--Fluid .TK-container{max-width:none}.TK-container{-webkit-box-sizing:border-box;box-sizing:border-box;margin-left:auto;margin-right:auto;max-width:1230px;padding-left:30px;padding-right:30px}@media only screen and (max-width:1229px){.TK-container{padding-left:20px;padding-right:20px}}@media only screen and (max-width:589px){.TK-container{padding-left:20px;padding-right:20px}}.TK-row{-webkit-box-sizing:border-box;box-sizing:border-box;font-size:0;margin-left:-15px;margin-right:-15px}.TK-col-1,.TK-col-10,.TK-col-11,.TK-col-12,.TK-col-13,.TK-col-14,.TK-col-15,.TK-col-16,.TK-col-17,.TK-col-18,.TK-col-19,.TK-col-2,.TK-col-20,.TK-col-21,.TK-col-22,.TK-col-23,.TK-col-24,.TK-col-3,.TK-col-4,.TK-col-5,.TK-col-6,.TK-col-7,.TK-col-8,.TK-col-9{-webkit-box-sizing:border-box;box-sizing:border-box;display:inline-block;font-size:14px;min-height:1px;padding-left:15px;paddin

Chrome Cache Entry: 395

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	363
Entropy (8bit):	4.55972645456488
Encrypted:	false
SSDEEP:	6:2LGa3ymyCE//MzGCFiM1wBJPwcQK5DrIt6xfeGYqX3OLGhw47Jsr4z+LibIEBE7g:2f3ymyCEIiMRhykgIaOEsrq1EiE7Dmyu
MD5:	A1AB0546CD0209ECAF9D81C1EC431E9B
SHA1:	A35F658C7DF8BE35A1BABAF39998CFB23419E994
SHA-256:	4922A8859B315C354C23AD278E35483C6CF29AEBF1C509C2C928C1F41634FE43
SHA-512:	9EE64BAEBD84174ED337F668C90E3679B37FF57857AF64C2B07D9D8FC1A722BF0C097F9C4B6B902F6F2BE66443E37D7EBE9ED24F03006124C3321B68C8E0CAB5
Malicious:	false
URL:	https://bat.bing.com/p/action/5614127.js
Preview:	(function(w,d,c,k,a,b,t,e) {. var cs = d.currentScript;. if (cs) {. var uo = cs.getAttribute('data-ueto');. if (uo && w[uo] && typeof w[uo].setUserSignals === 'function') {. w[uo].setUserSignals({'ea': c, 'kc': k, 'at': a, 'bi': b, 'dt': t, 'ec': e});. }. }.})(window, document, false, true, false, false, false, false);..

\Device\ConDrv

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	920
Entropy (8bit):	5.250760793594964
Encrypted:	false
SSDEEP:	12:zKcJFyvBFNYO/aPKDLI4MWBFhy/aVDLI4MWBFr/axNDLI4MLO/ALIuNry/aLAbDM:zKwFyvDOiE4//E4/AJE4+LnN8XE4qE4H
MD5:	8C0DD89E3BBC4D24A41DA2D0DBFCC4F3
SHA1:	931B86A7765BD66F60442185E8796FCD7539E7EE
SHA-256:	3751EDDCD7F46CD11760B66CAE3C2E378A9F561F30F44A6BEF32BA6CA8042E77
SHA-512:	0308DAE4844F554B7BB9782E63F5D824F583BC4871B633D97AA6A3012B147C2C8CD16FA32BE02B3C03C4EFA2BEF8D2EA6433B37960DB73E73576E17E9AB1A0F4
Malicious:	false
Preview:	Microsoft (R) CLR Native Image Generator - Version 4.8.4320.0..Copyright (c) Microsoft Corporation. All rights reserved...2> Compiling assembly System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 (CLR v4.0.30319) .....4> Compiling assembly System.Numerics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 (CLR v4.0.30319) .....3> Compiling assembly System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a (CLR v4.0.30319) .....1> Compiling assembly C:\Users\user\AppData\Local\Programs\Fiddler\EnableLoopback.exe (CLR v4.0.30319) .....4> Compiling assembly System.Deployment, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a (CLR v4.0.30319) .....3> Compiling assembly System.Runtime.Serialization.Formatters.Soap, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a (CLR v4.0.30319) .....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.991848272299908
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	FiddlerSetup.5.0.20245.10105-latest.exe
File size:	4'656'360 bytes
MD5:	c1980b018489df28be8809eb32519001
SHA1:	e860439703d7b6665af4507b20bbef2bbb7b73f4
SHA256:	588024037b1e5929b1f2a741fff52a207bcab17f0650ec7cb0cd3cb78051998d
SHA512:	f70d419e869e56700a9e23350a9779f5dd56bb78adb9a1b0d5039287a24f20004db20f842294d234d4717feaa3184a5e6d90f0ee3666208bad2ea518d37b0a35
SSDEEP:	98304:qMgxyUnSAaB1eXq8yOkLiGXv72Qomw6pvtFIAwdaRdA:qMoWvePjqHv72Qo96pvtF5wH
TLSH:	2E2633E0902D8453D5D35EF0EAFB37128AF8BDF8313999954F12DB889837690D86EB41
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN..s~..PN..VH..PN.Rich.PN.........................PE..L....C.f.................f...".....

File Icon


Icon Hash:	4d9733535113864d

Static PE Info

General

Entrypoint:	0x40351c
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x660843F3 [Sat Mar 30 16:55:15 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f4639a0b3116c2cfc71144b88a929cfd

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	27/10/2023 16:45:04 27/10/2024 15:45:04
Subject Chain	CN=Progress Software Corporation, O=Progress Software Corporation, STREET=15 Wayside Rd Ste 4, L=Burlington, S=Massachusetts, C=US, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US, SERIALNUMBER=5743582, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	B13AE4988A452224CAF6151CCBDBDD94
Thumbprint SHA-1:	AB38282E84C27CAEDC42E9F4912CD031D8375880
Thumbprint SHA-256:	345FC38D2C7E97B1D475862DF3CF23826BA0C9F3C9664D8B9C1E04546CBE0C72
Serial:	09557E45BDC7AD80365E527F

Entrypoint Preview

Instruction
sub esp, 000003F8h
push ebp
push esi
push edi
push 00000020h
pop edi
xor ebp, ebp
push 00008001h
mov dword ptr [esp+20h], ebp
mov dword ptr [esp+18h], 0040A2D8h
mov dword ptr [esp+14h], ebp
call dword ptr [004080A4h]
mov esi, dword ptr [004080A8h]
lea eax, dword ptr [esp+34h]
push eax
mov dword ptr [esp+4Ch], ebp
mov dword ptr [esp+0000014Ch], ebp
mov dword ptr [esp+00000150h], ebp
mov dword ptr [esp+38h], 0000011Ch
call esi
test eax, eax
jne 00007FF8E0C3677Ah
lea eax, dword ptr [esp+34h]
mov dword ptr [esp+34h], 00000114h
push eax
call esi
mov ax, word ptr [esp+48h]
mov ecx, dword ptr [esp+62h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [esp+0000014Eh], 00000004h
not eax
and eax, ecx
mov word ptr [esp+00000148h], ax
cmp dword ptr [esp+38h], 0Ah
jnc 00007FF8E0C36748h
and word ptr [esp+42h], 0000h
mov eax, dword ptr [esp+40h]
movzx ecx, byte ptr [esp+3Ch]
mov dword ptr [00429AD8h], eax
xor eax, eax
mov ah, byte ptr [esp+38h]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [esp+00000148h]
movzx ecx, cx
shl eax, 10h
or eax, ecx
movzx ecx, byte ptr [esp+0000004Eh]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x84fc	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3b000	0x5628	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x46eca0	0x2048
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6576	0x6600	1e4066ed6e7440cc449c401dfd9ca64f	False	0.6663219975490197	data	6.461246686118911	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1358	0x1400	f0b500ff912dda10f31f36da3efc8a1e	False	0.44296875	data	5.102094016108248	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x1fb38	0x600	2e1d49b2855a89e6218e118f0c182b81	False	0.5026041666666666	data	4.044293204800279	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2a000	0x11000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3b000	0x5628	0x5800	e1299f34d29165d7cd9e110a8d17de7c	False	0.16650390625	data	3.360286154759448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3b298	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.08827800829875519
RT_ICON	0x3d840	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.13109756097560976
RT_ICON	0x3e8e8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.194043321299639
RT_ICON	0x3f190	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.28395953757225434
RT_ICON	0x3f6f8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.1622340425531915
RT_DIALOG	0x3fb60	0x100	data	English	United States	0.5234375
RT_DIALOG	0x3fc60	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x3fd80	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x3fde0	0x4c	data	English	United States	0.7631578947368421
RT_VERSION	0x3fe30	0x3c8	data	English	United States	0.42045454545454547
RT_MANIFEST	0x401f8	0x42a	XML 1.0 document, ASCII text, with very long lines (1066), with no line terminators	English	United States	0.5140712945590994

Imports

DLL	Import
ADVAPI32.dll	RegEnumValueW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegOpenKeyExW, RegCreateKeyExW
SHELL32.dll	SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW, ShellExecuteExW
ole32.dll	CoCreateInstance, OleUninitialize, OleInitialize, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Destroy, ImageList_AddMasked, ImageList_Create
USER32.dll	MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, CreatePopupMenu, AppendMenuW, TrackPopupMenu, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, IsWindowEnabled, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CharPrevW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, CharNextA, wsprintfA, DispatchMessageW, CreateWindowExW, PeekMessageW, GetSystemMetrics
GDI32.dll	GetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor
KERNEL32.dll	lstrcmpiA, CreateFileW, GetTempFileNameW, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, WriteFile, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, Sleep, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, MulDiv, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, SetEnvironmentVariableW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-15T15:59:41.271180+0100	2022112	ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015	1	192.168.2.5	49897	104.244.42.195	443	TCP
2024-11-15T15:59:41.384655+0100	2022112	ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015	1	192.168.2.5	49896	162.159.140.229	443	TCP
2024-11-15T15:59:41.386199+0100	2022112	ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015	1	192.168.2.5	49895	162.159.140.229	443	TCP
2024-11-15T15:59:41.389543+0100	2022112	ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015	1	192.168.2.5	49902	104.244.42.195	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 15, 2024 15:58:54.213228941 CET	49673	443	192.168.2.5	23.1.237.91
Nov 15, 2024 15:59:03.822489977 CET	49673	443	192.168.2.5	23.1.237.91
Nov 15, 2024 15:59:05.525583982 CET	443	49706	23.1.237.91	192.168.2.5
Nov 15, 2024 15:59:05.525818110 CET	49706	443	192.168.2.5	23.1.237.91
Nov 15, 2024 15:59:12.276168108 CET	49709	80	192.168.2.5	50.56.19.116
Nov 15, 2024 15:59:12.277513027 CET	49710	80	192.168.2.5	50.56.19.116
Nov 15, 2024 15:59:12.281297922 CET	80	49709	50.56.19.116	192.168.2.5
Nov 15, 2024 15:59:12.282381058 CET	80	49710	50.56.19.116	192.168.2.5
Nov 15, 2024 15:59:12.282552004 CET	49709	80	192.168.2.5	50.56.19.116
Nov 15, 2024 15:59:12.283106089 CET	49710	80	192.168.2.5	50.56.19.116
Nov 15, 2024 15:59:12.289618969 CET	49710	80	192.168.2.5	50.56.19.116
Nov 15, 2024 15:59:12.294549942 CET	80	49710	50.56.19.116	192.168.2.5
Nov 15, 2024 15:59:12.924083948 CET	80	49710	50.56.19.116	192.168.2.5
Nov 15, 2024 15:59:12.963673115 CET	49712	80	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:12.968583107 CET	80	49712	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:12.968734026 CET	49712	80	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:12.968873024 CET	49712	80	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:12.974061966 CET	80	49712	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:12.979538918 CET	49710	80	192.168.2.5	50.56.19.116
Nov 15, 2024 15:59:13.638245106 CET	80	49712	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:13.681972980 CET	49712	80	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:13.753472090 CET	49715	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:13.753516912 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:13.753570080 CET	49715	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:13.753753901 CET	49715	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:13.753765106 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:14.356483936 CET	49716	443	192.168.2.5	20.12.23.50
Nov 15, 2024 15:59:14.356580019 CET	443	49716	20.12.23.50	192.168.2.5
Nov 15, 2024 15:59:14.356966019 CET	49716	443	192.168.2.5	20.12.23.50
Nov 15, 2024 15:59:14.363985062 CET	49716	443	192.168.2.5	20.12.23.50
Nov 15, 2024 15:59:14.364020109 CET	443	49716	20.12.23.50	192.168.2.5
Nov 15, 2024 15:59:14.588382959 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:14.598649979 CET	49715	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:14.598669052 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:14.600522041 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:14.600622892 CET	49715	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:14.603738070 CET	49715	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:14.604067087 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:14.626219988 CET	49715	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:14.626235962 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:14.671617031 CET	49715	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:14.892338037 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:14.892381907 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:14.892465115 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:14.892739058 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:14.892755032 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:14.896164894 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:14.896195889 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:14.896209955 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:14.896271944 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:14.896276951 CET	49715	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:14.896316051 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:14.896334887 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:14.896368980 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:14.896383047 CET	49715	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:14.896383047 CET	49715	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:14.896406889 CET	49715	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:14.897139072 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:14.897166967 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:14.897221088 CET	49715	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:14.897232056 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:14.897267103 CET	49715	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:14.897958040 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:14.898004055 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:14.898036003 CET	49715	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:14.898045063 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:14.898155928 CET	49715	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.010293007 CET	49719	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.010418892 CET	443	49719	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:15.010579109 CET	49719	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.011770964 CET	49719	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.011806011 CET	443	49719	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:15.012707949 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:15.012804985 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:15.012877941 CET	49720	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.012963057 CET	443	49720	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:15.013098955 CET	49715	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.013118982 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:15.013214111 CET	49720	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.013220072 CET	49715	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.013654947 CET	49720	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.013725042 CET	443	49720	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:15.013825893 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:15.013856888 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:15.013891935 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:15.013897896 CET	49715	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.013915062 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:15.013993025 CET	49715	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.014036894 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:15.014255047 CET	49715	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.017091036 CET	49721	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.017174006 CET	443	49721	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:15.017266035 CET	49721	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.017688036 CET	49721	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.017721891 CET	443	49721	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:15.018965006 CET	49715	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.018980980 CET	443	49715	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:15.030814886 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:15.030900002 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:15.030987978 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:15.031096935 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:15.031116962 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:15.031157017 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:15.031196117 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:15.031277895 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:15.031613111 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:15.031696081 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:15.031955004 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:15.032332897 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.032361984 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:15.032495975 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.032608032 CET	49726	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.032691002 CET	443	49726	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:15.032805920 CET	49726	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.032833099 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.032851934 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:15.032958984 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.032977104 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:15.033004999 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.033046961 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.033071995 CET	49729	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.033092976 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:15.033165932 CET	49729	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.033169031 CET	49730	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.033185005 CET	443	49730	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:15.033246994 CET	49730	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.033468008 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.033487082 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:15.033720016 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.033772945 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:15.033813953 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:15.037743092 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:15.037770033 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:15.037996054 CET	49732	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.038013935 CET	443	49732	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:15.038171053 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.038202047 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:15.038239956 CET	49732	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.038311005 CET	49726	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.038338900 CET	443	49726	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:15.038615942 CET	49730	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.038639069 CET	443	49730	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:15.038875103 CET	49729	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.038897991 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:15.039153099 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.039175034 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:15.039340973 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.039352894 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:15.039685011 CET	49733	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:15.039733887 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:15.039832115 CET	49733	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:15.039958000 CET	49734	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:15.039975882 CET	443	49734	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:15.040030003 CET	49734	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:15.040282011 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:15.040329933 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:15.040390015 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:15.040608883 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.040632010 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:15.040904045 CET	49732	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.040930033 CET	443	49732	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:15.041122913 CET	49733	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:15.041151047 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:15.041335106 CET	49734	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:15.041349888 CET	443	49734	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:15.041565895 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:15.041598082 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:15.231987953 CET	443	49716	20.12.23.50	192.168.2.5
Nov 15, 2024 15:59:15.232171059 CET	49716	443	192.168.2.5	20.12.23.50
Nov 15, 2024 15:59:15.650196075 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:15.650285006 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:15.650484085 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:15.651197910 CET	443	49734	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:15.659444094 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:15.660921097 CET	443	49719	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:15.662473917 CET	443	49720	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:15.688659906 CET	443	49732	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:15.693600893 CET	49733	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:15.693635941 CET	49734	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:15.709189892 CET	49720	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.732753038 CET	443	49721	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:15.750195980 CET	49719	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.750298977 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:15.750341892 CET	49732	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.846573114 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:15.852653980 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:15.852946997 CET	49721	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:15.882296085 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:15.894020081 CET	443	49730	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:15.899143934 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:15.905324936 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:15.907440901 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:15.908227921 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:15.909013987 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:15.914051056 CET	443	49726	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:15.916110039 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:15.924654007 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:15.955693007 CET	49729	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.959666967 CET	49726	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:15.959666967 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:16.047393084 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:16.047398090 CET	49730	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:16.047398090 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:16.047398090 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:16.047743082 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:16.278564930 CET	49733	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:16.278644085 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:16.282454014 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:16.282571077 CET	49733	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:16.330157042 CET	49734	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:16.330243111 CET	443	49734	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:16.330418110 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:16.330501080 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:16.334142923 CET	443	49734	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:16.334233999 CET	49734	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:16.334511995 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:16.334547997 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:16.334657907 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:16.369101048 CET	49716	443	192.168.2.5	20.12.23.50
Nov 15, 2024 15:59:16.369138956 CET	443	49716	20.12.23.50	192.168.2.5
Nov 15, 2024 15:59:16.370065928 CET	443	49716	20.12.23.50	192.168.2.5
Nov 15, 2024 15:59:16.412003994 CET	49719	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:16.412048101 CET	443	49719	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:16.412252903 CET	49720	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:16.412293911 CET	443	49720	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:16.412957907 CET	443	49720	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:16.413563013 CET	443	49719	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:16.417603970 CET	49732	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:16.417646885 CET	443	49732	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:16.417664051 CET	49721	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:16.417679071 CET	443	49721	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:16.421688080 CET	443	49721	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:16.421732903 CET	443	49721	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:16.421876907 CET	49721	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:16.423676968 CET	443	49732	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:16.423712015 CET	443	49732	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:16.423767090 CET	49732	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:16.470489025 CET	49720	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:16.512386084 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:16.512397051 CET	49719	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:16.512408018 CET	49716	443	192.168.2.5	20.12.23.50
Nov 15, 2024 15:59:16.512412071 CET	49721	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:16.512412071 CET	49732	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:16.560754061 CET	49721	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:16.561038971 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:16.561127901 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:16.561150074 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:16.561173916 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:16.561220884 CET	443	49721	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:16.561515093 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:16.561590910 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:16.562690973 CET	49730	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:16.562738895 CET	443	49730	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:16.563097000 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:16.563119888 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:16.563157082 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:16.564028978 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:16.564042091 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:16.564104080 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:16.564320087 CET	443	49730	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:16.564342976 CET	443	49730	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:16.564382076 CET	49730	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:16.565334082 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:16.565423965 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:16.603406906 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:16.603492975 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:16.603528976 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:16.603557110 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:16.604902029 CET	49729	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:16.604975939 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:16.607428074 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:16.607462883 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:16.607523918 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:16.607547998 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:16.607584000 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:16.607618093 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:16.608709097 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:16.608787060 CET	49729	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:16.609226942 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:16.609276056 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:16.613104105 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:16.613121033 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:16.613178015 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:16.644337893 CET	49721	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:16.644404888 CET	443	49721	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:16.644444942 CET	49730	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:16.660223007 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:16.744615078 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:16.744616032 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:16.744616032 CET	49721	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:16.807602882 CET	49726	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:16.807647943 CET	443	49726	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:16.807666063 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:16.807682037 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:16.811552048 CET	443	49726	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:16.811620951 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:16.811759949 CET	49726	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:16.811759949 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:16.927500010 CET	49720	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:16.927959919 CET	443	49720	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:16.929936886 CET	49719	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:16.930409908 CET	443	49719	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:16.932365894 CET	49732	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:16.932869911 CET	443	49732	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:16.935264111 CET	49736	443	192.168.2.5	142.250.186.132
Nov 15, 2024 15:59:16.935349941 CET	443	49736	142.250.186.132	192.168.2.5
Nov 15, 2024 15:59:16.935405016 CET	49721	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:16.935434103 CET	49736	443	192.168.2.5	142.250.186.132
Nov 15, 2024 15:59:16.935540915 CET	49719	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:16.935574055 CET	49732	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:16.935553074 CET	49720	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:16.935622931 CET	443	49732	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:16.937474012 CET	49736	443	192.168.2.5	142.250.186.132
Nov 15, 2024 15:59:16.937513113 CET	443	49736	142.250.186.132	192.168.2.5
Nov 15, 2024 15:59:16.979357004 CET	443	49720	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:16.979366064 CET	443	49719	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:16.979391098 CET	443	49721	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.038923979 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.038955927 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.040000916 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.046358109 CET	49732	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:17.077297926 CET	49734	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.077306986 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.077588081 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.077702999 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.077702999 CET	49730	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.077703953 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.077754974 CET	443	49734	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.077815056 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.077950001 CET	443	49730	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.077950001 CET	49729	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.077950001 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.078188896 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.078243971 CET	49726	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.078263998 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.078285933 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.078284979 CET	49733	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:17.078300953 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.078427076 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.078452110 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.078497887 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.078532934 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.078675985 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.078691006 CET	443	49726	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.078711033 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.078766108 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:17.078874111 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.078922987 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.079020977 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.079725027 CET	49734	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.079747915 CET	443	49734	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.080063105 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.080147028 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.080184937 CET	49730	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.080185890 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.080224991 CET	443	49730	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.080259085 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.080284119 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.080284119 CET	49729	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.080305099 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.080307007 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.080379009 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.080394030 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.080420971 CET	49726	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.080432892 CET	443	49726	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.080503941 CET	49733	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:17.080574989 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:17.080631018 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.080662966 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.080692053 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.080708981 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.080801964 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.080832958 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.085345984 CET	443	49732	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.085406065 CET	443	49732	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.085606098 CET	49732	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:17.085666895 CET	443	49732	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.085712910 CET	443	49719	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.085743904 CET	49732	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:17.085771084 CET	443	49719	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.085793972 CET	443	49719	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.085827112 CET	49719	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:17.085839033 CET	443	49719	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.085867882 CET	49719	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:17.085877895 CET	49719	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:17.085884094 CET	443	49719	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.086007118 CET	443	49720	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.086054087 CET	443	49720	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.086116076 CET	49720	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:17.086175919 CET	443	49720	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.093065977 CET	443	49721	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.093118906 CET	443	49721	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.093281984 CET	443	49721	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.093451023 CET	49721	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:17.093516111 CET	443	49721	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.093585014 CET	49721	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:17.108606100 CET	443	49732	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.108733892 CET	443	49732	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.108853102 CET	49732	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:17.109015942 CET	443	49720	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.109227896 CET	49720	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:17.109396935 CET	443	49719	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.109464884 CET	49719	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:17.115958929 CET	443	49721	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.116081953 CET	443	49721	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.116478920 CET	49721	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:17.127012014 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.159365892 CET	49734	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.159555912 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.159599066 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.159599066 CET	49733	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:17.159718990 CET	49729	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.159719944 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.159719944 CET	49726	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.167330980 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.223943949 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.224045038 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.224088907 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.224118948 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.224147081 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.224195957 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.224236965 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.224283934 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.224329948 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.224467993 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.224520922 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.224551916 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.225313902 CET	443	49734	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.225441933 CET	443	49734	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.225532055 CET	443	49734	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.225584030 CET	49734	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.225615978 CET	443	49734	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.225703955 CET	443	49734	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.225750923 CET	49734	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.225760937 CET	443	49734	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.225800991 CET	49734	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.225807905 CET	443	49734	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.225919962 CET	443	49734	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.226011038 CET	443	49734	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.226058006 CET	49734	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.226067066 CET	443	49734	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.226106882 CET	49734	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.246579885 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:17.246670008 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:17.246737957 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:17.246819973 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:17.246912956 CET	49733	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:17.246912956 CET	49733	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:17.246980906 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:17.247123957 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:17.247185946 CET	49733	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:17.247195005 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:17.247220993 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:17.247282982 CET	49733	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:17.247309923 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:17.248779058 CET	49730	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.248779058 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.248779058 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.248779058 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.248924017 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.322735071 CET	49720	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:17.322767973 CET	443	49720	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.324374914 CET	49721	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:17.324439049 CET	443	49721	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.340174913 CET	443	49734	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.341058016 CET	443	49734	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.341120958 CET	49734	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.342871904 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.342926025 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.343008995 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.343020916 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.343020916 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.343082905 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.343110085 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.343167067 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.343180895 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.343230963 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.343400955 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.343415022 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.343978882 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.344027042 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.344053030 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.344065905 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.344105959 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.344115973 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.344847918 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.344892025 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.344918013 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.344928980 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.344975948 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.345005035 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.345019102 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.345247984 CET	443	49730	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.345305920 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.345391035 CET	443	49730	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.345551014 CET	49730	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.345652103 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.345731020 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.346214056 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.346225977 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.346648932 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.347536087 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.348062038 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.349826097 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.349883080 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.361196995 CET	49733	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:17.361259937 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:17.361473083 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:17.361546993 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:17.361668110 CET	49733	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:17.361737013 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:17.361987114 CET	49733	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:17.362004995 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:17.362150908 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:17.362210989 CET	49733	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:17.362226009 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:17.362684965 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:17.363049030 CET	49733	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:17.370928049 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.370986938 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.371006966 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.371040106 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.371067047 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.371088028 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.371094942 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.371138096 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.371169090 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.371213913 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.371248960 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.371258974 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.372478008 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.372509003 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.372555971 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.372562885 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.372589111 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.372596025 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.372637033 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.372659922 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.386713982 CET	49732	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:17.386776924 CET	443	49732	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.387420893 CET	49719	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:17.387475014 CET	443	49719	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:17.397516966 CET	49730	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.397579908 CET	443	49730	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.398850918 CET	49734	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.398860931 CET	443	49734	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.399606943 CET	49733	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:17.399669886 CET	443	49733	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:17.426079035 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.426140070 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.426167011 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.426188946 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.426235914 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.426258087 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.426342010 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.426342010 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.426342010 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.426342010 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.426413059 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.426505089 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.427726984 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.427783012 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.427803993 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.427824974 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.427864075 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.427886963 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.427886963 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.427886963 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.427923918 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.427942038 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.427942038 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.427985907 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.428019047 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.428020954 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.428037882 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.428091049 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.428111076 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.428128958 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.428160906 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.428160906 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.428160906 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.428162098 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.428162098 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.428245068 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.428297997 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.430246115 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.430294037 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.430356979 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.430376053 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.430382013 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.430382967 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.430419922 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.430422068 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.430422068 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.430533886 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.443814039 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.443881989 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.443906069 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.443926096 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.443967104 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.443980932 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.443999052 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.444060087 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.444106102 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.444106102 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.444106102 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.444140911 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.445382118 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.445451021 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.445601940 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.445602894 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.445667982 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.445723057 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.451380968 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.451435089 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.451435089 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.451435089 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.461674929 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.461728096 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.461857080 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.461869001 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.461880922 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.461934090 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.461970091 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.461999893 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.462059021 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.462074041 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.462152958 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.462187052 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.462232113 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.462260962 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.462286949 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.462337017 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.462371111 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.462373972 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.462374926 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.462374926 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.462374926 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.462374926 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.462409973 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.462409973 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.462450027 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.462475061 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.462496996 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.462511063 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.462547064 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.462553978 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.462563038 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.462615967 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.463304996 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.463335037 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.463371992 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.463427067 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.463471889 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.463484049 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.463548899 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.464216948 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.464282036 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.464296103 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.464368105 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.464382887 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.464433908 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.464445114 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.464492083 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.465341091 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.465409040 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.465437889 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.465471029 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.465492010 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.465498924 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.465516090 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.465539932 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.465738058 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.465773106 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.465792894 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.465835094 CET	49729	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.465838909 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.465852976 CET	49729	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.465862036 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.465889931 CET	49729	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.465898037 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.465915918 CET	49729	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.465920925 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.465946913 CET	49729	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.466063023 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.466094017 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.466114044 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.466155052 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.466156006 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.466176987 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.466186047 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.466204882 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.466250896 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.466274023 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.466274977 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.466274977 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.466274977 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.466274977 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.466274977 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.466274977 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.466275930 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.466319084 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.466362953 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.466408968 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.466439962 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.466439962 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.466439962 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.466494083 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.466624022 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.467178106 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.467212915 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.467228889 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.467277050 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.467295885 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.467369080 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.467369080 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.467369080 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.467369080 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.467442989 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.467484951 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.467818022 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.467864990 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.467904091 CET	49729	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.467911959 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.467916012 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.467930079 CET	49729	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.467936993 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.467983961 CET	49729	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.467988968 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.468000889 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.468039036 CET	49729	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.468817949 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.468858004 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.468894005 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.468897104 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.468918085 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.468921900 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.468924046 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.468943119 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.468945026 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.468960047 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.468967915 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.468981028 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.468985081 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.468997955 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.469001055 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.469002008 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.469022989 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.469032049 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.469043970 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.469053030 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.469072104 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.469074965 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.469086885 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.469110966 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.469124079 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.469429016 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.469789982 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.469815016 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.469834089 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.469850063 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.469873905 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.469878912 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.469892025 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.469902992 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.470010042 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.470187902 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.470211983 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.470227957 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.470248938 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.470271111 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.470272064 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.470288038 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.470299006 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.470319033 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.470335960 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.470345974 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.470355034 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.470391989 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.470406055 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.470494986 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.470550060 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.470568895 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.470617056 CET	49729	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.470622063 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.470634937 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.470688105 CET	49729	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.471126080 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.471127987 CET	443	49726	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.471189976 CET	443	49726	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.471210957 CET	443	49726	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.471231937 CET	443	49726	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.471252918 CET	49726	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.471261024 CET	443	49726	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.471275091 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.471281052 CET	443	49726	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.471288919 CET	49726	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.471299887 CET	443	49726	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.471333981 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.471339941 CET	49726	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.471353054 CET	443	49726	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.471379042 CET	49726	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.471383095 CET	443	49726	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.471393108 CET	49726	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.471610069 CET	443	49726	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.471672058 CET	49726	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.474543095 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.474564075 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.474761009 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.474770069 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.474770069 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.476154089 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.489146948 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.489214897 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.489240885 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.489260912 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.489284992 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.489294052 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.490058899 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.490118027 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.490154028 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.490161896 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.490192890 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.490202904 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.491610050 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.491655111 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.491684914 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.491692066 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.491715908 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.491731882 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.530580044 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.530648947 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.530677080 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.530697107 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.530719042 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.530738115 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.532674074 CET	49735	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:17.532736063 CET	443	49735	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:17.532974958 CET	49727	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.533036947 CET	443	49727	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.534379959 CET	49729	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.534409046 CET	443	49729	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.535952091 CET	49728	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.536015034 CET	443	49728	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.538912058 CET	49725	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.538974047 CET	443	49725	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.539710999 CET	49731	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.539741039 CET	443	49731	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.541277885 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.541307926 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.541356087 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.541407108 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.541485071 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.541486025 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.541486025 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.541559935 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.541795015 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.541821957 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.541845083 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.541873932 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.541893959 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.541944027 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.541975975 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.542006969 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.542028904 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.543354034 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.543370008 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.543427944 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.543441057 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.543478012 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.543478012 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.544837952 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.544864893 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.544914007 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.544955969 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.544965982 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.544965982 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.544987917 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.545114040 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.545813084 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.545854092 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.545872927 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.545887947 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.545928955 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.546351910 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.546422005 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.546447992 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.546454906 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.546504021 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.546504021 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.548192024 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.548237085 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.548285961 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.548294067 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.548332930 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.548332930 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.578794003 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.578840971 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.578859091 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.578876019 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.578882933 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.578906059 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.578936100 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.578964949 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.579004049 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.579041004 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.579336882 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.579931974 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.580005884 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.580020905 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.580034971 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.580065966 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.580085993 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.581562042 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.581629992 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.581651926 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.581664085 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.581697941 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.581721067 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.583148003 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.583194971 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.583235025 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.583245039 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.583275080 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.583293915 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.606256962 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.606322050 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.606364012 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.606390953 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.606409073 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.606507063 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.606559038 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.606616020 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.606616020 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.606628895 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.606787920 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.607536077 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.607580900 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.607623100 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.607629061 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.607650995 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.607665062 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.610749960 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.610795021 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.610848904 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.610855103 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.611053944 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.611054897 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.611547947 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.611596107 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.611634016 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.611676931 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.611690044 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.611733913 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.612458944 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.612502098 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.612535000 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.612541914 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.612566948 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.612580061 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.629283905 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.647727966 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.647802114 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.647855043 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.647864103 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.647892952 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.647902966 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.663131952 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.663161993 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.663237095 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.663252115 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.663294077 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.663294077 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.663888931 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.663911104 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.664004087 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.664011955 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.664062977 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.664541960 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.664613008 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.664665937 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.664665937 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.664674044 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.664720058 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.665611982 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.665632963 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.665678024 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.665682077 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.665693045 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.665744066 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.665744066 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.666747093 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.666768074 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.666810989 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.666872025 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.666872025 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.666879892 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.666915894 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.668797970 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.668840885 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.668879032 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.668885946 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.668940067 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.668940067 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.669194937 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.669229031 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.669269085 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.669275999 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.669291019 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.669318914 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.669800043 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.669873953 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.677406073 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.677468061 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.677645922 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.677645922 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.677721024 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.677812099 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.678550959 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.678621054 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.678767920 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.678767920 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.678832054 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.679095030 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.679171085 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.679224014 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.679260015 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.679295063 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.679362059 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.679362059 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.680181026 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.680224895 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.680269003 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.680282116 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.680310965 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.680429935 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.682109118 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.682157993 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.682210922 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.682221889 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.682252884 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.682271957 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.682946920 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.682988882 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.683043003 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.683053017 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.683089018 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.683109999 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.683862925 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.683907032 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.683938980 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.683949947 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.683990002 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.684014082 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.722795010 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.722888947 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.722898960 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.722950935 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.722974062 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.723289013 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.779249907 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.779335022 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.779529095 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.779743910 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.779915094 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.779997110 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.780145884 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.780213118 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.780257940 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.780257940 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.780270100 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.780349970 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.780495882 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.780503035 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.780610085 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.780617952 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.780678988 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.780721903 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.780721903 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.780738115 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.780761003 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.780822039 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.780822039 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.780877113 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.780978918 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.781002045 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.781008005 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.781064034 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.781064034 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.781095982 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.781148911 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.781202078 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.781250954 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.781270981 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.781277895 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.781315088 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.781377077 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.781471968 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.794523001 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.794584990 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.794640064 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.794720888 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.794769049 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.794769049 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.794996023 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.795037031 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.795084000 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.795101881 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.795130968 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.795336008 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.795373917 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.795411110 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.795428038 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.795449972 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.795522928 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.796572924 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.798162937 CET	443	49736	142.250.186.132	192.168.2.5
Nov 15, 2024 15:59:17.821490049 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.821515083 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.821574926 CET	49718	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:17.821583033 CET	443	49718	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:17.834542036 CET	49736	443	192.168.2.5	142.250.186.132
Nov 15, 2024 15:59:17.834604025 CET	443	49736	142.250.186.132	192.168.2.5
Nov 15, 2024 15:59:17.837347031 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.837728024 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.838546038 CET	49722	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.838612080 CET	443	49722	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.838670969 CET	443	49736	142.250.186.132	192.168.2.5
Nov 15, 2024 15:59:17.838885069 CET	49736	443	192.168.2.5	142.250.186.132
Nov 15, 2024 15:59:17.840265989 CET	49726	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:17.840298891 CET	443	49726	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:17.852140903 CET	49736	443	192.168.2.5	142.250.186.132
Nov 15, 2024 15:59:17.852509975 CET	443	49736	142.250.186.132	192.168.2.5
Nov 15, 2024 15:59:17.859806061 CET	49724	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.859836102 CET	443	49724	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.860599041 CET	49723	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:17.860624075 CET	443	49723	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:17.946685076 CET	49736	443	192.168.2.5	142.250.186.132
Nov 15, 2024 15:59:17.946744919 CET	443	49736	142.250.186.132	192.168.2.5
Nov 15, 2024 15:59:18.040647030 CET	49739	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:18.040733099 CET	443	49739	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:18.040807962 CET	49739	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:18.042810917 CET	49739	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:18.042853117 CET	443	49739	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:18.139676094 CET	49736	443	192.168.2.5	142.250.186.132
Nov 15, 2024 15:59:18.810198069 CET	49740	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:18.810292006 CET	443	49740	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:18.810398102 CET	49740	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:18.833760977 CET	49741	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:18.833846092 CET	443	49741	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:18.833934069 CET	49741	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:18.834500074 CET	49742	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:18.834547997 CET	443	49742	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:18.834641933 CET	49742	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:18.835247993 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:18.835308075 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:18.835366011 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:18.835971117 CET	49744	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:18.835982084 CET	443	49744	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:18.836071968 CET	49744	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:18.836595058 CET	49740	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:18.836674929 CET	443	49740	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:18.836931944 CET	49741	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:18.837011099 CET	443	49741	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:18.837061882 CET	49742	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:18.837089062 CET	443	49742	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:18.837188959 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:18.837207079 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:18.837536097 CET	49744	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:18.837549925 CET	443	49744	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:18.879776955 CET	49716	443	192.168.2.5	20.12.23.50
Nov 15, 2024 15:59:18.880099058 CET	443	49739	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:18.880635023 CET	49745	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:18.880712986 CET	443	49745	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:18.880801916 CET	49739	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:18.880829096 CET	443	49739	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:18.880897045 CET	49745	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:18.881114006 CET	49745	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:18.881148100 CET	443	49745	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:18.884423018 CET	443	49739	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:18.884494066 CET	49739	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:18.896603107 CET	49739	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:18.896738052 CET	49739	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:18.896750927 CET	443	49739	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:18.896908998 CET	443	49739	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:18.923408985 CET	443	49716	20.12.23.50	192.168.2.5
Nov 15, 2024 15:59:18.930906057 CET	49746	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:18.930948973 CET	443	49746	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:18.931005955 CET	49746	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:18.965591908 CET	49747	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:18.965657949 CET	443	49747	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:18.965723991 CET	49747	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:18.971160889 CET	49748	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:18.971246004 CET	443	49748	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:18.971362114 CET	49748	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:18.994051933 CET	49749	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:18.994138002 CET	443	49749	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:18.994185925 CET	49746	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:18.994221926 CET	443	49746	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:18.994411945 CET	49749	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:18.994411945 CET	49749	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:18.994543076 CET	443	49749	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:19.009577036 CET	49750	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:19.009617090 CET	443	49750	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:19.009691000 CET	49750	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:19.014652014 CET	49747	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:19.014691114 CET	443	49747	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:19.016366959 CET	49748	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:19.016386986 CET	443	49748	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:19.018006086 CET	49750	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:19.018044949 CET	443	49750	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:19.064322948 CET	49739	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:19.064352989 CET	443	49739	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:19.142297029 CET	443	49739	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:19.142359972 CET	49739	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:19.142374992 CET	443	49739	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:19.142437935 CET	443	49739	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:19.142488956 CET	49739	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:19.163806915 CET	443	49716	20.12.23.50	192.168.2.5
Nov 15, 2024 15:59:19.163866043 CET	443	49716	20.12.23.50	192.168.2.5
Nov 15, 2024 15:59:19.163887978 CET	443	49716	20.12.23.50	192.168.2.5
Nov 15, 2024 15:59:19.163923025 CET	49716	443	192.168.2.5	20.12.23.50
Nov 15, 2024 15:59:19.163930893 CET	443	49716	20.12.23.50	192.168.2.5
Nov 15, 2024 15:59:19.163952112 CET	443	49716	20.12.23.50	192.168.2.5
Nov 15, 2024 15:59:19.163973093 CET	443	49716	20.12.23.50	192.168.2.5
Nov 15, 2024 15:59:19.163975000 CET	49716	443	192.168.2.5	20.12.23.50
Nov 15, 2024 15:59:19.163975000 CET	49716	443	192.168.2.5	20.12.23.50
Nov 15, 2024 15:59:19.164004087 CET	49716	443	192.168.2.5	20.12.23.50
Nov 15, 2024 15:59:19.164005995 CET	443	49716	20.12.23.50	192.168.2.5
Nov 15, 2024 15:59:19.164024115 CET	49716	443	192.168.2.5	20.12.23.50
Nov 15, 2024 15:59:19.164083004 CET	49716	443	192.168.2.5	20.12.23.50
Nov 15, 2024 15:59:19.164113998 CET	443	49716	20.12.23.50	192.168.2.5
Nov 15, 2024 15:59:19.164132118 CET	443	49716	20.12.23.50	192.168.2.5
Nov 15, 2024 15:59:19.164164066 CET	49716	443	192.168.2.5	20.12.23.50
Nov 15, 2024 15:59:19.164191008 CET	49716	443	192.168.2.5	20.12.23.50
Nov 15, 2024 15:59:19.164216042 CET	443	49716	20.12.23.50	192.168.2.5
Nov 15, 2024 15:59:19.164359093 CET	443	49716	20.12.23.50	192.168.2.5
Nov 15, 2024 15:59:19.164407015 CET	49716	443	192.168.2.5	20.12.23.50
Nov 15, 2024 15:59:19.197216034 CET	49739	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:19.197237968 CET	443	49739	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:19.439743996 CET	443	49741	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:19.488506079 CET	443	49742	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:19.521420002 CET	49741	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:19.521480083 CET	443	49741	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:19.521580935 CET	49742	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:19.521608114 CET	443	49742	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:19.523081064 CET	443	49741	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:19.523102045 CET	443	49741	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:19.523101091 CET	443	49742	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:19.523158073 CET	49741	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:19.523945093 CET	49742	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:19.524128914 CET	49741	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:19.524287939 CET	49741	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:19.524302959 CET	443	49741	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:19.524315119 CET	49742	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:19.524338961 CET	443	49742	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:19.524364948 CET	443	49741	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:19.571326971 CET	443	49742	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:19.648299932 CET	49741	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:19.648359060 CET	443	49741	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:19.663598061 CET	49742	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:19.686065912 CET	443	49741	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:19.686111927 CET	443	49741	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:19.686167002 CET	49741	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:19.686235905 CET	443	49741	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:19.686278105 CET	443	49741	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:19.686325073 CET	49741	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:19.686325073 CET	49741	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:19.686367035 CET	443	49741	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:19.686393976 CET	443	49741	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:19.686445951 CET	49741	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:19.691225052 CET	443	49740	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:19.752541065 CET	443	49749	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:19.754477978 CET	443	49746	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:19.758088112 CET	443	49745	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:19.762717009 CET	443	49750	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:19.765074968 CET	443	49747	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:19.809720039 CET	443	49742	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:19.833206892 CET	443	49742	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:19.833564997 CET	49742	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:19.861105919 CET	49745	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:19.861105919 CET	49747	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:19.861183882 CET	49740	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:19.861183882 CET	49750	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:19.896949053 CET	443	49744	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:19.899255037 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:19.925503016 CET	49746	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:19.925648928 CET	49749	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:20.054558039 CET	49744	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:20.069725990 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:20.892715931 CET	443	49748	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:20.966365099 CET	49748	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:21.876228094 CET	49740	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:21.876308918 CET	443	49740	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:21.876321077 CET	49745	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:21.876403093 CET	443	49745	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:21.876677036 CET	49744	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:21.876713037 CET	443	49744	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:21.876799107 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:21.876863956 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:21.878463984 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:21.878484011 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:21.878546000 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:21.879942894 CET	49748	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:21.879972935 CET	443	49748	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:21.880127907 CET	443	49740	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:21.880158901 CET	443	49740	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:21.880199909 CET	49740	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:21.880217075 CET	443	49745	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:21.880254030 CET	443	49745	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:21.880290031 CET	49745	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:21.880462885 CET	443	49744	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:21.880491972 CET	443	49744	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:21.880578041 CET	49744	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:21.880744934 CET	49748	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:21.880757093 CET	443	49748	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:21.881171942 CET	49747	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:21.881201029 CET	443	49747	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:21.881618977 CET	49747	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:21.881629944 CET	443	49747	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:21.881936073 CET	49749	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:21.882010937 CET	443	49749	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:21.882262945 CET	49749	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:21.882276058 CET	443	49749	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:21.882463932 CET	49746	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:21.882486105 CET	443	49746	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:21.882997990 CET	49746	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:21.883002043 CET	443	49746	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:21.883222103 CET	49750	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:21.883249044 CET	443	49750	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:21.883686066 CET	49750	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:21.883696079 CET	443	49750	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:21.959675074 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:21.959741116 CET	49740	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:21.959745884 CET	49745	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:21.972282887 CET	49744	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.007797956 CET	443	49748	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.007857084 CET	443	49748	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.007925034 CET	49748	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.007946968 CET	443	49748	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.007986069 CET	443	49746	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.007994890 CET	49748	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.007996082 CET	443	49748	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.008043051 CET	443	49746	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.008043051 CET	49748	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.008091927 CET	49746	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.008102894 CET	443	49746	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.008138895 CET	49746	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.008187056 CET	443	49746	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.008225918 CET	49746	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.010031939 CET	443	49750	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.010175943 CET	443	49750	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.010231018 CET	49750	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.011286020 CET	443	49747	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.011509895 CET	443	49747	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.011555910 CET	49747	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.012392998 CET	443	49749	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.012444973 CET	443	49749	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.012494087 CET	49749	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.012507915 CET	443	49749	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.012578964 CET	443	49749	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.012626886 CET	49749	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.037761927 CET	49740	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:22.038007021 CET	443	49740	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:22.038012981 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.038289070 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.038369894 CET	49745	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:22.038698912 CET	443	49745	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:22.039498091 CET	49744	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.039865971 CET	443	49744	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.040632010 CET	49740	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:22.040664911 CET	443	49740	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:22.040708065 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.040735960 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.040751934 CET	49745	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:22.040777922 CET	443	49745	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:22.046379089 CET	49748	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.046379089 CET	49748	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.046417952 CET	443	49748	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.046442032 CET	443	49748	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.047058105 CET	49747	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.047075987 CET	443	49747	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.047122955 CET	49747	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.047131062 CET	443	49747	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.047831059 CET	49749	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.047848940 CET	443	49749	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.047863007 CET	49749	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.047878981 CET	443	49749	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.049516916 CET	49746	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.049526930 CET	443	49746	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.049537897 CET	49746	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.049542904 CET	443	49746	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.050185919 CET	49750	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.050204992 CET	443	49750	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.050229073 CET	49750	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.050241947 CET	443	49750	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.086713076 CET	49716	443	192.168.2.5	20.12.23.50
Nov 15, 2024 15:59:22.086713076 CET	49716	443	192.168.2.5	20.12.23.50
Nov 15, 2024 15:59:22.086779118 CET	443	49716	20.12.23.50	192.168.2.5
Nov 15, 2024 15:59:22.086843967 CET	443	49716	20.12.23.50	192.168.2.5
Nov 15, 2024 15:59:22.088074923 CET	49742	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:22.088100910 CET	443	49742	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:22.093943119 CET	49753	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.093976974 CET	443	49753	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.094054937 CET	49753	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.094985962 CET	49741	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:22.095005035 CET	443	49741	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:22.114481926 CET	49754	443	192.168.2.5	104.18.32.137
Nov 15, 2024 15:59:22.114502907 CET	443	49754	104.18.32.137	192.168.2.5
Nov 15, 2024 15:59:22.114557028 CET	49754	443	192.168.2.5	104.18.32.137
Nov 15, 2024 15:59:22.114803076 CET	49754	443	192.168.2.5	104.18.32.137
Nov 15, 2024 15:59:22.114816904 CET	443	49754	104.18.32.137	192.168.2.5
Nov 15, 2024 15:59:22.117415905 CET	49753	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.117434978 CET	443	49753	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.124033928 CET	49744	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.124044895 CET	443	49744	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.250206947 CET	49744	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.263366938 CET	443	49745	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:22.263436079 CET	49745	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:22.265378952 CET	49740	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:22.265605927 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.271476030 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.295897961 CET	443	49745	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:22.295958042 CET	443	49745	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:22.295979977 CET	443	49745	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:22.296001911 CET	443	49745	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:22.296039104 CET	443	49745	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:22.296061039 CET	443	49745	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:22.296139002 CET	49745	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:22.296139956 CET	49745	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:22.296139956 CET	49745	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:22.296211004 CET	443	49745	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:22.296250105 CET	443	49745	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:22.296372890 CET	49745	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:22.390502930 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.390532970 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.390552998 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.390578032 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.390597105 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.390618086 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.390629053 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.390650034 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.390650988 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.390667915 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.390697956 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.390728951 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.392203093 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.392222881 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.392288923 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.392292023 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.392308950 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.392328978 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.392342091 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.392347097 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.392364979 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.392385006 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.392404079 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.392427921 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.459755898 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.459774017 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.509448051 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.509480000 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.509515047 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.509526968 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.509552002 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.509557009 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.509572983 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.509581089 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.509599924 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.509608984 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.509627104 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.509634972 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.509649038 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.509778023 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.509825945 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.509843111 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.509887934 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.509932041 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:22.509985924 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:22.589545965 CET	443	49740	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:22.589720011 CET	443	49740	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:22.589795113 CET	49740	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:22.736793041 CET	443	49754	104.18.32.137	192.168.2.5
Nov 15, 2024 15:59:22.746151924 CET	49755	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.746247053 CET	443	49755	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:22.746400118 CET	49755	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:22.846611977 CET	49754	443	192.168.2.5	104.18.32.137
Nov 15, 2024 15:59:22.857703924 CET	443	49753	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:23.045021057 CET	49753	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:24.311578035 CET	49754	443	192.168.2.5	104.18.32.137
Nov 15, 2024 15:59:24.311666012 CET	443	49754	104.18.32.137	192.168.2.5
Nov 15, 2024 15:59:24.315515995 CET	443	49754	104.18.32.137	192.168.2.5
Nov 15, 2024 15:59:24.315551043 CET	443	49754	104.18.32.137	192.168.2.5
Nov 15, 2024 15:59:24.315593958 CET	49754	443	192.168.2.5	104.18.32.137
Nov 15, 2024 15:59:24.322206020 CET	49756	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:24.322307110 CET	443	49756	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:24.322462082 CET	49756	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:24.326865911 CET	49755	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:24.326894999 CET	443	49755	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:24.327294111 CET	49753	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:24.327307940 CET	443	49753	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:24.328882933 CET	49753	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:24.328888893 CET	443	49753	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:24.330635071 CET	49757	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:24.330679893 CET	443	49757	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:24.330836058 CET	49757	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:24.331340075 CET	49757	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:24.331357956 CET	443	49757	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:24.341257095 CET	49754	443	192.168.2.5	104.18.32.137
Nov 15, 2024 15:59:24.341450930 CET	443	49754	104.18.32.137	192.168.2.5
Nov 15, 2024 15:59:24.343427896 CET	49754	443	192.168.2.5	104.18.32.137
Nov 15, 2024 15:59:24.343461037 CET	443	49754	104.18.32.137	192.168.2.5
Nov 15, 2024 15:59:24.351960897 CET	49758	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:24.351984978 CET	443	49758	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:24.352077007 CET	49758	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:24.354839087 CET	49756	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:24.354871988 CET	443	49756	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:24.404019117 CET	49743	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:24.404038906 CET	443	49743	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:24.421314001 CET	49758	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:24.421395063 CET	443	49758	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:24.449023962 CET	49754	443	192.168.2.5	104.18.32.137
Nov 15, 2024 15:59:24.502619028 CET	49740	443	192.168.2.5	18.66.107.176
Nov 15, 2024 15:59:24.502685070 CET	443	49740	18.66.107.176	192.168.2.5
Nov 15, 2024 15:59:24.532789946 CET	49745	443	192.168.2.5	18.245.206.63
Nov 15, 2024 15:59:24.532847881 CET	443	49745	18.245.206.63	192.168.2.5
Nov 15, 2024 15:59:24.565802097 CET	49759	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:24.565845966 CET	443	49759	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:24.566036940 CET	49759	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:24.566919088 CET	49759	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:24.566955090 CET	443	49759	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:24.589029074 CET	49760	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:24.589111090 CET	443	49760	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:24.589271069 CET	49760	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:24.589488983 CET	49760	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:24.589510918 CET	443	49760	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:24.630021095 CET	443	49753	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:24.630179882 CET	443	49753	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:24.630239964 CET	443	49754	104.18.32.137	192.168.2.5
Nov 15, 2024 15:59:24.630350113 CET	49753	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:24.630394936 CET	443	49754	104.18.32.137	192.168.2.5
Nov 15, 2024 15:59:24.631098986 CET	49754	443	192.168.2.5	104.18.32.137
Nov 15, 2024 15:59:24.644797087 CET	49753	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:24.644828081 CET	443	49753	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:24.644843102 CET	49753	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:24.644850969 CET	443	49753	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:24.757857084 CET	49761	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:24.757961988 CET	443	49761	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:24.758037090 CET	49761	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:24.758733988 CET	49754	443	192.168.2.5	104.18.32.137
Nov 15, 2024 15:59:24.758764982 CET	443	49754	104.18.32.137	192.168.2.5
Nov 15, 2024 15:59:24.773399115 CET	49761	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:24.773441076 CET	443	49761	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:24.806648970 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:24.806689978 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:24.806754112 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:24.806966066 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:24.806977987 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:24.846699953 CET	49706	443	192.168.2.5	23.1.237.91
Nov 15, 2024 15:59:25.071052074 CET	443	49755	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.084712982 CET	443	49757	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.096348047 CET	443	49756	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.169918060 CET	49757	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:25.248186111 CET	49756	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:25.248239040 CET	49755	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:25.271709919 CET	443	49759	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.273798943 CET	49759	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:25.273829937 CET	443	49759	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.274949074 CET	443	49759	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.275491953 CET	49759	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:25.275633097 CET	49759	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:25.275639057 CET	443	49759	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.275665045 CET	443	49759	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.277414083 CET	443	49760	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.303263903 CET	49760	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:25.303313017 CET	443	49760	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.304490089 CET	443	49760	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.306977987 CET	49760	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:25.307126999 CET	49760	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:25.307140112 CET	443	49760	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.307173967 CET	443	49760	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.328821898 CET	49755	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:25.328847885 CET	443	49755	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.337362051 CET	49755	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:25.337371111 CET	443	49755	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.338012934 CET	49757	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:25.338031054 CET	443	49757	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.338301897 CET	49757	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:25.338306904 CET	443	49757	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.346496105 CET	49756	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:25.346560955 CET	443	49756	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.346900940 CET	49756	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:25.346913099 CET	443	49756	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.359806061 CET	49759	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:25.360112906 CET	49760	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:25.368714094 CET	443	49758	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.414689064 CET	49758	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:25.414712906 CET	443	49758	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.415291071 CET	49758	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:25.415296078 CET	443	49758	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.439471006 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.448704004 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:25.448724031 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.449177980 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.461070061 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:25.461155891 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.461679935 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:25.464632034 CET	443	49755	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.464906931 CET	443	49755	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.464970112 CET	49755	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:25.467363119 CET	443	49757	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.467654943 CET	443	49757	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.467725039 CET	49757	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:25.473118067 CET	443	49759	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.473551035 CET	49755	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:25.473551035 CET	49755	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:25.473622084 CET	443	49755	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.473656893 CET	443	49755	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.476130009 CET	49757	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:25.476145029 CET	443	49757	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.484890938 CET	443	49756	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.485711098 CET	443	49756	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.485794067 CET	49756	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:25.493455887 CET	443	49759	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.493544102 CET	49759	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:25.503330946 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.513638020 CET	443	49761	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.582807064 CET	443	49758	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.582954884 CET	443	49758	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:25.583148956 CET	49758	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:25.583550930 CET	443	49760	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.583605051 CET	443	49760	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.583625078 CET	443	49760	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.583643913 CET	443	49760	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.583681107 CET	443	49760	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.583698988 CET	443	49760	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.583715916 CET	49760	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:25.583775997 CET	443	49760	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.583807945 CET	49760	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:25.583807945 CET	49760	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:25.583857059 CET	443	49760	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.583935022 CET	443	49760	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.583936930 CET	49760	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:25.584014893 CET	443	49760	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.584115982 CET	49760	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:25.585232019 CET	443	49760	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.585350037 CET	443	49760	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:25.585438967 CET	49760	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:25.617614031 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.617675066 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.617757082 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.617806911 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:25.617827892 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.617887974 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.617933035 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:25.617938995 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.617995977 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:25.618000031 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.618088007 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.618252993 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.618295908 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:25.618300915 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.618333101 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:25.618343115 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.647382975 CET	49761	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:25.651798010 CET	49763	443	192.168.2.5	2.19.244.127
Nov 15, 2024 15:59:25.651890993 CET	443	49763	2.19.244.127	192.168.2.5
Nov 15, 2024 15:59:25.652096033 CET	49763	443	192.168.2.5	2.19.244.127
Nov 15, 2024 15:59:25.653506041 CET	49763	443	192.168.2.5	2.19.244.127
Nov 15, 2024 15:59:25.653542042 CET	443	49763	2.19.244.127	192.168.2.5
Nov 15, 2024 15:59:25.739378929 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.739460945 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:25.739475012 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.739562035 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.739613056 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:25.739619017 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.739964962 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.740010977 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:25.740016937 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.740181923 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.740227938 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:25.740232944 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.740492105 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.740547895 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:25.740552902 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.740658998 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.740709066 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:25.740714073 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.741368055 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.741449118 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:25.741455078 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.741482973 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.741529942 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:25.741565943 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.742136002 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.742192984 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:25.742197990 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.742289066 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.742338896 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:25.742342949 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:25.908154964 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:25.908164978 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.006464958 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.006517887 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.006547928 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.006558895 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.006573915 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.006627083 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.006639957 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.006680965 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.006738901 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.006911039 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.006961107 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.006969929 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.007081032 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.007138968 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.007143021 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.007206917 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.007266998 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.007271051 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.007297993 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.007354975 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.007359028 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.007515907 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.007536888 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.007570028 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.007574081 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.007596016 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.007628918 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.007680893 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.007684946 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.007720947 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.007771969 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.007776022 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.007828951 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.007879019 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.007883072 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.007920980 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.007968903 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.007973909 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.008014917 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.008073092 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.008076906 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.008111000 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.008162975 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.008167028 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.008202076 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.008253098 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.008256912 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.011643887 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.011661053 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.011687994 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.011723995 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.011790991 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.011842012 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.011852026 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.011879921 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.011931896 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.011936903 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.011966944 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.012013912 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.012018919 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.012732983 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.012784004 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.012789965 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.012814999 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.012861967 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.012866020 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.013570070 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.013626099 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.013631105 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.013674021 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.013720036 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.013724089 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.013818979 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.014184952 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.014241934 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.014273882 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.014328957 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.014965057 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.015017033 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.015105963 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.015155077 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.016697884 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.016757011 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.016798019 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.016849041 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.016901970 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.016952038 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.017038107 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.017092943 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.017124891 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.017180920 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.017801046 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.017855883 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.017896891 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.017957926 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.018615007 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.018672943 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.019026041 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.019088984 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.019120932 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.019171000 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.019908905 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.019964933 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.019994974 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.020046949 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.020642042 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.020713091 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.020740032 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.020792007 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.020817995 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.020870924 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.021625996 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.021689892 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.104435921 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.104513884 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.104537964 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.104551077 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.104592085 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.104600906 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.104654074 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.104779005 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.104832888 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.104840994 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.104863882 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.104897976 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.104907990 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.105310917 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.105372906 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.105390072 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.105432034 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.105457067 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.105773926 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.105814934 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.105829000 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.105848074 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.105879068 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.106281042 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.106337070 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.106358051 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.106364965 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.106395960 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.106797934 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.106836081 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.106873035 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.106878996 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.106887102 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.107434034 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.107472897 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.107508898 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.107515097 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.107558966 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.110933065 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.110970020 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.111010075 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.111015081 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.111047983 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.111212015 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.111252069 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.111272097 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.111278057 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.111320972 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.111638069 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.111680984 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.111702919 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.111707926 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.111737967 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.111973047 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.112020016 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.112025023 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.112051010 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.112082005 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.112302065 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.112340927 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.112353086 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.112375021 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.112404108 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.113039017 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.113090038 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.113097906 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.113120079 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.113154888 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.113260984 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.113297939 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.113315105 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.113321066 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.113347054 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.113362074 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.113364935 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.113456011 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.113502979 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.214976072 CET	49756	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.214976072 CET	49756	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.215048075 CET	443	49756	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:26.215084076 CET	443	49756	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:26.465569019 CET	49761	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.465668917 CET	443	49761	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:26.465868950 CET	49761	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.465887070 CET	443	49761	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:26.518301010 CET	49758	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.518301964 CET	49758	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.518371105 CET	443	49758	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:26.518409014 CET	443	49758	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:26.519228935 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.531953096 CET	49764	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.532001019 CET	443	49764	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:26.532068968 CET	49764	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.546456099 CET	49765	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.546546936 CET	443	49765	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:26.546818018 CET	49764	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.546849966 CET	49765	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.546852112 CET	443	49764	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:26.552535057 CET	49765	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.552572012 CET	443	49765	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:26.553684950 CET	49766	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.553709030 CET	443	49766	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:26.553875923 CET	49766	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.554131031 CET	49766	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.554157019 CET	443	49766	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:26.554945946 CET	49767	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.554975986 CET	443	49767	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:26.555341959 CET	49767	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.555480957 CET	49767	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.555507898 CET	443	49767	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:26.556725025 CET	443	49763	2.19.244.127	192.168.2.5
Nov 15, 2024 15:59:26.556787014 CET	49763	443	192.168.2.5	2.19.244.127
Nov 15, 2024 15:59:26.558764935 CET	49759	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:26.558789015 CET	443	49759	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:26.600625038 CET	443	49761	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:26.600701094 CET	443	49761	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:26.601121902 CET	49761	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.607652903 CET	49763	443	192.168.2.5	2.19.244.127
Nov 15, 2024 15:59:26.607691050 CET	443	49763	2.19.244.127	192.168.2.5
Nov 15, 2024 15:59:26.608575106 CET	443	49763	2.19.244.127	192.168.2.5
Nov 15, 2024 15:59:26.658025026 CET	49763	443	192.168.2.5	2.19.244.127
Nov 15, 2024 15:59:26.768829107 CET	49761	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.768829107 CET	49761	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.768910885 CET	443	49761	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:26.768949986 CET	443	49761	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:26.771446943 CET	49768	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.771531105 CET	443	49768	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:26.771647930 CET	49768	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.820277929 CET	49769	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:26.820374012 CET	443	49769	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:26.820463896 CET	49769	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:26.820960045 CET	49769	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:26.820997953 CET	443	49769	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:26.835452080 CET	49768	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:26.835530043 CET	443	49768	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:26.871823072 CET	49760	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:26.871890068 CET	443	49760	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:26.884610891 CET	49763	443	192.168.2.5	2.19.244.127
Nov 15, 2024 15:59:26.902817011 CET	49762	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.902833939 CET	443	49762	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.917802095 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.917850971 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.917917013 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.918096066 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:26.918111086 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:26.927355051 CET	443	49763	2.19.244.127	192.168.2.5
Nov 15, 2024 15:59:27.141943932 CET	443	49763	2.19.244.127	192.168.2.5
Nov 15, 2024 15:59:27.142082930 CET	443	49763	2.19.244.127	192.168.2.5
Nov 15, 2024 15:59:27.142174959 CET	49763	443	192.168.2.5	2.19.244.127
Nov 15, 2024 15:59:27.142515898 CET	49763	443	192.168.2.5	2.19.244.127
Nov 15, 2024 15:59:27.142554998 CET	443	49763	2.19.244.127	192.168.2.5
Nov 15, 2024 15:59:27.307415962 CET	443	49764	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:27.328449965 CET	443	49767	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:27.332743883 CET	443	49766	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:27.333194971 CET	443	49765	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:27.451338053 CET	49764	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:27.451339006 CET	49766	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:27.466934919 CET	49767	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:27.467071056 CET	49765	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:27.469499111 CET	443	49769	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:27.582705021 CET	443	49768	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:27.582817078 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:27.599857092 CET	49769	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:27.748290062 CET	49768	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:27.748398066 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:27.801275015 CET	443	49736	142.250.186.132	192.168.2.5
Nov 15, 2024 15:59:27.801373959 CET	443	49736	142.250.186.132	192.168.2.5
Nov 15, 2024 15:59:27.801574945 CET	49736	443	192.168.2.5	142.250.186.132
Nov 15, 2024 15:59:29.630727053 CET	49768	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:29.630806923 CET	443	49768	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:29.631599903 CET	49768	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:29.631616116 CET	443	49768	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:29.632643938 CET	49765	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:29.632726908 CET	443	49765	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:29.633546114 CET	49765	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:29.633560896 CET	443	49765	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:29.643743038 CET	49764	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:29.643815041 CET	443	49764	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:29.644043922 CET	49764	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:29.644057035 CET	443	49764	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:29.756584883 CET	443	49768	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:29.756927967 CET	443	49768	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:29.757000923 CET	49768	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:29.761915922 CET	443	49765	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:29.762053967 CET	443	49765	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:29.762233973 CET	49765	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:29.769149065 CET	443	49764	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:29.769227028 CET	443	49764	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:29.769296885 CET	49764	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:29.825252056 CET	49769	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:29.825344086 CET	443	49769	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:29.825428963 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:29.825514078 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:29.826733112 CET	443	49769	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:29.826909065 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:29.939539909 CET	49769	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:29.939713955 CET	443	49769	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:29.939780951 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:29.939960957 CET	49769	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:29.939999104 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:29.940026045 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:29.940160990 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:29.941287041 CET	49767	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:29.941365957 CET	443	49767	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:29.941780090 CET	49767	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:29.941795111 CET	443	49767	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:29.942470074 CET	49765	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:29.942502022 CET	443	49765	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:29.942539930 CET	49765	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:29.942554951 CET	443	49765	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:29.942668915 CET	49764	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:29.942670107 CET	49764	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:29.942727089 CET	443	49764	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:29.942760944 CET	443	49764	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:29.983345985 CET	443	49769	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:30.019779921 CET	49766	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:30.019819021 CET	443	49766	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:30.020108938 CET	49766	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:30.020119905 CET	443	49766	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:30.069917917 CET	443	49767	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:30.070071936 CET	443	49767	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:30.070143938 CET	49767	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:30.092040062 CET	443	49769	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:30.092065096 CET	443	49769	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:30.092284918 CET	49769	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:30.092355013 CET	443	49769	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:30.101948023 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.102072954 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.102112055 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.102189064 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.102258921 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.102274895 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.102375031 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.102421999 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.102438927 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.102534056 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.102643013 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.102703094 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.102718115 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.102850914 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.114854097 CET	443	49769	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:30.115051985 CET	49769	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:30.155165911 CET	443	49766	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:30.155293941 CET	443	49766	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:30.155575037 CET	49766	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:30.223560095 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.223747969 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.223814011 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.223833084 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.223865986 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.223931074 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.223957062 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.224556923 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.224651098 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.224714994 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.224744081 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.224796057 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.224811077 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.224929094 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.224982023 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.224994898 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.225087881 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.225298882 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.225311995 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.225405931 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.225495100 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.225541115 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.225555897 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.225708961 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.225730896 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.225763083 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.225970984 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.226031065 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.226193905 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.226239920 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.226249933 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.341928005 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.345231056 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.345422983 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.345480919 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.345521927 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.345623016 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.345711946 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.345762014 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.345783949 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.345887899 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.345937014 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.345947981 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.345988989 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.345997095 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.346126080 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.346236944 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.346244097 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.346273899 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.346333027 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.346340895 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.346371889 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.346657038 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.346681118 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.346713066 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.346889019 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.346910000 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.346947908 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.346961021 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.346976042 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.347757101 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.347816944 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.347829103 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.347860098 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.347915888 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.347923994 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.347965002 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.348015070 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.348022938 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.348109961 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.348639011 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.348702908 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.348747015 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.348799944 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.349627018 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.349703074 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.349713087 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.349740982 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.349764109 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.349776983 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.467307091 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.467418909 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.467488050 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.467552900 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:30.467593908 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.467745066 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:30.467803955 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:31.619658947 CET	49768	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:31.619658947 CET	49768	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:31.619735003 CET	443	49768	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:31.619765997 CET	443	49768	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:31.621802092 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:31.622909069 CET	49767	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:31.622909069 CET	49767	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:31.622982025 CET	443	49767	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:31.623014927 CET	443	49767	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:31.623792887 CET	49766	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:31.623826027 CET	443	49766	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:31.623848915 CET	49766	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:31.623857975 CET	443	49766	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:31.634110928 CET	49772	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:31.634196043 CET	443	49772	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:31.634279966 CET	49772	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:31.645241976 CET	49772	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:31.645317078 CET	443	49772	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:31.654047966 CET	49773	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:31.654083967 CET	443	49773	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:31.654145002 CET	49773	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:31.655339956 CET	49773	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:31.655359030 CET	443	49773	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:31.663392067 CET	49774	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:31.663475990 CET	443	49774	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:31.663557053 CET	49774	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:31.663664103 CET	49774	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:31.663687944 CET	443	49774	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:31.671788931 CET	49769	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:31.671823978 CET	443	49769	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:31.704046011 CET	49775	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:31.704075098 CET	443	49775	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:31.704401970 CET	49775	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:31.711074114 CET	49771	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:31.711101055 CET	443	49771	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:31.733051062 CET	49736	443	192.168.2.5	142.250.186.132
Nov 15, 2024 15:59:31.733115911 CET	443	49736	142.250.186.132	192.168.2.5
Nov 15, 2024 15:59:31.733335018 CET	49776	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:31.733362913 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:31.733447075 CET	49776	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:31.733764887 CET	49776	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:31.733782053 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:31.734314919 CET	49777	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:31.734354973 CET	443	49777	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:31.734411955 CET	49777	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:31.734672070 CET	49777	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:31.734688997 CET	443	49777	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:31.737198114 CET	49775	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:31.737220049 CET	443	49775	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:31.739106894 CET	49778	443	192.168.2.5	2.19.244.127
Nov 15, 2024 15:59:31.739125013 CET	443	49778	2.19.244.127	192.168.2.5
Nov 15, 2024 15:59:31.739248037 CET	49778	443	192.168.2.5	2.19.244.127
Nov 15, 2024 15:59:31.739411116 CET	49778	443	192.168.2.5	2.19.244.127
Nov 15, 2024 15:59:31.739425898 CET	443	49778	2.19.244.127	192.168.2.5
Nov 15, 2024 15:59:31.749442101 CET	49779	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:31.749464989 CET	443	49779	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:31.749530077 CET	49779	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:31.755155087 CET	49779	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:31.755171061 CET	443	49779	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.344502926 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.353250027 CET	443	49777	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.381704092 CET	443	49772	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.385421038 CET	49776	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.385452986 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.385550976 CET	49777	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.385612011 CET	443	49777	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.386746883 CET	443	49777	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.386861086 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.396500111 CET	443	49773	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.403063059 CET	49772	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.403095007 CET	443	49772	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.404490948 CET	49772	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.404498100 CET	443	49772	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.412363052 CET	49777	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.412476063 CET	49776	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.412578106 CET	49777	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.412606001 CET	443	49777	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.412611008 CET	49776	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.412627935 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.412708044 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.412918091 CET	443	49777	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.414498091 CET	49773	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.414515018 CET	443	49773	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.415014029 CET	49773	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.415021896 CET	443	49773	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.486079931 CET	443	49775	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.488226891 CET	49776	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.505590916 CET	443	49779	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.529856920 CET	443	49772	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.530010939 CET	443	49772	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.530081034 CET	49772	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.540685892 CET	443	49773	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.540834904 CET	443	49773	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.540977955 CET	49773	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.542794943 CET	49775	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.542817116 CET	443	49775	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.543036938 CET	49779	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.543098927 CET	49775	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.543112993 CET	443	49779	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.543113947 CET	443	49775	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.543323040 CET	49773	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.543323040 CET	49773	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.543339968 CET	443	49773	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.543363094 CET	443	49773	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.543553114 CET	49779	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.543572903 CET	443	49779	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.545206070 CET	49772	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.545206070 CET	49772	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.545249939 CET	443	49772	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.545274973 CET	443	49772	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.554869890 CET	49780	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.554892063 CET	443	49780	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.555079937 CET	49780	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.555286884 CET	49780	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.555299997 CET	443	49780	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.556345940 CET	49781	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.556397915 CET	443	49781	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.556617022 CET	49781	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.558228016 CET	49781	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.558258057 CET	443	49781	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.562427044 CET	49777	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.583653927 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.583739042 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.583800077 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.583841085 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.583856106 CET	49776	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.583889008 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.583904028 CET	49776	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.583931923 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.583971024 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.584009886 CET	49776	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.584012032 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.584031105 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.584064960 CET	49776	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.584074974 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.584114075 CET	49776	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.584357977 CET	443	49777	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.584486008 CET	443	49777	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.584578037 CET	443	49777	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.584628105 CET	49777	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.584638119 CET	443	49777	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.584681034 CET	49777	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.584686041 CET	443	49777	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.584790945 CET	443	49777	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.584852934 CET	49777	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.584857941 CET	443	49777	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.584934950 CET	443	49777	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.584999084 CET	49777	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.585004091 CET	443	49777	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.585089922 CET	443	49777	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.585134029 CET	49777	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.585139036 CET	443	49777	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.585344076 CET	443	49777	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.585393906 CET	49777	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.588620901 CET	49777	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.588637114 CET	443	49777	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.610192060 CET	443	49778	2.19.244.127	192.168.2.5
Nov 15, 2024 15:59:32.610836029 CET	49778	443	192.168.2.5	2.19.244.127
Nov 15, 2024 15:59:32.611824036 CET	49778	443	192.168.2.5	2.19.244.127
Nov 15, 2024 15:59:32.611835003 CET	443	49778	2.19.244.127	192.168.2.5
Nov 15, 2024 15:59:32.612041950 CET	443	49778	2.19.244.127	192.168.2.5
Nov 15, 2024 15:59:32.616908073 CET	49778	443	192.168.2.5	2.19.244.127
Nov 15, 2024 15:59:32.663331985 CET	443	49778	2.19.244.127	192.168.2.5
Nov 15, 2024 15:59:32.672875881 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.672946930 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.673010111 CET	49776	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.673021078 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.673049927 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.673146963 CET	49776	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.698026896 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.698173046 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.698216915 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.698285103 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.698286057 CET	49776	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.699120045 CET	49776	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.702833891 CET	443	49779	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.703000069 CET	443	49779	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.703123093 CET	49779	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.728497982 CET	443	49775	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.729341984 CET	443	49775	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.729535103 CET	49775	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.745809078 CET	49779	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.745830059 CET	443	49779	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.745843887 CET	49779	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.745851040 CET	443	49779	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.753701925 CET	49775	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.753701925 CET	49775	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:32.753724098 CET	443	49775	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.753734112 CET	443	49775	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:32.774441957 CET	49776	443	192.168.2.5	104.18.86.42
Nov 15, 2024 15:59:32.774497032 CET	443	49776	104.18.86.42	192.168.2.5
Nov 15, 2024 15:59:32.876627922 CET	443	49778	2.19.244.127	192.168.2.5
Nov 15, 2024 15:59:32.877814054 CET	443	49778	2.19.244.127	192.168.2.5
Nov 15, 2024 15:59:32.878015995 CET	49778	443	192.168.2.5	2.19.244.127
Nov 15, 2024 15:59:33.169076920 CET	49782	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:33.169138908 CET	443	49782	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:33.169215918 CET	49782	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:33.172008991 CET	49782	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:33.172034979 CET	443	49782	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:33.311686993 CET	443	49780	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.316749096 CET	443	49781	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.401659966 CET	49784	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:33.401681900 CET	443	49784	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:33.401786089 CET	49784	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:33.405651093 CET	49784	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:33.405673981 CET	443	49784	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:33.415842056 CET	443	49774	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.440927029 CET	49780	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.440968990 CET	443	49780	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.441483974 CET	49780	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.441503048 CET	443	49780	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.442002058 CET	49781	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.442035913 CET	443	49781	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.442625999 CET	49781	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.442636967 CET	443	49781	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.444367886 CET	49778	443	192.168.2.5	2.19.244.127
Nov 15, 2024 15:59:33.444394112 CET	443	49778	2.19.244.127	192.168.2.5
Nov 15, 2024 15:59:33.445450068 CET	49774	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.445477009 CET	443	49774	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.445914030 CET	49774	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.445923090 CET	443	49774	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.446387053 CET	49785	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:33.446424007 CET	443	49785	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:33.446506977 CET	49785	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:33.446957111 CET	49785	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:33.446966887 CET	443	49785	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:33.452419996 CET	49786	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.452477932 CET	443	49786	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.452534914 CET	49786	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.452794075 CET	49786	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.452815056 CET	443	49786	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.455228090 CET	49787	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.455271006 CET	443	49787	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.455415010 CET	49787	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.455513954 CET	49787	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.455526114 CET	443	49787	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.585388899 CET	443	49780	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.585541010 CET	443	49780	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.585591078 CET	49780	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.586035967 CET	443	49774	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.586196899 CET	443	49774	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.586312056 CET	49780	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.586312056 CET	49780	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.586333990 CET	443	49780	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.586345911 CET	443	49780	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.586358070 CET	49774	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.610421896 CET	49792	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:33.610466957 CET	443	49792	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:33.610580921 CET	49793	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:33.610595942 CET	49792	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:33.610666037 CET	443	49793	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:33.611120939 CET	49793	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:33.613245964 CET	49793	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:33.613262892 CET	443	49793	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:33.613473892 CET	49792	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:33.613492966 CET	443	49792	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:33.634357929 CET	443	49781	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.634521008 CET	443	49781	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.634913921 CET	49781	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.642657995 CET	49774	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.642699957 CET	443	49774	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.642740965 CET	49774	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.642755985 CET	443	49774	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.650998116 CET	49781	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.650999069 CET	49781	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.651014090 CET	443	49781	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.651035070 CET	443	49781	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.887484074 CET	49794	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.887593985 CET	443	49794	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.887783051 CET	49794	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.905280113 CET	49794	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.905319929 CET	443	49794	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.906011105 CET	49795	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.906045914 CET	443	49795	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.906116962 CET	49795	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.906217098 CET	49795	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.906223059 CET	443	49795	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.912843943 CET	49796	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.912931919 CET	443	49796	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:33.913119078 CET	49796	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.923932076 CET	49796	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:33.923969030 CET	443	49796	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.006850004 CET	49797	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.006939888 CET	443	49797	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.007035017 CET	49797	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.007296085 CET	49797	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.007343054 CET	443	49797	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.008809090 CET	49798	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.008878946 CET	443	49798	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.009107113 CET	49798	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.009627104 CET	49798	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.009654999 CET	443	49798	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.043482065 CET	49799	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.043514013 CET	443	49799	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.043596029 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.043626070 CET	49799	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.043631077 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.043673992 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.043926954 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.043945074 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.044104099 CET	49799	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.044116020 CET	443	49799	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.056643963 CET	49801	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.056687117 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.056766987 CET	49801	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.057096004 CET	49801	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.057112932 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.057465076 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:34.057507038 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:34.057596922 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:34.057789087 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:34.057806015 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:34.090043068 CET	443	49784	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:34.090563059 CET	49784	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:34.090593100 CET	443	49784	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:34.092247963 CET	443	49784	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:34.092353106 CET	49784	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:34.094062090 CET	49784	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:34.094168901 CET	443	49784	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:34.094513893 CET	49784	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:34.094530106 CET	443	49784	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:34.095639944 CET	443	49782	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:34.101537943 CET	49782	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:34.101607084 CET	443	49782	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:34.102422953 CET	443	49782	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:34.102793932 CET	49782	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:34.102852106 CET	49782	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:34.102886915 CET	443	49782	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:34.107400894 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:34.107445955 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:34.107507944 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:34.107693911 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:34.107708931 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:34.111372948 CET	49804	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.111413956 CET	443	49804	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.111485004 CET	49804	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.111669064 CET	49804	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.111699104 CET	443	49804	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.113205910 CET	49805	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.113230944 CET	443	49805	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.113290071 CET	49805	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.113461971 CET	49805	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.113476038 CET	443	49805	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.121098042 CET	49806	443	192.168.2.5	18.66.107.59
Nov 15, 2024 15:59:34.121136904 CET	443	49806	18.66.107.59	192.168.2.5
Nov 15, 2024 15:59:34.121201992 CET	49806	443	192.168.2.5	18.66.107.59
Nov 15, 2024 15:59:34.121345997 CET	49807	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:34.121356964 CET	443	49807	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:34.121402025 CET	49807	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:34.121568918 CET	49806	443	192.168.2.5	18.66.107.59
Nov 15, 2024 15:59:34.121593952 CET	443	49806	18.66.107.59	192.168.2.5
Nov 15, 2024 15:59:34.121718884 CET	49807	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:34.121730089 CET	443	49807	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:34.160588980 CET	49784	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:34.198656082 CET	443	49786	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.204648972 CET	443	49787	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.227067947 CET	49786	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.227097988 CET	443	49786	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.227447033 CET	49786	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.227453947 CET	443	49786	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.227632046 CET	49787	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.227668047 CET	443	49787	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.227943897 CET	49787	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.227951050 CET	443	49787	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.247967005 CET	49782	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:34.261584044 CET	443	49784	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:34.262492895 CET	49784	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:34.262537003 CET	443	49784	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:34.262619972 CET	49784	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:34.264282942 CET	49808	443	192.168.2.5	18.66.107.59
Nov 15, 2024 15:59:34.264314890 CET	443	49808	18.66.107.59	192.168.2.5
Nov 15, 2024 15:59:34.264373064 CET	49808	443	192.168.2.5	18.66.107.59
Nov 15, 2024 15:59:34.264673948 CET	49809	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:34.264756918 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:34.264832020 CET	49809	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:34.264899969 CET	49808	443	192.168.2.5	18.66.107.59
Nov 15, 2024 15:59:34.264914036 CET	443	49808	18.66.107.59	192.168.2.5
Nov 15, 2024 15:59:34.265062094 CET	49809	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:34.265096903 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:34.265465975 CET	49810	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:34.265515089 CET	443	49810	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:34.265580893 CET	49810	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:34.265753984 CET	49810	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:34.265786886 CET	443	49810	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:34.271094084 CET	443	49793	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.271341085 CET	49793	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.271373034 CET	443	49793	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.272417068 CET	443	49792	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.272641897 CET	49792	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.272651911 CET	443	49792	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.273616076 CET	443	49792	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.273680925 CET	49792	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.274477959 CET	49792	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.274538994 CET	443	49792	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.274631977 CET	49792	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.274640083 CET	443	49792	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.274950981 CET	443	49793	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.275023937 CET	49793	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.275352955 CET	49793	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.275511026 CET	443	49793	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.275566101 CET	49793	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.277353048 CET	443	49785	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:34.277582884 CET	49785	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:34.277604103 CET	443	49785	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:34.279031038 CET	443	49785	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:34.279094934 CET	49785	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:34.279969931 CET	49785	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:34.280059099 CET	443	49785	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:34.280163050 CET	49785	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:34.280178070 CET	443	49785	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:34.304982901 CET	49811	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.305017948 CET	443	49811	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.305068970 CET	49811	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.305224895 CET	49811	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.305239916 CET	443	49811	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.307228088 CET	49812	443	192.168.2.5	172.64.155.119
Nov 15, 2024 15:59:34.307271957 CET	443	49812	172.64.155.119	192.168.2.5
Nov 15, 2024 15:59:34.307338953 CET	49812	443	192.168.2.5	172.64.155.119
Nov 15, 2024 15:59:34.307655096 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.307665110 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.307708979 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.307873964 CET	49812	443	192.168.2.5	172.64.155.119
Nov 15, 2024 15:59:34.307893991 CET	443	49812	172.64.155.119	192.168.2.5
Nov 15, 2024 15:59:34.307991028 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.308007002 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.319360018 CET	443	49793	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.325139046 CET	49814	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.325170994 CET	443	49814	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.325232983 CET	49814	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.325411081 CET	49814	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.325428963 CET	443	49814	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.326968908 CET	49815	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.326981068 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.327035904 CET	49815	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.327198982 CET	49815	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.327224970 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.328377962 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.328463078 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.328527927 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.328654051 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.328676939 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.353838921 CET	443	49786	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.353996038 CET	443	49786	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.354053974 CET	49786	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.354096889 CET	49786	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.354110956 CET	443	49786	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.354123116 CET	49786	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.354129076 CET	443	49786	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.354758024 CET	443	49787	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.354908943 CET	443	49787	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.354963064 CET	49787	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.355207920 CET	49787	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.355217934 CET	443	49787	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.355237007 CET	49787	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.355242968 CET	443	49787	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.359024048 CET	49817	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.359046936 CET	443	49817	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.359112978 CET	49817	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.360644102 CET	49818	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.360656977 CET	443	49818	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.360708952 CET	49818	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.360830069 CET	49817	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.360843897 CET	443	49817	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.361093998 CET	49818	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.361109972 CET	443	49818	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.378228903 CET	443	49782	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:34.378283978 CET	443	49782	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:34.378324032 CET	49782	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:34.378333092 CET	443	49782	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:34.378346920 CET	443	49782	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:34.378387928 CET	49782	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:34.382110119 CET	49782	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:34.382117033 CET	443	49782	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:34.405447006 CET	49792	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.405450106 CET	49785	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:34.428354025 CET	49819	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:34.428391933 CET	443	49819	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:34.428452969 CET	49819	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:34.428567886 CET	443	49792	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.428587914 CET	443	49793	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.428632975 CET	443	49792	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.428639889 CET	49819	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:34.428663969 CET	443	49819	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:34.428663969 CET	49793	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.428692102 CET	443	49793	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.428698063 CET	49792	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.428718090 CET	443	49792	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.428739071 CET	49793	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.428745985 CET	443	49793	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.432863951 CET	49793	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.432962894 CET	443	49793	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.433033943 CET	49793	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.433129072 CET	49820	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.433212996 CET	443	49820	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.433291912 CET	49820	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.433928967 CET	49820	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.433965921 CET	443	49820	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.434016943 CET	443	49785	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:34.434103012 CET	443	49785	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:34.434154987 CET	49785	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:34.434360981 CET	49785	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:34.434381962 CET	443	49785	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:34.434395075 CET	49785	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:34.434436083 CET	49785	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:34.434987068 CET	49821	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:34.435000896 CET	443	49821	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:34.435075045 CET	49821	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:34.435405016 CET	49821	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:34.435421944 CET	443	49821	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:34.451766968 CET	443	49792	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.451818943 CET	49792	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.455898046 CET	49792	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.455919981 CET	443	49792	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.456209898 CET	49822	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.456295967 CET	443	49822	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.456367016 CET	49822	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.456808090 CET	49822	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.456842899 CET	443	49822	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.634850979 CET	443	49795	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.635634899 CET	49795	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.635662079 CET	443	49795	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.636162043 CET	49795	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.636168003 CET	443	49795	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.649437904 CET	443	49799	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.649836063 CET	49799	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.649848938 CET	443	49799	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.651258945 CET	443	49799	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.651330948 CET	49799	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.651629925 CET	49799	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.651709080 CET	443	49799	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.651761055 CET	49799	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.651767969 CET	443	49799	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.656090975 CET	443	49798	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.656284094 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.656547070 CET	49798	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.656547070 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.656568050 CET	443	49798	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.656589985 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.657543898 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.657766104 CET	49801	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.657789946 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.658530951 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.658581018 CET	443	49798	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.658617973 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.658638954 CET	49798	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.658987045 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.659075022 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.659280062 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.659307003 CET	49798	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.659348011 CET	49801	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.659384966 CET	443	49798	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.659394979 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.659403086 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.659445047 CET	49798	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.659452915 CET	443	49798	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.659708977 CET	49801	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.659825087 CET	49801	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.659847975 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.660020113 CET	443	49796	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.667453051 CET	49796	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.667534113 CET	443	49796	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.668077946 CET	49796	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.668092012 CET	443	49796	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.701800108 CET	443	49797	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.702037096 CET	49797	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.702061892 CET	443	49797	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.705621958 CET	443	49797	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.705719948 CET	49797	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.706080914 CET	49797	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.706226110 CET	49797	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.706238031 CET	443	49797	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.706262112 CET	443	49797	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.719013929 CET	443	49805	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.719244003 CET	49805	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.719263077 CET	443	49805	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.720690966 CET	443	49805	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.720746040 CET	49805	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.721126080 CET	49805	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.721204996 CET	443	49805	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.721245050 CET	49805	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.729801893 CET	443	49794	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.745963097 CET	49794	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.746000051 CET	443	49794	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.746601105 CET	49794	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.746607065 CET	443	49794	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.763330936 CET	443	49805	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.763422966 CET	443	49804	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.763736010 CET	49804	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.763751030 CET	443	49804	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.767982006 CET	443	49804	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.768054008 CET	49804	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.768606901 CET	49804	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.768732071 CET	49804	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.768738031 CET	443	49804	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.768789053 CET	443	49804	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.774574041 CET	443	49795	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.774722099 CET	443	49795	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.774777889 CET	49795	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.800826073 CET	49795	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.800849915 CET	443	49795	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.800863028 CET	49795	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.800870895 CET	443	49795	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.801958084 CET	443	49799	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.802006006 CET	443	49799	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.802006960 CET	49799	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.802020073 CET	443	49799	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.802073002 CET	49799	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.802082062 CET	443	49799	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.802133083 CET	443	49799	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.802172899 CET	443	49799	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.802174091 CET	49799	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.802185059 CET	443	49799	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.802217007 CET	49799	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.802225113 CET	443	49799	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.802295923 CET	443	49799	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.802329063 CET	443	49799	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.802337885 CET	49799	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.802344084 CET	443	49799	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.802385092 CET	49799	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.802390099 CET	443	49799	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.802412987 CET	443	49799	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.802453995 CET	49799	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.803917885 CET	49799	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.803924084 CET	443	49799	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.808907032 CET	49823	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.808927059 CET	443	49823	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.808995008 CET	49823	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.809205055 CET	49823	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.809220076 CET	443	49823	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.810194969 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.810242891 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.810251951 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.810269117 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.810324907 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.810347080 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.810357094 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.810404062 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.810404062 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.810417891 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.810619116 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.810628891 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.824419022 CET	443	49796	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.824559927 CET	443	49796	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.824615002 CET	49796	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.825277090 CET	49796	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.825284958 CET	443	49796	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.825301886 CET	49796	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.825306892 CET	443	49796	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.829171896 CET	443	49798	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.829232931 CET	49798	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.829245090 CET	443	49798	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.829332113 CET	49798	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.829535961 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.829591036 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.829592943 CET	49801	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.829626083 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.829668999 CET	49801	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.829674959 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.829689980 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.829734087 CET	49801	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.829745054 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.829797983 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.829843044 CET	49801	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.829853058 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.831948996 CET	49798	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.831988096 CET	443	49798	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.832087994 CET	443	49798	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.832104921 CET	49798	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.832135916 CET	49798	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.832839966 CET	49797	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.832850933 CET	49805	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.832854033 CET	49804	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.832859039 CET	443	49805	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.832861900 CET	443	49804	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.832897902 CET	443	49797	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.867456913 CET	443	49797	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.867494106 CET	443	49797	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.867543936 CET	49797	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.867557049 CET	443	49797	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.867584944 CET	49797	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.867604971 CET	49797	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.867615938 CET	443	49797	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.881195068 CET	443	49794	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.881345987 CET	443	49794	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.881470919 CET	49794	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.886404991 CET	443	49797	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.886483908 CET	49797	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.888037920 CET	49797	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.888072014 CET	443	49797	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:34.888098001 CET	49797	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.888124943 CET	49797	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.890408039 CET	49794	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.890433073 CET	443	49794	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.890445948 CET	49794	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.890451908 CET	443	49794	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.899595976 CET	49824	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.899677992 CET	443	49824	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.899749994 CET	49824	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.899853945 CET	443	49805	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.899898052 CET	443	49805	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.899905920 CET	49805	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.899914980 CET	443	49805	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.899954081 CET	49805	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.899954081 CET	443	49805	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.899966955 CET	443	49805	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.900012016 CET	49805	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.900023937 CET	443	49805	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.900080919 CET	443	49805	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.900120020 CET	49805	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.900957108 CET	49824	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.900990963 CET	443	49824	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.901974916 CET	49825	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.902021885 CET	443	49825	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.902076960 CET	49825	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.902228117 CET	49825	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:34.902247906 CET	443	49825	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:34.906258106 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:34.906544924 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:34.906564951 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:34.907793045 CET	49805	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.907800913 CET	443	49805	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.908000946 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:34.908073902 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:34.908687115 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:34.908771038 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:34.909260988 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:34.909276009 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:34.927097082 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.927136898 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.927145004 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.927158117 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.927207947 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.927212954 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.927223921 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.927337885 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.927386045 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.927450895 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.927483082 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.927490950 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.927503109 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.927603006 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.928011894 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.928080082 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.928114891 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.928128004 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.928136110 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.928195953 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.928931952 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.928987980 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.929023027 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.929025888 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.929035902 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.929258108 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.929719925 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.929838896 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.929877996 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.929898024 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.929905891 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.929953098 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:34.929960012 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:34.929999113 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.930059910 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.930058956 CET	49801	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.930095911 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.930139065 CET	49801	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.930150032 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.944725990 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.944785118 CET	49801	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.944803953 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.946069002 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.946125031 CET	49801	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.946135998 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.946244001 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.946289062 CET	49801	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.948653936 CET	49801	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.948683977 CET	443	49801	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.951062918 CET	49804	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:34.951066971 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:34.951980114 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:34.952177048 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:34.952191114 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:34.953787088 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:34.953864098 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:34.954171896 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:34.954282999 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:34.954308033 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:34.955176115 CET	443	49810	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:34.955365896 CET	49810	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:34.955382109 CET	443	49810	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:34.956814051 CET	443	49810	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:34.956876040 CET	49810	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:34.957211971 CET	49810	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:34.957287073 CET	443	49810	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:34.957325935 CET	49810	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:34.961289883 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.961477041 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.961488008 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.964348078 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.964412928 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.964708090 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.964793921 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.964822054 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.967891932 CET	443	49812	172.64.155.119	192.168.2.5
Nov 15, 2024 15:59:34.968096018 CET	49812	443	192.168.2.5	172.64.155.119
Nov 15, 2024 15:59:34.968108892 CET	443	49812	172.64.155.119	192.168.2.5
Nov 15, 2024 15:59:34.971647024 CET	443	49812	172.64.155.119	192.168.2.5
Nov 15, 2024 15:59:34.971715927 CET	49812	443	192.168.2.5	172.64.155.119
Nov 15, 2024 15:59:34.972029924 CET	49812	443	192.168.2.5	172.64.155.119
Nov 15, 2024 15:59:34.972126961 CET	443	49812	172.64.155.119	192.168.2.5
Nov 15, 2024 15:59:34.972209930 CET	49812	443	192.168.2.5	172.64.155.119
Nov 15, 2024 15:59:34.978283882 CET	443	49806	18.66.107.59	192.168.2.5
Nov 15, 2024 15:59:34.978461027 CET	49806	443	192.168.2.5	18.66.107.59
Nov 15, 2024 15:59:34.978471041 CET	443	49806	18.66.107.59	192.168.2.5
Nov 15, 2024 15:59:34.979526043 CET	443	49806	18.66.107.59	192.168.2.5
Nov 15, 2024 15:59:34.979588985 CET	49806	443	192.168.2.5	18.66.107.59
Nov 15, 2024 15:59:34.979927063 CET	49806	443	192.168.2.5	18.66.107.59
Nov 15, 2024 15:59:34.979993105 CET	443	49806	18.66.107.59	192.168.2.5
Nov 15, 2024 15:59:34.980079889 CET	49806	443	192.168.2.5	18.66.107.59
Nov 15, 2024 15:59:34.980087996 CET	443	49806	18.66.107.59	192.168.2.5
Nov 15, 2024 15:59:34.981548071 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.981745958 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.981754065 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.983237028 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.983294010 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.983597040 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.983683109 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.983726025 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.984442949 CET	443	49814	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.984653950 CET	49814	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.984664917 CET	443	49814	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.986752033 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.986965895 CET	49815	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.986977100 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.988236904 CET	443	49814	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.988317013 CET	49814	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.988673925 CET	49814	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.988816023 CET	49814	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.988846064 CET	443	49814	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.990559101 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.990631104 CET	49815	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.990928888 CET	49815	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.991050959 CET	49815	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:34.991115093 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:34.994488955 CET	443	49807	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:34.994678974 CET	49807	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:34.994684935 CET	443	49807	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:34.995359898 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:34.996567965 CET	443	49807	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:34.996633053 CET	49807	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:34.996906996 CET	49807	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:34.996990919 CET	443	49807	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:34.997071981 CET	49807	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:34.997077942 CET	443	49807	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:34.999351978 CET	443	49810	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:35.007364988 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.007567883 CET	443	49811	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.007774115 CET	49811	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.007783890 CET	443	49811	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.008250952 CET	443	49811	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.008579016 CET	49811	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.008666039 CET	443	49811	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.008703947 CET	49811	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.008718014 CET	443	49811	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.019329071 CET	443	49812	172.64.155.119	192.168.2.5
Nov 15, 2024 15:59:35.027350903 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.042125940 CET	443	49804	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.044703007 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.044804096 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:35.044819117 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.044918060 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.044960976 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:35.044969082 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.045078993 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.045120955 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:35.045129061 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.045257092 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.045300961 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:35.045309067 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.045423985 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.045466900 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:35.045475006 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.045617104 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.045635939 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.045663118 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:35.045671940 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.045686007 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:35.045734882 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.045777082 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:35.045784950 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.045816898 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:35.045865059 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.045883894 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.045911074 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:35.045985937 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.046037912 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:35.046046019 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.046077013 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:35.046261072 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.046328068 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:35.046384096 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.046432018 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:35.046489954 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.046658993 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.046710968 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:35.046720028 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.046765089 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:35.047013044 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.047060966 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:35.047112942 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.047163010 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:35.047171116 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.047261953 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.047331095 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:35.047883987 CET	49800	443	192.168.2.5	104.17.25.14
Nov 15, 2024 15:59:35.047904015 CET	443	49800	104.17.25.14	192.168.2.5
Nov 15, 2024 15:59:35.064543962 CET	443	49804	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.064616919 CET	49804	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.065202951 CET	49804	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.065218925 CET	443	49804	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.081485987 CET	49810	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:35.081494093 CET	443	49810	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:35.081501961 CET	49814	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.081501961 CET	49806	443	192.168.2.5	18.66.107.59
Nov 15, 2024 15:59:35.081501961 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.081507921 CET	443	49814	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.081512928 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.081522942 CET	49807	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:35.102544069 CET	443	49818	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:35.105340958 CET	443	49817	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:35.107049942 CET	49818	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:35.107064009 CET	443	49818	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:35.107976913 CET	49818	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:35.107980967 CET	443	49818	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:35.108782053 CET	49817	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:35.108800888 CET	443	49817	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:35.109169960 CET	49817	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:35.109174967 CET	443	49817	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:35.109517097 CET	443	49808	18.66.107.59	192.168.2.5
Nov 15, 2024 15:59:35.109723091 CET	49808	443	192.168.2.5	18.66.107.59
Nov 15, 2024 15:59:35.109749079 CET	443	49808	18.66.107.59	192.168.2.5
Nov 15, 2024 15:59:35.110217094 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.110291004 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.110301971 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.110395908 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.110455036 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.110462904 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.110559940 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.110620022 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.110625029 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.110652924 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.110778093 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.110785961 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.113164902 CET	443	49808	18.66.107.59	192.168.2.5
Nov 15, 2024 15:59:35.113226891 CET	49808	443	192.168.2.5	18.66.107.59
Nov 15, 2024 15:59:35.113908052 CET	49808	443	192.168.2.5	18.66.107.59
Nov 15, 2024 15:59:35.113991022 CET	443	49808	18.66.107.59	192.168.2.5
Nov 15, 2024 15:59:35.114157915 CET	49808	443	192.168.2.5	18.66.107.59
Nov 15, 2024 15:59:35.114166975 CET	443	49808	18.66.107.59	192.168.2.5
Nov 15, 2024 15:59:35.131470919 CET	443	49812	172.64.155.119	192.168.2.5
Nov 15, 2024 15:59:35.131604910 CET	443	49814	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.131637096 CET	49812	443	192.168.2.5	172.64.155.119
Nov 15, 2024 15:59:35.131689072 CET	443	49814	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.131707907 CET	49814	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.131714106 CET	443	49814	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.131757021 CET	49814	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.131793022 CET	443	49814	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.131959915 CET	443	49814	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.132010937 CET	49814	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.132015944 CET	443	49814	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.132092953 CET	443	49814	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.132138968 CET	443	49814	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.132167101 CET	49814	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.132172108 CET	443	49814	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.132241011 CET	49814	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.137181044 CET	49812	443	192.168.2.5	172.64.155.119
Nov 15, 2024 15:59:35.137206078 CET	443	49812	172.64.155.119	192.168.2.5
Nov 15, 2024 15:59:35.137455940 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.137566090 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.137628078 CET	49815	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.137639046 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.137679100 CET	49815	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.137686968 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.137839079 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.137887001 CET	49815	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.137896061 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.138001919 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.138098955 CET	49815	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.138108015 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.140271902 CET	443	49822	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.140480042 CET	49822	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.140489101 CET	443	49822	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.141607046 CET	443	49822	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.142011881 CET	49822	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.142148018 CET	49822	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.142158031 CET	443	49822	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.142199039 CET	443	49822	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.143287897 CET	443	49820	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.143568039 CET	49820	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.143582106 CET	443	49820	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.145978928 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.146035910 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.146043062 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.146186113 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.146231890 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.146236897 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.146357059 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.146440983 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.146447897 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.146476030 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.146521091 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.146554947 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.147104025 CET	443	49820	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.147190094 CET	49820	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.147871017 CET	49820	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.148030996 CET	443	49820	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.148077011 CET	49820	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.150352955 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.150494099 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.150502920 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.157023907 CET	443	49810	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:35.157089949 CET	49810	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:35.157347918 CET	49810	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:35.157358885 CET	443	49810	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:35.159336090 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.159400940 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.169785976 CET	49811	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.169864893 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.169872999 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.187261105 CET	49808	443	192.168.2.5	18.66.107.59
Nov 15, 2024 15:59:35.187309027 CET	49822	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.195329905 CET	443	49820	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.202032089 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.222872019 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.222980976 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.223056078 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.223076105 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.223123074 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.223129988 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.223239899 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.223373890 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.223426104 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.223434925 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.223474979 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.223481894 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.225352049 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.225442886 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.225442886 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.225474119 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.226140022 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.226196051 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.226207018 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.226244926 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.226258039 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.226455927 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.226546049 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.226603985 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.226614952 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.226653099 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.226660013 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.227788925 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.227843046 CET	443	49806	18.66.107.59	192.168.2.5
Nov 15, 2024 15:59:35.227847099 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.227900982 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.227910995 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.227931023 CET	443	49806	18.66.107.59	192.168.2.5
Nov 15, 2024 15:59:35.227952003 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.227988958 CET	49806	443	192.168.2.5	18.66.107.59
Nov 15, 2024 15:59:35.232763052 CET	443	49818	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:35.233023882 CET	443	49818	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:35.233062029 CET	443	49817	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:35.233078957 CET	49818	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:35.233876944 CET	443	49817	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:35.233928919 CET	49817	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:35.240853071 CET	49818	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:35.240861893 CET	443	49818	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:35.240874052 CET	49818	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:35.240885019 CET	443	49818	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:35.242583036 CET	49817	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:35.242603064 CET	443	49817	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:35.242615938 CET	49817	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:35.242623091 CET	443	49817	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:35.247639894 CET	443	49814	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.247962952 CET	443	49814	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.248025894 CET	49814	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.255515099 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.255639076 CET	49815	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.255640984 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.255673885 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.255997896 CET	49815	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.256006956 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.256109953 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.256164074 CET	49815	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.256172895 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.256306887 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.256371975 CET	49815	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.256380081 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.256632090 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.256843090 CET	49815	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.264281034 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.264337063 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.264344931 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.264446974 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.264542103 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.264588118 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.264594078 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.264630079 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.264662981 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.264817953 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.264906883 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.264962912 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.264970064 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.265013933 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.265512943 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.265681982 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.265758991 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.265769958 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.265975952 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.266022921 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.266028881 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.267869949 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.267946005 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.267951012 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.268035889 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.268085003 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.268090963 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.269068956 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.269126892 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.269133091 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.290005922 CET	443	49821	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:35.295938969 CET	49821	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:35.295949936 CET	443	49821	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:35.296432018 CET	443	49821	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:35.302057028 CET	49821	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:35.302149057 CET	443	49821	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:35.302300930 CET	443	49820	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.302369118 CET	49820	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.302376032 CET	443	49820	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.302618980 CET	49820	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.302624941 CET	443	49820	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.302651882 CET	49821	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:35.302707911 CET	49821	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:35.302819967 CET	443	49821	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:35.308928967 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.311696053 CET	49809	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:35.311719894 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.313549995 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.313613892 CET	49809	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:35.313884974 CET	49809	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:35.313960075 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.314001083 CET	49809	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:35.319201946 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.319211960 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.319253922 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.319283962 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.319298983 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.319319010 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.319350958 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.319365978 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.319380045 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.319387913 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.319401026 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.321193933 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.321202993 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.321247101 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.321253061 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.321280003 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.321296930 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.321331024 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.321347952 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.321347952 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.321347952 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.321363926 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.321377039 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.322017908 CET	443	49811	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.322048903 CET	443	49811	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.322060108 CET	443	49811	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.322079897 CET	443	49811	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.322089911 CET	443	49811	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.322098017 CET	443	49811	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.322113991 CET	49811	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.322129965 CET	443	49811	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.322148085 CET	49811	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.322249889 CET	443	49811	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.322295904 CET	49811	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.325248957 CET	443	49820	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.325301886 CET	49820	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.338474989 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.338711023 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.338807106 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.338809967 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.338843107 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.338891029 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.338978052 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.339153051 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.339210987 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.339219093 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.339308023 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.339411974 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.339420080 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.339519024 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.339648962 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.339705944 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.339715004 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.339754105 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.340780020 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.340837955 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.340887070 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.340939045 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.340990067 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.341042995 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.341084003 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.341095924 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.341134071 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.341322899 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.341382980 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.341598988 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.341662884 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.341722012 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.341779947 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.343121052 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.343189955 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.343209028 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.343255997 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.354229927 CET	443	49819	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:35.354438066 CET	49819	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:35.354453087 CET	443	49819	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:35.355336905 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.355907917 CET	443	49819	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:35.355977058 CET	49819	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:35.356307030 CET	49819	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:35.356388092 CET	443	49819	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:35.356664896 CET	49819	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:35.356674910 CET	443	49819	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:35.358165026 CET	443	49808	18.66.107.59	192.168.2.5
Nov 15, 2024 15:59:35.358453035 CET	443	49808	18.66.107.59	192.168.2.5
Nov 15, 2024 15:59:35.358520031 CET	49808	443	192.168.2.5	18.66.107.59
Nov 15, 2024 15:59:35.362276077 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.383074045 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.383117914 CET	443	49807	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:35.383172989 CET	443	49807	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:35.383197069 CET	443	49807	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:35.383223057 CET	443	49807	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:35.383240938 CET	49807	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:35.383243084 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.383254051 CET	443	49807	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:35.383263111 CET	49807	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:35.383270025 CET	443	49807	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:35.383295059 CET	443	49807	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:35.383296967 CET	49807	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:35.383306980 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.383328915 CET	49807	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:35.383328915 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.383335114 CET	443	49807	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:35.383343935 CET	49807	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:35.383363008 CET	443	49807	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:35.383380890 CET	49807	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:35.383435965 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.383482933 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.383490086 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.383543968 CET	443	49807	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:35.383595943 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.383651972 CET	49807	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:35.383651972 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.383656979 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.383753061 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.383814096 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.383862019 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.383867979 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.383908987 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.383913994 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.384010077 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.384064913 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.384072065 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.384113073 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.384130955 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.384185076 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.384233952 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.384287119 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.384360075 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.384416103 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.384496927 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.384546995 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.384577036 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.384613037 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.384630919 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.384679079 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.386441946 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.386518002 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.388489962 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.388570070 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.388597965 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.388648987 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.388685942 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.388736963 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.411741972 CET	443	49822	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.411803007 CET	443	49822	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.411838055 CET	443	49822	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.411880016 CET	49822	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.411899090 CET	443	49822	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.411916971 CET	49822	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.411932945 CET	443	49822	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.411953926 CET	443	49822	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.411967039 CET	49822	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.411989927 CET	49822	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.412000895 CET	49822	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.412242889 CET	443	49822	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.412277937 CET	443	49822	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.412307024 CET	49822	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.412312984 CET	443	49822	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.412345886 CET	49822	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.412388086 CET	443	49822	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:35.412425995 CET	49822	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:35.440103054 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.440114021 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.440177917 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.440186024 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.440237045 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.440274000 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.440298080 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.440340996 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.440340996 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.440341949 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.440341949 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.441461086 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.441468954 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.441514015 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.441518068 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.441548109 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.441560030 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.441572905 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.441602945 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.443484068 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.443509102 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.443561077 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.443568945 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.443603039 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.443603039 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.452764034 CET	49809	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:35.452790976 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.454001904 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.454098940 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.454183102 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.454238892 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.454350948 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.454432964 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.454473019 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.454546928 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.454585075 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.454638004 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.454690933 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.454755068 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.454797029 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.454849005 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.454896927 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.454952002 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.455614090 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.455673933 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.455739021 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.455792904 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.455830097 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.455878019 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.456454039 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.456516027 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.456528902 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.456583023 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.459359884 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.459412098 CET	443	49821	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:35.459455013 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.459460020 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.459487915 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.459508896 CET	49821	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:35.459522963 CET	443	49821	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:35.459537029 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.459598064 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.459654093 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.459665060 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.459705114 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.459707022 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.459737062 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.459750891 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.459836960 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.459882975 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.459893942 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.459929943 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.459943056 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.459996939 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.460048914 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.460093975 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.460148096 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.460191965 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.460254908 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.460309029 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.460408926 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.460467100 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.460481882 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.460522890 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.460599899 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.460652113 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.460742950 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.460813046 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.471373081 CET	49819	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:35.486146927 CET	443	49821	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:35.486249924 CET	49821	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:35.499511003 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.499578953 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.499669075 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.499730110 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.499784946 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.499855042 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.499917030 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.499969006 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.501468897 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.501576900 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.501590967 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.501642942 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.501692057 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.501842022 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.501876116 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.501913071 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.584094048 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.584117889 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.584180117 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.584196091 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.584228992 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.584245920 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.584764004 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.584800959 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.584837914 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.584846020 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.584875107 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.584889889 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.584996939 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.585057974 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.585077047 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.585161924 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.585175037 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.585201979 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.585310936 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.585364103 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.586410999 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.586478949 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.586489916 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.586509943 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.586534977 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.586555004 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.586623907 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.586674929 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.586683035 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.586697102 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.586724043 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.586927891 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.587037086 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.587094069 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.587116003 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.587157965 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.587162018 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.587213039 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.587244987 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.587532043 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.587578058 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.587613106 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.587622881 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.587651968 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.587677956 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.587946892 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.587990046 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.588027954 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.588036060 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.588048935 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.588212013 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.588263988 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.588275909 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.588306904 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.588337898 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.588366032 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.588619947 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.588654041 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.588696957 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.588711023 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.588721991 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.589049101 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.589092016 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.589121103 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.589128971 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.589158058 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.589175940 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.589339972 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.589381933 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.589402914 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.589410067 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.589437008 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.589448929 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.589941025 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.589961052 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.590013981 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.590024948 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.590214968 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.590261936 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.590280056 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.590287924 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.590321064 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.590329885 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.590526104 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.590568066 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.590591908 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.590599060 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.590626955 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.590640068 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.590828896 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.590872049 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.590893984 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.590903044 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.590941906 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.590959072 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.591082096 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.591130972 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.591137886 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.591151953 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.591763973 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.591805935 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.591834068 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.591841936 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.591841936 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.591859102 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.591900110 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.592040062 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.592097044 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.592114925 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.592123985 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.592150927 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.592164040 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.592287064 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.592333078 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.592349052 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.592358112 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.592387915 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.592397928 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.592454910 CET	443	49823	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:35.592458010 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.592514992 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.592535973 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.592542887 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.592570066 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.592586994 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.614995956 CET	443	49819	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:35.615046978 CET	443	49819	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:35.615180016 CET	49819	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:35.615195990 CET	443	49819	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:35.615247965 CET	49819	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:35.615401030 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.615463018 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.615487099 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.615500927 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.615516901 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.615643978 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:35.616312981 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.616367102 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.616386890 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.616389990 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:35.616426945 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.616426945 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.616463900 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.616504908 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.635464907 CET	443	49825	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:35.642827988 CET	443	49824	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:35.644507885 CET	49809	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:35.644531012 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.644584894 CET	49823	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:35.647180080 CET	49824	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:35.647214890 CET	443	49824	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:35.647562027 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.647576094 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.647594929 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.647603989 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.647612095 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.647619963 CET	49809	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:35.647631884 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.647659063 CET	49809	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:35.647685051 CET	49809	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:35.647790909 CET	49824	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:35.647803068 CET	443	49824	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:35.656265974 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.656275988 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.656299114 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.656313896 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.656322956 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.656343937 CET	49809	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:35.656346083 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.656395912 CET	49809	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:35.656404972 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.656441927 CET	49809	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:35.669399023 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.669425964 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.669471025 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.669486046 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.669514894 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.669527054 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.669539928 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.669605970 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.670289993 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.670312881 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.670348883 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.670356035 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.670367002 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.670583963 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.670630932 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.670635939 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.670655966 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.670897961 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.670942068 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.670944929 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.670969963 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.670983076 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.671000957 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.671000957 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.671024084 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.715141058 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.715173960 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.715193987 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.715245008 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.715265989 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.715287924 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.715370893 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.715370893 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.715370893 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.715370893 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.715370893 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.715444088 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.733172894 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.733192921 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.733237982 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.733257055 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.733268023 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.733299017 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.733325958 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.763576984 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.763626099 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.763645887 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.763655901 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.763665915 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.763673067 CET	49809	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:35.763684034 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.763719082 CET	49809	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:35.763742924 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.763796091 CET	49809	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:35.764889956 CET	49825	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:35.769412994 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.769423008 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.769475937 CET	49809	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:35.769486904 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.769503117 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:35.769550085 CET	49809	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:35.772445917 CET	443	49824	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:35.772586107 CET	443	49824	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:35.774972916 CET	49824	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:35.830918074 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.830946922 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.831000090 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.831064939 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.831064939 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.831064939 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.831135035 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.831187963 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.832556009 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.832590103 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.832607985 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.832631111 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.832655907 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.832662106 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.832662106 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.832678080 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.832705975 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.832721949 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.832721949 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.832756996 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.835457087 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.835478067 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.835519075 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.835532904 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.835556030 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.835570097 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.835602999 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.837766886 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.837830067 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.837841988 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.837897062 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.837914944 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:35.839567900 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:35.999599934 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:36.000772953 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:36.001681089 CET	49814	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:36.001698971 CET	443	49814	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:36.002207994 CET	49815	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:36.002243042 CET	443	49815	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:36.004462004 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:36.017586946 CET	49828	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:36.017620087 CET	443	49828	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:36.017688990 CET	49828	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:36.017815113 CET	49829	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:36.017834902 CET	443	49829	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:36.017976999 CET	49829	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:36.018655062 CET	49821	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:36.018662930 CET	443	49821	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:36.019937992 CET	49806	443	192.168.2.5	18.66.107.59
Nov 15, 2024 15:59:36.019962072 CET	443	49806	18.66.107.59	192.168.2.5
Nov 15, 2024 15:59:36.054778099 CET	49816	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:36.054785013 CET	443	49816	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:36.057795048 CET	49830	443	192.168.2.5	13.224.245.89
Nov 15, 2024 15:59:36.057816982 CET	443	49830	13.224.245.89	192.168.2.5
Nov 15, 2024 15:59:36.057900906 CET	49830	443	192.168.2.5	13.224.245.89
Nov 15, 2024 15:59:36.058372021 CET	49831	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:36.058428049 CET	443	49831	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:36.058552980 CET	49831	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:36.058867931 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:36.058876991 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:36.058933973 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:36.059777975 CET	49828	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:36.059802055 CET	443	49828	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:36.060097933 CET	49829	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:36.060112000 CET	443	49829	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:36.063910961 CET	49830	443	192.168.2.5	13.224.245.89
Nov 15, 2024 15:59:36.063926935 CET	443	49830	13.224.245.89	192.168.2.5
Nov 15, 2024 15:59:36.064275980 CET	49831	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:36.064295053 CET	443	49831	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:36.064486027 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:36.064496994 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:36.073812008 CET	49823	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.073837996 CET	443	49823	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.074232101 CET	49823	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.074239016 CET	443	49823	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.076059103 CET	49825	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.076083899 CET	443	49825	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.076420069 CET	49825	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.076427937 CET	443	49825	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.101691008 CET	49824	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.101691008 CET	49824	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.101736069 CET	443	49824	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.101766109 CET	443	49824	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.122370958 CET	49834	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.122390985 CET	443	49834	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.123091936 CET	49834	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.124563932 CET	49835	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.124596119 CET	443	49835	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.124656916 CET	49835	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.124990940 CET	49834	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.125005960 CET	443	49834	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.158780098 CET	49836	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.158823013 CET	443	49836	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.158914089 CET	49836	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.174621105 CET	49835	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.174648046 CET	443	49835	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.175817013 CET	49820	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:36.175817013 CET	49820	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:36.175832033 CET	443	49820	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:36.175878048 CET	49820	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:36.176760912 CET	49808	443	192.168.2.5	18.66.107.59
Nov 15, 2024 15:59:36.176789045 CET	443	49808	18.66.107.59	192.168.2.5
Nov 15, 2024 15:59:36.199817896 CET	49819	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:36.199839115 CET	443	49819	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:36.200928926 CET	443	49823	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.201097965 CET	443	49823	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.201251030 CET	49823	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.201821089 CET	443	49825	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.202264071 CET	443	49825	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.202312946 CET	49825	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.203722000 CET	49811	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:36.203738928 CET	443	49811	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:36.204123974 CET	49807	443	192.168.2.5	18.66.17.64
Nov 15, 2024 15:59:36.204135895 CET	443	49807	18.66.17.64	192.168.2.5
Nov 15, 2024 15:59:36.204430103 CET	49822	443	192.168.2.5	50.56.19.112
Nov 15, 2024 15:59:36.204437971 CET	443	49822	50.56.19.112	192.168.2.5
Nov 15, 2024 15:59:36.210211992 CET	49809	443	192.168.2.5	152.199.21.175
Nov 15, 2024 15:59:36.210225105 CET	443	49809	152.199.21.175	192.168.2.5
Nov 15, 2024 15:59:36.211587906 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:36.211672068 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:36.211757898 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:36.214464903 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:36.214487076 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:36.214589119 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:36.214987993 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:36.215023041 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:36.215496063 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:36.215512991 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:36.218559027 CET	49836	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.218575954 CET	443	49836	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.470413923 CET	49823	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.470453978 CET	443	49823	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.470487118 CET	49823	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.470504999 CET	443	49823	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.472177029 CET	49825	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.472177029 CET	49825	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.472210884 CET	443	49825	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.472246885 CET	443	49825	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.473206043 CET	49803	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:36.473212957 CET	443	49803	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:36.681240082 CET	443	49831	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:36.688076019 CET	49802	443	192.168.2.5	3.160.156.198
Nov 15, 2024 15:59:36.688142061 CET	443	49802	3.160.156.198	192.168.2.5
Nov 15, 2024 15:59:36.689182997 CET	49831	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:36.689203024 CET	443	49831	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:36.690767050 CET	443	49831	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:36.690839052 CET	49831	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:36.737170935 CET	443	49829	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:36.737580061 CET	443	49828	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:36.778069973 CET	49831	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:36.778232098 CET	49829	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:36.778247118 CET	443	49829	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:36.778323889 CET	443	49831	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:36.779315948 CET	49828	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:36.779345989 CET	443	49828	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:36.780118942 CET	49831	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:36.780141115 CET	443	49831	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:36.782037020 CET	443	49829	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:36.782135963 CET	49829	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:36.783107042 CET	443	49828	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:36.783211946 CET	49828	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:36.791465998 CET	49813	443	192.168.2.5	104.18.87.42
Nov 15, 2024 15:59:36.791491032 CET	443	49813	104.18.87.42	192.168.2.5
Nov 15, 2024 15:59:36.793118954 CET	49829	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:36.793313026 CET	443	49829	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:36.793632030 CET	49828	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:36.793819904 CET	443	49828	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:36.794142008 CET	49829	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:36.794147968 CET	443	49829	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:36.799806118 CET	49841	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.799823046 CET	443	49841	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.799951077 CET	49841	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.801116943 CET	49842	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.801151991 CET	443	49842	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.801213980 CET	49842	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.801390886 CET	49841	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.801400900 CET	443	49841	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.801476002 CET	49842	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.801492929 CET	443	49842	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.849534988 CET	443	49834	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.854136944 CET	49828	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:36.854151964 CET	443	49828	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:36.859868050 CET	49829	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:36.859875917 CET	49831	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:36.879791021 CET	49834	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.879802942 CET	443	49834	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.880409002 CET	49834	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.880413055 CET	443	49834	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.888972998 CET	443	49830	13.224.245.89	192.168.2.5
Nov 15, 2024 15:59:36.889334917 CET	49830	443	192.168.2.5	13.224.245.89
Nov 15, 2024 15:59:36.889352083 CET	443	49830	13.224.245.89	192.168.2.5
Nov 15, 2024 15:59:36.890983105 CET	443	49830	13.224.245.89	192.168.2.5
Nov 15, 2024 15:59:36.891072035 CET	49830	443	192.168.2.5	13.224.245.89
Nov 15, 2024 15:59:36.891879082 CET	49830	443	192.168.2.5	13.224.245.89
Nov 15, 2024 15:59:36.891963959 CET	443	49830	13.224.245.89	192.168.2.5
Nov 15, 2024 15:59:36.892081976 CET	49830	443	192.168.2.5	13.224.245.89
Nov 15, 2024 15:59:36.892090082 CET	443	49830	13.224.245.89	192.168.2.5
Nov 15, 2024 15:59:36.919743061 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:36.922132969 CET	443	49835	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.925540924 CET	443	49831	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:36.925668955 CET	443	49831	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:36.925762892 CET	49831	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:36.935643911 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:36.935657024 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:36.939403057 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:36.939470053 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:36.940727949 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:36.940867901 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:36.940874100 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:36.940915108 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:36.941364050 CET	49835	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.941389084 CET	443	49835	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.941741943 CET	49835	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:36.941749096 CET	443	49835	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:36.942030907 CET	49831	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:36.942060947 CET	443	49831	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:36.957860947 CET	443	49829	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:36.958054066 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:36.958801031 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:36.958862066 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:36.959723949 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:36.959803104 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:36.960710049 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:36.960779905 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:36.961867094 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:36.961951017 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:36.962229967 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:36.962245941 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:36.967351913 CET	49830	443	192.168.2.5	13.224.245.89
Nov 15, 2024 15:59:36.990746021 CET	443	49829	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:36.994123936 CET	49829	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:37.003987074 CET	443	49834	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.004173994 CET	443	49834	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.004230976 CET	49834	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.022011042 CET	49829	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:37.022027969 CET	443	49829	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:37.052424908 CET	49828	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:37.052651882 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:37.070173025 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.077450991 CET	443	49835	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.077850103 CET	443	49835	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.077927113 CET	49835	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.115396976 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.115451097 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.115520000 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:37.115581036 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.116180897 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.116202116 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.116235018 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.116246939 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:37.116272926 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.116306067 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:37.116306067 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:37.139498949 CET	49834	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.139517069 CET	443	49834	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.139544964 CET	49834	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.139550924 CET	443	49834	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.139827967 CET	443	49830	13.224.245.89	192.168.2.5
Nov 15, 2024 15:59:37.141602039 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.141632080 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.142518044 CET	49843	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:37.142535925 CET	443	49843	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:37.142601967 CET	49843	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:37.143167019 CET	49843	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:37.143177986 CET	443	49843	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:37.145549059 CET	49835	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.145580053 CET	443	49835	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.145593882 CET	49835	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.145601988 CET	443	49835	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.145617962 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.145647049 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.145678997 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.147360086 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.147424936 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.157398939 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.157582045 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.157685995 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.157694101 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.163713932 CET	49844	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.163739920 CET	443	49844	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.163826942 CET	49844	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.165544987 CET	49844	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.165556908 CET	443	49844	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.166434050 CET	49845	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.166487932 CET	443	49845	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.166558981 CET	49845	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.167176008 CET	49845	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.167203903 CET	443	49845	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.188637018 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:37.227437019 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.230547905 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.230616093 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.230660915 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:37.230688095 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:37.231525898 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.231545925 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.231594086 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:37.231642962 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.231643915 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:37.231698036 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:37.231712103 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.232367992 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.232388020 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.232415915 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.232424974 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:37.232439995 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.232466936 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:37.256542921 CET	443	49830	13.224.245.89	192.168.2.5
Nov 15, 2024 15:59:37.256566048 CET	443	49830	13.224.245.89	192.168.2.5
Nov 15, 2024 15:59:37.256584883 CET	443	49830	13.224.245.89	192.168.2.5
Nov 15, 2024 15:59:37.256608009 CET	49830	443	192.168.2.5	13.224.245.89
Nov 15, 2024 15:59:37.256623030 CET	443	49830	13.224.245.89	192.168.2.5
Nov 15, 2024 15:59:37.256642103 CET	443	49830	13.224.245.89	192.168.2.5
Nov 15, 2024 15:59:37.256653070 CET	49830	443	192.168.2.5	13.224.245.89
Nov 15, 2024 15:59:37.256668091 CET	49830	443	192.168.2.5	13.224.245.89
Nov 15, 2024 15:59:37.256685019 CET	443	49830	13.224.245.89	192.168.2.5
Nov 15, 2024 15:59:37.256700993 CET	49830	443	192.168.2.5	13.224.245.89
Nov 15, 2024 15:59:37.256867886 CET	443	49830	13.224.245.89	192.168.2.5
Nov 15, 2024 15:59:37.256920099 CET	49830	443	192.168.2.5	13.224.245.89
Nov 15, 2024 15:59:37.258183002 CET	49830	443	192.168.2.5	13.224.245.89
Nov 15, 2024 15:59:37.258197069 CET	443	49830	13.224.245.89	192.168.2.5
Nov 15, 2024 15:59:37.266314983 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.335567951 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:37.335586071 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.339468956 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.339492083 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.339510918 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.339538097 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:37.339551926 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.339584112 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:37.344470024 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.344492912 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.344511986 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.344540119 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.344557047 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.344578981 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.344584942 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.344610929 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.344618082 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.344618082 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.344635963 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.344650984 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.346149921 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.346168995 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.346204042 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.346215010 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:37.346226931 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.346254110 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.346256018 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:37.346256018 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:37.346306086 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:37.346317053 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.346513987 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.346570969 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:37.347440958 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.347460032 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.347479105 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.347492933 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.347503901 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.347533941 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.347537994 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.347553968 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.347573042 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.347583055 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.347596884 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.347609043 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.347623110 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.409064054 CET	49838	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:37.409121990 CET	443	49838	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:37.456023932 CET	49847	53	192.168.2.5	1.1.1.1
Nov 15, 2024 15:59:37.460896969 CET	53	49847	1.1.1.1	192.168.2.5
Nov 15, 2024 15:59:37.460967064 CET	49847	53	192.168.2.5	1.1.1.1
Nov 15, 2024 15:59:37.461052895 CET	49847	53	192.168.2.5	1.1.1.1
Nov 15, 2024 15:59:37.461071968 CET	49847	53	192.168.2.5	1.1.1.1
Nov 15, 2024 15:59:37.461466074 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.461500883 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.461525917 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.461551905 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.461584091 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.461606979 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.461625099 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.461627960 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.461647987 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.461661100 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.461680889 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.461684942 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.461699963 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.462631941 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.462645054 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.462671041 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.462680101 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.462682962 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.462687969 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.462699890 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.462718964 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.462732077 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.462748051 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.464407921 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.464421034 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.464438915 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.464468002 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.464476109 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.464504957 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.466140985 CET	53	49847	1.1.1.1	192.168.2.5
Nov 15, 2024 15:59:37.466244936 CET	53	49847	1.1.1.1	192.168.2.5
Nov 15, 2024 15:59:37.467493057 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.467530966 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.467545033 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.467550039 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.467567921 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.467582941 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.467591047 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.467611074 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.467622042 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.488519907 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.488789082 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.488836050 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.488837957 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.488867998 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.488924026 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.488924026 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.488936901 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.488985062 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.495672941 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.502579927 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.502646923 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.502665043 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.533461094 CET	49848	443	192.168.2.5	104.22.54.104
Nov 15, 2024 15:59:37.533503056 CET	443	49848	104.22.54.104	192.168.2.5
Nov 15, 2024 15:59:37.533551931 CET	49848	443	192.168.2.5	104.22.54.104
Nov 15, 2024 15:59:37.533814907 CET	49848	443	192.168.2.5	104.22.54.104
Nov 15, 2024 15:59:37.533832073 CET	443	49848	104.22.54.104	192.168.2.5
Nov 15, 2024 15:59:37.534251928 CET	443	49842	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.543199062 CET	443	49841	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.544748068 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.544816971 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.544842958 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.544871092 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.544909000 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.562726974 CET	49842	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.562803984 CET	443	49842	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.563514948 CET	49842	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.563529968 CET	443	49842	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.576072931 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.584088087 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.584151983 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.591268063 CET	49832	443	192.168.2.5	18.66.122.127
Nov 15, 2024 15:59:37.591281891 CET	443	49832	18.66.122.127	192.168.2.5
Nov 15, 2024 15:59:37.607676029 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.607904911 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.607975006 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.608035088 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.608310938 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.608380079 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.608400106 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.608625889 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.608690977 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.608702898 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.608978033 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.609033108 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.609045029 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.609208107 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.609262943 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.609275103 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.609427929 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.609483004 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.609494925 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.609613895 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.609668016 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.609679937 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.614439964 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.614485025 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.614517927 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.614532948 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.614592075 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.614605904 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.663641930 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.663796902 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.663829088 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.701630116 CET	443	49842	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.701765060 CET	443	49842	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.701843023 CET	49842	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.727262020 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.727327108 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.727349043 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.727406025 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.727459908 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.727461100 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.727473021 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.727530956 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.727540970 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.727606058 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.727653027 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.727658987 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.727699995 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.727744102 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.727749109 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.728557110 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.728606939 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.728615046 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.728663921 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.728708982 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.728713989 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.728800058 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.728846073 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.746577978 CET	443	49843	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:37.747376919 CET	443	49841	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.747446060 CET	49841	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.749622107 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:37.749653101 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:37.749716997 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:37.750380993 CET	49843	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:37.750390053 CET	443	49843	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:37.750715971 CET	443	49843	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:37.754838943 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:37.754854918 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:37.755392075 CET	49843	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:37.755455971 CET	443	49843	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:37.769330025 CET	49843	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:37.790329933 CET	49840	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:37.790364981 CET	443	49840	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:37.811368942 CET	443	49843	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:37.815529108 CET	49841	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.815535069 CET	443	49841	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.816145897 CET	49841	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.816149950 CET	443	49841	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.862895966 CET	49842	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.862895966 CET	49842	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.862942934 CET	443	49842	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.862960100 CET	443	49842	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.885015965 CET	443	49844	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.893728018 CET	443	49845	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.902602911 CET	49845	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.902641058 CET	443	49845	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.903079033 CET	49845	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.903085947 CET	443	49845	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.907084942 CET	443	49843	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:37.907129049 CET	443	49843	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:37.907172918 CET	49843	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:37.907181025 CET	443	49843	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:37.907233953 CET	443	49843	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:37.907289028 CET	49843	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:37.907304049 CET	443	49843	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:37.907351971 CET	443	49843	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:37.907372952 CET	49843	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:37.907402039 CET	443	49843	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:37.907442093 CET	49843	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:37.916049957 CET	49844	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.916088104 CET	443	49844	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.916913986 CET	49844	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:37.916919947 CET	443	49844	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:37.999927044 CET	443	49836	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.024880886 CET	443	49841	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.024960995 CET	443	49841	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.025015116 CET	49841	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.028044939 CET	443	49845	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.028175116 CET	443	49845	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.028232098 CET	49845	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.042192936 CET	443	49844	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.042349100 CET	443	49844	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.042411089 CET	49844	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.047069073 CET	49836	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.061563969 CET	53	49847	1.1.1.1	192.168.2.5
Nov 15, 2024 15:59:38.145951986 CET	443	49848	104.22.54.104	192.168.2.5
Nov 15, 2024 15:59:38.247524023 CET	49847	53	192.168.2.5	1.1.1.1
Nov 15, 2024 15:59:38.247523069 CET	49848	443	192.168.2.5	104.22.54.104
Nov 15, 2024 15:59:38.530412912 CET	49847	53	192.168.2.5	1.1.1.1
Nov 15, 2024 15:59:38.530808926 CET	49848	443	192.168.2.5	104.22.54.104
Nov 15, 2024 15:59:38.530852079 CET	443	49848	104.22.54.104	192.168.2.5
Nov 15, 2024 15:59:38.532480955 CET	443	49848	104.22.54.104	192.168.2.5
Nov 15, 2024 15:59:38.532501936 CET	443	49848	104.22.54.104	192.168.2.5
Nov 15, 2024 15:59:38.532563925 CET	49848	443	192.168.2.5	104.22.54.104
Nov 15, 2024 15:59:38.532572031 CET	49836	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.532593966 CET	443	49836	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.533045053 CET	49836	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.533056021 CET	443	49836	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.533149958 CET	49844	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.533164978 CET	443	49844	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.533200979 CET	49844	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.533206940 CET	443	49844	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.534373045 CET	49841	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.534404993 CET	443	49841	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.534442902 CET	49841	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.534451008 CET	443	49841	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.535166025 CET	49845	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.535166025 CET	49845	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.535188913 CET	443	49845	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.535211086 CET	443	49845	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.543844938 CET	49848	443	192.168.2.5	104.22.54.104
Nov 15, 2024 15:59:38.543939114 CET	443	49848	104.22.54.104	192.168.2.5
Nov 15, 2024 15:59:38.546561003 CET	49848	443	192.168.2.5	104.22.54.104
Nov 15, 2024 15:59:38.546581030 CET	443	49848	104.22.54.104	192.168.2.5
Nov 15, 2024 15:59:38.549441099 CET	49855	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.549526930 CET	443	49855	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.549622059 CET	49855	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.549725056 CET	49855	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.549760103 CET	443	49855	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.551605940 CET	49843	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:38.551615953 CET	443	49843	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:38.553181887 CET	49856	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.553204060 CET	443	49856	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.553425074 CET	49856	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.557358027 CET	49857	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.557420015 CET	443	49857	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.557521105 CET	49857	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.557524920 CET	49856	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.557550907 CET	443	49856	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.558526039 CET	49858	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.558547020 CET	443	49858	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.558615923 CET	49858	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.558653116 CET	49857	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.558676958 CET	443	49857	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.558763027 CET	49858	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.558785915 CET	443	49858	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.652705908 CET	49848	443	192.168.2.5	104.22.54.104
Nov 15, 2024 15:59:38.675081968 CET	53	49847	1.1.1.1	192.168.2.5
Nov 15, 2024 15:59:38.675632000 CET	49847	53	192.168.2.5	1.1.1.1
Nov 15, 2024 15:59:38.688157082 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:38.695676088 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:38.695707083 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:38.698010921 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:38.698096037 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:38.698929071 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:38.699023008 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:38.699671984 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:38.699682951 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:38.796005964 CET	443	49836	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.796169996 CET	443	49836	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.796294928 CET	49836	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.810954094 CET	443	49848	104.22.54.104	192.168.2.5
Nov 15, 2024 15:59:38.811080933 CET	443	49848	104.22.54.104	192.168.2.5
Nov 15, 2024 15:59:38.811156034 CET	49848	443	192.168.2.5	104.22.54.104
Nov 15, 2024 15:59:38.811183929 CET	443	49848	104.22.54.104	192.168.2.5
Nov 15, 2024 15:59:38.811279058 CET	443	49848	104.22.54.104	192.168.2.5
Nov 15, 2024 15:59:38.811353922 CET	49848	443	192.168.2.5	104.22.54.104
Nov 15, 2024 15:59:38.811362982 CET	443	49848	104.22.54.104	192.168.2.5
Nov 15, 2024 15:59:38.811593056 CET	443	49848	104.22.54.104	192.168.2.5
Nov 15, 2024 15:59:38.811645985 CET	49848	443	192.168.2.5	104.22.54.104
Nov 15, 2024 15:59:38.826148033 CET	49859	443	192.168.2.5	216.239.34.181
Nov 15, 2024 15:59:38.826188087 CET	443	49859	216.239.34.181	192.168.2.5
Nov 15, 2024 15:59:38.827600002 CET	49859	443	192.168.2.5	216.239.34.181
Nov 15, 2024 15:59:38.827872038 CET	49859	443	192.168.2.5	216.239.34.181
Nov 15, 2024 15:59:38.827887058 CET	443	49859	216.239.34.181	192.168.2.5
Nov 15, 2024 15:59:38.844238997 CET	49836	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.844239950 CET	49836	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.844273090 CET	443	49836	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.844290018 CET	443	49836	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.845581055 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:38.848469973 CET	49848	443	192.168.2.5	104.22.54.104
Nov 15, 2024 15:59:38.848494053 CET	443	49848	104.22.54.104	192.168.2.5
Nov 15, 2024 15:59:38.853672028 CET	49860	443	192.168.2.5	172.217.18.98
Nov 15, 2024 15:59:38.853755951 CET	443	49860	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:38.853831053 CET	49860	443	192.168.2.5	172.217.18.98
Nov 15, 2024 15:59:38.853991985 CET	49860	443	192.168.2.5	172.217.18.98
Nov 15, 2024 15:59:38.854013920 CET	443	49860	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:38.859123945 CET	49861	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.859153986 CET	443	49861	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.859426975 CET	49861	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.863997936 CET	49862	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:38.864092112 CET	443	49862	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:38.864180088 CET	49862	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:38.864921093 CET	49863	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:38.865003109 CET	443	49863	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:38.865058899 CET	49862	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:38.865108967 CET	443	49862	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:38.865135908 CET	49863	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:38.865875959 CET	49863	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:38.865900993 CET	443	49863	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:38.870779991 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:38.870862961 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:38.870944977 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:38.871155977 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:38.871191978 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:38.871539116 CET	49861	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:38.871557951 CET	443	49861	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:38.887094975 CET	49865	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:38.887181044 CET	443	49865	54.217.99.7	192.168.2.5
Nov 15, 2024 15:59:38.887265921 CET	49865	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:38.887463093 CET	49865	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:38.887486935 CET	443	49865	54.217.99.7	192.168.2.5
Nov 15, 2024 15:59:38.996306896 CET	49868	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:38.996395111 CET	443	49868	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:38.996493101 CET	49868	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:38.996634960 CET	49868	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:38.996658087 CET	443	49868	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:39.203749895 CET	49869	443	192.168.2.5	13.224.245.27
Nov 15, 2024 15:59:39.203836918 CET	443	49869	13.224.245.27	192.168.2.5
Nov 15, 2024 15:59:39.203912973 CET	49869	443	192.168.2.5	13.224.245.27
Nov 15, 2024 15:59:39.204168081 CET	49869	443	192.168.2.5	13.224.245.27
Nov 15, 2024 15:59:39.204200983 CET	443	49869	13.224.245.27	192.168.2.5
Nov 15, 2024 15:59:39.204478025 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:39.204500914 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:39.204562902 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:39.204771996 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:39.204796076 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:39.206522942 CET	49872	53	192.168.2.5	1.1.1.1
Nov 15, 2024 15:59:39.211544991 CET	53	49872	1.1.1.1	192.168.2.5
Nov 15, 2024 15:59:39.211620092 CET	49872	53	192.168.2.5	1.1.1.1
Nov 15, 2024 15:59:39.211841106 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:39.211863995 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:39.211899996 CET	49872	53	192.168.2.5	1.1.1.1
Nov 15, 2024 15:59:39.211899996 CET	49872	53	192.168.2.5	1.1.1.1
Nov 15, 2024 15:59:39.211925030 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:39.212131977 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:39.212161064 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:39.215409040 CET	49875	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:39.215451956 CET	443	49875	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:39.215508938 CET	49875	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:39.215651035 CET	49875	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:39.215668917 CET	443	49875	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:39.216705084 CET	53	49872	1.1.1.1	192.168.2.5
Nov 15, 2024 15:59:39.217061996 CET	53	49872	1.1.1.1	192.168.2.5
Nov 15, 2024 15:59:39.217504978 CET	49877	443	192.168.2.5	172.67.5.216
Nov 15, 2024 15:59:39.217556953 CET	443	49877	172.67.5.216	192.168.2.5
Nov 15, 2024 15:59:39.217669964 CET	49877	443	192.168.2.5	172.67.5.216
Nov 15, 2024 15:59:39.217705965 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:39.217715025 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:39.217778921 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:39.217931986 CET	49877	443	192.168.2.5	172.67.5.216
Nov 15, 2024 15:59:39.217966080 CET	443	49877	172.67.5.216	192.168.2.5
Nov 15, 2024 15:59:39.218061924 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:39.218077898 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:39.410793066 CET	443	49858	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.412359953 CET	49858	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.412405014 CET	443	49858	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.412673950 CET	49858	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.412703037 CET	443	49858	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.414028883 CET	443	49855	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.414393902 CET	49855	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.414412975 CET	443	49855	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.414953947 CET	49855	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.414959908 CET	443	49855	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.416631937 CET	443	49856	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.416958094 CET	49856	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.416973114 CET	443	49856	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.417336941 CET	49856	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.417342901 CET	443	49856	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.432739019 CET	443	49857	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.433020115 CET	49857	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.433043957 CET	443	49857	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.433428049 CET	49857	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.433433056 CET	443	49857	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.468527079 CET	443	49859	216.239.34.181	192.168.2.5
Nov 15, 2024 15:59:39.468734980 CET	49859	443	192.168.2.5	216.239.34.181
Nov 15, 2024 15:59:39.468782902 CET	443	49859	216.239.34.181	192.168.2.5
Nov 15, 2024 15:59:39.469319105 CET	443	49859	216.239.34.181	192.168.2.5
Nov 15, 2024 15:59:39.469389915 CET	49859	443	192.168.2.5	216.239.34.181
Nov 15, 2024 15:59:39.470308065 CET	443	49859	216.239.34.181	192.168.2.5
Nov 15, 2024 15:59:39.470385075 CET	49859	443	192.168.2.5	216.239.34.181
Nov 15, 2024 15:59:39.471139908 CET	49859	443	192.168.2.5	216.239.34.181
Nov 15, 2024 15:59:39.471218109 CET	443	49859	216.239.34.181	192.168.2.5
Nov 15, 2024 15:59:39.471302986 CET	49859	443	192.168.2.5	216.239.34.181
Nov 15, 2024 15:59:39.471318007 CET	443	49859	216.239.34.181	192.168.2.5
Nov 15, 2024 15:59:39.471715927 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.471776009 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.471796036 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.471833944 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.471837997 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.471853018 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.471869946 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.471874952 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.471911907 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.471916914 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.471916914 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.471916914 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.471954107 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.474268913 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.474278927 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.474312067 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.474340916 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.474351883 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.474378109 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.474407911 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.474427938 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.544379950 CET	443	49858	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.544522047 CET	443	49858	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.544599056 CET	49858	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.546066046 CET	443	49855	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.546928883 CET	443	49855	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.546997070 CET	49855	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.547882080 CET	49858	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.547904015 CET	443	49858	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.547920942 CET	49858	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.547926903 CET	443	49858	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.548796892 CET	49855	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.548804045 CET	443	49855	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.548815966 CET	49855	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.548820972 CET	443	49855	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.549679041 CET	443	49863	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:39.549912930 CET	49863	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:39.549942970 CET	443	49863	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:39.550412893 CET	443	49863	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:39.550714970 CET	49863	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:39.550800085 CET	443	49863	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:39.550831079 CET	49863	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:39.551559925 CET	49882	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.551599979 CET	443	49882	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.551659107 CET	49882	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.552304983 CET	49883	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.552325010 CET	443	49883	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.552385092 CET	49883	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.552412987 CET	49882	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.552427053 CET	443	49882	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.552479982 CET	49883	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.552495003 CET	443	49883	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.570710897 CET	49859	443	192.168.2.5	216.239.34.181
Nov 15, 2024 15:59:39.576478958 CET	443	49856	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.576637983 CET	443	49856	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.576747894 CET	49856	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.576747894 CET	49856	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.576747894 CET	49856	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.578623056 CET	49884	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.578711987 CET	443	49884	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.578843117 CET	49884	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.579056025 CET	49884	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.579091072 CET	443	49884	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.584402084 CET	443	49857	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.584471941 CET	443	49857	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.584518909 CET	49857	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.584606886 CET	49857	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.584619999 CET	443	49857	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.584634066 CET	49857	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.584639072 CET	443	49857	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.586551905 CET	49885	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.586635113 CET	443	49885	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.586730003 CET	49885	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.586839914 CET	49885	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.586879969 CET	443	49885	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.591373920 CET	443	49863	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:39.594974041 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.595046997 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.595091105 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.595123053 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.595155001 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.595180035 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.596118927 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.596165895 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.596203089 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.596215010 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.596251965 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.596251965 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.597677946 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.597718954 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.597752094 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.597763062 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.597789049 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.597806931 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.600671053 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.600769043 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.600770950 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.600800991 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.600847006 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.600847006 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.604739904 CET	443	49862	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:39.609194994 CET	443	49861	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.613049984 CET	49861	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.613091946 CET	443	49861	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.613446951 CET	49861	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.613451958 CET	443	49861	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.620187044 CET	49862	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:39.620214939 CET	443	49862	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:39.621752977 CET	443	49862	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:39.622081041 CET	443	49859	216.239.34.181	192.168.2.5
Nov 15, 2024 15:59:39.622134924 CET	49862	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:39.622508049 CET	49859	443	192.168.2.5	216.239.34.181
Nov 15, 2024 15:59:39.622572899 CET	443	49862	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:39.622576952 CET	443	49859	216.239.34.181	192.168.2.5
Nov 15, 2024 15:59:39.622637033 CET	49859	443	192.168.2.5	216.239.34.181
Nov 15, 2024 15:59:39.623986006 CET	49862	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:39.648844004 CET	49863	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:39.667404890 CET	443	49862	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:39.718461990 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.718492031 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.718609095 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.718667030 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.718694925 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.718700886 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.718727112 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.718728065 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.718745947 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.718775034 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.718775034 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.718806982 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.718806982 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.719392061 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.719440937 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.719468117 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.719472885 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.719510078 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.719551086 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.726001978 CET	443	49860	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:39.730808973 CET	49860	443	192.168.2.5	172.217.18.98
Nov 15, 2024 15:59:39.730870008 CET	443	49860	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:39.731873035 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:39.732547998 CET	443	49860	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:39.732628107 CET	49860	443	192.168.2.5	172.217.18.98
Nov 15, 2024 15:59:39.735496998 CET	49850	443	192.168.2.5	18.172.112.30
Nov 15, 2024 15:59:39.735529900 CET	443	49850	18.172.112.30	192.168.2.5
Nov 15, 2024 15:59:39.743345976 CET	443	49861	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.743491888 CET	443	49861	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.743552923 CET	49861	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.744275093 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:39.744294882 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:39.745837927 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:39.746021986 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:39.756323099 CET	49860	443	192.168.2.5	172.217.18.98
Nov 15, 2024 15:59:39.756803036 CET	443	49860	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:39.760962963 CET	49860	443	192.168.2.5	172.217.18.98
Nov 15, 2024 15:59:39.761044979 CET	443	49860	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:39.763093948 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:39.763398886 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:39.764136076 CET	443	49863	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:39.773320913 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:39.773402929 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:39.774780035 CET	443	49862	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:39.776397943 CET	443	49862	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:39.776454926 CET	49862	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:39.782150984 CET	49861	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.782200098 CET	443	49861	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.782227993 CET	49861	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.782247066 CET	443	49861	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.789355040 CET	49886	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.789385080 CET	443	49886	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.789439917 CET	49886	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.800030947 CET	443	49863	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:39.800085068 CET	49863	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:39.800441027 CET	443	49868	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:39.803554058 CET	49863	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:39.803585052 CET	443	49863	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:39.804069996 CET	49868	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:39.804099083 CET	443	49868	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:39.805151939 CET	49862	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:39.805171013 CET	443	49862	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:39.805527925 CET	49886	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:39.805545092 CET	443	49886	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:39.805651903 CET	443	49868	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:39.805707932 CET	49868	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:39.806183100 CET	49868	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:39.806260109 CET	443	49868	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:39.808108091 CET	49868	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:39.808118105 CET	443	49868	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:39.817584038 CET	53	49872	1.1.1.1	192.168.2.5
Nov 15, 2024 15:59:39.818099976 CET	49872	53	192.168.2.5	1.1.1.1
Nov 15, 2024 15:59:39.823529005 CET	53	49872	1.1.1.1	192.168.2.5
Nov 15, 2024 15:59:39.823700905 CET	49872	53	192.168.2.5	1.1.1.1
Nov 15, 2024 15:59:39.835612059 CET	49860	443	192.168.2.5	172.217.18.98
Nov 15, 2024 15:59:39.835612059 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:39.835757017 CET	443	49877	172.67.5.216	192.168.2.5
Nov 15, 2024 15:59:39.835913897 CET	443	49875	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:39.836492062 CET	49889	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:39.836498976 CET	49877	443	192.168.2.5	172.67.5.216
Nov 15, 2024 15:59:39.836545944 CET	443	49877	172.67.5.216	192.168.2.5
Nov 15, 2024 15:59:39.836556911 CET	49828	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:39.836575985 CET	443	49889	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:39.836658955 CET	49889	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:39.837013960 CET	49889	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:39.837091923 CET	443	49889	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:39.837167978 CET	49875	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:39.837228060 CET	443	49875	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:39.838170052 CET	443	49877	172.67.5.216	192.168.2.5
Nov 15, 2024 15:59:39.838243961 CET	49877	443	192.168.2.5	172.67.5.216
Nov 15, 2024 15:59:39.838624001 CET	49877	443	192.168.2.5	172.67.5.216
Nov 15, 2024 15:59:39.838704109 CET	443	49877	172.67.5.216	192.168.2.5
Nov 15, 2024 15:59:39.838718891 CET	49877	443	192.168.2.5	172.67.5.216
Nov 15, 2024 15:59:39.841083050 CET	443	49875	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:39.841160059 CET	49875	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:39.841483116 CET	49875	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:39.841607094 CET	49875	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:39.841679096 CET	443	49875	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:39.855864048 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:39.855947971 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:39.856059074 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:39.856295109 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:39.856367111 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:39.879342079 CET	443	49828	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:39.879489899 CET	443	49877	172.67.5.216	192.168.2.5
Nov 15, 2024 15:59:39.941823006 CET	49868	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:39.941838026 CET	49877	443	192.168.2.5	172.67.5.216
Nov 15, 2024 15:59:39.941895962 CET	443	49877	172.67.5.216	192.168.2.5
Nov 15, 2024 15:59:39.956074953 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:39.956276894 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:39.956310987 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:39.956789970 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:39.956877947 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:39.957777023 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:39.957837105 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:39.958029032 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:39.958106995 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:39.958132982 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:39.958941936 CET	443	49868	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:39.959021091 CET	49868	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:39.959041119 CET	443	49868	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:39.959156990 CET	443	49868	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:39.959206104 CET	49868	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:39.959986925 CET	49868	443	192.168.2.5	52.252.156.53
Nov 15, 2024 15:59:39.960011005 CET	443	49868	52.252.156.53	192.168.2.5
Nov 15, 2024 15:59:39.985825062 CET	443	49875	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:39.985934019 CET	443	49875	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:39.986076117 CET	443	49875	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:39.986107111 CET	49875	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:39.986126900 CET	443	49875	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:39.986161947 CET	49875	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:39.986222982 CET	443	49875	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:39.986323118 CET	49875	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:39.986335039 CET	443	49875	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:39.986445904 CET	443	49875	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:39.986537933 CET	49875	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:39.987003088 CET	443	49865	54.217.99.7	192.168.2.5
Nov 15, 2024 15:59:39.987055063 CET	49875	443	192.168.2.5	104.17.247.203
Nov 15, 2024 15:59:39.987067938 CET	443	49875	104.17.247.203	192.168.2.5
Nov 15, 2024 15:59:39.987621069 CET	49865	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:39.987688065 CET	443	49865	54.217.99.7	192.168.2.5
Nov 15, 2024 15:59:39.988722086 CET	443	49865	54.217.99.7	192.168.2.5
Nov 15, 2024 15:59:39.988851070 CET	49865	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:39.991439104 CET	49865	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:39.991507053 CET	443	49865	54.217.99.7	192.168.2.5
Nov 15, 2024 15:59:39.991571903 CET	49865	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:39.992311001 CET	443	49877	172.67.5.216	192.168.2.5
Nov 15, 2024 15:59:39.992384911 CET	49877	443	192.168.2.5	172.67.5.216
Nov 15, 2024 15:59:39.992414951 CET	443	49877	172.67.5.216	192.168.2.5
Nov 15, 2024 15:59:39.992510080 CET	443	49877	172.67.5.216	192.168.2.5
Nov 15, 2024 15:59:39.992568016 CET	49877	443	192.168.2.5	172.67.5.216
Nov 15, 2024 15:59:39.992582083 CET	443	49877	172.67.5.216	192.168.2.5
Nov 15, 2024 15:59:39.992789030 CET	443	49877	172.67.5.216	192.168.2.5
Nov 15, 2024 15:59:39.992841959 CET	49877	443	192.168.2.5	172.67.5.216
Nov 15, 2024 15:59:39.993870020 CET	49877	443	192.168.2.5	172.67.5.216
Nov 15, 2024 15:59:39.993897915 CET	443	49877	172.67.5.216	192.168.2.5
Nov 15, 2024 15:59:39.999341011 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.006623030 CET	443	49828	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:40.021450996 CET	443	49860	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:40.035332918 CET	443	49865	54.217.99.7	192.168.2.5
Nov 15, 2024 15:59:40.041338921 CET	443	49828	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:40.041426897 CET	49828	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:40.051244020 CET	49865	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:40.051270008 CET	443	49865	54.217.99.7	192.168.2.5
Nov 15, 2024 15:59:40.053838968 CET	443	49869	13.224.245.27	192.168.2.5
Nov 15, 2024 15:59:40.055489063 CET	49828	443	192.168.2.5	192.29.11.142
Nov 15, 2024 15:59:40.055516005 CET	443	49828	192.29.11.142	192.168.2.5
Nov 15, 2024 15:59:40.056030035 CET	49869	443	192.168.2.5	13.224.245.27
Nov 15, 2024 15:59:40.056044102 CET	443	49869	13.224.245.27	192.168.2.5
Nov 15, 2024 15:59:40.057154894 CET	49856	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.057184935 CET	443	49856	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.057224035 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.057238102 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.059576035 CET	443	49869	13.224.245.27	192.168.2.5
Nov 15, 2024 15:59:40.059653044 CET	49869	443	192.168.2.5	13.224.245.27
Nov 15, 2024 15:59:40.059912920 CET	49869	443	192.168.2.5	13.224.245.27
Nov 15, 2024 15:59:40.060020924 CET	49869	443	192.168.2.5	13.224.245.27
Nov 15, 2024 15:59:40.060082912 CET	443	49869	13.224.245.27	192.168.2.5
Nov 15, 2024 15:59:40.061935902 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.062946081 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.062959909 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.065344095 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.065404892 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.066013098 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.066133976 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.066207886 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.066215038 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.066227913 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.066458941 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.066467047 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.067893982 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.067955971 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.068281889 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.068281889 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.068363905 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.115773916 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.115858078 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.115875959 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.115921974 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.142599106 CET	443	49860	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:40.142703056 CET	49860	443	192.168.2.5	172.217.18.98
Nov 15, 2024 15:59:40.143279076 CET	49860	443	192.168.2.5	172.217.18.98
Nov 15, 2024 15:59:40.143302917 CET	443	49860	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:40.153726101 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.153731108 CET	49865	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:40.154087067 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.154103041 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.155878067 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.155925989 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.155936003 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.155986071 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.156008005 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.156018972 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.156047106 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.156085014 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.156115055 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.156115055 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.156116009 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.156151056 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.157103062 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.157125950 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.157191992 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.157212973 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.157246113 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.158706903 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.169348955 CET	49869	443	192.168.2.5	13.224.245.27
Nov 15, 2024 15:59:40.169379950 CET	443	49869	13.224.245.27	192.168.2.5
Nov 15, 2024 15:59:40.233123064 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.233160019 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.233197927 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.233227968 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.233263969 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.233309031 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.233331919 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.233367920 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.234395027 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.234419107 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.234460115 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.234461069 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.234482050 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.234510899 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.234510899 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.235229015 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.235255957 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.235301971 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.235313892 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.235337019 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.236398935 CET	443	49865	54.217.99.7	192.168.2.5
Nov 15, 2024 15:59:40.236449957 CET	443	49865	54.217.99.7	192.168.2.5
Nov 15, 2024 15:59:40.236512899 CET	49865	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:40.236690998 CET	49865	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:40.236702919 CET	443	49865	54.217.99.7	192.168.2.5
Nov 15, 2024 15:59:40.247065067 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:40.247109890 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:40.247297049 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:40.248116970 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:40.248200893 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:40.248274088 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:40.248332977 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:40.248364925 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:40.248684883 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:40.248720884 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:40.263443947 CET	49893	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:40.263530970 CET	443	49893	54.217.99.7	192.168.2.5
Nov 15, 2024 15:59:40.267637968 CET	49893	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:40.267827988 CET	49893	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:40.267863989 CET	443	49893	54.217.99.7	192.168.2.5
Nov 15, 2024 15:59:40.272789001 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.272815943 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.272924900 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.272950888 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.274110079 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.274566889 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.274590969 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.274632931 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.274638891 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.274692059 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.276377916 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.276401043 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.276479006 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.276485920 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.276515007 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.276542902 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.279294014 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.279330969 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.279383898 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.279391050 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.279443026 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.296143055 CET	443	49882	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.296931982 CET	49882	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.296955109 CET	443	49882	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.298254967 CET	49882	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.298259020 CET	443	49882	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.308046103 CET	49894	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:40.308118105 CET	443	49894	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:40.308293104 CET	49894	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:40.308589935 CET	49894	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:40.308625937 CET	443	49894	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:40.309442043 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.312206984 CET	443	49885	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.312402964 CET	443	49884	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.312900066 CET	49884	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.312939882 CET	443	49884	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.313333035 CET	49885	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.313352108 CET	443	49885	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.313488007 CET	49884	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.313499928 CET	443	49884	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.314667940 CET	49885	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.314678907 CET	443	49885	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.317996025 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.318038940 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.318090916 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.318114996 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.318133116 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.318162918 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.318406105 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.319597006 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.319605112 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.325202942 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.325680017 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.325686932 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.350867033 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.350970984 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.351012945 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.351032972 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.351061106 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.351068020 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.351104975 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.351121902 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.351160049 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.351187944 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.351219893 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.351252079 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.351272106 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.351337910 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.351810932 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.351918936 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.352015018 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.353646040 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.353646040 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.353662014 CET	443	49870	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.353722095 CET	49870	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.358057022 CET	49895	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:40.358097076 CET	443	49895	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:40.358231068 CET	49896	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:40.358253956 CET	443	49896	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:40.358289003 CET	49895	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:40.358562946 CET	49895	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:40.358578920 CET	443	49895	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:40.358616114 CET	49896	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:40.358699083 CET	49896	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:40.358707905 CET	443	49896	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:40.360049009 CET	49897	443	192.168.2.5	104.244.42.195
Nov 15, 2024 15:59:40.360060930 CET	443	49897	104.244.42.195	192.168.2.5
Nov 15, 2024 15:59:40.360146999 CET	49897	443	192.168.2.5	104.244.42.195
Nov 15, 2024 15:59:40.360353947 CET	49897	443	192.168.2.5	104.244.42.195
Nov 15, 2024 15:59:40.360366106 CET	443	49897	104.244.42.195	192.168.2.5
Nov 15, 2024 15:59:40.363420010 CET	49869	443	192.168.2.5	13.224.245.27
Nov 15, 2024 15:59:40.363429070 CET	443	49869	13.224.245.27	192.168.2.5
Nov 15, 2024 15:59:40.389538050 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.389573097 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.389651060 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.389688969 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.389724016 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.390136957 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.390165091 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.390336990 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.390336990 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.390394926 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.391232967 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.391252995 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.391307116 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.391351938 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.391392946 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.391643047 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.391783953 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.391803980 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.391872883 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.391885996 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.392339945 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.392365932 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.392411947 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.392425060 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.392457008 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.392477036 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.394660950 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.394680977 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.394725084 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.394736052 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.394766092 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.394785881 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.396075010 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.396327972 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.396351099 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.396411896 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.396445990 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.396487951 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.396569014 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.418406963 CET	443	49869	13.224.245.27	192.168.2.5
Nov 15, 2024 15:59:40.418437004 CET	443	49869	13.224.245.27	192.168.2.5
Nov 15, 2024 15:59:40.418565989 CET	443	49869	13.224.245.27	192.168.2.5
Nov 15, 2024 15:59:40.418567896 CET	49869	443	192.168.2.5	13.224.245.27
Nov 15, 2024 15:59:40.418567896 CET	49869	443	192.168.2.5	13.224.245.27
Nov 15, 2024 15:59:40.418587923 CET	443	49869	13.224.245.27	192.168.2.5
Nov 15, 2024 15:59:40.418606997 CET	443	49869	13.224.245.27	192.168.2.5
Nov 15, 2024 15:59:40.418629885 CET	49869	443	192.168.2.5	13.224.245.27
Nov 15, 2024 15:59:40.418633938 CET	443	49869	13.224.245.27	192.168.2.5
Nov 15, 2024 15:59:40.418646097 CET	49869	443	192.168.2.5	13.224.245.27
Nov 15, 2024 15:59:40.418678999 CET	49869	443	192.168.2.5	13.224.245.27
Nov 15, 2024 15:59:40.418781042 CET	443	49869	13.224.245.27	192.168.2.5
Nov 15, 2024 15:59:40.418975115 CET	49869	443	192.168.2.5	13.224.245.27
Nov 15, 2024 15:59:40.419192076 CET	49869	443	192.168.2.5	13.224.245.27
Nov 15, 2024 15:59:40.419192076 CET	49869	443	192.168.2.5	13.224.245.27
Nov 15, 2024 15:59:40.419231892 CET	443	49869	13.224.245.27	192.168.2.5
Nov 15, 2024 15:59:40.419621944 CET	49869	443	192.168.2.5	13.224.245.27
Nov 15, 2024 15:59:40.427114964 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.427149057 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.427261114 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.427261114 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.427261114 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.427289963 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.427304983 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.427347898 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.427392960 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.427393913 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.427421093 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.427443981 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.429301023 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.429316044 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.429342031 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.429352045 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.429363012 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.429366112 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.429384947 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.429424047 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.429425001 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.429456949 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.432111025 CET	443	49882	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.433078051 CET	443	49882	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.433163881 CET	49882	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.435010910 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.435065031 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.435108900 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.435127974 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.435144901 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.435175896 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.435393095 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.435456038 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.435470104 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.435532093 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.435584068 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.435623884 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.435633898 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.435647964 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.435717106 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.436454058 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.436507940 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.436513901 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.436528921 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.436578989 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.436593056 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.440541983 CET	49882	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.440541983 CET	49882	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.440557957 CET	443	49882	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.440567017 CET	443	49882	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.443188906 CET	443	49884	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.443800926 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.443850040 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.443871975 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.443886995 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.444011927 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.444042921 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.444119930 CET	443	49884	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.444195032 CET	49884	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.444749117 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.445132017 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.445144892 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.446652889 CET	443	49885	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.447324991 CET	443	49885	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.447551966 CET	49885	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.452668905 CET	49885	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.452670097 CET	49885	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.452734947 CET	443	49885	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.452769995 CET	443	49885	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.453675032 CET	49884	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.453711033 CET	443	49884	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.453736067 CET	49884	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.453749895 CET	443	49884	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.460741997 CET	49899	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.460792065 CET	443	49899	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.461277962 CET	49899	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.463001966 CET	49900	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.463049889 CET	443	49900	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.463128090 CET	49900	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.467238903 CET	49899	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.467274904 CET	443	49899	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.468235016 CET	49900	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.468266010 CET	443	49900	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.471610069 CET	49901	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.471651077 CET	443	49901	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.471879005 CET	49901	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.478046894 CET	49901	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.478060961 CET	443	49901	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.490601063 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.490669012 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.490720034 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.497756004 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.497822046 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.497843981 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.497848034 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.497915983 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.499838114 CET	49864	443	192.168.2.5	3.165.206.67
Nov 15, 2024 15:59:40.499855995 CET	443	49864	3.165.206.67	192.168.2.5
Nov 15, 2024 15:59:40.536808968 CET	443	49886	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.543827057 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.543843031 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.543869972 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.543939114 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.543977022 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.543998003 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.544034004 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.544043064 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.544084072 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.545423031 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.545437098 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.545497894 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.545515060 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.545546055 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.545556068 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.545587063 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.545608044 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.545624018 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.545641899 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.545660973 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.545687914 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.547225952 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.547243118 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.547282934 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.547337055 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.547347069 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.547363043 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.547399044 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.556422949 CET	49902	443	192.168.2.5	104.244.42.195
Nov 15, 2024 15:59:40.556497097 CET	443	49902	104.244.42.195	192.168.2.5
Nov 15, 2024 15:59:40.556605101 CET	49902	443	192.168.2.5	104.244.42.195
Nov 15, 2024 15:59:40.557709932 CET	49902	443	192.168.2.5	104.244.42.195
Nov 15, 2024 15:59:40.557746887 CET	443	49902	104.244.42.195	192.168.2.5
Nov 15, 2024 15:59:40.565903902 CET	49886	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.565942049 CET	443	49886	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.566665888 CET	49886	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.566678047 CET	443	49886	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.580627918 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.580701113 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.580749035 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.580773115 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.580826998 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.580830097 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.580878019 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.580929995 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.580960035 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.581026077 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.581073999 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.581108093 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.581110001 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.581123114 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.581163883 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.581794977 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.581861973 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.581914902 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.581931114 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.582016945 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.582039118 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.582093954 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.584063053 CET	49874	443	192.168.2.5	146.75.120.157
Nov 15, 2024 15:59:40.584098101 CET	443	49874	146.75.120.157	192.168.2.5
Nov 15, 2024 15:59:40.592298985 CET	443	49889	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.592564106 CET	49889	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.592596054 CET	443	49889	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.593275070 CET	443	49889	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.593458891 CET	49889	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.594314098 CET	443	49889	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.594985008 CET	49889	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.595274925 CET	49889	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.595455885 CET	443	49889	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.595518112 CET	49889	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.595531940 CET	443	49889	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.639916897 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.655837059 CET	49889	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.661133051 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.661166906 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.661210060 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.661228895 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.661250114 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.661282063 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.661303997 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.661329985 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.661329985 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.661329985 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.661345959 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.661360025 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.661369085 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.661401987 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.661401987 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.661436081 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.661442995 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.661452055 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.661468029 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.661520958 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.661571980 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.661668062 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.661681890 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.661720037 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:40.661789894 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:40.706299067 CET	443	49886	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.706440926 CET	443	49886	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.706507921 CET	49886	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.711741924 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:40.745522022 CET	443	49889	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.746289015 CET	443	49889	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:40.747138977 CET	443	49883	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.747221947 CET	49889	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:40.899470091 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:40.919362068 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:40.919581890 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:40.951375961 CET	443	49883	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:40.952234030 CET	49883	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:40.969031096 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:40.978210926 CET	443	49896	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:40.978588104 CET	443	49895	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:41.017998934 CET	443	49897	104.244.42.195	192.168.2.5
Nov 15, 2024 15:59:41.056118011 CET	49895	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:41.056148052 CET	443	49895	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:41.056354046 CET	49896	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:41.056350946 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.056360960 CET	443	49896	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:41.056417942 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.056978941 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.057044983 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.057403088 CET	49897	443	192.168.2.5	104.244.42.195
Nov 15, 2024 15:59:41.057414055 CET	443	49897	104.244.42.195	192.168.2.5
Nov 15, 2024 15:59:41.058763981 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.058854103 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.060195923 CET	443	49896	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:41.060250044 CET	443	49896	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:41.060295105 CET	49896	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:41.060398102 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.060431957 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.060511112 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.060820103 CET	443	49895	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:41.060864925 CET	443	49895	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:41.060890913 CET	49895	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:41.061316967 CET	443	49897	104.244.42.195	192.168.2.5
Nov 15, 2024 15:59:41.061388016 CET	49897	443	192.168.2.5	104.244.42.195
Nov 15, 2024 15:59:41.061450005 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.061758041 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.103713036 CET	49896	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:41.104027033 CET	443	49896	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:41.104448080 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.105689049 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.106050014 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.106791973 CET	49878	443	192.168.2.5	18.66.122.7
Nov 15, 2024 15:59:41.106827021 CET	443	49878	18.66.122.7	192.168.2.5
Nov 15, 2024 15:59:41.108395100 CET	443	49893	54.217.99.7	192.168.2.5
Nov 15, 2024 15:59:41.109968901 CET	49895	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:41.110284090 CET	443	49895	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:41.111332893 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.111392975 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.111526012 CET	49897	443	192.168.2.5	104.244.42.195
Nov 15, 2024 15:59:41.111974001 CET	49893	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:41.111985922 CET	443	49897	104.244.42.195	192.168.2.5
Nov 15, 2024 15:59:41.111994028 CET	443	49893	54.217.99.7	192.168.2.5
Nov 15, 2024 15:59:41.112293005 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.112338066 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.112550020 CET	49896	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:41.112565041 CET	443	49896	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:41.112586021 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.112654924 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.112860918 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.112941027 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.113331079 CET	49895	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:41.113348961 CET	443	49895	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:41.115031004 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.115334034 CET	49897	443	192.168.2.5	104.244.42.195
Nov 15, 2024 15:59:41.115340948 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.115343094 CET	443	49897	104.244.42.195	192.168.2.5
Nov 15, 2024 15:59:41.115695953 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.115710974 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.115864038 CET	443	49893	54.217.99.7	192.168.2.5
Nov 15, 2024 15:59:41.115940094 CET	49893	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:41.117619038 CET	49893	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:41.117753029 CET	49893	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:41.117758989 CET	443	49893	54.217.99.7	192.168.2.5
Nov 15, 2024 15:59:41.118025064 CET	443	49893	54.217.99.7	192.168.2.5
Nov 15, 2024 15:59:41.140052080 CET	49886	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.140080929 CET	443	49886	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.140094042 CET	49886	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.140101910 CET	443	49886	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.141158104 CET	49883	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.141211987 CET	443	49883	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.141697884 CET	49883	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.141766071 CET	443	49883	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.153798103 CET	49889	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:41.153822899 CET	443	49889	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:41.169637918 CET	49904	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.169720888 CET	443	49904	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.169812918 CET	49904	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.170846939 CET	49895	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:41.170865059 CET	49893	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:41.170874119 CET	443	49893	54.217.99.7	192.168.2.5
Nov 15, 2024 15:59:41.170880079 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.176649094 CET	49904	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.176683903 CET	443	49904	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.191483974 CET	443	49900	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.192099094 CET	49900	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.192117929 CET	443	49900	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.192907095 CET	49900	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.192912102 CET	443	49900	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.222673893 CET	443	49902	104.244.42.195	192.168.2.5
Nov 15, 2024 15:59:41.222948074 CET	49902	443	192.168.2.5	104.244.42.195
Nov 15, 2024 15:59:41.223009109 CET	443	49902	104.244.42.195	192.168.2.5
Nov 15, 2024 15:59:41.223284960 CET	443	49901	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.224064112 CET	443	49902	104.244.42.195	192.168.2.5
Nov 15, 2024 15:59:41.224153042 CET	49902	443	192.168.2.5	104.244.42.195
Nov 15, 2024 15:59:41.224153996 CET	49901	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.224221945 CET	443	49901	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.225069046 CET	49901	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.225121975 CET	443	49901	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.233824968 CET	49902	443	192.168.2.5	104.244.42.195
Nov 15, 2024 15:59:41.233967066 CET	443	49902	104.244.42.195	192.168.2.5
Nov 15, 2024 15:59:41.234076023 CET	49902	443	192.168.2.5	104.244.42.195
Nov 15, 2024 15:59:41.234138966 CET	443	49902	104.244.42.195	192.168.2.5
Nov 15, 2024 15:59:41.240390062 CET	443	49899	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.240819931 CET	49899	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.240880013 CET	443	49899	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.241209030 CET	49899	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.241261005 CET	443	49899	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.252641916 CET	49896	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:41.252646923 CET	49897	443	192.168.2.5	104.244.42.195
Nov 15, 2024 15:59:41.252759933 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.252824068 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.267307043 CET	443	49883	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.267595053 CET	443	49883	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.267712116 CET	49883	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.267813921 CET	49883	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.267813921 CET	49883	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.267854929 CET	443	49883	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.267889023 CET	443	49883	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.271086931 CET	49905	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.271125078 CET	443	49905	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.271205902 CET	49905	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.271234989 CET	443	49897	104.244.42.195	192.168.2.5
Nov 15, 2024 15:59:41.271326065 CET	443	49897	104.244.42.195	192.168.2.5
Nov 15, 2024 15:59:41.271378040 CET	49897	443	192.168.2.5	104.244.42.195
Nov 15, 2024 15:59:41.272697926 CET	49897	443	192.168.2.5	104.244.42.195
Nov 15, 2024 15:59:41.272713900 CET	443	49897	104.244.42.195	192.168.2.5
Nov 15, 2024 15:59:41.274957895 CET	49905	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.274976015 CET	443	49905	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.276721001 CET	49906	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:41.276741982 CET	443	49906	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:41.276802063 CET	49906	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:41.277138948 CET	49906	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:41.277153015 CET	443	49906	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:41.306736946 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:41.306821108 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:41.306917906 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:41.307178974 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:41.307216883 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:41.322829962 CET	443	49900	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.322983980 CET	443	49900	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.323054075 CET	49900	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.323272943 CET	49900	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.323337078 CET	443	49900	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.323374987 CET	49900	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.323391914 CET	443	49900	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.325746059 CET	49908	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.325769901 CET	443	49908	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.325850010 CET	49908	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.325942993 CET	49908	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.325967073 CET	443	49908	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.350711107 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.354432106 CET	443	49901	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.354751110 CET	443	49901	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.354824066 CET	49901	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.354866982 CET	49901	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.354887009 CET	443	49901	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.357402086 CET	49893	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:41.357861042 CET	49909	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.357925892 CET	443	49909	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.358002901 CET	49909	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.358583927 CET	49909	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.358616114 CET	443	49909	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.358644009 CET	443	49893	54.217.99.7	192.168.2.5
Nov 15, 2024 15:59:41.358804941 CET	443	49893	54.217.99.7	192.168.2.5
Nov 15, 2024 15:59:41.358864069 CET	49893	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:41.359004021 CET	49893	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:41.359024048 CET	443	49893	54.217.99.7	192.168.2.5
Nov 15, 2024 15:59:41.359046936 CET	49893	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:41.359086037 CET	49893	443	192.168.2.5	54.217.99.7
Nov 15, 2024 15:59:41.360086918 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.360177994 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.360279083 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.375279903 CET	443	49899	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.375449896 CET	443	49899	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.375616074 CET	49899	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.375616074 CET	49899	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.375616074 CET	49899	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.381242037 CET	49910	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.381262064 CET	443	49910	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.381341934 CET	49910	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.383091927 CET	49910	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.383116007 CET	443	49910	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.384669065 CET	443	49896	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:41.384767056 CET	443	49896	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:41.384946108 CET	49896	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:41.386321068 CET	443	49895	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:41.386674881 CET	443	49895	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:41.386732101 CET	49895	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:41.388264894 CET	49895	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:41.388273954 CET	443	49895	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:41.389749050 CET	443	49902	104.244.42.195	192.168.2.5
Nov 15, 2024 15:59:41.389821053 CET	49902	443	192.168.2.5	104.244.42.195
Nov 15, 2024 15:59:41.393635988 CET	49896	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:41.393662930 CET	443	49896	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:41.397202969 CET	49902	443	192.168.2.5	104.244.42.195
Nov 15, 2024 15:59:41.397233009 CET	443	49902	104.244.42.195	192.168.2.5
Nov 15, 2024 15:59:41.400779009 CET	49911	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:41.400827885 CET	443	49911	142.250.186.164	192.168.2.5
Nov 15, 2024 15:59:41.400892973 CET	49911	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:41.401473045 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.401489973 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.401635885 CET	49911	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:41.401654959 CET	443	49911	142.250.186.164	192.168.2.5
Nov 15, 2024 15:59:41.405601978 CET	49912	443	192.168.2.5	66.102.1.155
Nov 15, 2024 15:59:41.405615091 CET	443	49912	66.102.1.155	192.168.2.5
Nov 15, 2024 15:59:41.405674934 CET	49912	443	192.168.2.5	66.102.1.155
Nov 15, 2024 15:59:41.406182051 CET	49912	443	192.168.2.5	66.102.1.155
Nov 15, 2024 15:59:41.406192064 CET	443	49912	66.102.1.155	192.168.2.5
Nov 15, 2024 15:59:41.428215027 CET	443	49894	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:41.428615093 CET	49894	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:41.428634882 CET	443	49894	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:41.430768013 CET	443	49894	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:41.430854082 CET	49894	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:41.433281898 CET	49894	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:41.433383942 CET	443	49894	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:41.433559895 CET	49894	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:41.433594942 CET	443	49894	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:41.465920925 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.465939999 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.466027021 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.466027021 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.466094971 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.466130018 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.466149092 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.466181993 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.466218948 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.466218948 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.466219902 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.466247082 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.466312885 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.467678070 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.467689037 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.467716932 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.467726946 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.467735052 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.467744112 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.467765093 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.467787981 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.467813015 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.467813015 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.467842102 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.480448008 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.480478048 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.480530024 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.480539083 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.480571985 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.480581045 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.480593920 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.480600119 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.480624914 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.480642080 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.480678082 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.480678082 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.483895063 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.483917952 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.483925104 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.483963966 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.483989000 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.484000921 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.484050989 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.484071970 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.484127045 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.484127045 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.484127045 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.484127998 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.486629009 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.486650944 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.486691952 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.486700058 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.486751080 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.486766100 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.486794949 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.486809015 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.486824989 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.486886978 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.520747900 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.520767927 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.520807028 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.520833015 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.520855904 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.520874977 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.520929098 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.520929098 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.520929098 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.520930052 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.521011114 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.521071911 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.544889927 CET	49894	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:41.593729973 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.593746901 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.593822956 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.593880892 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.593882084 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.593928099 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.593959093 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.593959093 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.595007896 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.595033884 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.595068932 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.595087051 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.595113039 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.596880913 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.596899986 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.596956968 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.596978903 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.597023964 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.598129988 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.598154068 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.598202944 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.598207951 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.598244905 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.598263979 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.598263979 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.598272085 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.598315954 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.603343964 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.603404999 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.603440046 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.603446960 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.603465080 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.603492022 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.604311943 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.604357004 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.604372978 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.604379892 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.604404926 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.604441881 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.606007099 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.606053114 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.606133938 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.606133938 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.606142044 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.606183052 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.609462976 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.609508991 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.609548092 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.609554052 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.609580040 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.609599113 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.617085934 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.617134094 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.617213011 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.617221117 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.617259979 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.617284060 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.623044968 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.623353958 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.627671957 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.627712011 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.627774000 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.627811909 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.627849102 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.654927015 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.654974937 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.655010939 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.655021906 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.655070066 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.669888973 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.696778059 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.696794033 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.696829081 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.696860075 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.696894884 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.696927071 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.696947098 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.697284937 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.697314978 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.697354078 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.697367907 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.697397947 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.697416067 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.698617935 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.698642969 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.698678017 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.698690891 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.698721886 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.698753119 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.699498892 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.699518919 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.699554920 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.699563026 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.699578047 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.699595928 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.699623108 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.699635983 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.699664116 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.699736118 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.705251932 CET	443	49894	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:41.705317020 CET	443	49894	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:41.705374956 CET	49894	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:41.705426931 CET	443	49894	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:41.705463886 CET	443	49894	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:41.705485106 CET	49894	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:41.705523968 CET	49894	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:41.706541061 CET	49894	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:41.706568956 CET	443	49894	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:41.709988117 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.710032940 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.710059881 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.710072041 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.710100889 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.713614941 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.713658094 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.713702917 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.713711023 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.713762999 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.723078012 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.723129988 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.723159075 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.723166943 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.723208904 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.723231077 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.723558903 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.723606110 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.723628044 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.723634958 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.723730087 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.723730087 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.724304914 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.724348068 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.724385023 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.724411011 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.724447012 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.724500895 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.724567890 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.729909897 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.729949951 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.729990959 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.730009079 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.730047941 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.730072021 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.731934071 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.732023001 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.746135950 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.746172905 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.746213913 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.746227980 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.746268034 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.762480974 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.762525082 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.762568951 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.762584925 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.762630939 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.778453112 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.778493881 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.778532028 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.778546095 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.778573990 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.793432951 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.793492079 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.793536901 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.793550014 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.793597937 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.795869112 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.795938969 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.795950890 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.796057940 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.827152967 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.827240944 CET	49899	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.827269077 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.827275991 CET	443	49899	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.827374935 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.827375889 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.827444077 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.827502966 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.828669071 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.828723907 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.828768015 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.828784943 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.828824997 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.828847885 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.833858013 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.833908081 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.833945036 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.833959103 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.834001064 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.834038019 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.834058046 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.834126949 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.834140062 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.834213972 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.834281921 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.924403906 CET	443	49904	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.961085081 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.963413000 CET	49914	443	192.168.2.5	172.217.18.98
Nov 15, 2024 15:59:41.963501930 CET	443	49914	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:41.963579893 CET	49914	443	192.168.2.5	172.217.18.98
Nov 15, 2024 15:59:41.966000080 CET	49892	443	192.168.2.5	169.150.236.105
Nov 15, 2024 15:59:41.966023922 CET	443	49892	169.150.236.105	192.168.2.5
Nov 15, 2024 15:59:41.969963074 CET	49890	443	192.168.2.5	18.245.46.123
Nov 15, 2024 15:59:41.969985962 CET	443	49890	18.245.46.123	192.168.2.5
Nov 15, 2024 15:59:41.972336054 CET	49914	443	192.168.2.5	172.217.18.98
Nov 15, 2024 15:59:41.972374916 CET	443	49914	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:41.981733084 CET	49904	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.981761932 CET	443	49904	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.982975006 CET	49904	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:41.982981920 CET	443	49904	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:41.988259077 CET	49891	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:41.988291025 CET	443	49891	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:41.989329100 CET	49915	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:41.989370108 CET	443	49915	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:41.989444017 CET	49915	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:41.991803885 CET	49915	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:41.991822958 CET	443	49915	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:41.998333931 CET	49918	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:41.998377085 CET	443	49918	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:41.998466015 CET	49918	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:41.999097109 CET	49918	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:41.999116898 CET	443	49918	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.016931057 CET	443	49906	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.023499012 CET	49906	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.023508072 CET	443	49906	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.025063992 CET	443	49906	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.025744915 CET	49906	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.025851965 CET	443	49905	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.025979042 CET	443	49906	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.026494026 CET	49919	443	192.168.2.5	98.83.237.110
Nov 15, 2024 15:59:42.026535034 CET	443	49919	98.83.237.110	192.168.2.5
Nov 15, 2024 15:59:42.026602030 CET	49919	443	192.168.2.5	98.83.237.110
Nov 15, 2024 15:59:42.026792049 CET	49906	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.027235985 CET	49919	443	192.168.2.5	98.83.237.110
Nov 15, 2024 15:59:42.027265072 CET	443	49919	98.83.237.110	192.168.2.5
Nov 15, 2024 15:59:42.044919014 CET	49920	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:42.044954062 CET	443	49920	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:42.045015097 CET	49920	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:42.045171976 CET	49920	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:42.045192957 CET	443	49920	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:42.067348957 CET	443	49906	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.070063114 CET	443	49908	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.088845015 CET	49905	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.088860989 CET	443	49905	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.089332104 CET	49905	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.089339018 CET	443	49905	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.092255116 CET	49908	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.092315912 CET	443	49908	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.092751980 CET	49908	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.092763901 CET	443	49908	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.097433090 CET	443	49909	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.097893000 CET	49909	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.097924948 CET	443	49909	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.098268032 CET	49909	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.098273993 CET	443	49909	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.104847908 CET	443	49910	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.105271101 CET	49910	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.105284929 CET	443	49910	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.105787039 CET	49910	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.105797052 CET	443	49910	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.114272118 CET	443	49904	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.114448071 CET	443	49904	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.114521027 CET	49904	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.118769884 CET	49904	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.118769884 CET	49904	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.118812084 CET	443	49904	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.118841887 CET	443	49904	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.149687052 CET	49923	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.149729967 CET	443	49923	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.149805069 CET	49923	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.150358915 CET	49923	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.150376081 CET	443	49923	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.180041075 CET	443	49906	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.181459904 CET	443	49906	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.181514978 CET	49906	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.193607092 CET	49906	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.193618059 CET	443	49906	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.193631887 CET	49906	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.193659067 CET	49906	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.198482990 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.198920965 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.198982000 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.202029943 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.202105045 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.202383041 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.202470064 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.202511072 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.217199087 CET	443	49908	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.217354059 CET	443	49908	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.217422962 CET	49908	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.217559099 CET	443	49905	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.217638969 CET	443	49905	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.217727900 CET	49905	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.218683004 CET	49908	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.218712091 CET	443	49908	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.218744993 CET	49908	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.218758106 CET	443	49908	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.218993902 CET	49905	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.219017982 CET	443	49905	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.223156929 CET	49924	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.223193884 CET	443	49924	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.223264933 CET	49924	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.223445892 CET	49924	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.223474026 CET	443	49924	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.224107981 CET	49925	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.224167109 CET	443	49925	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.224245071 CET	49925	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.224462986 CET	49925	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.224483967 CET	443	49925	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.225094080 CET	49926	443	192.168.2.5	104.244.42.131
Nov 15, 2024 15:59:42.225112915 CET	443	49926	104.244.42.131	192.168.2.5
Nov 15, 2024 15:59:42.225205898 CET	49926	443	192.168.2.5	104.244.42.131
Nov 15, 2024 15:59:42.225426912 CET	49926	443	192.168.2.5	104.244.42.131
Nov 15, 2024 15:59:42.225450993 CET	443	49926	104.244.42.131	192.168.2.5
Nov 15, 2024 15:59:42.228388071 CET	443	49909	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.228467941 CET	443	49909	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.228518963 CET	49909	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.228741884 CET	49909	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.228754044 CET	443	49909	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.228781939 CET	49909	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.228787899 CET	443	49909	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.233179092 CET	443	49910	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.233340025 CET	443	49910	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.233408928 CET	49910	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.235543966 CET	49927	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.235558987 CET	443	49927	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.235708952 CET	49927	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.236309052 CET	49927	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.236325979 CET	443	49927	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.247334957 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.256376982 CET	49910	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.256376982 CET	49910	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.256442070 CET	443	49910	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.256475925 CET	443	49910	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.259458065 CET	443	49911	142.250.186.164	192.168.2.5
Nov 15, 2024 15:59:42.259686947 CET	49911	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:42.259756088 CET	443	49911	142.250.186.164	192.168.2.5
Nov 15, 2024 15:59:42.261337042 CET	443	49911	142.250.186.164	192.168.2.5
Nov 15, 2024 15:59:42.261399984 CET	443	49912	66.102.1.155	192.168.2.5
Nov 15, 2024 15:59:42.261421919 CET	49911	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:42.261708021 CET	49912	443	192.168.2.5	66.102.1.155
Nov 15, 2024 15:59:42.261724949 CET	443	49912	66.102.1.155	192.168.2.5
Nov 15, 2024 15:59:42.262098074 CET	49911	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:42.262211084 CET	443	49911	142.250.186.164	192.168.2.5
Nov 15, 2024 15:59:42.262223005 CET	49911	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:42.263662100 CET	443	49912	66.102.1.155	192.168.2.5
Nov 15, 2024 15:59:42.263725042 CET	49912	443	192.168.2.5	66.102.1.155
Nov 15, 2024 15:59:42.264774084 CET	49912	443	192.168.2.5	66.102.1.155
Nov 15, 2024 15:59:42.264857054 CET	443	49912	66.102.1.155	192.168.2.5
Nov 15, 2024 15:59:42.264949083 CET	49912	443	192.168.2.5	66.102.1.155
Nov 15, 2024 15:59:42.264955997 CET	443	49912	66.102.1.155	192.168.2.5
Nov 15, 2024 15:59:42.274548054 CET	49928	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.274610043 CET	443	49928	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.274688959 CET	49928	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.274821043 CET	49928	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.274854898 CET	443	49928	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.303353071 CET	443	49911	142.250.186.164	192.168.2.5
Nov 15, 2024 15:59:42.341728926 CET	49912	443	192.168.2.5	66.102.1.155
Nov 15, 2024 15:59:42.355396032 CET	49929	443	192.168.2.5	104.244.42.131
Nov 15, 2024 15:59:42.355420113 CET	443	49929	104.244.42.131	192.168.2.5
Nov 15, 2024 15:59:42.355519056 CET	49929	443	192.168.2.5	104.244.42.131
Nov 15, 2024 15:59:42.355700970 CET	49929	443	192.168.2.5	104.244.42.131
Nov 15, 2024 15:59:42.355717897 CET	443	49929	104.244.42.131	192.168.2.5
Nov 15, 2024 15:59:42.357352972 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.357413054 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.357460976 CET	49911	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:42.357522964 CET	443	49911	142.250.186.164	192.168.2.5
Nov 15, 2024 15:59:42.565052986 CET	49911	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:42.565135956 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.584029913 CET	443	49912	66.102.1.155	192.168.2.5
Nov 15, 2024 15:59:42.584156990 CET	443	49911	142.250.186.164	192.168.2.5
Nov 15, 2024 15:59:42.588521004 CET	49912	443	192.168.2.5	66.102.1.155
Nov 15, 2024 15:59:42.588614941 CET	443	49912	66.102.1.155	192.168.2.5
Nov 15, 2024 15:59:42.588644028 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.588685036 CET	49912	443	192.168.2.5	66.102.1.155
Nov 15, 2024 15:59:42.588709116 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.588730097 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.588751078 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.588767052 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.588809013 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.588840008 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.588840961 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.588857889 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.588887930 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.588891029 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.588915110 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.588927984 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.588951111 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.590306044 CET	49911	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:42.590409994 CET	443	49911	142.250.186.164	192.168.2.5
Nov 15, 2024 15:59:42.590507984 CET	49911	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:42.590650082 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.590668917 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.590703964 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.590708017 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.590725899 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.590744019 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.590745926 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.590760946 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.590764046 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.590780020 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.590799093 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.590821981 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.590821981 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.591495991 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:42.591546059 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:42.591610909 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:42.591821909 CET	49932	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:42.591850042 CET	443	49932	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:42.591897964 CET	49932	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:42.592009068 CET	49933	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:42.592081070 CET	443	49933	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:42.592194080 CET	49933	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:42.592612982 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:42.592632055 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:42.592833042 CET	49932	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:42.592847109 CET	443	49932	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:42.593681097 CET	49933	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:42.593713999 CET	443	49933	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:42.593929052 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:42.594017982 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:42.594124079 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:42.594268084 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:42.594321012 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:42.600523949 CET	49935	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:42.600610018 CET	443	49935	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:42.600718021 CET	49935	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:42.600883961 CET	49935	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:42.600912094 CET	443	49935	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:42.658936977 CET	49704	80	192.168.2.5	104.18.20.226
Nov 15, 2024 15:59:42.659010887 CET	49703	80	192.168.2.5	151.101.130.133
Nov 15, 2024 15:59:42.659022093 CET	49705	80	192.168.2.5	88.221.169.152
Nov 15, 2024 15:59:42.664575100 CET	80	49704	104.18.20.226	192.168.2.5
Nov 15, 2024 15:59:42.665236950 CET	80	49705	88.221.169.152	192.168.2.5
Nov 15, 2024 15:59:42.665323019 CET	49704	80	192.168.2.5	104.18.20.226
Nov 15, 2024 15:59:42.665323019 CET	49705	80	192.168.2.5	88.221.169.152
Nov 15, 2024 15:59:42.665358067 CET	80	49703	151.101.130.133	192.168.2.5
Nov 15, 2024 15:59:42.667598963 CET	49703	80	192.168.2.5	151.101.130.133
Nov 15, 2024 15:59:42.684604883 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.684629917 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.684669971 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.684716940 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.684752941 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.684782982 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.684799910 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.684818983 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.684845924 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.684845924 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.705959082 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.705997944 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.706038952 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.706043005 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.706058025 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.706085920 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.706118107 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.706130028 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.707174063 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.707192898 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.707231045 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.707250118 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.707266092 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.707289934 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.707317114 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.725450993 CET	49936	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:42.725536108 CET	443	49936	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:42.725680113 CET	49936	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:42.725972891 CET	49936	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:42.726007938 CET	443	49936	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:42.735635042 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.735774040 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.735790968 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.735811949 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.735841036 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.735851049 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.735872984 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.735898972 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.735898972 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.742737055 CET	443	49915	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.743043900 CET	443	49918	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.743046999 CET	49915	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.743083000 CET	443	49915	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.743355989 CET	49918	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.743421078 CET	443	49918	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.743604898 CET	443	49915	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.743951082 CET	443	49918	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.744029045 CET	49918	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.744318008 CET	49915	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.744405031 CET	443	49915	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.744585991 CET	49915	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.744959116 CET	443	49918	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.745017052 CET	49918	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.745142937 CET	49918	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.745234013 CET	443	49918	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.745237112 CET	49918	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.760324955 CET	49937	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:42.760411024 CET	443	49937	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:42.760548115 CET	49937	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:42.760727882 CET	49937	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:42.760767937 CET	443	49937	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:42.787350893 CET	443	49915	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.787355900 CET	443	49918	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.801753044 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.801811934 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.801887989 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.801985979 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.801986933 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.802052975 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.802110910 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.822194099 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.822205067 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.822252989 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.822274923 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.822287083 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.822345972 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.822382927 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.822382927 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.823628902 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.823679924 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.823699951 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.823719025 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.823734045 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.823760986 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.824443102 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.824484110 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.824512959 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.824527025 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.824557066 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.825439930 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.825488091 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.825500965 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.825522900 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.825557947 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.826459885 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.826499939 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.826523066 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.826534033 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.826566935 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.842329025 CET	443	49914	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:42.842521906 CET	49914	443	192.168.2.5	172.217.18.98
Nov 15, 2024 15:59:42.842560053 CET	443	49914	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:42.843053102 CET	443	49914	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:42.843386889 CET	49914	443	192.168.2.5	172.217.18.98
Nov 15, 2024 15:59:42.843481064 CET	443	49914	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:42.843682051 CET	49914	443	192.168.2.5	172.217.18.98
Nov 15, 2024 15:59:42.843708992 CET	443	49914	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:42.845056057 CET	49918	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.845114946 CET	443	49918	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.851906061 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.851955891 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.851970911 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.851984024 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.852034092 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.870806932 CET	443	49926	104.244.42.131	192.168.2.5
Nov 15, 2024 15:59:42.886847019 CET	443	49923	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.888654947 CET	49926	443	192.168.2.5	104.244.42.131
Nov 15, 2024 15:59:42.888715029 CET	443	49926	104.244.42.131	192.168.2.5
Nov 15, 2024 15:59:42.890661001 CET	443	49920	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:42.892270088 CET	443	49926	104.244.42.131	192.168.2.5
Nov 15, 2024 15:59:42.892363071 CET	49926	443	192.168.2.5	104.244.42.131
Nov 15, 2024 15:59:42.893903017 CET	443	49918	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.893968105 CET	49918	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.893992901 CET	443	49918	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.894094944 CET	49918	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.894098997 CET	443	49918	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.894129038 CET	443	49918	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.894211054 CET	49926	443	192.168.2.5	104.244.42.131
Nov 15, 2024 15:59:42.894226074 CET	49918	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.894324064 CET	49920	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:42.894345045 CET	443	49920	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:42.894397974 CET	443	49926	104.244.42.131	192.168.2.5
Nov 15, 2024 15:59:42.894433975 CET	49926	443	192.168.2.5	104.244.42.131
Nov 15, 2024 15:59:42.895787954 CET	443	49920	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:42.895874023 CET	49920	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:42.896692991 CET	443	49918	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.896742105 CET	49920	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:42.896820068 CET	443	49918	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.896831989 CET	443	49920	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:42.896883965 CET	49918	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.897109985 CET	49920	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:42.897119045 CET	443	49920	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:42.898576021 CET	443	49915	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.900284052 CET	443	49915	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.901988983 CET	49915	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.918370008 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.918426991 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.918560982 CET	49923	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.918577909 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.918586016 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.918586016 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.918601990 CET	443	49923	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.918657064 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.918868065 CET	49923	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.918876886 CET	443	49923	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.925414085 CET	49938	443	192.168.2.5	63.32.145.9
Nov 15, 2024 15:59:42.925448895 CET	443	49938	63.32.145.9	192.168.2.5
Nov 15, 2024 15:59:42.925982952 CET	49915	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.926007986 CET	443	49915	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.926019907 CET	49938	443	192.168.2.5	63.32.145.9
Nov 15, 2024 15:59:42.926059008 CET	49915	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.926071882 CET	49915	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.926749945 CET	49907	443	192.168.2.5	13.33.187.109
Nov 15, 2024 15:59:42.926789999 CET	443	49907	13.33.187.109	192.168.2.5
Nov 15, 2024 15:59:42.927622080 CET	49938	443	192.168.2.5	63.32.145.9
Nov 15, 2024 15:59:42.927651882 CET	443	49938	63.32.145.9	192.168.2.5
Nov 15, 2024 15:59:42.928061008 CET	49918	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.928061962 CET	49918	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.928098917 CET	443	49918	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.929219007 CET	49918	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.935357094 CET	443	49926	104.244.42.131	192.168.2.5
Nov 15, 2024 15:59:42.937810898 CET	49939	443	192.168.2.5	13.32.27.5
Nov 15, 2024 15:59:42.937894106 CET	443	49939	13.32.27.5	192.168.2.5
Nov 15, 2024 15:59:42.937951088 CET	49939	443	192.168.2.5	13.32.27.5
Nov 15, 2024 15:59:42.938178062 CET	49939	443	192.168.2.5	13.32.27.5
Nov 15, 2024 15:59:42.938214064 CET	443	49939	13.32.27.5	192.168.2.5
Nov 15, 2024 15:59:42.938817024 CET	49940	443	192.168.2.5	18.164.68.79
Nov 15, 2024 15:59:42.938846111 CET	443	49940	18.164.68.79	192.168.2.5
Nov 15, 2024 15:59:42.938895941 CET	49940	443	192.168.2.5	18.164.68.79
Nov 15, 2024 15:59:42.939146042 CET	49940	443	192.168.2.5	18.164.68.79
Nov 15, 2024 15:59:42.939176083 CET	443	49940	18.164.68.79	192.168.2.5
Nov 15, 2024 15:59:42.948232889 CET	49941	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.948273897 CET	443	49941	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.948354959 CET	49941	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.948524952 CET	49941	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:42.948558092 CET	443	49941	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:42.954243898 CET	49942	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.954274893 CET	443	49942	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.954546928 CET	49942	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.954809904 CET	49942	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:42.954823017 CET	443	49942	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.965321064 CET	443	49925	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.966125011 CET	443	49924	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:42.982882023 CET	443	49927	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.002826929 CET	443	49928	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.037290096 CET	49925	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.037302971 CET	49926	443	192.168.2.5	104.244.42.131
Nov 15, 2024 15:59:43.037333965 CET	49927	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.037362099 CET	443	49926	104.244.42.131	192.168.2.5
Nov 15, 2024 15:59:43.042618036 CET	443	49926	104.244.42.131	192.168.2.5
Nov 15, 2024 15:59:43.042819977 CET	49926	443	192.168.2.5	104.244.42.131
Nov 15, 2024 15:59:43.043144941 CET	49926	443	192.168.2.5	104.244.42.131
Nov 15, 2024 15:59:43.043183088 CET	443	49926	104.244.42.131	192.168.2.5
Nov 15, 2024 15:59:43.043723106 CET	443	49923	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.043857098 CET	443	49923	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.043935061 CET	49923	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.060787916 CET	49920	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:43.060794115 CET	49924	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.060945034 CET	49928	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.117687941 CET	443	49914	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:43.117826939 CET	443	49914	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:43.117918968 CET	443	49914	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:43.117985964 CET	49914	443	192.168.2.5	172.217.18.98
Nov 15, 2024 15:59:43.118005037 CET	443	49914	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:43.118037939 CET	443	49914	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:43.118062019 CET	49914	443	192.168.2.5	172.217.18.98
Nov 15, 2024 15:59:43.170275927 CET	49914	443	192.168.2.5	172.217.18.98
Nov 15, 2024 15:59:43.170337915 CET	443	49914	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:43.177731037 CET	443	49920	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:43.177968025 CET	443	49920	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:43.179591894 CET	49920	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:43.204091072 CET	443	49933	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:43.210695028 CET	443	49932	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:43.238394976 CET	443	49914	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:43.238540888 CET	49914	443	192.168.2.5	172.217.18.98
Nov 15, 2024 15:59:43.250129938 CET	443	49929	104.244.42.131	192.168.2.5
Nov 15, 2024 15:59:43.333619118 CET	49933	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:43.333683968 CET	443	49933	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:43.333705902 CET	49932	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:43.333724976 CET	443	49932	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:43.333929062 CET	49929	443	192.168.2.5	104.244.42.131
Nov 15, 2024 15:59:43.333952904 CET	443	49929	104.244.42.131	192.168.2.5
Nov 15, 2024 15:59:43.335014105 CET	443	49929	104.244.42.131	192.168.2.5
Nov 15, 2024 15:59:43.335024118 CET	443	49929	104.244.42.131	192.168.2.5
Nov 15, 2024 15:59:43.335091114 CET	49929	443	192.168.2.5	104.244.42.131
Nov 15, 2024 15:59:43.337440968 CET	443	49932	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:43.337474108 CET	443	49932	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:43.337505102 CET	49932	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:43.337621927 CET	443	49933	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:43.337662935 CET	443	49933	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:43.337692022 CET	49933	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:43.417004108 CET	49929	443	192.168.2.5	104.244.42.131
Nov 15, 2024 15:59:43.417483091 CET	443	49929	104.244.42.131	192.168.2.5
Nov 15, 2024 15:59:43.419625044 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:43.430201054 CET	49932	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:43.430402040 CET	443	49932	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:43.433487892 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:43.437527895 CET	49933	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:43.437994003 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:43.438010931 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:43.438030958 CET	443	49933	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:43.438138008 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:43.438169003 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:43.438286066 CET	49929	443	192.168.2.5	104.244.42.131
Nov 15, 2024 15:59:43.438313961 CET	443	49929	104.244.42.131	192.168.2.5
Nov 15, 2024 15:59:43.438329935 CET	49932	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:43.438345909 CET	443	49932	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:43.438407898 CET	49933	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:43.438442945 CET	443	49933	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:43.439491987 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:43.439570904 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:43.441725016 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:43.441803932 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:43.591522932 CET	443	49929	104.244.42.131	192.168.2.5
Nov 15, 2024 15:59:43.591598034 CET	49929	443	192.168.2.5	104.244.42.131
Nov 15, 2024 15:59:43.591720104 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:43.591902018 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:43.592123985 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:43.592374086 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:43.594466925 CET	49929	443	192.168.2.5	104.244.42.131
Nov 15, 2024 15:59:43.594496012 CET	443	49929	104.244.42.131	192.168.2.5
Nov 15, 2024 15:59:43.594958067 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:43.594986916 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:43.595129013 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:43.595151901 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:43.628062010 CET	443	49932	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:43.628119946 CET	49932	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:43.641746998 CET	49933	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:43.657216072 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:43.657988071 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:43.671395063 CET	443	49941	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:43.696738958 CET	443	49935	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:43.700644016 CET	443	49933	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:43.700815916 CET	443	49933	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:43.700938940 CET	49933	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:43.713768959 CET	49928	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.713773012 CET	443	49942	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.713830948 CET	443	49928	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.714199066 CET	49928	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.714214087 CET	443	49928	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.714381933 CET	49925	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.714402914 CET	443	49925	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.714701891 CET	49925	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.714709997 CET	443	49925	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.715331078 CET	49923	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.715331078 CET	49923	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.715358973 CET	443	49923	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.715373039 CET	443	49923	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.715727091 CET	49924	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.715780973 CET	443	49924	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.716195107 CET	49924	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.716207027 CET	443	49924	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.727585077 CET	49927	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.727615118 CET	443	49927	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.727907896 CET	49927	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.727912903 CET	443	49927	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.741501093 CET	49941	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:43.741518974 CET	443	49941	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:43.741847992 CET	49935	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:43.741856098 CET	443	49935	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:43.742013931 CET	443	49941	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:43.742571115 CET	49942	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.742635012 CET	443	49942	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.743377924 CET	443	49935	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:43.743447065 CET	49935	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:43.744194031 CET	49932	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:43.744213104 CET	443	49932	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:43.745381117 CET	49941	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:43.745460033 CET	443	49941	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:43.745596886 CET	49933	443	192.168.2.5	162.159.140.229
Nov 15, 2024 15:59:43.745634079 CET	443	49933	162.159.140.229	192.168.2.5
Nov 15, 2024 15:59:43.746155977 CET	49935	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:43.746241093 CET	443	49935	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:43.746434927 CET	443	49942	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.746511936 CET	49942	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.749294043 CET	49942	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.749502897 CET	443	49942	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.749672890 CET	49941	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:43.749799967 CET	49935	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:43.749819994 CET	443	49935	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:43.749970913 CET	49942	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.749986887 CET	443	49942	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.781701088 CET	443	49939	13.32.27.5	192.168.2.5
Nov 15, 2024 15:59:43.783391953 CET	49939	443	192.168.2.5	13.32.27.5
Nov 15, 2024 15:59:43.783420086 CET	443	49939	13.32.27.5	192.168.2.5
Nov 15, 2024 15:59:43.785006046 CET	443	49939	13.32.27.5	192.168.2.5
Nov 15, 2024 15:59:43.785109997 CET	49939	443	192.168.2.5	13.32.27.5
Nov 15, 2024 15:59:43.789273024 CET	49944	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.789305925 CET	443	49944	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.789412022 CET	49944	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.795326948 CET	443	49941	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:43.805001020 CET	49939	443	192.168.2.5	13.32.27.5
Nov 15, 2024 15:59:43.805233002 CET	443	49939	13.32.27.5	192.168.2.5
Nov 15, 2024 15:59:43.805648088 CET	49920	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:43.805668116 CET	443	49920	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:43.811378956 CET	49939	443	192.168.2.5	13.32.27.5
Nov 15, 2024 15:59:43.811428070 CET	443	49939	13.32.27.5	192.168.2.5
Nov 15, 2024 15:59:43.811453104 CET	49914	443	192.168.2.5	172.217.18.98
Nov 15, 2024 15:59:43.811496973 CET	443	49914	172.217.18.98	192.168.2.5
Nov 15, 2024 15:59:43.820626974 CET	443	49936	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:43.821374893 CET	49945	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:43.821418047 CET	443	49945	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:43.821491957 CET	49945	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:43.821793079 CET	49936	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:43.821803093 CET	443	49936	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:43.822730064 CET	443	49936	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:43.824829102 CET	49945	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:43.824850082 CET	443	49945	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:43.838543892 CET	443	49928	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.838618994 CET	443	49928	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.838721991 CET	49928	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.839972019 CET	443	49940	18.164.68.79	192.168.2.5
Nov 15, 2024 15:59:43.840150118 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:43.840240955 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:43.840344906 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:43.842720032 CET	443	49925	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.842781067 CET	443	49925	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.842864037 CET	49925	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.842947006 CET	443	49924	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.843252897 CET	443	49924	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.843327999 CET	49924	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.851020098 CET	49936	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:43.851161957 CET	443	49937	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:43.851207018 CET	443	49936	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:43.851859093 CET	49940	443	192.168.2.5	18.164.68.79
Nov 15, 2024 15:59:43.851933002 CET	443	49940	18.164.68.79	192.168.2.5
Nov 15, 2024 15:59:43.853632927 CET	49937	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:43.853662014 CET	443	49937	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:43.854757071 CET	443	49940	18.164.68.79	192.168.2.5
Nov 15, 2024 15:59:43.854769945 CET	443	49937	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:43.854844093 CET	49940	443	192.168.2.5	18.164.68.79
Nov 15, 2024 15:59:43.855196953 CET	49936	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:43.855196953 CET	49936	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:43.855273962 CET	443	49936	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:43.856236935 CET	49937	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:43.856411934 CET	443	49937	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:43.857112885 CET	49937	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:43.857151985 CET	49937	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:43.857173920 CET	443	49937	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:43.882775068 CET	49940	443	192.168.2.5	18.164.68.79
Nov 15, 2024 15:59:43.882981062 CET	443	49940	18.164.68.79	192.168.2.5
Nov 15, 2024 15:59:43.883075953 CET	49940	443	192.168.2.5	18.164.68.79
Nov 15, 2024 15:59:43.883127928 CET	443	49940	18.164.68.79	192.168.2.5
Nov 15, 2024 15:59:43.883784056 CET	49924	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.883784056 CET	49924	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.883850098 CET	443	49924	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.883872032 CET	49944	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.883882999 CET	443	49924	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.883900881 CET	443	49944	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.899727106 CET	443	49941	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:43.900367022 CET	49928	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.900367022 CET	49928	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.900396109 CET	443	49928	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.900419950 CET	443	49928	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.901252031 CET	49925	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.901272058 CET	443	49925	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.901437044 CET	443	49941	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:43.901608944 CET	49941	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:43.908696890 CET	49946	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.908727884 CET	443	49946	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.908848047 CET	49946	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.910276890 CET	49947	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.910301924 CET	443	49947	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.911015987 CET	49947	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.911742926 CET	49948	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.911771059 CET	443	49948	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.912317991 CET	49948	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.913490057 CET	49941	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:43.913500071 CET	443	49941	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:43.916203976 CET	49947	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.916219950 CET	443	49947	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.916244984 CET	49946	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.916261911 CET	443	49946	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.916771889 CET	49948	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.916789055 CET	443	49948	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.923768044 CET	443	49927	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.923835039 CET	443	49927	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.923897982 CET	49927	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.924215078 CET	49927	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.924223900 CET	443	49927	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.924236059 CET	49927	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.924241066 CET	443	49927	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.943661928 CET	49940	443	192.168.2.5	18.164.68.79
Nov 15, 2024 15:59:43.944226027 CET	49949	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.944310904 CET	443	49949	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.944401979 CET	49949	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.944853067 CET	49949	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.944886923 CET	443	49949	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.955373049 CET	443	49942	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:43.955579996 CET	49942	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:43.958678007 CET	49935	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:43.958688021 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:43.958695889 CET	49939	443	192.168.2.5	13.32.27.5
Nov 15, 2024 15:59:43.958702087 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.061059952 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.175162077 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.175179005 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.175249100 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.175276041 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.175295115 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.175328016 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.175338030 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.175348997 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.175354004 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.175379038 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.176558971 CET	443	49942	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.176630974 CET	443	49942	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.176712990 CET	49942	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.176768064 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.176778078 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.176826954 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.176830053 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.176872969 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.176894903 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.176920891 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.176942110 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.176942110 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.176942110 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.176954031 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.176964045 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.177174091 CET	443	49935	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:44.177191973 CET	443	49939	13.32.27.5	192.168.2.5
Nov 15, 2024 15:59:44.177298069 CET	443	49935	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:44.177359104 CET	443	49936	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:44.177356958 CET	49935	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:44.177419901 CET	443	49935	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:44.177591085 CET	443	49937	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:44.177601099 CET	443	49935	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:44.177618027 CET	443	49936	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:44.177634954 CET	443	49939	13.32.27.5	192.168.2.5
Nov 15, 2024 15:59:44.177645922 CET	49935	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:44.177691936 CET	49939	443	192.168.2.5	13.32.27.5
Nov 15, 2024 15:59:44.177690983 CET	49936	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:44.177814960 CET	443	49937	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:44.177985907 CET	443	49940	18.164.68.79	192.168.2.5
Nov 15, 2024 15:59:44.178056955 CET	49937	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:44.178148031 CET	443	49940	18.164.68.79	192.168.2.5
Nov 15, 2024 15:59:44.178199053 CET	49940	443	192.168.2.5	18.164.68.79
Nov 15, 2024 15:59:44.181484938 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.181536913 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.181570053 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.181588888 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.181602955 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.181624889 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.181638956 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.181638956 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.181655884 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.183134079 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.183155060 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.183216095 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.183226109 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.183254957 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.183882952 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.183938026 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.183944941 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.184997082 CET	443	49938	63.32.145.9	192.168.2.5
Nov 15, 2024 15:59:44.185931921 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.185950994 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.186027050 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.186038017 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.186131001 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.191066980 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.191087008 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.191127062 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.191135883 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.191169977 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.191180944 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.193269014 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.193312883 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.193363905 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.193372011 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.193412066 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.209901094 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.209947109 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.209991932 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.210000038 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.210028887 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.215440989 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.215511084 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.215518951 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.215557098 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.222872019 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.222903967 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.222934961 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.222958088 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.222974062 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.222994089 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.223014116 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.223041058 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.223073006 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.223073006 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.223073959 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.223109961 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.226530075 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.226574898 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.226597071 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.226604939 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.226635933 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.226645947 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.242058039 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.242104053 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.242125988 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.242135048 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.242160082 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.242181063 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.246067047 CET	49938	443	192.168.2.5	63.32.145.9
Nov 15, 2024 15:59:44.257065058 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.257108927 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.257132053 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.257152081 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.257184982 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.257194996 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.271109104 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.271127939 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.271168947 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.271178961 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.271212101 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.271224022 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.273578882 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.273654938 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.308618069 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.308670044 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.308692932 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.308701038 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.308738947 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.309065104 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.309104919 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.309130907 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.309151888 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.309169054 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.311000109 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.311043024 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.311067104 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.311078072 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.311114073 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.312895060 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.312968016 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.312977076 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.313026905 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.313131094 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.367940903 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.367965937 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.368110895 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.368110895 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.368143082 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.368196011 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.368309975 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.368374109 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.369971037 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.370057106 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.370070934 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.370132923 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.371786118 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.371804953 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.371855021 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.371874094 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.371905088 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.374444962 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.374471903 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.374510050 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.374524117 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.374555111 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.466118097 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.479254007 CET	49937	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:44.479289055 CET	443	49937	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:44.525207996 CET	49936	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:44.525273085 CET	443	49936	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:44.526689053 CET	49938	443	192.168.2.5	63.32.145.9
Nov 15, 2024 15:59:44.526734114 CET	443	49938	63.32.145.9	192.168.2.5
Nov 15, 2024 15:59:44.526954889 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.528456926 CET	443	49938	63.32.145.9	192.168.2.5
Nov 15, 2024 15:59:44.528479099 CET	443	49938	63.32.145.9	192.168.2.5
Nov 15, 2024 15:59:44.528562069 CET	49938	443	192.168.2.5	63.32.145.9
Nov 15, 2024 15:59:44.529335022 CET	49942	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.529372931 CET	443	49942	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.530400038 CET	49935	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:44.530441999 CET	443	49935	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:44.544806004 CET	49938	443	192.168.2.5	63.32.145.9
Nov 15, 2024 15:59:44.544918060 CET	443	49938	63.32.145.9	192.168.2.5
Nov 15, 2024 15:59:44.546231985 CET	49938	443	192.168.2.5	63.32.145.9
Nov 15, 2024 15:59:44.546242952 CET	443	49938	63.32.145.9	192.168.2.5
Nov 15, 2024 15:59:44.584707975 CET	49950	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.584748030 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.584909916 CET	49950	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.585083961 CET	49950	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.585103989 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.590507984 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.590935946 CET	49940	443	192.168.2.5	18.164.68.79
Nov 15, 2024 15:59:44.590956926 CET	443	49940	18.164.68.79	192.168.2.5
Nov 15, 2024 15:59:44.592613935 CET	49939	443	192.168.2.5	13.32.27.5
Nov 15, 2024 15:59:44.592619896 CET	443	49939	13.32.27.5	192.168.2.5
Nov 15, 2024 15:59:44.596951962 CET	49931	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:44.596963882 CET	443	49931	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:44.598988056 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.599000931 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.599021912 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.599065065 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.599184036 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.599184990 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.599248886 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.599481106 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.599544048 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.599551916 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.599565983 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.599594116 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.599631071 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.599632025 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.599657059 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.599678993 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.599987030 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.600007057 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.600047112 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.600059986 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.600087881 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.600109100 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.613641024 CET	443	49944	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.614836931 CET	49944	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.614865065 CET	443	49944	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.615252972 CET	49944	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.615268946 CET	443	49944	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.642241955 CET	443	49947	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.644798040 CET	49947	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.644798040 CET	49947	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.644860029 CET	443	49947	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.644887924 CET	443	49947	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.652692080 CET	49938	443	192.168.2.5	63.32.145.9
Nov 15, 2024 15:59:44.652959108 CET	443	49946	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.653785944 CET	49946	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.653805017 CET	443	49946	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.654334068 CET	49946	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.654347897 CET	443	49946	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.657094002 CET	443	49948	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.658051014 CET	49948	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.658072948 CET	443	49948	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.658418894 CET	49948	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.658425093 CET	443	49948	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.713521004 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.713546991 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.713617086 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.713649988 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.713668108 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.713748932 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.729465961 CET	443	49945	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:44.741820097 CET	443	49944	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.742063046 CET	443	49944	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.742136955 CET	49944	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.768960953 CET	443	49947	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.769084930 CET	443	49947	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.769726038 CET	49947	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.781053066 CET	49945	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:44.781079054 CET	443	49945	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:44.782428980 CET	443	49946	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.782572031 CET	443	49946	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.783123016 CET	49946	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.783297062 CET	49944	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.783297062 CET	49944	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.783318996 CET	443	49944	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.783329964 CET	443	49944	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.784554958 CET	49947	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.784584999 CET	443	49947	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.784610033 CET	49947	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.784625053 CET	443	49947	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.784977913 CET	443	49945	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:44.785012007 CET	443	49945	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:44.785059929 CET	49945	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:44.786283970 CET	49946	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.786283970 CET	49946	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.786292076 CET	443	49946	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.786300898 CET	443	49946	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.788831949 CET	49945	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:44.789036036 CET	443	49945	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:44.789103985 CET	443	49948	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.789170027 CET	443	49948	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.789222002 CET	49948	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.793569088 CET	49945	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:44.793596983 CET	443	49945	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:44.800574064 CET	49948	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.800595045 CET	443	49948	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.800607920 CET	49948	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.800615072 CET	443	49948	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.813276052 CET	49951	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:44.813361883 CET	443	49951	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:44.813448906 CET	49951	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:44.813636065 CET	49951	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:44.813659906 CET	443	49951	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:44.815628052 CET	49952	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.815711975 CET	443	49952	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.815783978 CET	49952	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.838749886 CET	49952	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.838787079 CET	443	49952	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.840243101 CET	443	49938	63.32.145.9	192.168.2.5
Nov 15, 2024 15:59:44.840296984 CET	443	49938	63.32.145.9	192.168.2.5
Nov 15, 2024 15:59:44.840357065 CET	49938	443	192.168.2.5	63.32.145.9
Nov 15, 2024 15:59:44.840687037 CET	49938	443	192.168.2.5	63.32.145.9
Nov 15, 2024 15:59:44.840687037 CET	49938	443	192.168.2.5	63.32.145.9
Nov 15, 2024 15:59:44.840708971 CET	443	49938	63.32.145.9	192.168.2.5
Nov 15, 2024 15:59:44.841129065 CET	49938	443	192.168.2.5	63.32.145.9
Nov 15, 2024 15:59:44.841512918 CET	49953	443	192.168.2.5	63.32.145.9
Nov 15, 2024 15:59:44.841564894 CET	443	49953	63.32.145.9	192.168.2.5
Nov 15, 2024 15:59:44.841628075 CET	49953	443	192.168.2.5	63.32.145.9
Nov 15, 2024 15:59:44.842232943 CET	49953	443	192.168.2.5	63.32.145.9
Nov 15, 2024 15:59:44.842267036 CET	443	49953	63.32.145.9	192.168.2.5
Nov 15, 2024 15:59:44.847369909 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.847395897 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.847446918 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.847469091 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.847489119 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.847516060 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.847527027 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.847554922 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.851073027 CET	49945	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:44.854585886 CET	49954	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.854598045 CET	443	49954	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.854702950 CET	49954	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.855015039 CET	49954	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.855032921 CET	443	49954	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.857480049 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:44.857487917 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:44.857594013 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:44.857753038 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:44.857764959 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:44.858134031 CET	49956	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:44.858169079 CET	443	49956	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:44.858236074 CET	49934	443	192.168.2.5	169.150.247.36
Nov 15, 2024 15:59:44.858242989 CET	443	49934	169.150.247.36	192.168.2.5
Nov 15, 2024 15:59:44.858623028 CET	49956	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:44.858623028 CET	49956	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:44.858658075 CET	443	49956	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:44.866436005 CET	49957	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.866455078 CET	443	49957	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.866842031 CET	49957	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.867326975 CET	49957	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.867338896 CET	443	49957	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.892337084 CET	49958	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:44.892405033 CET	443	49958	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:44.892736912 CET	49958	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:44.892949104 CET	49958	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:44.892987013 CET	443	49958	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:44.907603025 CET	49959	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.907612085 CET	443	49959	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.907665968 CET	49959	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.911535025 CET	49959	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.911545038 CET	443	49959	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.913295984 CET	443	49949	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.914856911 CET	49949	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.914940119 CET	443	49949	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:44.915322065 CET	49949	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:44.915335894 CET	443	49949	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.044030905 CET	443	49949	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.044651031 CET	443	49949	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.044845104 CET	49949	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.046787024 CET	49949	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.046824932 CET	443	49949	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.052619934 CET	49960	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.052659988 CET	443	49960	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.052762032 CET	49960	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.053945065 CET	49960	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.053978920 CET	443	49960	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.080662966 CET	443	49945	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:45.154659986 CET	49945	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:45.154717922 CET	443	49945	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:45.211591005 CET	443	49945	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:45.211684942 CET	49945	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:45.326105118 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.333492041 CET	49950	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.333508015 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.333986044 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.335653067 CET	49950	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.335827112 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.338107109 CET	49950	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.347816944 CET	49945	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:45.347847939 CET	443	49945	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:45.350769043 CET	49961	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:45.350853920 CET	443	49961	142.250.186.164	192.168.2.5
Nov 15, 2024 15:59:45.350948095 CET	49961	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:45.351103067 CET	49961	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:45.351139069 CET	443	49961	142.250.186.164	192.168.2.5
Nov 15, 2024 15:59:45.379333973 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.584161043 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.584220886 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.584264994 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.584290028 CET	49950	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.584321022 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.584340096 CET	49950	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.584378004 CET	49950	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.586042881 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.586091042 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.586111069 CET	49950	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.586119890 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.586152077 CET	49950	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.586164951 CET	49950	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.590107918 CET	443	49952	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.590852976 CET	443	49957	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.595139980 CET	443	49954	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.598326921 CET	443	49956	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:45.609564066 CET	49956	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:45.609582901 CET	443	49956	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:45.610093117 CET	443	49956	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:45.610405922 CET	49952	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.610435009 CET	443	49952	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.610817909 CET	49952	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.610824108 CET	443	49952	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.611845016 CET	49957	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.611865044 CET	443	49957	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.612186909 CET	49957	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.612190962 CET	443	49957	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.612412930 CET	49954	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.612426996 CET	443	49954	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.612854004 CET	49954	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.612859011 CET	443	49954	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.657902002 CET	49956	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:45.658009052 CET	443	49956	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:45.658337116 CET	49956	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:45.658830881 CET	443	49959	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.669706106 CET	443	49953	63.32.145.9	192.168.2.5
Nov 15, 2024 15:59:45.689868927 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:45.703330040 CET	443	49956	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:45.704493046 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.704556942 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.704591990 CET	49950	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.704602957 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.704636097 CET	49950	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.704644918 CET	49950	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.705770016 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.705816984 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.705858946 CET	49950	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.705868006 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.705909014 CET	49950	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.705909014 CET	49950	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.705913067 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.705944061 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.706011057 CET	49950	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.706020117 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.706162930 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.706211090 CET	49950	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.737205029 CET	443	49957	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.737368107 CET	443	49957	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.737601042 CET	49957	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.739240885 CET	443	49954	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.739612103 CET	443	49954	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.740183115 CET	49954	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.740528107 CET	443	49952	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.740703106 CET	443	49952	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.740756035 CET	49952	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.747885942 CET	49953	443	192.168.2.5	63.32.145.9
Nov 15, 2024 15:59:45.800065041 CET	443	49960	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:45.811650991 CET	443	49956	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:45.811873913 CET	443	49956	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:45.811973095 CET	49956	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:45.857248068 CET	49959	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.857419014 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:45.910146952 CET	443	49951	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:45.951180935 CET	49960	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:45.951598883 CET	49951	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:45.985323906 CET	443	49958	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:46.169770002 CET	49958	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:46.257740974 CET	443	49961	142.250.186.164	192.168.2.5
Nov 15, 2024 15:59:46.259970903 CET	49960	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.259995937 CET	443	49960	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.260507107 CET	49960	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.260519028 CET	443	49960	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.260776043 CET	49959	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.260807991 CET	443	49959	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.261161089 CET	49959	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.261164904 CET	443	49959	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.261307955 CET	49952	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.261307955 CET	49952	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.261379957 CET	443	49952	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.261410952 CET	443	49952	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.275402069 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:46.275412083 CET	49953	443	192.168.2.5	63.32.145.9
Nov 15, 2024 15:59:46.275440931 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.275495052 CET	443	49953	63.32.145.9	192.168.2.5
Nov 15, 2024 15:59:46.275814056 CET	49951	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:46.275857925 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.275866985 CET	443	49951	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:46.275979042 CET	49958	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:46.276015043 CET	49961	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:46.276053905 CET	443	49961	142.250.186.164	192.168.2.5
Nov 15, 2024 15:59:46.276057005 CET	443	49958	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:46.276065111 CET	443	49953	63.32.145.9	192.168.2.5
Nov 15, 2024 15:59:46.276596069 CET	443	49958	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:46.277064085 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:46.277157068 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.277232885 CET	443	49951	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:46.277509928 CET	49953	443	192.168.2.5	63.32.145.9
Nov 15, 2024 15:59:46.277586937 CET	443	49961	142.250.186.164	192.168.2.5
Nov 15, 2024 15:59:46.277609110 CET	443	49953	63.32.145.9	192.168.2.5
Nov 15, 2024 15:59:46.277642965 CET	49961	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:46.277784109 CET	49958	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:46.277878046 CET	443	49958	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:46.278017044 CET	49951	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:46.278224945 CET	443	49951	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:46.278358936 CET	49961	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:46.278450012 CET	443	49961	142.250.186.164	192.168.2.5
Nov 15, 2024 15:59:46.278455019 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:46.278537035 CET	49953	443	192.168.2.5	63.32.145.9
Nov 15, 2024 15:59:46.278683901 CET	49958	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:46.278717041 CET	443	49958	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:46.278786898 CET	49958	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:46.278814077 CET	443	49958	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:46.278845072 CET	49951	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:46.278908968 CET	443	49951	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:46.278944969 CET	49961	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:46.278961897 CET	443	49961	142.250.186.164	192.168.2.5
Nov 15, 2024 15:59:46.279226065 CET	49957	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.279241085 CET	443	49957	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.279252052 CET	49957	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.279258013 CET	443	49957	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.288357019 CET	49954	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.288357019 CET	49954	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.288374901 CET	443	49954	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.288400888 CET	443	49954	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.319350004 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.319370031 CET	443	49953	63.32.145.9	192.168.2.5
Nov 15, 2024 15:59:46.319700003 CET	49962	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.319735050 CET	443	49962	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.319844961 CET	49962	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.321966887 CET	49956	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:46.321975946 CET	443	49956	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:46.324987888 CET	49950	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.325016022 CET	443	49950	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.328352928 CET	49961	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:46.347101927 CET	49962	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.347117901 CET	443	49962	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.353229046 CET	49963	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.353260994 CET	443	49963	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.353319883 CET	49963	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.353419065 CET	49963	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.353429079 CET	443	49963	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.359383106 CET	49964	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.359411955 CET	443	49964	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.359462023 CET	49964	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.359797955 CET	49964	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.359817028 CET	443	49964	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.388079882 CET	443	49959	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.388256073 CET	443	49959	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.388308048 CET	49959	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.388329983 CET	49959	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.388339996 CET	443	49959	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.388358116 CET	49959	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.388362885 CET	443	49959	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.392054081 CET	443	49960	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.392211914 CET	443	49960	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.392287016 CET	49960	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.392287016 CET	49960	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.392312050 CET	49960	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.392326117 CET	443	49960	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.435081959 CET	49966	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.435098886 CET	443	49966	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.435152054 CET	49966	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.439870119 CET	49967	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.439924002 CET	443	49967	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.439991951 CET	49967	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.440115929 CET	49966	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.440130949 CET	443	49966	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.447880983 CET	49967	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.447906971 CET	443	49967	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.528110027 CET	443	49958	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:46.528198957 CET	443	49958	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:46.528249979 CET	49958	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:46.528611898 CET	49958	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:46.528635025 CET	443	49958	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:46.528645992 CET	49958	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:46.528678894 CET	49958	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:46.530169964 CET	49969	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:46.530204058 CET	443	49969	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:46.530369043 CET	49969	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:46.530457973 CET	49970	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.530498028 CET	443	49970	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.530550003 CET	49970	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.530879021 CET	443	49951	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:46.530896902 CET	49969	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:46.530911922 CET	443	49969	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:46.530953884 CET	49970	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.530967951 CET	443	49970	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.531054974 CET	443	49951	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:46.531111956 CET	49951	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:46.531420946 CET	49951	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:46.531445026 CET	443	49951	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:46.548038006 CET	443	49961	142.250.186.164	192.168.2.5
Nov 15, 2024 15:59:46.577279091 CET	443	49953	63.32.145.9	192.168.2.5
Nov 15, 2024 15:59:46.602746010 CET	49961	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:46.602793932 CET	443	49961	142.250.186.164	192.168.2.5
Nov 15, 2024 15:59:46.603442907 CET	49961	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:46.603693962 CET	443	49961	142.250.186.164	192.168.2.5
Nov 15, 2024 15:59:46.603765965 CET	49961	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:46.635952950 CET	49972	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:46.636039972 CET	443	49972	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:46.636106968 CET	49972	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:46.637455940 CET	49972	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:46.637485981 CET	443	49972	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:46.641304016 CET	49974	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:46.641344070 CET	443	49974	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:46.641407013 CET	49974	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:46.641633034 CET	49974	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:46.641661882 CET	443	49974	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:46.651829958 CET	49976	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.651875973 CET	443	49976	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.651940107 CET	49976	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.652164936 CET	49976	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.652182102 CET	443	49976	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.660506964 CET	49978	443	192.168.2.5	13.35.58.128
Nov 15, 2024 15:59:46.660531998 CET	443	49978	13.35.58.128	192.168.2.5
Nov 15, 2024 15:59:46.660586119 CET	49978	443	192.168.2.5	13.35.58.128
Nov 15, 2024 15:59:46.660783052 CET	49978	443	192.168.2.5	13.35.58.128
Nov 15, 2024 15:59:46.660806894 CET	443	49978	13.35.58.128	192.168.2.5
Nov 15, 2024 15:59:46.662143946 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.662170887 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.662233114 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.662398100 CET	49980	443	192.168.2.5	18.66.122.74
Nov 15, 2024 15:59:46.662419081 CET	443	49980	18.66.122.74	192.168.2.5
Nov 15, 2024 15:59:46.662468910 CET	49980	443	192.168.2.5	18.66.122.74
Nov 15, 2024 15:59:46.662836075 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:46.662863970 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:46.662942886 CET	49980	443	192.168.2.5	18.66.122.74
Nov 15, 2024 15:59:46.662955999 CET	443	49980	18.66.122.74	192.168.2.5
Nov 15, 2024 15:59:46.668055058 CET	443	49953	63.32.145.9	192.168.2.5
Nov 15, 2024 15:59:46.668113947 CET	49953	443	192.168.2.5	63.32.145.9
Nov 15, 2024 15:59:46.668332100 CET	49953	443	192.168.2.5	63.32.145.9
Nov 15, 2024 15:59:46.668356895 CET	443	49953	63.32.145.9	192.168.2.5
Nov 15, 2024 15:59:46.690639019 CET	49982	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:46.690675020 CET	443	49982	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:46.690733910 CET	49982	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:46.690896034 CET	49982	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:46.690917015 CET	443	49982	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:46.733439922 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.733510017 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.733542919 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.733617067 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:46.733617067 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:46.733685017 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.734688044 CET	49983	443	192.168.2.5	216.239.34.181
Nov 15, 2024 15:59:46.734703064 CET	443	49983	216.239.34.181	192.168.2.5
Nov 15, 2024 15:59:46.734751940 CET	49983	443	192.168.2.5	216.239.34.181
Nov 15, 2024 15:59:46.735189915 CET	49983	443	192.168.2.5	216.239.34.181
Nov 15, 2024 15:59:46.735202074 CET	443	49983	216.239.34.181	192.168.2.5
Nov 15, 2024 15:59:46.797063112 CET	49984	443	192.168.2.5	172.217.16.132
Nov 15, 2024 15:59:46.797100067 CET	443	49984	172.217.16.132	192.168.2.5
Nov 15, 2024 15:59:46.797153950 CET	49984	443	192.168.2.5	172.217.16.132
Nov 15, 2024 15:59:46.797528028 CET	49984	443	192.168.2.5	172.217.16.132
Nov 15, 2024 15:59:46.797545910 CET	443	49984	172.217.16.132	192.168.2.5
Nov 15, 2024 15:59:46.809986115 CET	49985	443	192.168.2.5	52.210.32.20
Nov 15, 2024 15:59:46.810034037 CET	443	49985	52.210.32.20	192.168.2.5
Nov 15, 2024 15:59:46.810085058 CET	49985	443	192.168.2.5	52.210.32.20
Nov 15, 2024 15:59:46.810230970 CET	49985	443	192.168.2.5	52.210.32.20
Nov 15, 2024 15:59:46.810250044 CET	443	49985	52.210.32.20	192.168.2.5
Nov 15, 2024 15:59:46.851952076 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.851962090 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.851998091 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.852010012 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.852016926 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.852051973 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:46.852129936 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.852174997 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.852178097 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:46.852205038 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:46.855993032 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.856067896 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:46.856086969 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.954205036 CET	49986	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:46.954258919 CET	443	49986	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:46.954324007 CET	49986	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:46.954637051 CET	49986	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:46.954658031 CET	443	49986	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:46.966414928 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:46.967288017 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.967300892 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.967329979 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.967340946 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.967364073 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.967370033 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:46.967410088 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:46.967410088 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:46.971499920 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.971534014 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.971554041 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:46.971585989 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:46.971648932 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:47.082489014 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:47.082500935 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:47.082534075 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:47.082541943 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:47.082602978 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:47.082715034 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:47.082715988 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:47.082715988 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:47.086329937 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:47.086393118 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:47.100486994 CET	443	49963	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.101000071 CET	49963	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.101032972 CET	443	49963	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.101608038 CET	49963	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.101634979 CET	443	49963	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.117822886 CET	443	49964	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.118457079 CET	49964	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.118477106 CET	443	49964	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.119204044 CET	49964	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.119211912 CET	443	49964	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.181776047 CET	443	49967	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.182475090 CET	443	49966	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.182526112 CET	49967	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.182570934 CET	443	49967	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.183334112 CET	49966	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.183348894 CET	443	49966	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.184686899 CET	49966	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.184689999 CET	49967	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.184693098 CET	443	49966	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.184703112 CET	443	49967	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.194397926 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:47.194406033 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:47.194438934 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:47.194758892 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:47.194758892 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:47.194823980 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:47.197604895 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:47.197794914 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:47.197813034 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:47.203953028 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:47.204138041 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:47.204155922 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:47.210113049 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:47.210293055 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:47.210304976 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:47.210514069 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:47.218322039 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:47.218347073 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:47.218516111 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:47.218528032 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:47.218552113 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:47.218698025 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:47.220758915 CET	49955	443	192.168.2.5	157.240.253.1
Nov 15, 2024 15:59:47.220784903 CET	443	49955	157.240.253.1	192.168.2.5
Nov 15, 2024 15:59:47.226052999 CET	49987	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:47.226090908 CET	443	49987	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:47.229388952 CET	49987	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:47.229562998 CET	49987	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:47.229577065 CET	443	49987	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:47.231007099 CET	443	49963	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.231256008 CET	443	49963	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.231348991 CET	49963	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.231348991 CET	49963	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.231386900 CET	49963	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.231395960 CET	443	49963	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.233617067 CET	49988	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.233661890 CET	443	49988	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.233891010 CET	49988	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.233891010 CET	49988	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.233949900 CET	443	49988	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.248677969 CET	443	49964	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.248713017 CET	443	49964	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.248776913 CET	443	49964	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.248905897 CET	49964	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.248935938 CET	49964	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.248935938 CET	49964	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.248955011 CET	443	49964	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.248965025 CET	443	49964	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.254100084 CET	49989	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.254162073 CET	443	49989	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.257915020 CET	49989	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.258028984 CET	49989	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.258059025 CET	443	49989	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.262702942 CET	443	49970	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.263169050 CET	49970	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.263176918 CET	443	49970	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.263645887 CET	443	49970	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.266830921 CET	49970	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.266910076 CET	443	49970	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.266952038 CET	49970	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.307351112 CET	443	49970	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.310089111 CET	443	49967	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.310235023 CET	443	49967	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.310321093 CET	49967	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.310456991 CET	49967	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.310483932 CET	443	49967	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.310524940 CET	49967	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.310539007 CET	443	49967	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.311063051 CET	443	49966	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.311211109 CET	443	49966	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.311402082 CET	49966	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.311546087 CET	49966	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.311546087 CET	49966	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.311561108 CET	443	49966	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.311570883 CET	443	49966	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.318011045 CET	49991	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.318022966 CET	49990	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.318038940 CET	443	49991	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.318114042 CET	443	49990	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.318197012 CET	49991	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.318198919 CET	49990	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.318341970 CET	49991	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.318367004 CET	443	49991	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.318466902 CET	49990	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.318505049 CET	443	49990	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.323009968 CET	443	49962	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.323385954 CET	49962	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.323407888 CET	443	49962	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.323795080 CET	49962	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.323800087 CET	443	49962	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.356693029 CET	443	49983	216.239.34.181	192.168.2.5
Nov 15, 2024 15:59:47.357307911 CET	49983	443	192.168.2.5	216.239.34.181
Nov 15, 2024 15:59:47.357327938 CET	443	49983	216.239.34.181	192.168.2.5
Nov 15, 2024 15:59:47.358556986 CET	443	49983	216.239.34.181	192.168.2.5
Nov 15, 2024 15:59:47.358954906 CET	49983	443	192.168.2.5	216.239.34.181
Nov 15, 2024 15:59:47.361051083 CET	443	49983	216.239.34.181	192.168.2.5
Nov 15, 2024 15:59:47.361351967 CET	49983	443	192.168.2.5	216.239.34.181
Nov 15, 2024 15:59:47.361958027 CET	49983	443	192.168.2.5	216.239.34.181
Nov 15, 2024 15:59:47.361958027 CET	49983	443	192.168.2.5	216.239.34.181
Nov 15, 2024 15:59:47.362023115 CET	443	49983	216.239.34.181	192.168.2.5
Nov 15, 2024 15:59:47.362162113 CET	443	49983	216.239.34.181	192.168.2.5
Nov 15, 2024 15:59:47.384538889 CET	443	49972	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:47.387660027 CET	49972	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:47.387691975 CET	443	49972	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:47.388119936 CET	443	49969	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:47.388248920 CET	443	49972	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:47.389050007 CET	443	49976	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.389806986 CET	49972	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:47.389900923 CET	443	49972	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:47.391037941 CET	49976	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.391061068 CET	443	49976	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.391076088 CET	49969	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:47.391093016 CET	443	49969	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:47.391704082 CET	49972	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:47.391747952 CET	443	49969	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:47.392206907 CET	49969	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:47.392206907 CET	49969	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:47.392240047 CET	443	49969	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:47.392328978 CET	443	49969	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:47.392771006 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.393009901 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.393071890 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.393335104 CET	443	49976	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.393521070 CET	49976	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.393781900 CET	49976	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.393847942 CET	443	49976	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.393874884 CET	49976	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.394469976 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.394563913 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.394911051 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.394911051 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.395013094 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.435353994 CET	443	49972	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:47.435375929 CET	443	49976	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.453193903 CET	49976	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.453213930 CET	443	49976	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.453246117 CET	49969	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:47.454370975 CET	443	49962	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.454668045 CET	443	49962	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.454860926 CET	49962	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.454860926 CET	49962	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.455342054 CET	49962	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.455358982 CET	443	49962	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.457158089 CET	49992	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.457187891 CET	443	49992	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.457370996 CET	49992	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.457370996 CET	49992	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.457403898 CET	443	49992	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.468724966 CET	49970	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.468724966 CET	49983	443	192.168.2.5	216.239.34.181
Nov 15, 2024 15:59:47.468741894 CET	443	49983	216.239.34.181	192.168.2.5
Nov 15, 2024 15:59:47.468739986 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.468806028 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.473720074 CET	443	49970	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.474104881 CET	443	49970	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.474258900 CET	49970	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.474258900 CET	49970	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.502532959 CET	443	49978	13.35.58.128	192.168.2.5
Nov 15, 2024 15:59:47.502784014 CET	49978	443	192.168.2.5	13.35.58.128
Nov 15, 2024 15:59:47.502818108 CET	443	49978	13.35.58.128	192.168.2.5
Nov 15, 2024 15:59:47.504323006 CET	443	49978	13.35.58.128	192.168.2.5
Nov 15, 2024 15:59:47.504714012 CET	49978	443	192.168.2.5	13.35.58.128
Nov 15, 2024 15:59:47.504714012 CET	49978	443	192.168.2.5	13.35.58.128
Nov 15, 2024 15:59:47.504810095 CET	443	49978	13.35.58.128	192.168.2.5
Nov 15, 2024 15:59:47.504854918 CET	49978	443	192.168.2.5	13.35.58.128
Nov 15, 2024 15:59:47.508069992 CET	443	49980	18.66.122.74	192.168.2.5
Nov 15, 2024 15:59:47.508291960 CET	49980	443	192.168.2.5	18.66.122.74
Nov 15, 2024 15:59:47.508304119 CET	443	49980	18.66.122.74	192.168.2.5
Nov 15, 2024 15:59:47.511765003 CET	443	49983	216.239.34.181	192.168.2.5
Nov 15, 2024 15:59:47.511852026 CET	443	49980	18.66.122.74	192.168.2.5
Nov 15, 2024 15:59:47.511857033 CET	49983	443	192.168.2.5	216.239.34.181
Nov 15, 2024 15:59:47.512043953 CET	49980	443	192.168.2.5	18.66.122.74
Nov 15, 2024 15:59:47.512810946 CET	49983	443	192.168.2.5	216.239.34.181
Nov 15, 2024 15:59:47.512810946 CET	49980	443	192.168.2.5	18.66.122.74
Nov 15, 2024 15:59:47.512825966 CET	443	49983	216.239.34.181	192.168.2.5
Nov 15, 2024 15:59:47.512914896 CET	443	49980	18.66.122.74	192.168.2.5
Nov 15, 2024 15:59:47.513406038 CET	49980	443	192.168.2.5	18.66.122.74
Nov 15, 2024 15:59:47.522510052 CET	49994	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:47.522533894 CET	443	49994	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:47.522578001 CET	49993	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:47.522614956 CET	443	49993	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:47.522638083 CET	49995	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:47.522655964 CET	443	49995	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:47.522672892 CET	49994	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:47.522772074 CET	49993	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:47.522772074 CET	49995	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:47.522959948 CET	49994	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:47.522960901 CET	49993	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:47.522969961 CET	443	49994	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:47.522979021 CET	443	49993	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:47.523264885 CET	49995	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:47.523288965 CET	443	49995	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:47.540323019 CET	443	49972	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:47.540491104 CET	443	49972	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:47.540600061 CET	49972	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:47.540627003 CET	443	49972	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:47.540656090 CET	443	49972	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:47.540698051 CET	49972	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:47.540714979 CET	443	49972	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:47.540827036 CET	49972	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:47.541172981 CET	443	49972	150.171.28.10	192.168.2.5
Nov 15, 2024 15:59:47.541214943 CET	49972	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:47.541297913 CET	49972	443	192.168.2.5	150.171.28.10
Nov 15, 2024 15:59:47.547350883 CET	443	49978	13.35.58.128	192.168.2.5
Nov 15, 2024 15:59:47.555344105 CET	443	49980	18.66.122.74	192.168.2.5
Nov 15, 2024 15:59:47.596879959 CET	443	49976	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.597609997 CET	49976	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.609489918 CET	49997	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.609493971 CET	49976	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.609522104 CET	443	49976	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.609523058 CET	443	49997	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.610069036 CET	49997	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.610444069 CET	49997	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.610455990 CET	443	49997	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.615623951 CET	49999	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:47.615658998 CET	443	49999	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:47.615765095 CET	49999	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:47.616559029 CET	49999	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:47.616584063 CET	443	49999	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:47.633694887 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.633728981 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.633748055 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.633789062 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.633785009 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.633810043 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.633861065 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.633907080 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.633907080 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.633907080 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.633908987 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.633944035 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.639543056 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.639565945 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.639586926 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.639636040 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.639653921 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.639674902 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.639738083 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.639738083 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.639738083 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.639738083 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.639806986 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.639867067 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.654225111 CET	49978	443	192.168.2.5	13.35.58.128
Nov 15, 2024 15:59:47.654252052 CET	443	49978	13.35.58.128	192.168.2.5
Nov 15, 2024 15:59:47.655740976 CET	443	49969	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:47.656044006 CET	49969	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:47.656058073 CET	443	49969	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:47.656229019 CET	49969	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:47.656279087 CET	443	49969	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:47.656431913 CET	443	49969	142.250.185.162	192.168.2.5
Nov 15, 2024 15:59:47.656491041 CET	49969	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:47.656491041 CET	49969	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:47.656730890 CET	49969	443	192.168.2.5	142.250.185.162
Nov 15, 2024 15:59:47.657985926 CET	50001	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:47.658065081 CET	443	50001	142.250.186.164	192.168.2.5
Nov 15, 2024 15:59:47.658376932 CET	50001	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:47.658376932 CET	50001	443	192.168.2.5	142.250.186.164
Nov 15, 2024 15:59:47.658449888 CET	443	50001	142.250.186.164	192.168.2.5
Nov 15, 2024 15:59:47.669593096 CET	49980	443	192.168.2.5	18.66.122.74
Nov 15, 2024 15:59:47.669617891 CET	443	49980	18.66.122.74	192.168.2.5
Nov 15, 2024 15:59:47.680814981 CET	443	49984	172.217.16.132	192.168.2.5
Nov 15, 2024 15:59:47.681289911 CET	49984	443	192.168.2.5	172.217.16.132
Nov 15, 2024 15:59:47.681302071 CET	443	49984	172.217.16.132	192.168.2.5
Nov 15, 2024 15:59:47.683063984 CET	443	49984	172.217.16.132	192.168.2.5
Nov 15, 2024 15:59:47.683281898 CET	49984	443	192.168.2.5	172.217.16.132
Nov 15, 2024 15:59:47.683510065 CET	49984	443	192.168.2.5	172.217.16.132
Nov 15, 2024 15:59:47.683573008 CET	49984	443	192.168.2.5	172.217.16.132
Nov 15, 2024 15:59:47.683578968 CET	443	49984	172.217.16.132	192.168.2.5
Nov 15, 2024 15:59:47.683593988 CET	443	49984	172.217.16.132	192.168.2.5
Nov 15, 2024 15:59:47.734694958 CET	443	49974	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:47.735383034 CET	49974	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:47.735420942 CET	443	49974	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:47.736589909 CET	443	49974	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:47.737392902 CET	49974	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:47.737576008 CET	443	49974	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:47.737634897 CET	49974	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:47.737716913 CET	443	49974	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:47.748442888 CET	443	49978	13.35.58.128	192.168.2.5
Nov 15, 2024 15:59:47.748733044 CET	49978	443	192.168.2.5	13.35.58.128
Nov 15, 2024 15:59:47.749528885 CET	49978	443	192.168.2.5	13.35.58.128
Nov 15, 2024 15:59:47.749558926 CET	443	49978	13.35.58.128	192.168.2.5
Nov 15, 2024 15:59:47.750891924 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.750936985 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.750984907 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.751029015 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.751060009 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.751095057 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.751095057 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.755235910 CET	443	49982	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:47.755908012 CET	49982	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:47.755920887 CET	443	49982	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:47.756428957 CET	443	49982	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:47.756458998 CET	443	49980	18.66.122.74	192.168.2.5
Nov 15, 2024 15:59:47.756498098 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.756519079 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.756544113 CET	49980	443	192.168.2.5	18.66.122.74
Nov 15, 2024 15:59:47.756566048 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.756584883 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.756599903 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.756599903 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.756627083 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.756656885 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.756656885 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.756706953 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.756850004 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.757095098 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.757231951 CET	49982	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:47.757231951 CET	49982	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:47.757268906 CET	443	49982	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:47.757328987 CET	443	49982	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:47.758021116 CET	49979	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.758044958 CET	443	49979	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.766917944 CET	49980	443	192.168.2.5	18.66.122.74
Nov 15, 2024 15:59:47.766937971 CET	443	49980	18.66.122.74	192.168.2.5
Nov 15, 2024 15:59:47.841660976 CET	49974	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:47.857259989 CET	49984	443	192.168.2.5	172.217.16.132
Nov 15, 2024 15:59:47.857260942 CET	49970	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:47.857275963 CET	443	49984	172.217.16.132	192.168.2.5
Nov 15, 2024 15:59:47.857279062 CET	443	49970	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:47.857335091 CET	49982	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:47.890088081 CET	443	49985	52.210.32.20	192.168.2.5
Nov 15, 2024 15:59:47.890547991 CET	49985	443	192.168.2.5	52.210.32.20
Nov 15, 2024 15:59:47.890571117 CET	443	49985	52.210.32.20	192.168.2.5
Nov 15, 2024 15:59:47.894126892 CET	443	49985	52.210.32.20	192.168.2.5
Nov 15, 2024 15:59:47.894233942 CET	49985	443	192.168.2.5	52.210.32.20
Nov 15, 2024 15:59:47.894584894 CET	49985	443	192.168.2.5	52.210.32.20
Nov 15, 2024 15:59:47.894623995 CET	49985	443	192.168.2.5	52.210.32.20
Nov 15, 2024 15:59:47.894680023 CET	443	49985	52.210.32.20	192.168.2.5
Nov 15, 2024 15:59:47.951028109 CET	49985	443	192.168.2.5	52.210.32.20
Nov 15, 2024 15:59:47.951045036 CET	443	49985	52.210.32.20	192.168.2.5
Nov 15, 2024 15:59:47.966628075 CET	49984	443	192.168.2.5	172.217.16.132
Nov 15, 2024 15:59:47.966643095 CET	443	49984	172.217.16.132	192.168.2.5
Nov 15, 2024 15:59:47.967252016 CET	49984	443	192.168.2.5	172.217.16.132
Nov 15, 2024 15:59:47.967359066 CET	443	49984	172.217.16.132	192.168.2.5
Nov 15, 2024 15:59:47.967566013 CET	49984	443	192.168.2.5	172.217.16.132
Nov 15, 2024 15:59:48.154258013 CET	49985	443	192.168.2.5	52.210.32.20
Nov 15, 2024 15:59:48.179269075 CET	443	49974	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:48.179356098 CET	443	49974	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:48.179413080 CET	49974	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:48.179414988 CET	443	49982	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:48.179502964 CET	443	49982	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:48.179687023 CET	49982	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:48.180146933 CET	49982	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:48.180165052 CET	443	49982	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:48.181060076 CET	49974	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:48.181085110 CET	443	49974	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:48.181111097 CET	49974	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:48.181158066 CET	49974	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:48.181193113 CET	443	49985	52.210.32.20	192.168.2.5
Nov 15, 2024 15:59:48.181339025 CET	443	49985	52.210.32.20	192.168.2.5
Nov 15, 2024 15:59:48.181513071 CET	49985	443	192.168.2.5	52.210.32.20
Nov 15, 2024 15:59:48.182235003 CET	50003	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:48.182276964 CET	49985	443	192.168.2.5	52.210.32.20
Nov 15, 2024 15:59:48.182298899 CET	443	49985	52.210.32.20	192.168.2.5
Nov 15, 2024 15:59:48.182321072 CET	443	50003	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:48.182476044 CET	443	49986	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:48.182521105 CET	50003	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:48.182754040 CET	50003	443	192.168.2.5	34.251.101.162
Nov 15, 2024 15:59:48.182790041 CET	443	50003	34.251.101.162	192.168.2.5
Nov 15, 2024 15:59:48.182863951 CET	49986	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:48.182874918 CET	443	49986	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:48.183351994 CET	443	49986	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:48.183743954 CET	49986	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:48.183866978 CET	443	49986	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:48.184009075 CET	49986	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:48.184034109 CET	443	49986	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:48.184034109 CET	49986	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:48.184046030 CET	443	49986	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:48.184160948 CET	443	49987	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:48.184674978 CET	49987	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:48.184700966 CET	443	49987	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:48.185167074 CET	443	49987	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:48.185570002 CET	49987	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:48.185659885 CET	443	49987	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:48.185694933 CET	49987	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:48.186032057 CET	443	49989	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.186794996 CET	49989	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.186814070 CET	443	49989	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.187697887 CET	49989	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.187707901 CET	443	49989	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.191680908 CET	443	49988	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.192034006 CET	443	49990	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.192301035 CET	443	49991	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.192347050 CET	49988	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.192357063 CET	443	49988	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.192807913 CET	49990	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.192821026 CET	443	49990	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.193043947 CET	49988	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.193051100 CET	443	49988	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.193691969 CET	49990	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.193698883 CET	443	49990	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.194242001 CET	49991	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.194253922 CET	443	49991	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.194983959 CET	49991	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.194993973 CET	443	49991	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.227365017 CET	443	49987	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:48.309528112 CET	443	49992	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.320116043 CET	443	49989	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.320177078 CET	443	49989	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.320324898 CET	443	49989	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.320364952 CET	49989	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.320434093 CET	49989	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.322395086 CET	443	49988	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.322462082 CET	443	49988	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.322530985 CET	49988	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.322592020 CET	443	49988	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.322634935 CET	443	49988	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.322709084 CET	49988	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.324788094 CET	443	49990	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.325417042 CET	443	49990	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.325436115 CET	443	49991	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.325476885 CET	49990	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.325490952 CET	443	49991	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.325620890 CET	443	49991	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.325645924 CET	49991	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.325679064 CET	49991	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.345607042 CET	49987	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:48.348166943 CET	49992	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.348196983 CET	443	49992	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.348618984 CET	49992	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.348625898 CET	443	49992	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.348845959 CET	49990	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.348846912 CET	49990	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.348911047 CET	443	49990	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.348918915 CET	49991	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.348920107 CET	49991	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.348942041 CET	443	49990	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.348984957 CET	443	49991	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.349015951 CET	443	49991	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.352638006 CET	443	49997	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.353102922 CET	49997	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.353113890 CET	443	49997	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.353569984 CET	443	49997	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.353880882 CET	49997	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.353975058 CET	443	49997	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.354178905 CET	49997	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.354304075 CET	49989	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.354316950 CET	443	49989	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.355117083 CET	49988	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.355129957 CET	443	49988	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.355191946 CET	49988	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.355206013 CET	443	49988	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.361377954 CET	50004	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.361407995 CET	443	50004	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.361489058 CET	50004	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.362262011 CET	50005	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.362297058 CET	443	50005	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.362318039 CET	50004	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.362333059 CET	443	50004	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.362345934 CET	50005	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.362437010 CET	50005	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.362451077 CET	443	50005	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.363441944 CET	50006	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.363451958 CET	443	50006	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.363544941 CET	50006	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.368798018 CET	443	49995	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:48.368870020 CET	443	49993	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:48.368973970 CET	49995	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:48.368982077 CET	443	49995	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:48.369307995 CET	49993	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:48.369314909 CET	443	49993	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:48.369374037 CET	443	49994	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:48.369529963 CET	50007	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.369539022 CET	443	50007	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.369587898 CET	50007	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.369775057 CET	49994	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:48.369790077 CET	443	49994	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:48.369960070 CET	50007	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.369972944 CET	443	50007	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.370282888 CET	50006	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.370301962 CET	443	50006	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.371732950 CET	443	49994	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:48.371783018 CET	49994	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:48.372306108 CET	443	49995	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:48.372370005 CET	49995	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:48.373193026 CET	443	49993	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:48.373261929 CET	49993	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:48.373783112 CET	49994	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:48.373851061 CET	443	49994	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:48.373965025 CET	49995	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:48.374044895 CET	443	49995	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:48.374058008 CET	49993	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:48.374136925 CET	443	49993	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:48.374267101 CET	49994	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:48.374274969 CET	443	49994	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:48.374494076 CET	49995	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:48.374501944 CET	443	49995	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:48.374536991 CET	49993	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:48.374542952 CET	443	49993	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:48.399331093 CET	443	49997	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.439383030 CET	443	49986	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:48.439574003 CET	443	49986	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:48.439707041 CET	49986	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:48.440447092 CET	49986	443	192.168.2.5	54.75.69.192
Nov 15, 2024 15:59:48.440490961 CET	443	49986	54.75.69.192	192.168.2.5
Nov 15, 2024 15:59:48.451142073 CET	49994	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:48.452254057 CET	443	49999	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:48.452789068 CET	49999	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:48.452809095 CET	443	49999	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:48.456374884 CET	443	49999	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:48.456485987 CET	49999	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:48.459326982 CET	49999	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:48.459501028 CET	443	49999	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:48.459626913 CET	49999	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:48.459636927 CET	443	49999	157.240.253.35	192.168.2.5
Nov 15, 2024 15:59:48.466629982 CET	49995	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:48.466706038 CET	49993	443	192.168.2.5	157.240.253.35
Nov 15, 2024 15:59:48.474860907 CET	443	49992	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.474936008 CET	443	49992	13.107.246.45	192.168.2.5
Nov 15, 2024 15:59:48.475006104 CET	49992	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.517780066 CET	443	49987	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:48.517865896 CET	443	49987	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:48.517875910 CET	49987	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:48.517905951 CET	443	49987	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:48.517947912 CET	49987	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:48.517956018 CET	443	49987	157.240.251.9	192.168.2.5
Nov 15, 2024 15:59:48.517998934 CET	49987	443	192.168.2.5	157.240.251.9
Nov 15, 2024 15:59:48.524820089 CET	49992	443	192.168.2.5	13.107.246.45
Nov 15, 2024 15:59:48.524872065 CET	443	49992	13.107.246.45	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 15, 2024 15:59:12.240216017 CET	192.168.2.5	1.1.1.1	0xb07	Standard query (0)	fiddler2.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:12.240216017 CET	192.168.2.5	1.1.1.1	0x36d6	Standard query (0)	fiddler2.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:12.927051067 CET	192.168.2.5	1.1.1.1	0xa0b5	Standard query (0)	www.telerik.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:12.927301884 CET	192.168.2.5	1.1.1.1	0x6895	Standard query (0)	www.telerik.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:13.745368958 CET	192.168.2.5	1.1.1.1	0xf1fd	Standard query (0)	www.telerik.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:13.745479107 CET	192.168.2.5	1.1.1.1	0x9a05	Standard query (0)	www.telerik.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:15.011336088 CET	192.168.2.5	1.1.1.1	0x56bd	Standard query (0)	dtzbdy9anri2p.cloudfront.net	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:15.011435032 CET	192.168.2.5	1.1.1.1	0xd116	Standard query (0)	dtzbdy9anri2p.cloudfront.net	65	IN (0x0001)	false
Nov 15, 2024 15:59:15.014523029 CET	192.168.2.5	1.1.1.1	0x4375	Standard query (0)	d6vtbcy3ong79.cloudfront.net	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:15.014635086 CET	192.168.2.5	1.1.1.1	0x1d10	Standard query (0)	d6vtbcy3ong79.cloudfront.net	65	IN (0x0001)	false
Nov 15, 2024 15:59:15.028084040 CET	192.168.2.5	1.1.1.1	0x8b36	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:15.028337955 CET	192.168.2.5	1.1.1.1	0xcb13	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:15.028986931 CET	192.168.2.5	1.1.1.1	0xe632	Standard query (0)	cdn.cookielaw.org	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:15.029099941 CET	192.168.2.5	1.1.1.1	0x6234	Standard query (0)	cdn.cookielaw.org	65	IN (0x0001)	false
Nov 15, 2024 15:59:16.916636944 CET	192.168.2.5	1.1.1.1	0xfa0a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:16.916759968 CET	192.168.2.5	1.1.1.1	0x9ad5	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:18.027359962 CET	192.168.2.5	1.1.1.1	0xa690	Standard query (0)	cdn.insight.sitefinity.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:18.027710915 CET	192.168.2.5	1.1.1.1	0xf617	Standard query (0)	cdn.insight.sitefinity.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:18.028481007 CET	192.168.2.5	1.1.1.1	0xd19	Standard query (0)	d585tldpucybw.cloudfront.net	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:18.030165911 CET	192.168.2.5	1.1.1.1	0x1d07	Standard query (0)	d585tldpucybw.cloudfront.net	65	IN (0x0001)	false
Nov 15, 2024 15:59:22.102519035 CET	192.168.2.5	1.1.1.1	0x3362	Standard query (0)	geolocation.onetrust.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:22.103001118 CET	192.168.2.5	1.1.1.1	0x8c61	Standard query (0)	geolocation.onetrust.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:33.170345068 CET	192.168.2.5	1.1.1.1	0x962c	Standard query (0)	s1325.t.eloqua.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:33.170660019 CET	192.168.2.5	1.1.1.1	0xe79b	Standard query (0)	s1325.t.eloqua.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:33.402343035 CET	192.168.2.5	1.1.1.1	0xfed8	Standard query (0)	api.insight.sitefinity.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:33.402728081 CET	192.168.2.5	1.1.1.1	0xbaed	Standard query (0)	api.insight.sitefinity.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:33.584625006 CET	192.168.2.5	1.1.1.1	0x1912	Standard query (0)	www.telerik.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:33.584752083 CET	192.168.2.5	1.1.1.1	0x3638	Standard query (0)	www.telerik.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:34.035192013 CET	192.168.2.5	1.1.1.1	0x3031	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.035377979 CET	192.168.2.5	1.1.1.1	0x186b	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:34.037596941 CET	192.168.2.5	1.1.1.1	0x5799	Standard query (0)	cdn.cookielaw.org	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.037760019 CET	192.168.2.5	1.1.1.1	0x2878	Standard query (0)	cdn.cookielaw.org	65	IN (0x0001)	false
Nov 15, 2024 15:59:34.041739941 CET	192.168.2.5	1.1.1.1	0x8c27	Standard query (0)	dtzbdy9anri2p.cloudfront.net	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.041887045 CET	192.168.2.5	1.1.1.1	0xf39c	Standard query (0)	dtzbdy9anri2p.cloudfront.net	65	IN (0x0001)	false
Nov 15, 2024 15:59:34.105113983 CET	192.168.2.5	1.1.1.1	0x67aa	Standard query (0)	d6vtbcy3ong79.cloudfront.net	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.105271101 CET	192.168.2.5	1.1.1.1	0xf5e2	Standard query (0)	d6vtbcy3ong79.cloudfront.net	65	IN (0x0001)	false
Nov 15, 2024 15:59:34.109250069 CET	192.168.2.5	1.1.1.1	0x29fa	Standard query (0)	d585tldpucybw.cloudfront.net	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.109464884 CET	192.168.2.5	1.1.1.1	0xa9c8	Standard query (0)	d585tldpucybw.cloudfront.net	65	IN (0x0001)	false
Nov 15, 2024 15:59:34.256617069 CET	192.168.2.5	1.1.1.1	0xbf18	Standard query (0)	cdn.insight.sitefinity.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.256751060 CET	192.168.2.5	1.1.1.1	0xc068	Standard query (0)	cdn.insight.sitefinity.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:34.298919916 CET	192.168.2.5	1.1.1.1	0x1e36	Standard query (0)	geolocation.onetrust.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.299056053 CET	192.168.2.5	1.1.1.1	0xa73b	Standard query (0)	geolocation.onetrust.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:35.170475960 CET	192.168.2.5	1.1.1.1	0x511b	Standard query (0)	s1325.t.eloqua.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:35.170927048 CET	192.168.2.5	1.1.1.1	0xff14	Standard query (0)	s1325.t.eloqua.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:36.003956079 CET	192.168.2.5	1.1.1.1	0x4392	Standard query (0)	euob.ytwohlcq.telerik.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.004082918 CET	192.168.2.5	1.1.1.1	0xecb5	Standard query (0)	euob.ytwohlcq.telerik.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:36.005295992 CET	192.168.2.5	1.1.1.1	0x5051	Standard query (0)	static.hotjar.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.005553961 CET	192.168.2.5	1.1.1.1	0xfb4a	Standard query (0)	static.hotjar.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:36.005996943 CET	192.168.2.5	1.1.1.1	0x238b	Standard query (0)	unpkg.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.006290913 CET	192.168.2.5	1.1.1.1	0x4d50	Standard query (0)	unpkg.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:36.016688108 CET	192.168.2.5	1.1.1.1	0xe91c	Standard query (0)	img.en25.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.017064095 CET	192.168.2.5	1.1.1.1	0x59f8	Standard query (0)	img.en25.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:36.198699951 CET	192.168.2.5	1.1.1.1	0xc43a	Standard query (0)	static.ads-twitter.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.199032068 CET	192.168.2.5	1.1.1.1	0xd3ee	Standard query (0)	static.ads-twitter.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:36.199364901 CET	192.168.2.5	1.1.1.1	0xbdbc	Standard query (0)	snap.licdn.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.199466944 CET	192.168.2.5	1.1.1.1	0x26b	Standard query (0)	snap.licdn.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:37.365453959 CET	192.168.2.5	1.1.1.1	0xa871	Standard query (0)	a.quora.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:37.365626097 CET	192.168.2.5	1.1.1.1	0x2923	Standard query (0)	a.quora.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:37.447935104 CET	192.168.2.5	1.1.1.1	0x186e	Standard query (0)	script.crazyegg.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:37.448071003 CET	192.168.2.5	1.1.1.1	0x54e3	Standard query (0)	script.crazyegg.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:37.524116039 CET	192.168.2.5	1.1.1.1	0x9ff1	Standard query (0)	rum-static.pingdom.net	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:37.524256945 CET	192.168.2.5	1.1.1.1	0xc9ac	Standard query (0)	rum-static.pingdom.net	65	IN (0x0001)	false
Nov 15, 2024 15:59:37.690390110 CET	192.168.2.5	1.1.1.1	0xac	Standard query (0)	www.clickcease.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:37.690517902 CET	192.168.2.5	1.1.1.1	0x81a	Standard query (0)	www.clickcease.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:37.691051006 CET	192.168.2.5	1.1.1.1	0x4c16	Standard query (0)	px.ads.linkedin.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:37.691371918 CET	192.168.2.5	1.1.1.1	0x4e5f	Standard query (0)	px.ads.linkedin.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:37.751329899 CET	192.168.2.5	1.1.1.1	0x723a	Standard query (0)	q.quora.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:37.751574039 CET	192.168.2.5	1.1.1.1	0x19dc	Standard query (0)	q.quora.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:38.817447901 CET	192.168.2.5	1.1.1.1	0x3213	Standard query (0)	analytics.google.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:38.817585945 CET	192.168.2.5	1.1.1.1	0x740b	Standard query (0)	analytics.google.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:38.845963001 CET	192.168.2.5	1.1.1.1	0xc7c5	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:38.846071959 CET	192.168.2.5	1.1.1.1	0x22ff	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Nov 15, 2024 15:59:38.863038063 CET	192.168.2.5	1.1.1.1	0xd6	Standard query (0)	script.hotjar.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:38.863141060 CET	192.168.2.5	1.1.1.1	0x156e	Standard query (0)	script.hotjar.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:38.878786087 CET	192.168.2.5	1.1.1.1	0xab5b	Standard query (0)	rum-collector-2.pingdom.net	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:38.878901005 CET	192.168.2.5	1.1.1.1	0x16e0	Standard query (0)	rum-collector-2.pingdom.net	65	IN (0x0001)	false
Nov 15, 2024 15:59:38.974983931 CET	192.168.2.5	1.1.1.1	0x6d4b	Standard query (0)	api.insight.sitefinity.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:38.975115061 CET	192.168.2.5	1.1.1.1	0x8ab6	Standard query (0)	api.insight.sitefinity.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:39.195756912 CET	192.168.2.5	1.1.1.1	0xf4a4	Standard query (0)	static.hotjar.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.195858002 CET	192.168.2.5	1.1.1.1	0x75ca	Standard query (0)	static.hotjar.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:39.198127031 CET	192.168.2.5	1.1.1.1	0xc857	Standard query (0)	img.en25.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.198127031 CET	192.168.2.5	1.1.1.1	0x4c93	Standard query (0)	img.en25.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:39.199165106 CET	192.168.2.5	1.1.1.1	0x92f4	Standard query (0)	snap.licdn.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.199290037 CET	192.168.2.5	1.1.1.1	0x3ee5	Standard query (0)	snap.licdn.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:39.200417042 CET	192.168.2.5	1.1.1.1	0x558c	Standard query (0)	euob.ytwohlcq.telerik.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.200532913 CET	192.168.2.5	1.1.1.1	0x5cbe	Standard query (0)	euob.ytwohlcq.telerik.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:39.202874899 CET	192.168.2.5	1.1.1.1	0x4351	Standard query (0)	static.ads-twitter.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.203075886 CET	192.168.2.5	1.1.1.1	0x8061	Standard query (0)	static.ads-twitter.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:39.207968950 CET	192.168.2.5	1.1.1.1	0xf693	Standard query (0)	unpkg.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.208077908 CET	192.168.2.5	1.1.1.1	0x41c4	Standard query (0)	unpkg.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:39.208434105 CET	192.168.2.5	1.1.1.1	0xc403	Standard query (0)	px.ads.linkedin.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.208545923 CET	192.168.2.5	1.1.1.1	0xec38	Standard query (0)	px.ads.linkedin.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:39.209726095 CET	192.168.2.5	1.1.1.1	0x27c0	Standard query (0)	rum-static.pingdom.net	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.209836960 CET	192.168.2.5	1.1.1.1	0xede3	Standard query (0)	rum-static.pingdom.net	65	IN (0x0001)	false
Nov 15, 2024 15:59:39.210849047 CET	192.168.2.5	1.1.1.1	0xa7fb	Standard query (0)	q.quora.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.210958004 CET	192.168.2.5	1.1.1.1	0xd462	Standard query (0)	q.quora.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:39.466789007 CET	192.168.2.5	1.1.1.1	0xabf3	Standard query (0)	script.crazyegg.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.466906071 CET	192.168.2.5	1.1.1.1	0xc1b9	Standard query (0)	script.crazyegg.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:39.832623959 CET	192.168.2.5	1.1.1.1	0x738e	Standard query (0)	www.clickcease.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.832948923 CET	192.168.2.5	1.1.1.1	0x4549	Standard query (0)	www.clickcease.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:40.238821030 CET	192.168.2.5	1.1.1.1	0xc26f	Standard query (0)	connect.facebook.net	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:40.239068985 CET	192.168.2.5	1.1.1.1	0x5ca7	Standard query (0)	connect.facebook.net	65	IN (0x0001)	false
Nov 15, 2024 15:59:40.239752054 CET	192.168.2.5	1.1.1.1	0x699a	Standard query (0)	cl.qualaroo.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:40.239927053 CET	192.168.2.5	1.1.1.1	0x9e94	Standard query (0)	cl.qualaroo.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:40.240336895 CET	192.168.2.5	1.1.1.1	0x526e	Standard query (0)	obseu.ytwohlcq.telerik.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:40.240447044 CET	192.168.2.5	1.1.1.1	0x833	Standard query (0)	obseu.ytwohlcq.telerik.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:40.240868092 CET	192.168.2.5	1.1.1.1	0x2a2a	Standard query (0)	rum-collector-2.pingdom.net	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:40.241015911 CET	192.168.2.5	1.1.1.1	0x4c26	Standard query (0)	rum-collector-2.pingdom.net	65	IN (0x0001)	false
Nov 15, 2024 15:59:40.350343943 CET	192.168.2.5	1.1.1.1	0x4c59	Standard query (0)	t.co	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:40.350475073 CET	192.168.2.5	1.1.1.1	0x987c	Standard query (0)	t.co	65	IN (0x0001)	false
Nov 15, 2024 15:59:40.352652073 CET	192.168.2.5	1.1.1.1	0x3aca	Standard query (0)	analytics.twitter.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:40.352777958 CET	192.168.2.5	1.1.1.1	0xb954	Standard query (0)	analytics.twitter.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:41.298520088 CET	192.168.2.5	1.1.1.1	0xa137	Standard query (0)	script.hotjar.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:41.298643112 CET	192.168.2.5	1.1.1.1	0xf1aa	Standard query (0)	script.hotjar.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:41.393321037 CET	192.168.2.5	1.1.1.1	0xb5a5	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:41.393470049 CET	192.168.2.5	1.1.1.1	0x3b75	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:41.397747993 CET	192.168.2.5	1.1.1.1	0xe54	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:41.397878885 CET	192.168.2.5	1.1.1.1	0x4a3e	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Nov 15, 2024 15:59:42.012129068 CET	192.168.2.5	1.1.1.1	0x5774	Standard query (0)	geo.qualaroo.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.012274981 CET	192.168.2.5	1.1.1.1	0xc672	Standard query (0)	geo.qualaroo.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:42.035403013 CET	192.168.2.5	1.1.1.1	0x54ee	Standard query (0)	dntcl.qualaroo.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.035542011 CET	192.168.2.5	1.1.1.1	0xe401	Standard query (0)	dntcl.qualaroo.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:42.103171110 CET	192.168.2.5	1.1.1.1	0x6346	Standard query (0)	www.linkedin.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.103297949 CET	192.168.2.5	1.1.1.1	0x2043	Standard query (0)	www.linkedin.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:42.216525078 CET	192.168.2.5	1.1.1.1	0x6ae2	Standard query (0)	analytics.twitter.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.217175007 CET	192.168.2.5	1.1.1.1	0xee7c	Standard query (0)	analytics.twitter.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:42.353348017 CET	192.168.2.5	1.1.1.1	0x4267	Standard query (0)	t.co	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.353482008 CET	192.168.2.5	1.1.1.1	0x5882	Standard query (0)	t.co	65	IN (0x0001)	false
Nov 15, 2024 15:59:42.357155085 CET	192.168.2.5	1.1.1.1	0xc684	Standard query (0)	obseu.ytwohlcq.telerik.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.357279062 CET	192.168.2.5	1.1.1.1	0x452c	Standard query (0)	obseu.ytwohlcq.telerik.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:42.360614061 CET	192.168.2.5	1.1.1.1	0x618c	Standard query (0)	cl.qualaroo.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.360817909 CET	192.168.2.5	1.1.1.1	0xb693	Standard query (0)	cl.qualaroo.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:42.363847017 CET	192.168.2.5	1.1.1.1	0xa3fc	Standard query (0)	connect.facebook.net	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.363993883 CET	192.168.2.5	1.1.1.1	0xe041	Standard query (0)	connect.facebook.net	65	IN (0x0001)	false
Nov 15, 2024 15:59:42.901968002 CET	192.168.2.5	1.1.1.1	0x85f3	Standard query (0)	tracking.crazyegg.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.902352095 CET	192.168.2.5	1.1.1.1	0x22d6	Standard query (0)	tracking.crazyegg.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:42.919434071 CET	192.168.2.5	1.1.1.1	0xe5fc	Standard query (0)	pagestates-tracking.crazyegg.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.919564962 CET	192.168.2.5	1.1.1.1	0xd4a7	Standard query (0)	pagestates-tracking.crazyegg.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:42.924474955 CET	192.168.2.5	1.1.1.1	0x5ce6	Standard query (0)	assets-tracking.crazyegg.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.924783945 CET	192.168.2.5	1.1.1.1	0x95f8	Standard query (0)	assets-tracking.crazyegg.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:42.946841955 CET	192.168.2.5	1.1.1.1	0xb0de	Standard query (0)	www.clarity.ms	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.946955919 CET	192.168.2.5	1.1.1.1	0xba53	Standard query (0)	www.clarity.ms	65	IN (0x0001)	false
Nov 15, 2024 15:59:43.807445049 CET	192.168.2.5	1.1.1.1	0xf2eb	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:43.807586908 CET	192.168.2.5	1.1.1.1	0x21b5	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Nov 15, 2024 15:59:46.357177973 CET	192.168.2.5	1.1.1.1	0x4d0c	Standard query (0)	c.clarity.ms	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:46.357685089 CET	192.168.2.5	1.1.1.1	0xd976	Standard query (0)	c.clarity.ms	65	IN (0x0001)	false
Nov 15, 2024 15:59:46.456841946 CET	192.168.2.5	1.1.1.1	0xe6e5	Standard query (0)	b.clarity.ms	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:46.456990004 CET	192.168.2.5	1.1.1.1	0xa8ce	Standard query (0)	b.clarity.ms	65	IN (0x0001)	false
Nov 15, 2024 15:59:46.643867970 CET	192.168.2.5	1.1.1.1	0xd7d2	Standard query (0)	www.clarity.ms	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:46.643980026 CET	192.168.2.5	1.1.1.1	0xbdb	Standard query (0)	www.clarity.ms	65	IN (0x0001)	false
Nov 15, 2024 15:59:46.652679920 CET	192.168.2.5	1.1.1.1	0xd53e	Standard query (0)	pagestates-tracking.crazyegg.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:46.652791977 CET	192.168.2.5	1.1.1.1	0x8506	Standard query (0)	pagestates-tracking.crazyegg.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:46.653634071 CET	192.168.2.5	1.1.1.1	0x7b6a	Standard query (0)	assets-tracking.crazyegg.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:46.653908968 CET	192.168.2.5	1.1.1.1	0x5eb5	Standard query (0)	assets-tracking.crazyegg.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:46.789180040 CET	192.168.2.5	1.1.1.1	0x7d17	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:46.789303064 CET	192.168.2.5	1.1.1.1	0xab2f	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:46.802472115 CET	192.168.2.5	1.1.1.1	0xe43e	Standard query (0)	tracking.crazyegg.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:46.802592039 CET	192.168.2.5	1.1.1.1	0x6df6	Standard query (0)	tracking.crazyegg.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:47.514691114 CET	192.168.2.5	1.1.1.1	0x6274	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:47.514910936 CET	192.168.2.5	1.1.1.1	0xedcb	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:48.730214119 CET	192.168.2.5	1.1.1.1	0x887	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:48.730479002 CET	192.168.2.5	1.1.1.1	0x550e	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Nov 15, 2024 15:59:50.071058035 CET	192.168.2.5	1.1.1.1	0x691f	Standard query (0)	c.clarity.ms	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:50.071171045 CET	192.168.2.5	1.1.1.1	0x7943	Standard query (0)	c.clarity.ms	65	IN (0x0001)	false
Nov 15, 2024 16:00:41.754281044 CET	192.168.2.5	1.1.1.1	0xef8	Standard query (0)	obseu.ytwohlcq.telerik.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:00:41.754488945 CET	192.168.2.5	1.1.1.1	0x4ab	Standard query (0)	obseu.ytwohlcq.telerik.com	65	IN (0x0001)	false
Nov 15, 2024 16:00:43.127902031 CET	192.168.2.5	1.1.1.1	0x1e79	Standard query (0)	obseu.ytwohlcq.telerik.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:00:43.128088951 CET	192.168.2.5	1.1.1.1	0xd96e	Standard query (0)	obseu.ytwohlcq.telerik.com	65	IN (0x0001)	false
Nov 15, 2024 16:00:53.284697056 CET	192.168.2.5	1.1.1.1	0xd9a6	Standard query (0)	b.clarity.ms	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:00:53.285150051 CET	192.168.2.5	1.1.1.1	0x9bd7	Standard query (0)	b.clarity.ms	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 15, 2024 15:59:12.250044107 CET	1.1.1.1	192.168.2.5	0xb07	No error (0)	fiddler2.com		50.56.19.116	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:12.961061954 CET	1.1.1.1	192.168.2.5	0xa0b5	No error (0)	www.telerik.com	telerik.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:12.961061954 CET	1.1.1.1	192.168.2.5	0xa0b5	No error (0)	telerik.com		50.56.19.112	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:12.961738110 CET	1.1.1.1	192.168.2.5	0x6895	No error (0)	www.telerik.com	telerik.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:13.752633095 CET	1.1.1.1	192.168.2.5	0x9a05	No error (0)	www.telerik.com	telerik.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:13.752826929 CET	1.1.1.1	192.168.2.5	0xf1fd	No error (0)	www.telerik.com	telerik.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:13.752826929 CET	1.1.1.1	192.168.2.5	0xf1fd	No error (0)	telerik.com		50.56.19.112	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:15.022522926 CET	1.1.1.1	192.168.2.5	0x56bd	No error (0)	dtzbdy9anri2p.cloudfront.net		18.245.206.63	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:15.022522926 CET	1.1.1.1	192.168.2.5	0x56bd	No error (0)	dtzbdy9anri2p.cloudfront.net		18.245.206.195	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:15.022522926 CET	1.1.1.1	192.168.2.5	0x56bd	No error (0)	dtzbdy9anri2p.cloudfront.net		18.245.206.64	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:15.022522926 CET	1.1.1.1	192.168.2.5	0x56bd	No error (0)	dtzbdy9anri2p.cloudfront.net		18.245.206.157	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:15.026140928 CET	1.1.1.1	192.168.2.5	0x4375	No error (0)	d6vtbcy3ong79.cloudfront.net		18.66.17.64	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:15.026140928 CET	1.1.1.1	192.168.2.5	0x4375	No error (0)	d6vtbcy3ong79.cloudfront.net		18.66.17.225	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:15.026140928 CET	1.1.1.1	192.168.2.5	0x4375	No error (0)	d6vtbcy3ong79.cloudfront.net		18.66.17.186	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:15.026140928 CET	1.1.1.1	192.168.2.5	0x4375	No error (0)	d6vtbcy3ong79.cloudfront.net		18.66.17.218	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:15.035162926 CET	1.1.1.1	192.168.2.5	0x8b36	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:15.035162926 CET	1.1.1.1	192.168.2.5	0x8b36	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:15.035193920 CET	1.1.1.1	192.168.2.5	0xcb13	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Nov 15, 2024 15:59:15.035840988 CET	1.1.1.1	192.168.2.5	0x6234	No error (0)	cdn.cookielaw.org			65	IN (0x0001)	false
Nov 15, 2024 15:59:15.036221027 CET	1.1.1.1	192.168.2.5	0xe632	No error (0)	cdn.cookielaw.org		104.18.86.42	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:15.036221027 CET	1.1.1.1	192.168.2.5	0xe632	No error (0)	cdn.cookielaw.org		104.18.87.42	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:16.924128056 CET	1.1.1.1	192.168.2.5	0x9ad5	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 15, 2024 15:59:16.926126003 CET	1.1.1.1	192.168.2.5	0xfa0a	No error (0)	www.google.com		142.250.186.132	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:18.039761066 CET	1.1.1.1	192.168.2.5	0xd19	No error (0)	d585tldpucybw.cloudfront.net		18.66.107.176	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:18.039761066 CET	1.1.1.1	192.168.2.5	0xd19	No error (0)	d585tldpucybw.cloudfront.net		18.66.107.78	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:18.039761066 CET	1.1.1.1	192.168.2.5	0xd19	No error (0)	d585tldpucybw.cloudfront.net		18.66.107.59	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:18.039761066 CET	1.1.1.1	192.168.2.5	0xd19	No error (0)	d585tldpucybw.cloudfront.net		18.66.107.115	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:18.235758066 CET	1.1.1.1	192.168.2.5	0xa690	No error (0)	cdn.insight.sitefinity.com	sitefinity-insight.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:18.235758066 CET	1.1.1.1	192.168.2.5	0xa690	No error (0)	scdn1d828.wpc.353cd.gammacdn.net	sni1gl.wpc.gammacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:18.235758066 CET	1.1.1.1	192.168.2.5	0xa690	No error (0)	sni1gl.wpc.gammacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:18.241117954 CET	1.1.1.1	192.168.2.5	0xf617	No error (0)	cdn.insight.sitefinity.com	sitefinity-insight.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:18.241117954 CET	1.1.1.1	192.168.2.5	0xf617	No error (0)	scdn1d828.wpc.353cd.gammacdn.net	sni1gl.wpc.gammacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:22.110651016 CET	1.1.1.1	192.168.2.5	0x3362	No error (0)	geolocation.onetrust.com		104.18.32.137	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:22.110651016 CET	1.1.1.1	192.168.2.5	0x3362	No error (0)	geolocation.onetrust.com		172.64.155.119	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:22.111758947 CET	1.1.1.1	192.168.2.5	0x8c61	No error (0)	geolocation.onetrust.com			65	IN (0x0001)	false
Nov 15, 2024 15:59:33.181767941 CET	1.1.1.1	192.168.2.5	0xe79b	No error (0)	s1325.t.eloqua.com	p01f.t.eloqua.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:33.323803902 CET	1.1.1.1	192.168.2.5	0x962c	No error (0)	s1325.t.eloqua.com	p01f.t.eloqua.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:33.323803902 CET	1.1.1.1	192.168.2.5	0x962c	No error (0)	p01f.t.eloqua.com		192.29.11.142	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:33.424869061 CET	1.1.1.1	192.168.2.5	0xfed8	No error (0)	api.insight.sitefinity.com		52.252.156.53	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:33.592621088 CET	1.1.1.1	192.168.2.5	0x1912	No error (0)	www.telerik.com	telerik.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:33.592621088 CET	1.1.1.1	192.168.2.5	0x1912	No error (0)	telerik.com		50.56.19.112	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:33.619616985 CET	1.1.1.1	192.168.2.5	0x3638	No error (0)	www.telerik.com	telerik.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:34.042076111 CET	1.1.1.1	192.168.2.5	0x3031	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.042076111 CET	1.1.1.1	192.168.2.5	0x3031	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.042892933 CET	1.1.1.1	192.168.2.5	0x186b	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Nov 15, 2024 15:59:34.044498920 CET	1.1.1.1	192.168.2.5	0x5799	No error (0)	cdn.cookielaw.org		104.18.87.42	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.044498920 CET	1.1.1.1	192.168.2.5	0x5799	No error (0)	cdn.cookielaw.org		104.18.86.42	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.044936895 CET	1.1.1.1	192.168.2.5	0x2878	No error (0)	cdn.cookielaw.org			65	IN (0x0001)	false
Nov 15, 2024 15:59:34.053291082 CET	1.1.1.1	192.168.2.5	0x8c27	No error (0)	dtzbdy9anri2p.cloudfront.net		3.160.156.198	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.053291082 CET	1.1.1.1	192.168.2.5	0x8c27	No error (0)	dtzbdy9anri2p.cloudfront.net		3.160.156.47	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.053291082 CET	1.1.1.1	192.168.2.5	0x8c27	No error (0)	dtzbdy9anri2p.cloudfront.net		3.160.156.22	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.053291082 CET	1.1.1.1	192.168.2.5	0x8c27	No error (0)	dtzbdy9anri2p.cloudfront.net		3.160.156.184	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.114542007 CET	1.1.1.1	192.168.2.5	0x67aa	No error (0)	d6vtbcy3ong79.cloudfront.net		18.66.17.64	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.114542007 CET	1.1.1.1	192.168.2.5	0x67aa	No error (0)	d6vtbcy3ong79.cloudfront.net		18.66.17.186	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.114542007 CET	1.1.1.1	192.168.2.5	0x67aa	No error (0)	d6vtbcy3ong79.cloudfront.net		18.66.17.225	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.114542007 CET	1.1.1.1	192.168.2.5	0x67aa	No error (0)	d6vtbcy3ong79.cloudfront.net		18.66.17.218	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.120652914 CET	1.1.1.1	192.168.2.5	0x29fa	No error (0)	d585tldpucybw.cloudfront.net		18.66.107.59	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.120652914 CET	1.1.1.1	192.168.2.5	0x29fa	No error (0)	d585tldpucybw.cloudfront.net		18.66.107.78	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.120652914 CET	1.1.1.1	192.168.2.5	0x29fa	No error (0)	d585tldpucybw.cloudfront.net		18.66.107.176	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.120652914 CET	1.1.1.1	192.168.2.5	0x29fa	No error (0)	d585tldpucybw.cloudfront.net		18.66.107.115	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.263916016 CET	1.1.1.1	192.168.2.5	0xbf18	No error (0)	cdn.insight.sitefinity.com	sitefinity-insight.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:34.263916016 CET	1.1.1.1	192.168.2.5	0xbf18	No error (0)	scdn1d828.wpc.353cd.gammacdn.net	sni1gl.wpc.gammacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:34.263916016 CET	1.1.1.1	192.168.2.5	0xbf18	No error (0)	sni1gl.wpc.gammacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.263936996 CET	1.1.1.1	192.168.2.5	0xc068	No error (0)	cdn.insight.sitefinity.com	sitefinity-insight.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:34.263936996 CET	1.1.1.1	192.168.2.5	0xc068	No error (0)	scdn1d828.wpc.353cd.gammacdn.net	sni1gl.wpc.gammacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:34.306782007 CET	1.1.1.1	192.168.2.5	0x1e36	No error (0)	geolocation.onetrust.com		172.64.155.119	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.306782007 CET	1.1.1.1	192.168.2.5	0x1e36	No error (0)	geolocation.onetrust.com		104.18.32.137	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:34.306792974 CET	1.1.1.1	192.168.2.5	0xa73b	No error (0)	geolocation.onetrust.com			65	IN (0x0001)	false
Nov 15, 2024 15:59:35.516971111 CET	1.1.1.1	192.168.2.5	0xff14	No error (0)	s1325.t.eloqua.com	p01f.t.eloqua.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:35.646502972 CET	1.1.1.1	192.168.2.5	0x511b	No error (0)	s1325.t.eloqua.com	p01f.t.eloqua.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:35.646502972 CET	1.1.1.1	192.168.2.5	0x511b	No error (0)	p01f.t.eloqua.com		192.29.11.142	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.012842894 CET	1.1.1.1	192.168.2.5	0x5051	No error (0)	static.hotjar.com	static-cdn.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:36.012842894 CET	1.1.1.1	192.168.2.5	0x5051	No error (0)	static-cdn.hotjar.com		13.224.245.89	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.012842894 CET	1.1.1.1	192.168.2.5	0x5051	No error (0)	static-cdn.hotjar.com		13.224.245.27	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.012842894 CET	1.1.1.1	192.168.2.5	0x5051	No error (0)	static-cdn.hotjar.com		13.224.245.61	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.012842894 CET	1.1.1.1	192.168.2.5	0x5051	No error (0)	static-cdn.hotjar.com		13.224.245.87	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.012912989 CET	1.1.1.1	192.168.2.5	0xfb4a	No error (0)	static.hotjar.com	static-cdn.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:36.013139009 CET	1.1.1.1	192.168.2.5	0x238b	No error (0)	unpkg.com		104.17.247.203	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.013139009 CET	1.1.1.1	192.168.2.5	0x238b	No error (0)	unpkg.com		104.17.249.203	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.013139009 CET	1.1.1.1	192.168.2.5	0x238b	No error (0)	unpkg.com		104.17.246.203	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.013139009 CET	1.1.1.1	192.168.2.5	0x238b	No error (0)	unpkg.com		104.17.248.203	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.013139009 CET	1.1.1.1	192.168.2.5	0x238b	No error (0)	unpkg.com		104.17.245.203	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.013348103 CET	1.1.1.1	192.168.2.5	0x4d50	No error (0)	unpkg.com			65	IN (0x0001)	false
Nov 15, 2024 15:59:36.013696909 CET	1.1.1.1	192.168.2.5	0x4392	No error (0)	euob.ytwohlcq.telerik.com		18.66.122.127	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.013696909 CET	1.1.1.1	192.168.2.5	0x4392	No error (0)	euob.ytwohlcq.telerik.com		18.66.122.71	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.013696909 CET	1.1.1.1	192.168.2.5	0x4392	No error (0)	euob.ytwohlcq.telerik.com		18.66.122.7	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.013696909 CET	1.1.1.1	192.168.2.5	0x4392	No error (0)	euob.ytwohlcq.telerik.com		18.66.122.83	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.024997950 CET	1.1.1.1	192.168.2.5	0xe91c	No error (0)	img.en25.com	wildcard.en25.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:36.037652969 CET	1.1.1.1	192.168.2.5	0x59f8	No error (0)	img.en25.com	wildcard.en25.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:36.204826117 CET	1.1.1.1	192.168.2.5	0x2caf	No error (0)	bat-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:36.204826117 CET	1.1.1.1	192.168.2.5	0x2caf	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.204826117 CET	1.1.1.1	192.168.2.5	0x2caf	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.206352949 CET	1.1.1.1	192.168.2.5	0xc43a	No error (0)	static.ads-twitter.com	platform.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:36.206352949 CET	1.1.1.1	192.168.2.5	0xc43a	No error (0)	platform.twitter.map.fastly.net		146.75.120.157	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:36.206460953 CET	1.1.1.1	192.168.2.5	0x26b	No error (0)	snap.licdn.com	od.linkedin.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:36.207381964 CET	1.1.1.1	192.168.2.5	0xbdbc	No error (0)	snap.licdn.com	od.linkedin.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:36.207396984 CET	1.1.1.1	192.168.2.5	0xd3ee	No error (0)	static.ads-twitter.com	platform.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:37.372910023 CET	1.1.1.1	192.168.2.5	0xa871	No error (0)	a.quora.com	a.quora.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:37.373351097 CET	1.1.1.1	192.168.2.5	0x2923	No error (0)	a.quora.com	a.quora.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:37.455378056 CET	1.1.1.1	192.168.2.5	0x54e3	No error (0)	script.crazyegg.com	script.crazyegg.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:37.532461882 CET	1.1.1.1	192.168.2.5	0x9ff1	No error (0)	rum-static.pingdom.net		104.22.54.104	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:37.532461882 CET	1.1.1.1	192.168.2.5	0x9ff1	No error (0)	rum-static.pingdom.net		172.67.5.216	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:37.532461882 CET	1.1.1.1	192.168.2.5	0x9ff1	No error (0)	rum-static.pingdom.net		104.22.55.104	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:37.532672882 CET	1.1.1.1	192.168.2.5	0xc9ac	No error (0)	rum-static.pingdom.net			65	IN (0x0001)	false
Nov 15, 2024 15:59:37.698975086 CET	1.1.1.1	192.168.2.5	0xac	No error (0)	www.clickcease.com	d2no1x7oj2rkdb.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:37.698975086 CET	1.1.1.1	192.168.2.5	0xac	No error (0)	d2no1x7oj2rkdb.cloudfront.net		18.172.112.30	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:37.698975086 CET	1.1.1.1	192.168.2.5	0xac	No error (0)	d2no1x7oj2rkdb.cloudfront.net		18.172.112.97	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:37.698975086 CET	1.1.1.1	192.168.2.5	0xac	No error (0)	d2no1x7oj2rkdb.cloudfront.net		18.172.112.19	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:37.698975086 CET	1.1.1.1	192.168.2.5	0xac	No error (0)	d2no1x7oj2rkdb.cloudfront.net		18.172.112.62	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:37.699013948 CET	1.1.1.1	192.168.2.5	0x4e5f	No error (0)	px.ads.linkedin.com	afd-lnkd.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:37.699013948 CET	1.1.1.1	192.168.2.5	0x4e5f	No error (0)	afd-lnkd.www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:37.700229883 CET	1.1.1.1	192.168.2.5	0x4c16	No error (0)	px.ads.linkedin.com	afd-lnkd.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:37.700229883 CET	1.1.1.1	192.168.2.5	0x4c16	No error (0)	afd-lnkd.www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:37.708234072 CET	1.1.1.1	192.168.2.5	0x81a	No error (0)	www.clickcease.com	d2no1x7oj2rkdb.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:37.759526968 CET	1.1.1.1	192.168.2.5	0x19dc	No error (0)	q.quora.com	q.quora.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:37.760060072 CET	1.1.1.1	192.168.2.5	0x723a	No error (0)	q.quora.com	q.quora.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:38.061563969 CET	1.1.1.1	192.168.2.5	0x70a5	No error (0)	script.crazyegg.com	script.crazyegg.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:38.825501919 CET	1.1.1.1	192.168.2.5	0x3213	No error (0)	analytics.google.com	analytics-alv.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:38.825501919 CET	1.1.1.1	192.168.2.5	0x3213	No error (0)	analytics-alv.google.com		216.239.34.181	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:38.825501919 CET	1.1.1.1	192.168.2.5	0x3213	No error (0)	analytics-alv.google.com		216.239.36.181	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:38.825501919 CET	1.1.1.1	192.168.2.5	0x3213	No error (0)	analytics-alv.google.com		216.239.38.181	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:38.825501919 CET	1.1.1.1	192.168.2.5	0x3213	No error (0)	analytics-alv.google.com		216.239.32.181	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:38.825537920 CET	1.1.1.1	192.168.2.5	0x740b	No error (0)	analytics.google.com	analytics-alv.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:38.852978945 CET	1.1.1.1	192.168.2.5	0xc7c5	No error (0)	td.doubleclick.net		172.217.18.98	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:38.870142937 CET	1.1.1.1	192.168.2.5	0xd6	No error (0)	script.hotjar.com		3.165.206.67	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:38.870142937 CET	1.1.1.1	192.168.2.5	0xd6	No error (0)	script.hotjar.com		3.165.206.73	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:38.870142937 CET	1.1.1.1	192.168.2.5	0xd6	No error (0)	script.hotjar.com		3.165.206.128	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:38.870142937 CET	1.1.1.1	192.168.2.5	0xd6	No error (0)	script.hotjar.com		3.165.206.52	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:38.886221886 CET	1.1.1.1	192.168.2.5	0xab5b	No error (0)	rum-collector-2.pingdom.net	prod-dem-collector-elb-611025824.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:38.886221886 CET	1.1.1.1	192.168.2.5	0xab5b	No error (0)	prod-dem-collector-elb-611025824.eu-west-1.elb.amazonaws.com		54.217.99.7	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:38.886221886 CET	1.1.1.1	192.168.2.5	0xab5b	No error (0)	prod-dem-collector-elb-611025824.eu-west-1.elb.amazonaws.com		54.220.100.186	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:38.886221886 CET	1.1.1.1	192.168.2.5	0xab5b	No error (0)	prod-dem-collector-elb-611025824.eu-west-1.elb.amazonaws.com		108.128.230.113	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:38.886612892 CET	1.1.1.1	192.168.2.5	0x16e0	No error (0)	rum-collector-2.pingdom.net	prod-dem-collector-elb-611025824.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:38.995423079 CET	1.1.1.1	192.168.2.5	0x6d4b	No error (0)	api.insight.sitefinity.com		52.252.156.53	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.202909946 CET	1.1.1.1	192.168.2.5	0x75ca	No error (0)	static.hotjar.com	static-cdn.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:39.203370094 CET	1.1.1.1	192.168.2.5	0xf4a4	No error (0)	static.hotjar.com	static-cdn.hotjar.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:39.203370094 CET	1.1.1.1	192.168.2.5	0xf4a4	No error (0)	static-cdn.hotjar.com		13.224.245.27	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.203370094 CET	1.1.1.1	192.168.2.5	0xf4a4	No error (0)	static-cdn.hotjar.com		13.224.245.87	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.203370094 CET	1.1.1.1	192.168.2.5	0xf4a4	No error (0)	static-cdn.hotjar.com		13.224.245.61	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.203370094 CET	1.1.1.1	192.168.2.5	0xf4a4	No error (0)	static-cdn.hotjar.com		13.224.245.89	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.203753948 CET	1.1.1.1	192.168.2.5	0xe445	No error (0)	bat-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:39.203753948 CET	1.1.1.1	192.168.2.5	0xe445	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.203753948 CET	1.1.1.1	192.168.2.5	0xe445	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.205725908 CET	1.1.1.1	192.168.2.5	0x4c93	No error (0)	img.en25.com	wildcard.en25.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:39.206218004 CET	1.1.1.1	192.168.2.5	0x3ee5	No error (0)	snap.licdn.com	od.linkedin.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:39.207226038 CET	1.1.1.1	192.168.2.5	0xc857	No error (0)	img.en25.com	wildcard.en25.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:39.211374044 CET	1.1.1.1	192.168.2.5	0x4351	No error (0)	static.ads-twitter.com	platform.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:39.211374044 CET	1.1.1.1	192.168.2.5	0x4351	No error (0)	platform.twitter.map.fastly.net		146.75.120.157	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.211405039 CET	1.1.1.1	192.168.2.5	0x8061	No error (0)	static.ads-twitter.com	platform.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:39.212163925 CET	1.1.1.1	192.168.2.5	0x558c	No error (0)	euob.ytwohlcq.telerik.com		18.66.122.7	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.212163925 CET	1.1.1.1	192.168.2.5	0x558c	No error (0)	euob.ytwohlcq.telerik.com		18.66.122.71	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.212163925 CET	1.1.1.1	192.168.2.5	0x558c	No error (0)	euob.ytwohlcq.telerik.com		18.66.122.127	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.212163925 CET	1.1.1.1	192.168.2.5	0x558c	No error (0)	euob.ytwohlcq.telerik.com		18.66.122.83	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.214977980 CET	1.1.1.1	192.168.2.5	0x41c4	No error (0)	unpkg.com			65	IN (0x0001)	false
Nov 15, 2024 15:59:39.215115070 CET	1.1.1.1	192.168.2.5	0xf693	No error (0)	unpkg.com		104.17.247.203	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.215115070 CET	1.1.1.1	192.168.2.5	0xf693	No error (0)	unpkg.com		104.17.248.203	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.215115070 CET	1.1.1.1	192.168.2.5	0xf693	No error (0)	unpkg.com		104.17.246.203	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.215115070 CET	1.1.1.1	192.168.2.5	0xf693	No error (0)	unpkg.com		104.17.245.203	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.215115070 CET	1.1.1.1	192.168.2.5	0xf693	No error (0)	unpkg.com		104.17.249.203	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.215996027 CET	1.1.1.1	192.168.2.5	0xec38	No error (0)	px.ads.linkedin.com	afd-lnkd.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:39.215996027 CET	1.1.1.1	192.168.2.5	0xec38	No error (0)	afd-lnkd.www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:39.216048956 CET	1.1.1.1	192.168.2.5	0xc403	No error (0)	px.ads.linkedin.com	afd-lnkd.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:39.216048956 CET	1.1.1.1	192.168.2.5	0xc403	No error (0)	afd-lnkd.www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:39.217093945 CET	1.1.1.1	192.168.2.5	0xede3	No error (0)	rum-static.pingdom.net			65	IN (0x0001)	false
Nov 15, 2024 15:59:39.217123032 CET	1.1.1.1	192.168.2.5	0x27c0	No error (0)	rum-static.pingdom.net		172.67.5.216	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.217123032 CET	1.1.1.1	192.168.2.5	0x27c0	No error (0)	rum-static.pingdom.net		104.22.54.104	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.217123032 CET	1.1.1.1	192.168.2.5	0x27c0	No error (0)	rum-static.pingdom.net		104.22.55.104	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.217694044 CET	1.1.1.1	192.168.2.5	0xa7fb	No error (0)	q.quora.com	q.quora.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:39.218308926 CET	1.1.1.1	192.168.2.5	0xd462	No error (0)	q.quora.com	q.quora.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:39.474415064 CET	1.1.1.1	192.168.2.5	0xabf3	No error (0)	script.crazyegg.com	script.crazyegg.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:39.475208044 CET	1.1.1.1	192.168.2.5	0xc1b9	No error (0)	script.crazyegg.com	script.crazyegg.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:39.817584038 CET	1.1.1.1	192.168.2.5	0xd41e	No error (0)	snap.licdn.com	od.linkedin.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:39.840332031 CET	1.1.1.1	192.168.2.5	0x4549	No error (0)	www.clickcease.com	d2no1x7oj2rkdb.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:39.855350971 CET	1.1.1.1	192.168.2.5	0x738e	No error (0)	www.clickcease.com	d2no1x7oj2rkdb.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:39.855350971 CET	1.1.1.1	192.168.2.5	0x738e	No error (0)	d2no1x7oj2rkdb.cloudfront.net		18.245.46.123	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.855350971 CET	1.1.1.1	192.168.2.5	0x738e	No error (0)	d2no1x7oj2rkdb.cloudfront.net		18.245.46.63	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.855350971 CET	1.1.1.1	192.168.2.5	0x738e	No error (0)	d2no1x7oj2rkdb.cloudfront.net		18.245.46.28	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:39.855350971 CET	1.1.1.1	192.168.2.5	0x738e	No error (0)	d2no1x7oj2rkdb.cloudfront.net		18.245.46.72	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:40.246185064 CET	1.1.1.1	192.168.2.5	0x5ca7	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:40.246185064 CET	1.1.1.1	192.168.2.5	0x5ca7	No error (0)	scontent.xx.fbcdn.net			65	IN (0x0001)	false
Nov 15, 2024 15:59:40.246185064 CET	1.1.1.1	192.168.2.5	0x5ca7	No error (0)	scontent.xx.fbcdn.net			65	IN (0x0001)	false
Nov 15, 2024 15:59:40.246593952 CET	1.1.1.1	192.168.2.5	0xc26f	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:40.246593952 CET	1.1.1.1	192.168.2.5	0xc26f	No error (0)	scontent.xx.fbcdn.net		157.240.253.1	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:40.247222900 CET	1.1.1.1	192.168.2.5	0x9e94	No error (0)	cl.qualaroo.com	bcltest2.b-cdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:40.247253895 CET	1.1.1.1	192.168.2.5	0x699a	No error (0)	cl.qualaroo.com	bcltest2.b-cdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:40.247253895 CET	1.1.1.1	192.168.2.5	0x699a	No error (0)	bcltest2.b-cdn.net		169.150.236.105	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:40.247873068 CET	1.1.1.1	192.168.2.5	0x2a2a	No error (0)	rum-collector-2.pingdom.net	prod-dem-collector-elb-611025824.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:40.247873068 CET	1.1.1.1	192.168.2.5	0x2a2a	No error (0)	prod-dem-collector-elb-611025824.eu-west-1.elb.amazonaws.com		54.217.99.7	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:40.247873068 CET	1.1.1.1	192.168.2.5	0x2a2a	No error (0)	prod-dem-collector-elb-611025824.eu-west-1.elb.amazonaws.com		54.220.100.186	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:40.247873068 CET	1.1.1.1	192.168.2.5	0x2a2a	No error (0)	prod-dem-collector-elb-611025824.eu-west-1.elb.amazonaws.com		108.128.230.113	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:40.260081053 CET	1.1.1.1	192.168.2.5	0x4c26	No error (0)	rum-collector-2.pingdom.net	prod-dem-collector-elb-611025824.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:40.304502964 CET	1.1.1.1	192.168.2.5	0x526e	No error (0)	obseu.ytwohlcq.telerik.com		54.75.69.192	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:40.304502964 CET	1.1.1.1	192.168.2.5	0x526e	No error (0)	obseu.ytwohlcq.telerik.com		34.251.101.162	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:40.304502964 CET	1.1.1.1	192.168.2.5	0x526e	No error (0)	obseu.ytwohlcq.telerik.com		3.248.162.96	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:40.357543945 CET	1.1.1.1	192.168.2.5	0x4c59	No error (0)	t.co		162.159.140.229	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:40.359460115 CET	1.1.1.1	192.168.2.5	0x3aca	No error (0)	analytics.twitter.com	ads.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:40.359460115 CET	1.1.1.1	192.168.2.5	0x3aca	No error (0)	ads.twitter.com	s.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:40.359460115 CET	1.1.1.1	192.168.2.5	0x3aca	No error (0)	s.twitter.com		104.244.42.195	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:40.359587908 CET	1.1.1.1	192.168.2.5	0xb954	No error (0)	analytics.twitter.com	ads.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:40.359587908 CET	1.1.1.1	192.168.2.5	0xb954	No error (0)	ads.twitter.com	s.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:41.306204081 CET	1.1.1.1	192.168.2.5	0xa137	No error (0)	script.hotjar.com		13.33.187.109	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:41.306204081 CET	1.1.1.1	192.168.2.5	0xa137	No error (0)	script.hotjar.com		13.33.187.19	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:41.306204081 CET	1.1.1.1	192.168.2.5	0xa137	No error (0)	script.hotjar.com		13.33.187.92	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:41.306204081 CET	1.1.1.1	192.168.2.5	0xa137	No error (0)	script.hotjar.com		13.33.187.74	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:41.400180101 CET	1.1.1.1	192.168.2.5	0xb5a5	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:41.400281906 CET	1.1.1.1	192.168.2.5	0x3b75	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 15, 2024 15:59:41.404611111 CET	1.1.1.1	192.168.2.5	0xe54	No error (0)	stats.g.doubleclick.net		66.102.1.155	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:41.404611111 CET	1.1.1.1	192.168.2.5	0xe54	No error (0)	stats.g.doubleclick.net		66.102.1.157	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:41.404611111 CET	1.1.1.1	192.168.2.5	0xe54	No error (0)	stats.g.doubleclick.net		66.102.1.156	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:41.404611111 CET	1.1.1.1	192.168.2.5	0xe54	No error (0)	stats.g.doubleclick.net		66.102.1.154	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.020687103 CET	1.1.1.1	192.168.2.5	0x5774	No error (0)	geo.qualaroo.com		98.83.237.110	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.020687103 CET	1.1.1.1	192.168.2.5	0x5774	No error (0)	geo.qualaroo.com		34.203.87.212	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.043143988 CET	1.1.1.1	192.168.2.5	0xe401	No error (0)	dntcl.qualaroo.com	qualdnt.b-cdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:42.044574022 CET	1.1.1.1	192.168.2.5	0x54ee	No error (0)	dntcl.qualaroo.com	qualdnt.b-cdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:42.044574022 CET	1.1.1.1	192.168.2.5	0x54ee	No error (0)	qualdnt.b-cdn.net		169.150.247.36	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.109925985 CET	1.1.1.1	192.168.2.5	0x6346	No error (0)	www.linkedin.com	cf-afd.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:42.109925985 CET	1.1.1.1	192.168.2.5	0x6346	No error (0)	cf-afd.www.linkedin.com	www.linkedin.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:42.110877991 CET	1.1.1.1	192.168.2.5	0x2043	No error (0)	www.linkedin.com	cf-afd.www.linkedin.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:42.110877991 CET	1.1.1.1	192.168.2.5	0x2043	No error (0)	cf-afd.www.linkedin.com	www.linkedin.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:42.224056005 CET	1.1.1.1	192.168.2.5	0xee7c	No error (0)	analytics.twitter.com	ads.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:42.224056005 CET	1.1.1.1	192.168.2.5	0xee7c	No error (0)	ads.twitter.com	s.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:42.224385977 CET	1.1.1.1	192.168.2.5	0x6ae2	No error (0)	analytics.twitter.com	ads.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:42.224385977 CET	1.1.1.1	192.168.2.5	0x6ae2	No error (0)	ads.twitter.com	s.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:42.224385977 CET	1.1.1.1	192.168.2.5	0x6ae2	No error (0)	s.twitter.com		104.244.42.131	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.584739923 CET	1.1.1.1	192.168.2.5	0x4267	No error (0)	t.co		162.159.140.229	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.584943056 CET	1.1.1.1	192.168.2.5	0xa3fc	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:42.584943056 CET	1.1.1.1	192.168.2.5	0xa3fc	No error (0)	scontent.xx.fbcdn.net		157.240.251.9	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.584974051 CET	1.1.1.1	192.168.2.5	0xe041	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:42.584974051 CET	1.1.1.1	192.168.2.5	0xe041	No error (0)	scontent.xx.fbcdn.net			65	IN (0x0001)	false
Nov 15, 2024 15:59:42.584974051 CET	1.1.1.1	192.168.2.5	0xe041	No error (0)	scontent.xx.fbcdn.net			65	IN (0x0001)	false
Nov 15, 2024 15:59:42.592027903 CET	1.1.1.1	192.168.2.5	0x618c	No error (0)	cl.qualaroo.com	bcltest2.b-cdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:42.592027903 CET	1.1.1.1	192.168.2.5	0x618c	No error (0)	bcltest2.b-cdn.net		169.150.247.36	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.592269897 CET	1.1.1.1	192.168.2.5	0xb693	No error (0)	cl.qualaroo.com	bcltest2.b-cdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:42.597249031 CET	1.1.1.1	192.168.2.5	0xc684	No error (0)	obseu.ytwohlcq.telerik.com		34.251.101.162	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.597249031 CET	1.1.1.1	192.168.2.5	0xc684	No error (0)	obseu.ytwohlcq.telerik.com		54.75.69.192	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.597249031 CET	1.1.1.1	192.168.2.5	0xc684	No error (0)	obseu.ytwohlcq.telerik.com		3.248.162.96	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.909775972 CET	1.1.1.1	192.168.2.5	0x85f3	No error (0)	tracking.crazyegg.com		63.32.145.9	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.909775972 CET	1.1.1.1	192.168.2.5	0x85f3	No error (0)	tracking.crazyegg.com		52.50.84.223	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.909775972 CET	1.1.1.1	192.168.2.5	0x85f3	No error (0)	tracking.crazyegg.com		52.210.32.20	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.931274891 CET	1.1.1.1	192.168.2.5	0x5ce6	No error (0)	assets-tracking.crazyegg.com		13.32.27.5	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.931274891 CET	1.1.1.1	192.168.2.5	0x5ce6	No error (0)	assets-tracking.crazyegg.com		13.32.27.97	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.931274891 CET	1.1.1.1	192.168.2.5	0x5ce6	No error (0)	assets-tracking.crazyegg.com		13.32.27.111	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.931274891 CET	1.1.1.1	192.168.2.5	0x5ce6	No error (0)	assets-tracking.crazyegg.com		13.32.27.37	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.938250065 CET	1.1.1.1	192.168.2.5	0xe5fc	No error (0)	pagestates-tracking.crazyegg.com		18.164.68.79	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.938250065 CET	1.1.1.1	192.168.2.5	0xe5fc	No error (0)	pagestates-tracking.crazyegg.com		18.164.68.112	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.938250065 CET	1.1.1.1	192.168.2.5	0xe5fc	No error (0)	pagestates-tracking.crazyegg.com		18.164.68.24	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.938250065 CET	1.1.1.1	192.168.2.5	0xe5fc	No error (0)	pagestates-tracking.crazyegg.com		18.164.68.53	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.953519106 CET	1.1.1.1	192.168.2.5	0xb0de	No error (0)	www.clarity.ms	clarity.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:42.953519106 CET	1.1.1.1	192.168.2.5	0xb0de	No error (0)	clarity.azurefd.net	azurefd-t-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:42.953519106 CET	1.1.1.1	192.168.2.5	0xb0de	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:42.953519106 CET	1.1.1.1	192.168.2.5	0xb0de	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:42.953833103 CET	1.1.1.1	192.168.2.5	0xba53	No error (0)	www.clarity.ms	clarity.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:42.953833103 CET	1.1.1.1	192.168.2.5	0xba53	No error (0)	clarity.azurefd.net	azurefd-t-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:43.815262079 CET	1.1.1.1	192.168.2.5	0xf2eb	No error (0)	googleads.g.doubleclick.net		142.250.185.162	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:43.815293074 CET	1.1.1.1	192.168.2.5	0x21b5	No error (0)	googleads.g.doubleclick.net			65	IN (0x0001)	false
Nov 15, 2024 15:59:46.364530087 CET	1.1.1.1	192.168.2.5	0x4d0c	No error (0)	c.clarity.ms	c.msn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:46.364530087 CET	1.1.1.1	192.168.2.5	0x4d0c	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:46.364779949 CET	1.1.1.1	192.168.2.5	0xd976	No error (0)	c.clarity.ms	c.msn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:46.364779949 CET	1.1.1.1	192.168.2.5	0xd976	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:46.464107037 CET	1.1.1.1	192.168.2.5	0xa8ce	No error (0)	b.clarity.ms	vmss-clarity-ingest-eus2.eastus2.cloudapp.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:46.464780092 CET	1.1.1.1	192.168.2.5	0xe6e5	No error (0)	b.clarity.ms	vmss-clarity-ingest-eus2.eastus2.cloudapp.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:46.650588989 CET	1.1.1.1	192.168.2.5	0xbdb	No error (0)	www.clarity.ms	clarity.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:46.650588989 CET	1.1.1.1	192.168.2.5	0xbdb	No error (0)	clarity.azurefd.net	azurefd-t-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:46.651192904 CET	1.1.1.1	192.168.2.5	0xd7d2	No error (0)	www.clarity.ms	clarity.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:46.651192904 CET	1.1.1.1	192.168.2.5	0xd7d2	No error (0)	clarity.azurefd.net	azurefd-t-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:46.651192904 CET	1.1.1.1	192.168.2.5	0xd7d2	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:46.651192904 CET	1.1.1.1	192.168.2.5	0xd7d2	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:46.659796953 CET	1.1.1.1	192.168.2.5	0xd53e	No error (0)	pagestates-tracking.crazyegg.com		13.35.58.128	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:46.659796953 CET	1.1.1.1	192.168.2.5	0xd53e	No error (0)	pagestates-tracking.crazyegg.com		13.35.58.27	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:46.659796953 CET	1.1.1.1	192.168.2.5	0xd53e	No error (0)	pagestates-tracking.crazyegg.com		13.35.58.40	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:46.659796953 CET	1.1.1.1	192.168.2.5	0xd53e	No error (0)	pagestates-tracking.crazyegg.com		13.35.58.58	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:46.661726952 CET	1.1.1.1	192.168.2.5	0x7b6a	No error (0)	assets-tracking.crazyegg.com		18.66.122.74	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:46.661726952 CET	1.1.1.1	192.168.2.5	0x7b6a	No error (0)	assets-tracking.crazyegg.com		18.66.122.45	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:46.661726952 CET	1.1.1.1	192.168.2.5	0x7b6a	No error (0)	assets-tracking.crazyegg.com		18.66.122.72	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:46.661726952 CET	1.1.1.1	192.168.2.5	0x7b6a	No error (0)	assets-tracking.crazyegg.com		18.66.122.57	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:46.795895100 CET	1.1.1.1	192.168.2.5	0xab2f	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 15, 2024 15:59:46.796153069 CET	1.1.1.1	192.168.2.5	0x7d17	No error (0)	www.google.com		172.217.16.132	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:46.809653997 CET	1.1.1.1	192.168.2.5	0xe43e	No error (0)	tracking.crazyegg.com		52.210.32.20	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:46.809653997 CET	1.1.1.1	192.168.2.5	0xe43e	No error (0)	tracking.crazyegg.com		52.50.84.223	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:46.809653997 CET	1.1.1.1	192.168.2.5	0xe43e	No error (0)	tracking.crazyegg.com		63.32.145.9	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:47.521908998 CET	1.1.1.1	192.168.2.5	0x6274	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:47.521908998 CET	1.1.1.1	192.168.2.5	0x6274	No error (0)	star-mini.c10r.facebook.com		157.240.253.35	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:47.521924973 CET	1.1.1.1	192.168.2.5	0xedcb	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:47.521924973 CET	1.1.1.1	192.168.2.5	0xedcb	No error (0)	star-mini.c10r.facebook.com			65	IN (0x0001)	false
Nov 15, 2024 15:59:47.521924973 CET	1.1.1.1	192.168.2.5	0xedcb	No error (0)	star-mini.c10r.facebook.com			65	IN (0x0001)	false
Nov 15, 2024 15:59:48.737284899 CET	1.1.1.1	192.168.2.5	0x550e	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:48.737284899 CET	1.1.1.1	192.168.2.5	0x550e	No error (0)	star-mini.c10r.facebook.com			65	IN (0x0001)	false
Nov 15, 2024 15:59:48.737284899 CET	1.1.1.1	192.168.2.5	0x550e	No error (0)	star-mini.c10r.facebook.com			65	IN (0x0001)	false
Nov 15, 2024 15:59:48.737572908 CET	1.1.1.1	192.168.2.5	0x887	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:48.737572908 CET	1.1.1.1	192.168.2.5	0x887	No error (0)	star-mini.c10r.facebook.com		157.240.0.35	A (IP address)	IN (0x0001)	false
Nov 15, 2024 15:59:50.261928082 CET	1.1.1.1	192.168.2.5	0x691f	No error (0)	c.clarity.ms	c.msn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:50.261928082 CET	1.1.1.1	192.168.2.5	0x691f	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:50.261965990 CET	1.1.1.1	192.168.2.5	0x7943	No error (0)	c.clarity.ms	c.msn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 15:59:50.261965990 CET	1.1.1.1	192.168.2.5	0x7943	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:00:41.763267040 CET	1.1.1.1	192.168.2.5	0xef8	No error (0)	obseu.ytwohlcq.telerik.com		54.75.69.192	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:00:41.763267040 CET	1.1.1.1	192.168.2.5	0xef8	No error (0)	obseu.ytwohlcq.telerik.com		34.251.101.162	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:00:41.763267040 CET	1.1.1.1	192.168.2.5	0xef8	No error (0)	obseu.ytwohlcq.telerik.com		3.248.162.96	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:00:43.383394957 CET	1.1.1.1	192.168.2.5	0x1e79	No error (0)	obseu.ytwohlcq.telerik.com		3.248.162.96	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:00:43.383394957 CET	1.1.1.1	192.168.2.5	0x1e79	No error (0)	obseu.ytwohlcq.telerik.com		34.251.101.162	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:00:43.383394957 CET	1.1.1.1	192.168.2.5	0x1e79	No error (0)	obseu.ytwohlcq.telerik.com		54.75.69.192	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:00:53.292314053 CET	1.1.1.1	192.168.2.5	0xd9a6	No error (0)	b.clarity.ms	vmss-clarity-ingest-eus2.eastus2.cloudapp.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:00:53.293339968 CET	1.1.1.1	192.168.2.5	0x9bd7	No error (0)	b.clarity.ms	vmss-clarity-ingest-eus2.eastus2.cloudapp.azure.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49710	50.56.19.116	80	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 15:59:12.289618969 CET	446	OUT	GET /r/?Fiddler2FirstRun HTTP/1.1 Host: fiddler2.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 15, 2024 15:59:12.924083948 CET	226	IN	HTTP/1.1 301 Moved Permanently Cache-Control: no-cache Location: http://www.telerik.com/download/fiddler/first-run Server: Microsoft-IIS/8.5 X-Powered-By: ASP.NET Date: Fri, 15 Nov 2024 14:59:12 GMT Content-Length: 0
Nov 15, 2024 15:59:57.935089111 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 15, 2024 16:00:42.951302052 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49712	50.56.19.112	80	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 15:59:12.968873024 CET	456	OUT	GET /download/fiddler/first-run HTTP/1.1 Host: www.telerik.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 15, 2024 15:59:13.638245106 CET	139	IN	HTTP/1.0 301 Moved Permanently Location: https://www.telerik.com/download/fiddler/first-run Connection: Keep-Alive Content-Length: 0
Nov 15, 2024 15:59:58.638222933 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 15, 2024 16:00:43.655076981 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49709	50.56.19.116	80	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 15:59:57.294928074 CET	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49715	50.56.19.112	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:14 UTC	684	OUT	GET /download/fiddler/first-run HTTP/1.1 Host: www.telerik.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:14 UTC	448	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: http://localconverter.telerik.com Date: Fri, 15 Nov 2024 14:59:14 GMT Content-Length: 64896 Connection: close
2024-11-15 14:59:14 UTC	14051	IN	Data Raw: 20 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 20 3c 68 74 6d 6c 20 69 64 3d 22 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 68 74 6d 6c 22 20 69 64 3d 22 73 66 2d 74 72 61 63 6b 69 6e 67 2d 63 6f 6e 73 65 6e 74 2d 6d 61 6e 61 67 65 72 22 3e 0d 0a 09 3c 64 69 76 20 69 64 3d 22 74 72 61 63 6b 69 6e 67 2d 63 6f 6e 73 65 6e 74 2d 64 69 61 6c 6f 67 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 20 2f 3e 0d 0a 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 57 65 62 52 65 73 6f 75 72 63 65 2e 61 78 Data Ascii: <!doctype html> <html id="html" lang="en"> <head> <meta charset="utf-8" /><script type="text/html" id="sf-tracking-consent-manager"><div id="tracking-consent-dialog" style="display:none" /></script><script type="text/javascript" src="/WebResource.ax
2024-11-15 14:59:14 UTC	16384	IN	Data Raw: 2f 70 72 6f 64 75 63 74 73 2f 72 65 70 6f 72 74 69 6e 67 2e 61 73 70 78 22 20 63 6c 61 73 73 3d 22 54 4b 2d 44 61 73 68 2d 4c 69 6e 6b 22 20 64 61 74 61 2d 6d 61 74 63 68 2d 65 78 61 63 74 2d 70 61 74 68 3e 54 65 6c 65 72 69 6b 20 52 65 70 6f 72 74 69 6e 67 3c 2f 61 3e 20 3c 61 20 68 72 65 66 3d 22 2f 72 65 70 6f 72 74 2d 73 65 72 76 65 72 22 20 63 6c 61 73 73 3d 22 54 4b 2d 44 61 73 68 2d 4c 69 6e 6b 22 20 64 61 74 61 2d 6d 61 74 63 68 2d 65 78 61 63 74 2d 70 61 74 68 3e 54 65 6c 65 72 69 6b 20 52 65 70 6f 72 74 20 53 65 72 76 65 72 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 68 35 20 63 6c 61 73 73 3d 22 54 4b 2d 44 61 73 68 2d 54 69 74 6c 65 22 3e 54 65 73 74 69 6e 67 20 26 61 6d 70 3b 20 4d 6f 63 6b 69 6e 67 3c 2f 68 35 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 54 Data Ascii: /products/reporting.aspx" class="TK-Dash-Link" data-match-exact-path>Telerik Reporting</a> <a href="/report-server" class="TK-Dash-Link" data-match-exact-path>Telerik Report Server</a></div><h5 class="TK-Dash-Title">Testing & Mocking</h5><div class="T
2024-11-15 14:59:14 UTC	9680	IN	Data Raw: 6f 6f 74 65 72 2d 4c 69 73 74 2d 49 74 65 6d 22 3e 3c 61 20 68 72 65 66 3d 22 2f 62 6c 6f 67 73 22 20 63 6c 61 73 73 3d 22 54 4b 2d 46 6f 6f 74 65 72 2d 4c 69 6e 6b 22 3e 42 6c 6f 67 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 54 4b 2d 46 6f 6f 74 65 72 2d 4c 69 73 74 2d 49 74 65 6d 22 3e 3c 61 20 68 72 65 66 3d 22 2f 77 65 62 69 6e 61 72 73 22 20 63 6c 61 73 73 3d 22 54 4b 2d 46 6f 6f 74 65 72 2d 4c 69 6e 6b 22 3e 57 65 62 69 6e 61 72 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 54 4b 2d 46 6f 6f 74 65 72 2d 4c 69 73 74 2d 49 74 65 6d 22 3e 3c 61 20 68 72 65 66 3d 22 2f 76 69 64 65 6f 73 22 20 63 6c 61 73 73 3d 22 54 4b 2d 46 6f 6f 74 65 72 2d 4c 69 6e 6b 22 3e 56 69 64 65 6f 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 Data Ascii: ooter-List-Item"><a href="/blogs" class="TK-Footer-Link">Blogs</a></li><li class="TK-Footer-List-Item"><a href="/webinars" class="TK-Footer-Link">Webinars</a></li><li class="TK-Footer-List-Item"><a href="/videos" class="TK-Footer-Link">Videos</a></li><li
2024-11-15 14:59:15 UTC	5792	IN	Data Raw: 30 2c 30 2c 30 2c 31 2e 31 38 31 2d 2e 31 2c 33 2e 33 2c 33 2e 33 2c 30 2c 30 2c 31 2c 2e 38 32 37 2d 31 2e 36 39 31 68 30 43 36 2e 39 34 32 2c 31 36 2e 33 38 32 2c 35 2e 37 2c 31 34 2e 37 32 34 2c 35 2e 32 2c 31 33 2e 34 31 35 61 35 2e 35 30 36 2c 35 2e 35 30 36 2c 30 2c 30 2c 31 2c 2e 38 35 35 2d 35 2e 32 38 31 41 2e 31 38 38 2e 31 38 38 2c 30 2c 30 2c 30 2c 36 2e 31 2c 37 2e 39 38 39 61 34 2e 36 2c 34 2e 36 2c 30 2c 30 2c 31 2c 2e 31 34 2d 33 2e 30 37 33 2c 34 2e 38 35 38 2c 34 2e 38 35 38 2c 30 2c 30 2c 31 2c 32 2e 36 36 33 2c 31 6c 2e 33 33 37 2e 32 63 2e 31 34 31 2e 30 38 34 2e 31 2e 30 33 36 2e 32 33 38 2e 30 32 35 41 31 30 2e 31 38 32 2c 31 30 2e 31 38 32 2c 30 2c 30 2c 31 2c 31 32 2c 35 2e 37 39 32 61 31 30 2e 32 32 35 2c 31 30 2e 32 32 35 2c 30 Data Ascii: 0,0,0,1.181-.1,3.3,3.3,0,0,1,.827-1.691h0C6.942,16.382,5.7,14.724,5.2,13.415a5.506,5.506,0,0,1,.855-5.281A.188.188,0,0,0,6.1,7.989a4.6,4.6,0,0,1,.14-3.073,4.858,4.858,0,0,1,2.663,1l.337.2c.141.084.1.036.238.025A10.182,10.182,0,0,1,12,5.792a10.225,10.225,0
2024-11-15 14:59:15 UTC	1448	IN	Data Raw: 74 70 73 3a 2f 2f 77 77 77 2e 70 72 6f 67 72 65 73 73 2e 63 6f 6d 2f 63 6f 6d 70 61 6e 79 22 20 63 6c 61 73 73 3d 22 54 4b 2d 46 6f 6f 74 65 72 2d 4c 69 6e 6b 22 3e 43 6f 6d 70 61 6e 79 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 54 4b 2d 46 6f 6f 74 65 72 2d 4c 69 73 74 2d 49 74 65 6d 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 72 6f 67 72 65 73 73 2e 63 6f 6d 2f 70 72 6f 64 75 63 74 73 22 20 63 6c 61 73 73 3d 22 54 4b 2d 46 6f 6f 74 65 72 2d 4c 69 6e 6b 22 3e 54 65 63 68 6e 6f 6c 6f 67 79 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 54 4b 2d 46 6f 6f 74 65 72 2d 4c 69 73 74 2d 49 74 65 6d 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 72 6f 67 72 65 73 73 2e 63 6f 6d 2f Data Ascii: tps://www.progress.com/company" class="TK-Footer-Link">Company</a></li><li class="TK-Footer-List-Item"><a href="https://www.progress.com/products" class="TK-Footer-Link">Technology</a></li><li class="TK-Footer-List-Item"><a href="https://www.progress.com/
2024-11-15 14:59:15 UTC	16384	IN	Data Raw: 61 6c 22 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 54 4b 2d 46 6f 6f 74 65 72 2d 4c 69 73 74 2d 48 6f 72 69 7a 6f 6e 74 61 6c 2d 49 74 65 6d 20 54 4b 2d 46 6f 6f 74 65 72 2d 4c 69 73 74 2d 48 6f 72 69 7a 6f 6e 74 61 6c 2d 49 74 65 6d 2d 45 66 66 65 63 74 22 3e 3c 61 20 68 72 65 66 3d 22 2f 61 62 6f 75 74 2f 74 65 72 6d 73 2d 6f 66 2d 75 73 65 22 20 63 6c 61 73 73 3d 22 54 4b 2d 46 6f 6f 74 65 72 2d 4c 69 6e 6b 2d 54 69 6e 79 22 3e 54 65 72 6d 73 20 6f 66 20 55 73 65 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 54 4b 2d 46 6f 6f 74 65 72 2d 4c 69 73 74 2d 48 6f 72 69 7a 6f 6e 74 61 6c 2d 49 74 65 6d 20 54 4b 2d 46 6f 6f 74 65 72 2d 4c 69 73 74 2d 48 6f 72 69 7a 6f 6e 74 61 6c 2d 49 74 65 6d 2d 45 66 66 65 63 74 22 3e 3c 61 20 68 72 65 66 3d 22 2f Data Ascii: al"><li class="TK-Footer-List-Horizontal-Item TK-Footer-List-Horizontal-Item-Effect"><a href="/about/terms-of-use" class="TK-Footer-Link-Tiny">Terms of Use</a></li><li class="TK-Footer-List-Horizontal-Item TK-Footer-List-Horizontal-Item-Effect"><a href="/
2024-11-15 14:59:15 UTC	992	IN	Data Raw: 6d 67 2e 65 6e 32 35 2e 63 6f 6d 2f 69 2f 65 6c 71 43 66 67 2e 6d 69 6e 2e 6a 73 22 3b 20 76 61 72 20 78 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 20 78 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 73 2c 20 78 29 20 7d 20 7d 20 66 75 6e 63 74 69 6f 6e 20 6c 6f 61 64 47 41 28 29 20 7b 20 77 69 6e 64 6f 77 2e 5f 67 61 71 20 3d 20 77 69 6e 64 6f 77 2e 5f 67 61 71 20 7c 7c 20 5b 5d 2c 20 77 69 6e 64 6f 77 2e 5f 67 61 71 2e 70 75 73 68 28 5b 22 5f 73 65 74 41 63 63 6f 75 6e 74 22 2c 22 55 41 2d 31 31 31 34 35 35 2d 31 22 5d 2c 20 5b 22 5f 73 65 74 44 6f 6d 61 69 6e 4e 61 6d 65 22 2c 20 22 2e 74 65 6c 65 72 69 6b 2e 63 6f 6d 22 5d 2c 20 Data Ascii: mg.en25.com/i/elqCfg.min.js"; var x = document.getElementsByTagName("script")[0]; x.parentNode.insertBefore(s, x) } } function loadGA() { window._gaq = window._gaq \|\| [], window._gaq.push(["_setAccount","UA-111455-1"], ["_setDomainName", ".telerik.com"],
2024-11-15 14:59:15 UTC	165	IN	Data Raw: 57 65 62 2e 53 69 74 65 66 69 6e 69 74 79 45 78 74 65 6e 73 69 6f 6e 73 2e 45 6c 6f 71 75 61 43 6f 6e 6e 65 63 74 6f 72 2f 53 63 72 69 70 74 73 2f 53 65 74 42 72 6f 77 73 65 72 53 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 6d 69 6e 2e 6a 73 3f 70 61 63 6b 61 67 65 3d 50 75 72 65 4d 76 63 26 61 6d 70 3b 76 3d 53 55 52 4e 54 6c 4e 57 4c 30 51 32 55 55 39 73 53 46 70 34 5a 32 64 6d 59 6e 70 30 55 54 30 39 29 27 3e 3c 2f 73 63 72 69 70 74 3e 20 3c 2f 62 6f 64 79 3e 20 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: Web.SitefinityExtensions.EloquaConnector/Scripts/SetBrowserSessionStorage.min.js?package=PureMvc&v=SURNTlNWL0Q2UU9sSFp4Z2dmYnp0UT09)'></script> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49721	50.56.19.112	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:16 UTC	757	OUT	GET /WebResource.axd?d=DzHrpQl5URXarFHAtrmzFsPwWIExaUeLHf3gTuslFxiRsjc9gU89IWbLw9lFnSTXl5qZVz-0iBHHB3aQBiGWPYzKfk3ndhT8iH1RSf_M6Sk7X3EWbQzPMVpb-rxAUHFQlncyLjOo3RP6E9HfRXn18roSCYCGCRaVqv9jyNWgJTH95Urh0&t=638646398980000000 HTTP/1.1 Host: www.telerik.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/download/fiddler/first-run Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:17 UTC	500	IN	HTTP/1.1 200 OK Cache-Control: public Content-Type: application/x-javascript Expires: Sat, 15 Nov 2025 07:56:30 GMT Last-Modified: Wed, 16 Oct 2024 11:44:58 GMT Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: http://localconverter.telerik.com Date: Fri, 15 Nov 2024 14:59:16 GMT Content-Length: 3300 Connection: close
2024-11-15 14:59:17 UTC	2415	IN	Data Raw: 54 72 61 63 6b 69 6e 67 43 6f 6e 73 65 6e 74 4d 61 6e 61 67 65 72 3d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 63 6f 6e 73 65 6e 74 43 6f 6f 6b 69 65 4e 61 6d 65 3d 22 73 66 2d 74 72 61 63 6b 69 6e 67 2d 63 6f 6e 73 65 6e 74 22 3b 0a 76 61 72 20 63 6f 6e 73 65 6e 74 44 69 61 6c 6f 67 48 74 6d 6c 3d 22 22 3b 0a 76 61 72 20 63 6f 6e 73 65 6e 74 44 69 61 6c 6f 67 3d 6e 75 6c 6c 3b 0a 76 61 72 20 65 76 65 6e 74 4c 69 73 74 65 6e 65 72 73 3d 7b 41 66 74 65 72 44 69 61 6c 6f 67 44 69 73 70 6c 61 79 65 64 3a 5b 5d 2c 42 65 66 6f 72 65 44 69 61 6c 6f 67 43 6c 6f 73 65 64 3a 5b 5d 2c 43 6f 6e 73 65 6e 74 43 68 61 6e 67 65 64 3a 5b 5d 2c 7d 3b 0a 66 75 6e 63 74 69 6f 6e 20 63 6c 6f 73 65 43 6f 6e 73 65 6e 74 44 69 61 6c 6f 67 28 29 7b 69 66 28 63 6f 6e 73 65 Data Ascii: TrackingConsentManager=(function(){var consentCookieName="sf-tracking-consent";var consentDialogHtml="";var consentDialog=null;var eventListeners={AfterDialogDisplayed:[],BeforeDialogClosed:[],ConsentChanged:[],};function closeConsentDialog(){if(conse
2024-11-15 14:59:17 UTC	885	IN	Data Raw: 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 6c 6f 61 64 22 2c 6f 70 65 6e 44 69 61 6c 6f 67 49 66 43 6f 6e 73 65 6e 74 4e 6f 74 50 72 6f 76 69 64 65 64 29 3b 0a 7d 7d 72 65 74 75 72 6e 7b 63 61 6e 54 72 61 63 6b 43 75 72 72 65 6e 74 55 73 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 65 61 64 43 6f 6f 6b 69 65 28 63 6f 6e 73 65 6e 74 43 6f 6f 6b 69 65 4e 61 6d 65 29 3d 3d 22 74 72 75 65 22 3b 0a 7d 2c 61 73 6b 46 6f 72 55 73 65 72 43 6f 6e 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 70 65 6e 43 6f 6e 73 65 6e 74 44 69 61 6c 6f 67 28 29 3b 0a 7d 2c 75 70 64 61 74 65 55 73 65 72 43 6f 6e 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 63 6f 6e 73 65 6e 74 29 7b 76 61 72 20 61 63 63 65 70 74 65 64 3d 42 6f 6f 6c 65 61 6e 28 63 6f 6e 73 65 6e Data Ascii: tachEvent("onload",openDialogIfConsentNotProvided);}}return{canTrackCurrentUser:function(){return readCookie(consentCookieName)=="true";},askForUserConsent:function(){openConsentDialog();},updateUserConsent:function(consent){var accepted=Boolean(consen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49720	50.56.19.112	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:16 UTC	800	OUT	GET /WebResource.axd?d=HtQyXelCu6mzSPcVcvK_BiMPfgaXcXtBpU_p4oPRWdaaTkgqeBOpXuu1TRv9pAGD-FAzjGGeBeqirrj8SJpv3YU7eO6rv9kziBqvktqcdZzC15nZHrag4kg_mMMtSYLloBTL1HIRNuD4Iepyub_zCpOjm9RyH4DXkI1YDpCN_mnfRNsYUjpSNKzgKVak4AN3FQYzZOcP1Z4PmfVVfM_48qg3YrI1&t=638646398980000000 HTTP/1.1 Host: www.telerik.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/download/fiddler/first-run Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:17 UTC	500	IN	HTTP/1.1 200 OK Cache-Control: public Content-Type: application/x-javascript Expires: Sat, 15 Nov 2025 07:56:35 GMT Last-Modified: Wed, 16 Oct 2024 11:44:58 GMT Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: http://localconverter.telerik.com Date: Fri, 15 Nov 2024 14:59:16 GMT Content-Length: 2617 Connection: close
2024-11-15 14:59:17 UTC	2415	IN	Data Raw: ef bb bf 49 6e 73 69 67 68 74 49 6e 69 74 53 63 72 69 70 74 20 3d 20 7b 20 5f 73 65 74 74 69 6e 67 73 3a 20 6e 75 6c 6c 2c 20 5f 63 6c 69 65 6e 74 3a 20 6e 75 6c 6c 2c 20 5f 63 72 65 61 74 65 43 6c 69 65 6e 74 3a 20 66 75 6e 63 74 69 6f 6e 20 28 74 29 20 7b 20 49 6e 73 69 67 68 74 49 6e 69 74 53 63 72 69 70 74 2e 5f 63 6c 69 65 6e 74 20 3d 20 6e 65 77 20 73 66 44 61 74 61 49 6e 74 65 6c 6c 2e 43 6c 69 65 6e 74 28 7b 20 61 70 69 4b 65 79 3a 20 49 6e 73 69 67 68 74 49 6e 69 74 53 63 72 69 70 74 2e 5f 73 65 74 74 69 6e 67 73 2e 61 70 69 4b 65 79 2c 20 73 6f 75 72 63 65 3a 20 49 6e 73 69 67 68 74 49 6e 69 74 53 63 72 69 70 74 2e 5f 73 65 74 74 69 6e 67 73 2e 61 70 70 6c 69 63 61 74 69 6f 6e 4e 61 6d 65 2c 20 61 70 69 53 65 72 76 65 72 55 72 6c 3a 20 49 6e 73 Data Ascii: InsightInitScript = { _settings: null, _client: null, _createClient: function (t) { InsightInitScript._client = new sfDataIntell.Client({ apiKey: InsightInitScript._settings.apiKey, source: InsightInitScript._settings.applicationName, apiServerUrl: Ins
2024-11-15 14:59:17 UTC	202	IN	Data Raw: 43 6c 69 65 6e 74 29 2c 20 49 6e 73 69 67 68 74 49 6e 69 74 53 63 72 69 70 74 2e 5f 63 72 65 61 74 65 43 6c 69 65 6e 74 28 54 72 61 63 6b 69 6e 67 43 6f 6e 73 65 6e 74 4d 61 6e 61 67 65 72 2e 63 61 6e 54 72 61 63 6b 43 75 72 72 65 6e 74 55 73 65 72 28 29 29 29 20 3a 20 49 6e 73 69 67 68 74 49 6e 69 74 53 63 72 69 70 74 2e 5f 63 72 65 61 74 65 43 6c 69 65 6e 74 28 21 30 29 20 7d 20 7d 2c 20 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 69 6e 73 69 67 68 74 2d 73 64 6b 2d 72 65 61 64 79 22 2c 20 49 6e 73 69 67 68 74 49 6e 69 74 53 63 72 69 70 74 2e 6c 6f 61 64 29 3b Data Ascii: Client), InsightInitScript._createClient(TrackingConsentManager.canTrackCurrentUser())) : InsightInitScript._createClient(!0) } }, document.addEventListener("insight-sdk-ready", InsightInitScript.load);

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49719	50.56.19.112	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:16 UTC	800	OUT	GET /WebResource.axd?d=wnB2OjhYopty-dCFa4b2kKCIWGgLoaj0QQ4I7F_PiSysmtqnVBUtsGpmlAymZDgXEXdRjhe5BdfNkuyybLSHMhRnbzI9oh6WXC-y-EwOrJPY0qCvfWaOo0ltV4TVm8apzRlzF5O244Y4u7-m5V8Vv2yC1Tun7PurVRoOxfv28sPwY-isOJNAi7MSqc1tycGYAkqZXHU_zlVNorSTBDv4W4jemDM1&t=638646398980000000 HTTP/1.1 Host: www.telerik.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/download/fiddler/first-run Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:17 UTC	500	IN	HTTP/1.1 200 OK Cache-Control: public Content-Type: application/x-javascript Expires: Sat, 15 Nov 2025 08:02:16 GMT Last-Modified: Wed, 16 Oct 2024 11:44:58 GMT Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: http://localconverter.telerik.com Date: Fri, 15 Nov 2024 14:59:16 GMT Content-Length: 7351 Connection: close
2024-11-15 14:59:17 UTC	6759	IN	Data Raw: ef bb bf 76 61 72 20 70 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 4d 61 6e 61 67 65 72 20 3d 20 6e 75 6c 6c 3b 20 77 69 6e 64 6f 77 2e 73 66 43 6f 72 72 65 6c 61 74 69 6f 6e 49 64 20 3d 20 44 61 74 65 2e 6e 6f 77 28 29 2e 74 6f 53 74 72 69 6e 67 28 33 36 29 20 2b 20 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2e 74 6f 53 74 72 69 6e 67 28 33 36 29 2e 73 75 62 73 74 72 69 6e 67 28 32 29 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 22 75 73 65 20 73 74 72 69 63 74 22 3b 20 76 61 72 20 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 4d 61 6e 61 67 65 72 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 74 68 69 73 2e 70 65 72 73 6f 6e 61 6c 69 7a 65 64 43 6f 6e 74 61 69 6e 65 72 73 20 3d 20 5b 5d 2c 20 74 68 69 73 2e 70 65 72 73 6f 6e 61 6c 69 7a 65 64 43 6f 6e Data Ascii: var personalizationManager = null; window.sfCorrelationId = Date.now().toString(36) + Math.random().toString(36).substring(2), function () { "use strict"; var PersonalizationManager = function () { this.personalizedContainers = [], this.personalizedCon
2024-11-15 14:59:17 UTC	592	IN	Data Raw: 65 2e 69 6e 64 65 78 4f 66 28 22 2e 22 2c 20 69 29 29 2c 20 31 30 29 20 7d 2c 20 69 73 44 65 73 63 65 6e 64 61 6e 74 4f 66 53 76 67 3a 20 66 75 6e 63 74 69 6f 6e 20 28 65 29 20 7b 20 66 6f 72 20 28 3b 20 65 3b 29 20 7b 20 69 66 20 28 22 73 76 67 22 20 3d 3d 3d 20 65 2e 74 61 67 4e 61 6d 65 29 20 72 65 74 75 72 6e 20 21 30 3b 20 65 20 3d 20 65 2e 70 61 72 65 6e 74 4e 6f 64 65 20 7d 20 72 65 74 75 72 6e 20 21 31 20 7d 20 7d 2c 20 70 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 4d 61 6e 61 67 65 72 20 3d 20 6e 65 77 20 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 4d 61 6e 61 67 65 72 2c 20 77 69 6e 64 6f 77 2e 6a 51 75 65 72 79 29 20 6a 51 75 65 72 79 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 70 65 72 73 6f 6e Data Ascii: e.indexOf(".", i)), 10) }, isDescendantOfSvg: function (e) { for (; e;) { if ("svg" === e.tagName) return !0; e = e.parentNode } return !1 } }, personalizationManager = new PersonalizationManager, window.jQuery) jQuery(document).ready(function () { person

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49732	50.56.19.112	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:16 UTC	800	OUT	GET /WebResource.axd?d=NjxTqR2bqTw1rewxxlkHPoKtHrXAWC0HAaoiA_KkRcUyXkV02CSw2viy3BbwqQQWnOeUM4JljOrJ6SdN8P6xkcmc02D5IE0_hoR3ujKOHMUMV0D80Ax-2HQgUBn3JFGVcQMIptO-sbrJg4UhPcfKleFkBd3KXta5g771qRLz1--cqQWHZet4VERXE7zwP_V-_reX4bmQVhWS6yxLXOsj2Tnqll01&t=638646398980000000 HTTP/1.1 Host: www.telerik.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/download/fiddler/first-run Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:17 UTC	500	IN	HTTP/1.1 200 OK Cache-Control: public Content-Type: application/x-javascript Expires: Sat, 15 Nov 2025 08:07:56 GMT Last-Modified: Wed, 16 Oct 2024 11:44:58 GMT Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: http://localconverter.telerik.com Date: Fri, 15 Nov 2024 14:59:16 GMT Content-Length: 4191 Connection: close
2024-11-15 14:59:17 UTC	3863	IN	Data Raw: ef bb bf 76 61 72 20 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 54 72 61 63 6b 65 72 20 3d 20 6e 75 6c 6c 3b 20 21 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 22 75 73 65 20 73 74 72 69 63 74 22 3b 20 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 54 72 61 63 6b 65 72 20 3d 20 7b 20 5f 63 61 6e 54 72 61 63 6b 3a 20 21 31 2c 20 5f 70 61 67 65 49 64 3a 20 6e 75 6c 6c 2c 20 5f 75 72 6c 3a 20 21 31 2c 20 74 72 61 63 6b 3a 20 66 75 6e 63 74 69 6f 6e 20 28 65 29 20 7b 20 69 66 20 28 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 54 72 61 63 6b 65 72 2e 5f 63 61 6e 54 72 61 63 6b 20 3d 20 65 2c 20 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 54 72 61 63 6b 65 72 2e 5f 63 61 6e 54 72 61 63 6b 29 20 7b 20 69 66 20 28 21 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 54 Data Ascii: var PersonalizationTracker = null; !function () { "use strict"; PersonalizationTracker = { _canTrack: !1, _pageId: null, _url: !1, track: function (e) { if (PersonalizationTracker._canTrack = e, PersonalizationTracker._canTrack) { if (!PersonalizationT
2024-11-15 14:59:17 UTC	328	IN	Data Raw: 6e 54 72 61 63 6b 65 72 2e 74 72 61 63 6b 28 21 30 29 3b 20 76 61 72 20 65 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 54 72 61 63 6b 65 72 22 29 2c 20 72 20 3d 20 4a 53 4f 4e 2e 70 61 72 73 65 28 65 2e 69 6e 6e 65 72 54 65 78 74 29 3b 20 69 66 20 28 21 72 29 20 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 20 74 72 61 63 6b 65 72 20 61 72 67 75 6d 65 6e 74 73 20 61 72 65 20 77 72 6f 6e 67 21 22 29 3b 20 72 2e 49 73 50 61 67 65 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 54 61 72 67 65 74 20 26 26 20 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 54 72 61 63 6b 65 72 2e 74 72 61 63 6b 50 61 67 65 28 72 2e 50 61 67 65 49 64 Data Ascii: nTracker.track(!0); var e = document.getElementById("PersonalizationTracker"), r = JSON.parse(e.innerText); if (!r) throw new Error("Personalization tracker arguments are wrong!"); r.IsPagePersonalizationTarget && PersonalizationTracker.trackPage(r.PageId

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49735	104.17.25.14	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:17 UTC	555	OUT	GET /ajax/libs/jquery/3.7.1/jquery.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:17 UTC	958	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:17 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"64ed75bb-76fe" Last-Modified: Tue, 29 Aug 2023 04:36:11 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 162532 Expires: Wed, 05 Nov 2025 14:59:17 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HyoeaPO7lv%2FMem8rUxfENm4dzGeyAJh9YLzpE0vinoSTEYkiidDx8rTyfLMKAaIGru0F3c9%2BYBEenGdidWBu2TuUav3cLSDHEULvjIvuBSFlosFinD%2BXp0tZEdQbxGdXNa0E7tvv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8e301ab02e6c68fa-DFW alt-svc: h3=":443"; ma=86400
2024-11-15 14:59:17 UTC	411	IN	Data Raw: 33 39 37 38 0d 0a 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 37 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f Data Ascii: 3978/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Erro
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 6f 74 6f 74 79 70 65 4f 66 2c 61 65 3d 6f 65 2e 73 6c 69 63 65 2c 67 3d 6f 65 2e 66 6c 61 74 3f 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 65 2e 66 6c 61 74 2e 63 61 6c 6c 28 65 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 65 2e 63 6f 6e 63 61 74 2e 61 70 70 6c 79 28 5b 5d 2c 65 29 7d 2c 73 3d 6f 65 2e 70 75 73 68 2c 73 65 3d 6f 65 2e 69 6e 64 65 78 4f 66 2c 6e 3d 7b 7d 2c 69 3d 6e 2e 74 6f 53 74 72 69 6e 67 2c 75 65 3d 6e 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 6f 3d 75 65 2e 74 6f 53 74 72 69 6e 67 2c 61 3d 6f 2e 63 61 6c 6c 28 4f 62 6a 65 63 74 29 2c 6c 65 3d 7b 7d 2c 76 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 22 6e 75 6d Data Ascii: ototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"num
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 65 2c 74 2c 65 29 7d 29 29 7d 2c 73 6c 69 63 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 61 65 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 29 7d 2c 66 69 72 73 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 71 28 30 29 7d 2c 6c 61 73 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 71 28 2d 31 29 7d 2c 65 76 65 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 63 65 2e 67 72 65 70 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 74 2b 31 29 25 32 7d 29 29 7d 2c 6f 64 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 Data Ascii: e,t,e)}))},slice:function(){return this.pushStack(ae.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},even:function(){return this.pushStack(ce.grep(this,function(e,t){return(t+1)%2}))},odd:function(){return t
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 29 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 30 3b 69 66 28 63 28 65 29 29 7b 66 6f 72 28 6e 3d 65 2e 6c 65 6e 67 74 68 3b 72 3c 6e 3b 72 2b 2b 29 69 66 28 21 31 3d 3d 3d 74 2e 63 61 6c 6c 28 65 5b 72 5d 2c 72 2c 65 5b 72 5d 29 29 62 72 65 61 6b 7d 65 6c 73 65 20 66 6f 72 28 72 20 69 6e 20 65 29 69 66 28 21 31 3d 3d 3d 74 2e 63 61 6c 6c 28 65 5b 72 5d 2c 72 2c 65 5b 72 5d 29 29 62 72 65 61 6b 3b 72 65 74 75 72 6e 20 65 7d 2c 74 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3d 22 22 2c 72 3d 30 2c 69 3d 65 2e 6e 6f 64 65 54 79 70 65 3b 69 66 28 21 69 29 77 68 69 6c 65 28 74 3d 65 5b 72 2b 2b 5d 29 6e 2b 3d 63 65 2e 74 65 78 74 28 74 29 3b 72 65 74 75 72 6e 20 31 3d 3d 3d 69 7c 7c 31 31 3d Data Ascii: )},each:function(e,t){var n,r=0;if(c(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},text:function(e){var t,n="",r=0,i=e.nodeType;if(!i)while(t=e[r++])n+=ce.text(t);return 1===i\|\|11=
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 74 61 69 6e 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 74 26 26 74 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 72 65 74 75 72 6e 20 65 3d 3d 3d 6e 7c 7c 21 28 21 6e 7c 7c 31 21 3d 3d 6e 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 28 65 2e 63 6f 6e 74 61 69 6e 73 3f 65 2e 63 6f 6e 74 61 69 6e 73 28 6e 29 3a 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 26 26 31 36 26 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 6e 29 29 29 7d 3b 76 61 72 20 66 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 78 38 30 2d 5c 75 46 46 46 46 5c 77 2d 5d 2f 67 3b 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3f 22 5c 30 22 3d 3d 3d 65 3f 22 Data Ascii: tains=function(e,t){var n=t&&t.parentNode;return e===n\|\|!(!n\|\|1!==n.nodeType\|\|!(e.contains?e.contains(n):e.compareDocumentPosition&&16&e.compareDocumentPosition(n)))};var f=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\x80-\uFFFF\w-]/g;function p(e,t){return t?"\0"===e?"
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 7c 29 28 5c 5c 64 2a 29 6e 7c 29 22 2b 67 65 2b 22 2a 28 3f 3a 28 5b 2b 2d 5d 7c 29 22 2b 67 65 2b 22 2a 28 5c 5c 64 2b 29 7c 29 29 22 2b 67 65 2b 22 2a 5c 5c 29 7c 29 22 2c 22 69 22 29 2c 62 6f 6f 6c 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 3f 3a 22 2b 66 2b 22 29 24 22 2c 22 69 22 29 2c 6e 65 65 64 73 43 6f 6e 74 65 78 74 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 67 65 2b 22 2a 5b 3e 2b 7e 5d 7c 3a 28 65 76 65 6e 7c 6f 64 64 7c 65 71 7c 67 74 7c 6c 74 7c 6e 74 68 7c 66 69 72 73 74 7c 6c 61 73 74 29 28 3f 3a 5c 5c 28 22 2b 67 65 2b 22 2a 28 28 3f 3a 2d 5c 5c 64 29 3f 5c 5c 64 2a 29 22 2b 67 65 2b 22 2a 5c 5c 29 7c 29 28 3f 3d 5b 5e 2d 5d 7c 24 29 22 2c 22 69 22 29 7d 2c 4e 3d 2f 5e 28 3f 3a 69 6e 70 75 74 7c 73 65 6c 65 63 74 7c 74 65 78 74 61 Data Ascii: \|)(\\d)n\|)"+ge+"(?:([+-]\|)"+ge+"(\\d+)\|))"+ge+"\\)\|)","i"),bool:new RegExp("^(?:"+f+")$","i"),needsContext:new RegExp("^"+ge+"[>+~]\|:(even\|odd\|eq\|gt\|lt\|nth\|first\|last)(?:\$"+ge+"((?:-\\d)?\\d)"+ge+"\$\|)(?=[^-]\|$)","i")},N=/^(?:input\|select\|texta
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 29 29 29 7b 69 66 28 63 3d 74 2c 66 3d 65 2c 31 3d 3d 3d 70 26 26 28 78 2e 74 65 73 74 28 74 29 7c 7c 6d 2e 74 65 73 74 28 74 29 29 29 7b 28 66 3d 48 2e 74 65 73 74 28 74 29 26 26 55 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 65 26 26 6c 65 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 63 65 2e 65 73 63 61 70 65 53 65 6c 65 63 74 6f 72 28 73 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 59 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 51 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 Data Ascii: ))){if(c=t,f=e,1===p&&(x.test(t)\|\|m.test(t))){(f=H.test(t)&&U(e.parentNode)\|\|e)==e&&le.scope\|\|((s=e.getAttribute("id"))?s=ce.escapeSelector(s):e.setAttribute("id",s=S)),o=(l=Y(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+Q(l[o]);c=l.join(",")}try{retu
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 6c 65 6d 65 6e 74 26 26 28 72 3d 28 54 3d 6e 29 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2c 43 3d 21 63 65 2e 69 73 58 4d 4c 44 6f 63 28 54 29 2c 69 3d 72 2e 6d 61 74 63 68 65 73 7c 7c 72 2e 77 65 62 6b 69 74 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 7c 7c 72 2e 6d 73 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 2c 72 2e 6d 73 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 26 26 79 65 21 3d 54 26 26 28 74 3d 54 2e 64 65 66 61 75 6c 74 56 69 65 77 29 26 26 74 2e 74 6f 70 21 3d 3d 74 26 26 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 75 6e 6c 6f 61 64 22 2c 4d 29 2c 6c 65 2e 67 65 74 42 79 49 64 3d 24 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 72 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 2e 69 64 3d 63 65 2e 65 78 Data Ascii: lement&&(r=(T=n).documentElement,C=!ce.isXMLDoc(T),i=r.matches\|\|r.webkitMatchesSelector\|\|r.msMatchesSelector,r.msMatchesSelector&&ye!=T&&(t=T.defaultView)&&t.top!==t&&t.addEventListener("unload",M),le.getById=$(function(e){return r.appendChild(e).id=ce.ex
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 26 26 43 29 72 65 74 75 72 6e 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 65 29 7d 2c 64 3d 5b 5d 2c 24 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 69 64 3d 27 22 2b 53 2b 22 27 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 64 69 73 61 62 6c 65 64 27 3e 3c 2f 61 3e 3c 73 65 6c 65 63 74 20 69 64 3d 27 22 2b 53 2b 22 2d 5c 72 5c 5c 27 20 64 69 73 61 62 6c 65 64 3d 27 64 69 73 61 62 6c 65 64 27 3e 3c 6f 70 74 69 6f 6e 20 73 65 6c 65 63 74 65 64 3d 27 27 3e 3c 2f 6f 70 74 69 6f 6e 3e 3c 2f 73 65 6c 65 63 74 3e 22 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 Data Ascii: ElementsByClassName&&C)return t.getElementsByClassName(e)},d=[],$(function(e){var t;r.appendChild(e).innerHTML="<a id='"+S+"' href='' disabled='disabled'></a><select id='"+S+"-\r\\' disabled='disabled'><option selected=''></option></select>",e.querySelect
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 73 53 65 6c 65 63 74 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 56 28 65 29 2c 43 26 26 21 68 5b 74 2b 22 20 22 5d 26 26 28 21 64 7c 7c 21 64 2e 74 65 73 74 28 74 29 29 29 74 72 79 7b 76 61 72 20 6e 3d 69 2e 63 61 6c 6c 28 65 2c 74 29 3b 69 66 28 6e 7c 7c 6c 65 2e 64 69 73 63 6f 6e 6e 65 63 74 65 64 4d 61 74 63 68 7c 7c 65 2e 64 6f 63 75 6d 65 6e 74 26 26 31 31 21 3d 3d 65 2e 64 6f 63 75 6d 65 6e 74 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 65 29 7b 68 28 74 2c 21 30 29 7d 72 65 74 75 72 6e 20 30 3c 49 28 74 2c 54 2c 6e 75 6c 6c 2c 5b 65 5d 29 2e 6c 65 6e 67 74 68 7d 2c 49 2e 63 6f 6e 74 61 69 6e 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e Data Ascii: sSelector=function(e,t){if(V(e),C&&!h[t+" "]&&(!d\|\|!d.test(t)))try{var n=i.call(e,t);if(n\|\|le.disconnectedMatch\|\|e.document&&11!==e.document.nodeType)return n}catch(e){h(t,!0)}return 0<I(t,T,null,[e]).length},I.contains=function(e,t){return(e.ownerDocumen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49734	104.17.25.14	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:17 UTC	571	OUT	GET /ajax/libs/jquery-migrate/3.4.1/jquery-migrate.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:17 UTC	962	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:17 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"63f822fd-1327" Last-Modified: Fri, 24 Feb 2023 02:37:49 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 161865 Expires: Wed, 05 Nov 2025 14:59:17 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FIMSxsvD36%2BQ3yspFPCh55KbbFpgZGyKgNZjzXGZFKss0t080R7OKQ0fZNNROLjBZKWwEcdgifCB3OeR6SdJM9Ve5k1J9L%2FQip2WNMvzaqIJgz5NGzvAngq1sZ%2B2XMQzcnYGaT%2FK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8e301ab02b128d2c-DFW alt-svc: h3=":443"; ma=86400
2024-11-15 14:59:17 UTC	407	IN	Data Raw: 33 35 33 34 0d 0a 2f 2a 21 20 6a 51 75 65 72 79 20 4d 69 67 72 61 74 65 20 76 33 2e 34 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 6a 51 75 65 72 79 2e 6d 69 67 72 61 74 65 4d 75 74 65 26 26 28 6a 51 75 65 72 79 2e 6d 69 67 72 61 74 65 4d 75 74 65 3d 21 30 29 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 22 6a 71 75 65 72 79 22 5d 2c 66 75 6e 63 74 69 6f Data Ascii: 3534/! jQuery Migrate v3.4.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /"undefined"==typeof jQuery.migrateMute&&(jQuery.migrateMute=!0),function(t){"use strict";"function"==typeof define&&define.amd?define(["jquery"],functio
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 22 3b 66 75 6e 63 74 69 6f 6e 20 65 28 65 29 7b 72 65 74 75 72 6e 20 30 3c 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 72 3d 2f 5e 28 5c 64 2b 29 5c 2e 28 5c 64 2b 29 5c 2e 28 5c 64 2b 29 2f 2c 6e 3d 72 2e 65 78 65 63 28 65 29 7c 7c 5b 5d 2c 6f 3d 72 2e 65 78 65 63 28 74 29 7c 7c 5b 5d 2c 61 3d 31 3b 61 3c 3d 33 3b 61 2b 2b 29 7b 69 66 28 2b 6f 5b 61 5d 3c 2b 6e 5b 61 5d 29 72 65 74 75 72 6e 20 31 3b 69 66 28 2b 6e 5b 61 5d 3c 2b 6f 5b 61 5d 29 72 65 74 75 72 6e 2d 31 7d 72 65 74 75 72 6e 20 30 7d 28 73 2e 66 6e 2e 6a 71 75 65 72 79 2c 65 29 7d 73 2e 6d 69 67 72 61 74 65 56 65 72 73 69 6f 6e 3d 22 33 2e 34 2e 31 22 3b 76 61 72 20 74 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 6e 75 6c 6c 29 3b 73 2e 6d 69 67 72 61 74 65 44 69 73 Data Ascii: ";function e(e){return 0<=function(e,t){for(var r=/^(\d+)\.(\d+)\.(\d+)/,n=r.exec(e)\|\|[],o=r.exec(t)\|\|[],a=1;a<=3;a++){if(+o[a]<+n[a])return 1;if(+n[a]<+o[a])return-1}return 0}(s.fn.jquery,e)}s.migrateVersion="3.4.1";var t=Object.create(null);s.migrateDis
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 64 65 64 22 29 3b 72 65 74 75 72 6e 20 61 28 65 2c 74 2c 72 2c 6e 2c 6f 29 2c 30 7d 66 75 6e 63 74 69 6f 6e 20 69 28 65 2c 74 2c 72 2c 6e 29 7b 72 65 74 75 72 6e 20 61 28 65 2c 74 2c 72 2c 6e 29 2c 30 7d 73 2e 6d 69 67 72 61 74 65 44 65 64 75 70 6c 69 63 61 74 65 57 61 72 6e 69 6e 67 73 3d 21 30 2c 73 2e 6d 69 67 72 61 74 65 57 61 72 6e 69 6e 67 73 3d 5b 5d 2c 76 6f 69 64 20 30 3d 3d 3d 73 2e 6d 69 67 72 61 74 65 54 72 61 63 65 26 26 28 73 2e 6d 69 67 72 61 74 65 54 72 61 63 65 3d 21 30 29 2c 73 2e 6d 69 67 72 61 74 65 52 65 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 3d 7b 7d 2c 73 2e 6d 69 67 72 61 74 65 57 61 72 6e 69 6e 67 73 2e 6c 65 6e 67 74 68 3d 30 7d 2c 22 42 61 63 6b 43 6f 6d 70 61 74 22 3d 3d 3d 6e 2e 64 6f 63 75 6d 65 6e 74 2e 63 6f 6d 70 Data Ascii: ded");return a(e,t,r,n,o),0}function i(e,t,r,n){return a(e,t,r,n),0}s.migrateDeduplicateWarnings=!0,s.migrateWarnings=[],void 0===s.migrateTrace&&(s.migrateTrace=!0),s.migrateReset=function(){o={},s.migrateWarnings.length=0},"BackCompat"===n.document.comp
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 2c 22 6a 51 75 65 72 79 2e 66 6e 2e 73 69 7a 65 28 29 20 69 73 20 64 65 70 72 65 63 61 74 65 64 20 61 6e 64 20 72 65 6d 6f 76 65 64 3b 20 75 73 65 20 74 68 65 20 2e 6c 65 6e 67 74 68 20 70 72 6f 70 65 72 74 79 22 29 2c 63 28 73 2c 22 70 61 72 73 65 4a 53 4f 4e 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4a 53 4f 4e 2e 70 61 72 73 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 61 72 67 75 6d 65 6e 74 73 29 7d 2c 22 70 61 72 73 65 4a 53 4f 4e 22 2c 22 6a 51 75 65 72 79 2e 70 61 72 73 65 4a 53 4f 4e 20 69 73 20 64 65 70 72 65 63 61 74 65 64 3b 20 75 73 65 20 4a 53 4f 4e 2e 70 61 72 73 65 22 29 2c 63 28 73 2c 22 68 6f 6c 64 52 65 61 64 79 22 2c 73 2e 68 6f 6c 64 52 65 61 64 79 2c 22 68 6f 6c 64 52 65 61 64 79 22 2c 22 6a 51 75 65 72 79 2e 68 6f 6c 64 Data Ascii: ,"jQuery.fn.size() is deprecated and removed; use the .length property"),c(s,"parseJSON",function(){return JSON.parse.apply(null,arguments)},"parseJSON","jQuery.parseJSON is deprecated; use JSON.parse"),c(s,"holdReady",s.holdReady,"holdReady","jQuery.hold
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 65 29 5d 7c 7c 22 6f 62 6a 65 63 74 22 3a 74 79 70 65 6f 66 20 65 7d 2c 22 74 79 70 65 22 2c 22 6a 51 75 65 72 79 2e 74 79 70 65 20 69 73 20 64 65 70 72 65 63 61 74 65 64 22 29 2c 63 28 73 2c 22 69 73 46 75 6e 63 74 69 6f 6e 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 7d 2c 22 69 73 46 75 6e 63 74 69 6f 6e 22 2c 22 6a 51 75 65 72 79 2e 69 73 46 75 6e 63 74 69 6f 6e 28 29 20 69 73 20 64 65 70 72 65 63 61 74 65 64 22 29 2c 63 28 73 2c 22 69 73 57 69 6e 64 6f 77 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 65 26 26 65 3d 3d 3d 65 2e 77 69 6e 64 6f 77 7d 2c 22 69 73 57 69 6e 64 6f 77 22 2c 22 6a Data Ascii: ype.toString.call(e)]\|\|"object":typeof e},"type","jQuery.type is deprecated"),c(s,"isFunction",function(e){return"function"==typeof e},"isFunction","jQuery.isFunction() is deprecated"),c(s,"isWindow",function(e){return null!=e&&e===e.window},"isWindow","j
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 2c 69 28 73 2e 66 6e 2c 22 74 6f 67 67 6c 65 43 6c 61 73 73 22 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 21 3d 3d 74 26 26 22 62 6f 6f 6c 65 61 6e 22 21 3d 74 79 70 65 6f 66 20 74 3f 62 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 3a 28 75 28 22 74 6f 67 67 6c 65 43 6c 61 73 73 2d 62 6f 6f 6c 22 2c 22 6a 51 75 65 72 79 2e 66 6e 2e 74 6f 67 67 6c 65 43 6c 61 73 73 28 20 62 6f 6f 6c 65 61 6e 20 29 20 69 73 20 64 65 70 72 65 63 61 74 65 64 22 29 2c 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 67 65 74 41 74 74 72 69 62 75 74 65 26 26 74 68 69 73 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 63 6c 61 73 73 22 29 7c 7c 22 22 3b 65 26 26 73 2e 64 61 74 61 Data Ascii: ,i(s.fn,"toggleClass",function(t){return void 0!==t&&"boolean"!=typeof t?b.apply(this,arguments):(u("toggleClass-bool","jQuery.fn.toggleClass( boolean ) is deprecated"),this.each(function(){var e=this.getAttribute&&this.getAttribute("class")\|\|"";e&&s.data
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 69 74 79 3a 21 30 2c 6f 72 64 65 72 3a 21 30 2c 6f 72 70 68 61 6e 73 3a 21 30 2c 77 69 64 6f 77 73 3a 21 30 2c 7a 49 6e 64 65 78 3a 21 30 2c 7a 6f 6f 6d 3a 21 30 7d 2c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 78 79 3f 73 2e 63 73 73 4e 75 6d 62 65 72 3d 6e 65 77 20 50 72 6f 78 79 28 41 2c 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 28 22 63 73 73 2d 6e 75 6d 62 65 72 22 2c 22 6a 51 75 65 72 79 2e 63 73 73 4e 75 6d 62 65 72 20 69 73 20 64 65 70 72 65 63 61 74 65 64 22 29 2c 52 65 66 6c 65 63 74 2e 67 65 74 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 28 22 63 73 73 2d 6e 75 6d 62 65 72 22 2c 22 6a 51 75 65 Data Ascii: ity:!0,order:!0,orphans:!0,widows:!0,zIndex:!0,zoom:!0},"undefined"!=typeof Proxy?s.cssNumber=new Proxy(A,{get:function(){return u("css-number","jQuery.cssNumber is deprecated"),Reflect.get.apply(this,arguments)},set:function(){return u("css-number","jQue
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 65 61 73 69 6e 67 2d 6f 6e 65 2d 61 72 67 22 2c 22 27 6a 51 75 65 72 79 2e 65 61 73 69 6e 67 2e 22 2b 74 68 69 73 2e 65 61 73 69 6e 67 2e 74 6f 53 74 72 69 6e 67 28 29 2b 22 27 20 73 68 6f 75 6c 64 20 75 73 65 20 6f 6e 6c 79 20 6f 6e 65 20 61 72 67 75 6d 65 6e 74 22 29 2c 73 2e 65 61 73 69 6e 67 5b 74 68 69 73 2e 65 61 73 69 6e 67 5d 3d 48 29 2c 6b 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 2c 22 65 61 73 69 6e 67 2d 6f 6e 65 2d 61 72 67 22 29 2c 53 3d 73 2e 66 78 2e 69 6e 74 65 72 76 61 6c 2c 50 3d 22 6a 51 75 65 72 79 2e 66 78 2e 69 6e 74 65 72 76 61 6c 20 69 73 20 64 65 70 72 65 63 61 74 65 64 22 2c 6e 2e 72 65 71 75 65 73 74 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 26 26 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 Data Ascii: easing-one-arg","'jQuery.easing."+this.easing.toString()+"' should use only one argument"),s.easing[this.easing]=H),k.apply(this,arguments)},"easing-one-arg"),S=s.fx.interval,P="jQuery.fx.interval is deprecated",n.requestAnimationFrame&&Object.definePrope
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 6c 6f 61 64 22 2c 22 65 72 72 6f 72 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 28 73 2e 66 6e 2c 74 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 2c 30 29 3b 72 65 74 75 72 6e 22 6c 6f 61 64 22 3d 3d 3d 74 26 26 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 5b 30 5d 3f 4d 2e 61 70 70 6c 79 28 74 68 69 73 2c 65 29 3a 28 75 28 22 73 68 6f 72 74 68 61 6e 64 2d 72 65 6d 6f 76 65 64 2d 76 33 22 2c 22 6a 51 75 65 72 79 2e 66 6e 2e 22 2b 74 2b 22 28 29 20 69 73 20 64 65 70 72 65 63 61 74 65 64 22 29 2c 65 2e 73 70 6c 69 63 65 28 30 2c 30 2c 74 29 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3f 74 68 69 73 2e 6f 6e 2e 61 70 Data Ascii: load","error"],function(e,t){i(s.fn,t,function(){var e=Array.prototype.slice.call(arguments,0);return"load"===t&&"string"==typeof e[0]?M.apply(this,e):(u("shorthand-removed-v3","jQuery.fn."+t+"() is deprecated"),e.splice(0,0,t),arguments.length?this.on.ap
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 65 64 22 29 2c 63 28 73 2e 66 6e 2c 22 68 6f 76 65 72 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6f 6e 28 22 6d 6f 75 73 65 65 6e 74 65 72 22 2c 65 29 2e 6f 6e 28 22 6d 6f 75 73 65 6c 65 61 76 65 22 2c 74 7c 7c 65 29 7d 2c 22 70 72 65 2d 6f 6e 2d 6d 65 74 68 6f 64 73 22 2c 22 6a 51 75 65 72 79 2e 66 6e 2e 68 6f 76 65 72 28 29 20 69 73 20 64 65 70 72 65 63 61 74 65 64 22 29 3b 66 75 6e 63 74 69 6f 6e 20 54 28 65 29 7b 76 61 72 20 74 3d 6e 2e 64 6f 63 75 6d 65 6e 74 2e 69 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 2e 63 72 65 61 74 65 48 54 4d 4c 44 6f 63 75 6d 65 6e 74 28 22 22 29 3b 72 65 74 75 72 6e 20 74 2e 62 6f 64 79 2e 69 6e 6e 65 72 48 54 4d 4c 3d 65 2c 74 2e 62 6f 64 79 26 26 74 2e 62 6f 64 79 2e 69 6e 6e 65 72 Data Ascii: ed"),c(s.fn,"hover",function(e,t){return this.on("mouseenter",e).on("mouseleave",t\|\|e)},"pre-on-methods","jQuery.fn.hover() is deprecated");function T(e){var t=n.document.implementation.createHTMLDocument("");return t.body.innerHTML=e,t.body&&t.body.inner

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49730	18.66.17.64	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:17 UTC	571	OUT	GET /fonts/2.2.7/css/metric.min.css HTTP/1.1 Host: d6vtbcy3ong79.cloudfront.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:17 UTC	564	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 508 Connection: close Cache-Control: public,max-age=31536000 Last-Modified: Fri, 08 Nov 2024 14:58:52 GMT Accept-Ranges: bytes X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 09 Nov 2024 12:26:14 GMT X-Cache: Hit from cloudfront Via: 1.1 581d2b2095e9ae9fc9bd8c38d2258832.cloudfront.net (CloudFront) X-Amz-Cf-Pop: VIE50-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: j7Aqq6cg5d54BWLLoaOrAaLQa7_jnp8sIlKZ9ljzw0tjSXI87JhBNg== Age: 527583
2024-11-15 14:59:17 UTC	508	IN	Data Raw: 40 63 68 61 72 73 65 74 20 22 75 74 66 2d 38 22 3b 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 4d 65 74 72 69 63 3b 73 72 63 3a 75 72 6c 28 22 2e 2e 2f 6d 65 74 72 69 63 2f 4d 65 74 72 69 63 2d 4c 69 67 68 74 2e 77 6f 66 66 32 22 29 20 66 6f 72 6d 61 74 28 22 77 6f 66 66 32 22 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 31 30 30 20 33 30 30 3b 66 6f 6e 74 2d 64 69 73 70 6c 61 79 3a 73 77 61 70 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 4d 65 74 72 69 63 3b 73 72 63 3a 75 72 6c 28 22 2e 2e 2f 6d 65 74 72 69 63 2f 4d 65 74 72 69 63 2d 52 65 67 75 6c 61 72 2e 77 6f 66 66 32 22 29 20 66 6f 72 6d 61 74 28 22 77 6f 66 66 32 22 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 66 6f 6e 74 2d 64 69 73 70 6c Data Ascii: @charset "utf-8";@font-face{font-family:Metric;src:url("../metric/Metric-Light.woff2") format("woff2");font-weight:100 300;font-display:swap}@font-face{font-family:Metric;src:url("../metric/Metric-Regular.woff2") format("woff2");font-weight:400;font-displ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49729	18.66.17.64	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:17 UTC	594	OUT	GET /fonts/2.2.7/metric/Metric-Regular.woff2 HTTP/1.1 Host: d6vtbcy3ong79.cloudfront.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.telerik.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:17 UTC	601	IN	HTTP/1.1 200 OK Content-Type: font/woff2 Content-Length: 34640 Connection: close Cache-Control: public,max-age=31536000 Last-Modified: Fri, 01 Nov 2024 13:14:48 GMT Accept-Ranges: bytes Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 02 Nov 2024 14:51:13 GMT X-Cache: Hit from cloudfront Via: 1.1 3e0d912790c2cd730e222487cbb10f98.cloudfront.net (CloudFront) X-Amz-Cf-Pop: VIE50-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: 9ChkEDLt5oars8-j9gzOtqI2ZVe64wH2F7lBEBxFBB5yVIeDx6gsjA== Age: 1123684
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 87 50 00 13 00 00 00 01 9e ac 00 00 85 af 00 01 00 83 00 00 86 18 00 00 01 38 00 00 03 3a 00 00 00 00 00 00 00 00 1b 81 90 3e 1c 96 0e 14 83 52 06 60 16 8b 60 00 8b 16 08 52 09 82 73 11 14 0a 83 f4 60 83 c7 74 12 bd 58 01 36 02 24 03 8e 1a 0b 87 1e 00 04 20 05 8e 49 07 99 02 0c 84 56 5b 4d 83 71 07 eb b6 9d ef 54 84 d4 5d 95 e0 df 70 ff b2 57 0d f3 7c b1 e3 6e 15 a9 15 98 ec 72 09 db a6 44 b7 bb 55 d5 88 f4 70 0c b3 ff ff ff ff e4 04 15 31 b6 db 7d 98 bb 7f c4 52 44 52 2b 2b 70 99 59 40 f4 d1 4b 97 92 8c c1 a9 06 25 a7 b1 8e 31 ce 14 95 7c 54 d4 67 2f 5b 2d 9c 20 90 cb f4 d7 e6 d5 b2 dd 64 d7 dc 2d 01 e6 4e 7b e2 d7 8b dd e3 a0 a9 07 8e c0 21 d9 46 5b 37 7d 49 cd d8 f2 1a 68 f7 83 d9 7c ed 01 7a 1f 4b 9c 91 9a e0 e4 c0 d2 70 Data Ascii: wOF2P8:>R``Rs`tX6$ IV[MqT]pW\|nrDUp1}RDR++pY@K%1\|Tg/[- d-N{!F[7}Ih\|zKp
2024-11-15 14:59:17 UTC	15596	IN	Data Raw: c5 3f 85 2b c5 d3 aa 69 82 27 7b f7 21 f7 b9 d8 45 b7 d3 c3 de 10 f2 95 3a ff de 1e c7 31 7d 07 fc 47 ef 86 76 d5 2e a2 f6 26 46 91 e6 f1 fe 44 07 a4 5f 66 2e 46 80 71 c6 e2 34 c7 5d 01 f2 3e 2f f5 af 90 57 2a 91 aa b8 59 3e 79 49 b1 fe f9 98 9d 95 44 95 50 82 15 d8 45 b7 bc 76 28 73 d6 84 e2 c8 24 32 d9 7c 9d bf 5e 35 06 8c ed b7 66 bb e8 89 c8 5a fa 9e bf dd 85 c0 a7 f2 32 f7 ac 2b f0 68 87 a8 63 14 f8 ad 54 07 79 c4 df 39 30 cc f9 39 cc fe 1b c3 4e d1 93 99 41 bf 93 ed c1 e4 6e 72 f0 9b 69 9f f8 78 57 b0 1f a0 fc 8c f9 24 9c 60 85 57 61 bc 4c 38 0f db e9 03 a6 af 2a 59 61 9e 1a bc fd 23 fc 81 c0 61 a8 b9 e9 19 b8 93 14 01 9d 1e 4d a1 44 d3 e9 82 ed 7e c7 70 b8 11 3f bf 11 1c ee 18 eb 68 3f f4 2f eb c2 f8 31 63 11 17 7f 39 3f 1d 49 af e4 56 36 71 20 f6 Data Ascii: ?+i'{!E:1}Gv.&FD_f.Fq4]>/WY>yIDPEv(s$2\|^5fZ2+hcTy909NAnrixW$`WaL8Ya#aMD~p?h?/1c9?IV6q
2024-11-15 14:59:17 UTC	2660	IN	Data Raw: 30 4a 3b d5 34 a8 34 d8 c2 51 91 b4 ea a6 7a c1 d2 33 25 2f c5 ad 4f 06 c9 29 e6 1c f9 7b 32 91 b3 b9 3a ac cd 13 56 eb 7f 65 90 78 ca 40 8d 40 9c 11 8a 6e 0c 32 88 86 0d 66 ea f6 7f df f2 67 55 15 75 0e 29 ce e5 83 47 7e 1a cb e8 3a d5 0b 16 b3 e0 b4 a8 22 8f 13 30 e6 dd 2c 2a 7e a4 96 f7 21 5a 75 19 e8 23 42 de 8f bc ef e0 9c 19 74 35 9c b1 7c 89 3d e7 18 e4 0f e7 4f 48 97 7f b1 78 2d 81 a1 4a f7 9e 60 d4 ca aa 23 b9 64 52 97 06 3e 51 a3 ab 5f c7 08 a7 2a 32 77 6c 67 c3 3a e7 56 af 46 c4 a4 2b b6 26 96 74 e7 c9 c9 dc 5a 59 56 2f 70 4e 53 7f fb fc fb b8 8f 99 ee 74 e9 86 57 e5 8b 09 73 47 17 9f 8a 99 7e 39 04 96 3c 6d db 20 3c 16 0a 59 db 04 0a b2 5b 32 ad e4 2e ef e1 d0 0b cc 41 16 e6 b2 dc 8e 98 7e fa 77 7d c2 f3 6d 60 32 1b 9a be e9 9f d6 a9 82 40 3c Data Ascii: 0J;44Qz3%/O){2:Vex@@n2fgUu)G~:"0,~!Zu#Bt5\|=OHx-J`#dR>Q_2wlg:VF+&tZYV/pNStWsG~9<m <Y[2.A~w}m`2@<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49728	18.66.17.64	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:17 UTC	592	OUT	GET /fonts/2.2.7/metric/Metric-Light.woff2 HTTP/1.1 Host: d6vtbcy3ong79.cloudfront.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.telerik.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:17 UTC	600	IN	HTTP/1.1 200 OK Content-Type: font/woff2 Content-Length: 34032 Connection: close Cache-Control: public,max-age=31536000 Last-Modified: Fri, 08 Nov 2024 14:58:52 GMT Accept-Ranges: bytes Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 11 Nov 2024 12:33:41 GMT X-Cache: Hit from cloudfront Via: 1.1 8fc54d3acff9539327f4d7a6bf40a31e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: VIE50-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: LduOTGQNLyaQMuKgonlg0kM_rIoJ_2aU2qGtS6uz6ja_1Y1N9UCbFg== Age: 354336
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 84 f0 00 13 00 00 00 01 99 d8 00 00 83 4a 00 01 00 83 00 00 83 b4 00 00 01 3c 00 00 03 36 00 00 00 00 00 00 00 00 1b 81 90 3e 1c 96 0e 14 83 52 06 60 16 8b 60 00 8b 16 08 52 09 82 73 11 14 0a 83 eb 20 83 be 33 12 bd 58 01 36 02 24 03 8e 1a 0b 87 1e 00 04 20 05 8e 35 07 99 02 0c 84 56 5b 78 7e 91 04 d9 6e f7 83 17 94 0a b7 0d 00 ce be fe 5a d9 e7 00 db a6 c5 cf 6e 1b 01 92 7f 1e 5d 5c 46 09 de 74 0b b9 9d 27 1a 75 bc 6f f6 ff ff ff ff 7f 76 52 19 43 db 00 69 0b a8 8a ce dd b9 fd ff 85 62 42 65 14 0f 93 da 7a 9f 64 a6 84 74 60 b6 18 20 17 02 26 ac 90 b2 e9 c1 ea e6 60 8f 70 19 56 85 e1 3e b8 44 a5 eb b6 98 d3 19 73 18 bb 87 1b 27 6f 42 d5 1a 5e 0e 48 39 10 73 32 95 f2 e8 32 d6 94 28 8a 62 8a 3b d1 bc 34 75 da 36 f5 e4 41 48 66 Data Ascii: wOF2J<6>R``Rs 3X6$ 5V[x~nZn]\Ft'uovRCibBezdt` &`pV>Ds'oB^H9s22(b;4u6AHf
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 9d b2 32 5d 8a 07 16 82 c3 a2 7d bd 4f 63 c3 81 db 41 38 c0 56 4d 1d 5b 02 97 da af b2 e1 bb 31 34 ce b8 cd 60 8a 7f c9 f6 cf e6 bb 09 b7 02 f3 a9 31 3a 37 7d 51 3d d3 c4 6c 9a 61 fc a5 a2 14 c1 2c 63 d6 fa be e0 ab 35 7c be e6 6b a0 a6 aa d5 9b 6e f4 d8 59 87 56 82 5e 10 60 06 63 ac d1 00 7b b1 67 87 1e 08 40 45 be e0 0d 6e 8f c0 73 01 1a a2 e5 e5 86 db 7e 84 ff 64 e7 18 5c 49 8a 00 7e 21 14 41 24 04 86 e2 02 09 44 04 d2 f7 3d 7f bf 6f 7c 7d be f1 f3 7f 0f 1c e0 56 5f cb 6a 8d 50 04 22 22 c8 11 19 60 46 05 b9 62 0f 7f 52 c3 bb f8 13 d0 39 ac 66 db 09 34 7e b7 b8 88 26 36 94 25 69 19 c9 7a b1 36 68 e2 2d 20 5b 98 28 6e be 96 48 55 57 a1 7d 58 dc ee d8 3c 41 2e 72 93 98 a4 6b 3f ae 25 76 bf ac 7c f6 cc 79 64 d6 ce 4c 01 dd d9 cf 80 52 f7 42 ed 38 92 d2 5e Data Ascii: 2]}OcA8VM[14`1:7}Q=la,c5\|knYV^`c{g@Ens~d\I~!A$D=o\|}V_jP""`FbR9f4~&6%iz6h- [(nHUW}X<A.rk?%v\|ydLRB8^
2024-11-15 14:59:17 UTC	1264	IN	Data Raw: 72 8e 75 20 b6 80 d5 72 3b 02 4e bd ef 35 69 0d a8 6e 8e 02 d2 a6 49 0c 63 b6 0d a0 ea 30 18 8b a8 33 6e 29 57 c5 aa 34 ea 33 ea a2 c9 aa 75 a8 7e d5 92 56 59 db b6 bc 57 cd 49 16 40 3b b4 cd 56 d7 ae db 61 8f 1a 26 c0 04 f9 56 6b d5 67 2e 65 8e ed 01 25 1a 93 0a af 3b cc b5 dd 9d e3 01 45 32 f2 ef ec 78 90 6b 0b fe 98 e3 d8 d3 09 06 87 7d cf c9 61 12 4a 2e 98 12 19 7b e6 44 3c b9 09 e4 d0 0b a8 77 41 91 fc 46 66 9f 97 72 f1 f6 4d 4a 7f bd f8 f7 c6 30 df aa 96 85 2b 0f 77 e8 7c d7 0d a8 61 af 2c fd bf 5c b4 57 18 5f 84 a4 df 11 94 cc 43 b4 92 ee 06 36 dd 50 67 bb e5 3e 9c 4c 3a 8d 5a fb 21 e2 7a 9b fa d8 b3 ab 0a 0a 19 fb 8e d8 b0 2d 52 b6 3b 2c 76 cb 7c 07 0c c1 8a 73 af 06 af d9 4d 3e ea 30 b7 63 ac 4d 85 36 88 6e e4 4e 33 b3 a3 d8 02 50 11 c1 a6 7e 51 Data Ascii: ru r;N5inIc03n)W43u~VYWI@;Va&Vkg.e%;E2xk}aJ.{D<wAFfrMJ0+w\|a,\W_C6Pg>L:Z!z-R;,v\|sM>0cM6nN3P~Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49725	18.66.17.64	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:17 UTC	584	OUT	GET /telerik-navigation/3.5.50/css/index.min.css HTTP/1.1 Host: d6vtbcy3ong79.cloudfront.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:17 UTC	590	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 32694 Connection: close Cache-Control: public,max-age=31536000 Last-Modified: Tue, 22 Oct 2024 10:21:58 GMT Accept-Ranges: bytes X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 27 Oct 2024 03:07:00 GMT Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 62f2a061e41be90ceddd231b5157117c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: VIE50-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: Dffuj81NcXE2K3wqhVFr4vd_DPvPbXXuay50fYcHOyo1DVsm7_9k1w== Age: 1684337
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 2e 54 4b 2d 41 73 69 64 65 3a 61 66 74 65 72 2c 2e 54 4b 2d 44 72 61 77 65 72 3a 61 66 74 65 72 2c 2e 54 4b 2d 48 61 74 2d 41 73 69 64 65 3a 61 66 74 65 72 2c 2e 54 4b 2d 63 6f 6e 74 61 69 6e 65 72 3a 61 66 74 65 72 2c 2e 54 4b 2d 72 6f 77 3a 61 66 74 65 72 7b 63 6c 65 61 72 3a 62 6f 74 68 3b 63 6f 6e 74 65 6e 74 3a 22 22 3b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 7d 2e 54 4b 2d 4e 61 76 2d 2d 46 6c 75 69 64 20 2e 54 4b 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 7d 2e 54 4b 2d 63 6f 6e 74 61 69 6e 65 72 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 61 75 74 6f 3b 6d 61 72 67 69 Data Ascii: .TK-Aside:after,.TK-Drawer:after,.TK-Hat-Aside:after,.TK-container:after,.TK-row:after{clear:both;content:"";display:table}.TK-Nav--Fluid .TK-container{max-width:none}.TK-container{-webkit-box-sizing:border-box;box-sizing:border-box;margin-left:auto;margi
2024-11-15 14:59:17 UTC	16310	IN	Data Raw: 66 3b 70 61 64 64 69 6e 67 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 75 70 70 65 72 63 61 73 65 7d 2e 54 4b 2d 4d 65 6e 75 2d 49 74 65 6d 2d 42 75 74 74 6f 6e 3a 66 6f 63 75 73 2c 2e 54 4b 2d 4d 65 6e 75 2d 49 74 65 6d 2d 42 75 74 74 6f 6e 3a 68 6f 76 65 72 2c 2e 54 4b 2d 4d 65 6e 75 2d 49 74 65 6d 2d 4c 69 6e 6b 3a 66 6f 63 75 73 2c 2e 54 4b 2d 4d 65 6e 75 2d 49 74 65 6d 2d 4c 69 6e 6b 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 30 30 30 7d 2e 54 4b 2d 50 72 6f 64 75 63 74 73 2d 4d 65 6e 75 2d 49 74 65 6d 2d 42 75 74 74 6f 6e 2c 2e 54 4b 2d 50 72 6f 64 75 63 74 73 2d 4d 65 6e 75 2d 49 74 65 6d 2d 4c 69 6e 6b 7b 63 6f 6c 6f 72 3a 23 30 30 30 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 66 6f Data Ascii: f;padding:0;position:relative;text-transform:uppercase}.TK-Menu-Item-Button:focus,.TK-Menu-Item-Button:hover,.TK-Menu-Item-Link:focus,.TK-Menu-Item-Link:hover{color:#000}.TK-Products-Menu-Item-Button,.TK-Products-Menu-Item-Link{color:#000;display:block;fo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49731	18.66.17.64	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:17 UTC	595	OUT	GET /fonts/2.2.7/metric/Metric-Semibold.woff2 HTTP/1.1 Host: d6vtbcy3ong79.cloudfront.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.telerik.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:17 UTC	600	IN	HTTP/1.1 200 OK Content-Type: font/woff2 Content-Length: 35758 Connection: close Cache-Control: public,max-age=31536000 Last-Modified: Fri, 08 Nov 2024 14:58:52 GMT Accept-Ranges: bytes Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 11 Nov 2024 18:50:20 GMT X-Cache: Hit from cloudfront Via: 1.1 92835d2f5794bba6bff3a83645bbf4c4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: VIE50-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: h4gE_rYtWFnLQWQ1xL9EdoQ1nCYLpvVDzrXlh8Q9pN-8cA7-WplZyQ== Age: 331737
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 8b ae 00 13 00 00 00 01 af 60 00 00 8a 06 00 01 00 83 00 00 8a 70 00 00 01 3e 00 00 03 3c 00 00 00 00 00 00 00 00 1b 81 94 5e 1c 95 3c 14 83 59 06 60 16 8b 60 00 8b 2c 08 46 09 82 73 11 14 0a 84 90 68 83 e3 59 12 be 60 01 36 02 24 03 8e 36 0b 87 2c 00 04 20 05 8e 53 07 99 6d 0c 84 01 5b d5 93 91 04 ad 0d 3d 2d e9 09 36 06 d3 9b 55 3d ec ec f8 f5 00 07 d0 db f6 20 f4 66 49 f8 5c 37 7f e7 5b c2 b6 59 78 ec 76 d8 b4 cf 2d ef ca fe ff ff ff ff 5f 91 54 64 cc a6 1d 69 b7 0d d0 21 fe 2a 8a fa fb 0b a9 79 48 a6 84 44 81 da 20 62 14 4e b3 4c 41 39 54 0a 03 1d a9 f1 28 5d f1 a5 6b 14 6a a7 35 20 78 8e 99 f1 d5 c6 ef 52 c8 8b 10 7d ba de 5c 82 bc 72 02 46 1d b7 19 ea 4d bb 5f 02 33 d2 3e 71 00 5d 36 9b 8b 6b 14 6a 04 4f bc 1e 3b 15 a7 Data Ascii: wOF2`p><^<Y``,FshY`6$6, Sm[=-6U= fI\7[Yxv-_Tdi!*yHD bNLA9T(]kj5 xR}\rFM_3>q]6kjO;
2024-11-15 14:59:17 UTC	10463	IN	Data Raw: 00 41 5d 61 71 2e 7e 45 94 8b c8 97 55 f7 d9 8a 6d 8b 3a 90 1f a4 ef eb cf 1e 8f 67 35 ad 4f 6a d2 f6 8f 27 29 64 1d 7a 70 bc e8 f7 df 8b ac ad 85 a5 4b c9 b8 f3 fc 0b 31 2f 61 c5 60 84 07 da 6f e1 48 df 2a fc 52 e5 e0 f8 2a 50 35 0e 6d 6a 7b fb f2 fc 32 e6 c7 30 5f 1d 2f cd c0 0e 07 a0 d7 61 33 a4 93 20 8b bf 67 fd 84 e8 09 14 39 d6 db 60 1a 88 b7 81 38 1b de e2 f6 00 60 fa 58 f0 f5 20 ae 1e 8f b7 a5 64 3d 74 0f a7 68 30 8d 4b 9a 8a 64 4d 4c 69 53 61 7c 93 35 1b 1c 36 78 e1 bd 59 66 d0 14 d3 d4 b2 59 94 fa 1d 56 11 68 53 11 ba b4 54 65 e0 eb eb ae 2f 94 90 df 94 66 4a fe 80 b6 2b 61 b9 67 bb a7 a7 6f b1 bf eb bf 24 f1 55 16 7b e9 e9 a7 e8 6a 8e 7d 03 b7 d2 e9 1b 61 78 23 9d de ba d3 3b d9 d7 37 d7 db 3b d6 d7 37 d9 52 19 6d 59 af b0 2c fa 7a b9 4a ee 4a Data Ascii: A]aq.~EUm:g5Oj')dzpK1/a`oHRP5mj{20_/a3 g9`8`X d=th0KdMLiSa\|56xYfYVhSTe/fJ+ago$U{j}ax#;7;7RmY,zJJ
2024-11-15 14:59:17 UTC	8911	IN	Data Raw: 1e 36 69 65 3d f8 cb 58 85 da bc 5c d5 ce 6a 01 90 ca 55 57 8f 21 86 dd a0 ae f4 be 88 0c df 44 15 a7 04 09 a8 0c b2 28 b7 d9 d5 1a 56 c6 77 21 9c 8c 1e 73 92 03 04 2f 4b 52 ae 86 61 63 9f 12 a6 39 f8 2e c1 8f 7e 29 d9 89 64 f3 57 de 5f d3 fc 08 e3 57 dc 41 f7 24 b0 0c 4f da 5b da b0 4d bb 95 10 32 3d fd 1d a7 0c 25 28 33 66 35 5b 75 d7 4c dd a0 3f ba 4d 2b 82 01 af 0d 09 5f 0d 50 5d 51 d4 0d 3f 03 28 5c 3b 76 94 59 6c ba d0 94 05 55 d4 95 34 5b 17 57 1d 9e 81 f4 22 8a ab 29 02 95 c3 da 1d 0e 34 f5 a0 86 dc 8a d6 9f cb b5 2c 89 48 cf 9b 2d 95 5b fe 8a be 55 a9 5c 7a 16 1b 89 cb f9 0c 67 7c c6 67 b7 3e cb d0 41 15 aa 0c e6 9b 0b f3 39 a9 a6 29 9f 27 e6 35 ef 95 26 72 4c 6a ea b9 eb 55 50 71 9a da 09 83 b5 0b 76 dc 9b 2c cd 61 d6 4d 59 88 8c 92 5c 24 e8 ae Data Ascii: 6ie=X\jUW!D(Vw!s/KRac9.~)dW_WA$O[M2=%(3f5[uL?M+_P]Q?(\;vYlU4[W")4,H-[U\zg\|g>A9)'5&rLjUPqv,aMY\$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49727	18.66.17.64	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:17 UTC	593	OUT	GET /fonts/2.2.7/metric/Metric-Medium.woff2 HTTP/1.1 Host: d6vtbcy3ong79.cloudfront.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.telerik.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:17 UTC	601	IN	HTTP/1.1 200 OK Content-Type: font/woff2 Content-Length: 32412 Connection: close Cache-Control: public,max-age=31536000 Last-Modified: Fri, 01 Nov 2024 13:14:48 GMT Accept-Ranges: bytes Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 02 Nov 2024 14:51:12 GMT X-Cache: Hit from cloudfront Via: 1.1 8fc54d3acff9539327f4d7a6bf40a31e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: VIE50-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: z0Hz2Dw9vYuxJPilh11rvbfj-LruVOnn-Zzmzd3_gdMpUEN9tsY8ZQ== Age: 1123685
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 7e 9c 00 13 00 00 00 01 6a 58 00 00 7c fb 00 01 00 83 00 00 7d 64 00 00 01 38 00 00 03 38 00 00 00 00 00 00 00 00 1b 81 8a 24 1c 96 0e 14 83 5b 06 60 16 8b 60 00 8b 36 08 34 09 82 73 11 10 0a 83 91 64 82 e5 08 12 bf 24 01 36 02 24 03 8e 3e 0b 87 30 00 04 20 05 8e 3f 07 99 58 0c 82 4f 5b 03 4f 91 02 d9 6e b7 de 37 48 15 ce 13 c0 66 cd 2a fd f0 25 78 f3 c4 a4 ee 7a f9 0d f0 ed 85 41 01 c7 e1 41 77 00 7b 4a de 7b b3 c5 ff ff ff ff 9f 9d 54 64 cc 26 1b c9 c6 00 10 c0 83 aa ff e5 b2 a1 a8 f6 b5 e1 a0 b0 70 18 a3 b4 36 85 a0 f1 51 cc a5 ce b1 40 8d 31 6e 0b b6 b8 e1 0a 2b 1d 46 ee ec db 2a b6 6d 54 a2 2d 83 b8 72 ec 47 cc 39 8e 6c 35 ed b8 ff e0 d2 a0 9c 71 8f 02 45 31 94 e4 bb a8 94 ed 7a 84 04 5a 1a 9c aa 51 62 88 0b 4d 2d 15 62 Data Ascii: wOF2~jX\|}d88$[``64sd$6$>0 ?XO[On7Hf%xzAAw{J{Td&p6Q@1n+FmT-rG9l5qE1zZQbM-b
2024-11-15 14:59:17 UTC	1514	IN	Data Raw: 14 e1 f3 8a db bd 16 fc 7d 27 f9 3d 8c 4c f1 85 64 3f b0 02 43 ac 1e 64 43 7c 29 64 d8 fa cf e3 f6 56 69 56 f3 cf e5 c3 56 11 56 c9 f2 e4 9f 38 9e f7 86 e5 cf 4f d1 48 b5 da 0e 69 fd 91 91 de 5c 7e 7f 47 f8 5a d4 f3 69 cd 08 b3 02 f0 eb f4 92 64 d3 ce 01 b9 2c 60 e7 11 7a 70 7b 88 d0 29 08 bc 24 f2 ef 64 43 7d 46 08 97 20 23 be ea 86 ac 0c a7 bf f7 23 70 07 74 0f 7b 74 ea df ca 07 69 6d f4 ca d1 67 06 c8 e3 7a 3b 91 5f d9 66 5c 7d 52 57 3f 75 92 30 fb a7 67 22 b4 d7 c8 03 9f 49 2a 1b 93 ca 64 8c 0c 5d e6 d3 d5 eb cc ed 87 9e f1 bf 51 dd b9 e4 b4 31 9b 35 ea ca b4 c1 b2 07 eb 76 54 6c fa d9 d5 53 b7 30 fc ed 5f bf 69 15 5f 79 ed 13 cd 1b 66 5d f9 1d 0c fe 5e 69 0d f3 a6 7d ba 56 59 35 23 99 49 53 76 07 3d 09 62 97 7f 24 cc 41 70 04 bc 31 f3 3d 11 36 2e b3 Data Ascii: }'=Ld?CdC\|)dViVVV8OHi\~GZid,`zp{)$dC}F ##pt{timgz;_f\}RW?u0g"I*d]Q15vTlS0_i_yf]^i}VY5#ISv=b$Ap1=6.
2024-11-15 14:59:17 UTC	14514	IN	Data Raw: 84 b1 53 41 2c 55 8c 34 cd d9 75 cf c2 88 98 7d 5e d9 1b 8c 27 f9 1a 1a 01 41 bc ed f9 54 ac b9 18 18 d8 19 7d 17 0b 4d 09 22 d5 50 01 58 75 02 07 0a c7 bc 3d ec e6 1e 03 30 29 f4 92 62 98 ef 82 25 a8 3b b0 d9 25 e3 87 ad ed e4 c6 8f ff 97 d8 b7 c2 6c ab 3a 0a 69 c2 8c f9 a5 8c 97 79 fb 0f 87 4f 0e ad f2 58 79 3f 90 f0 be c1 45 c4 27 0f b6 43 30 f3 7a c3 e4 10 23 8f df 6a 3e 8d 3f d2 4a ec ca 36 2d 0c e5 4a 26 68 cf 9f 12 4c 95 3c 81 65 a4 85 d9 c1 36 60 5e 5e aa de f9 1d b6 d9 d1 d4 78 97 fd 0a 78 1c 36 3f e2 cc 25 23 89 de 51 d4 ff 75 c7 d1 33 88 bf f2 a6 c0 57 00 d8 73 65 7b ff 04 b0 e7 5e c9 2f 5c ff 90 cb ae 47 0f 99 7e fb ed 9c d8 47 dd dc df e7 3e 2f 7f ed cf e5 eb 8f 6e f8 a4 ef d7 a9 7f 00 70 e9 b5 d6 c5 8d c8 60 ad 95 31 75 e4 c0 5c 63 c3 28 ae Data Ascii: SA,U4u}^'AT}M"PXu=0)b%;%l:iyOXy?E'C0z#j>?J6-J&hL<e6`^^xx6?%#Qu3Wse{^/\G~G>/np`1u\c(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49726	18.66.17.64	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:17 UTC	599	OUT	GET /telerik-navigation/3.5.50/js/index.min.mjs HTTP/1.1 Host: d6vtbcy3ong79.cloudfront.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.telerik.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:17 UTC	643	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 16055 Connection: close Cache-Control: public,max-age=31536000 Last-Modified: Fri, 01 Nov 2024 13:14:48 GMT Accept-Ranges: bytes Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 03 Nov 2024 20:03:08 GMT Vary: Origin,Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 8fc54d3acff9539327f4d7a6bf40a31e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: VIE50-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: Rqv59yyTbu1oTYj4Dd6lrqA1BjhJk4sGMFq3YO8j4M6FGoqwt4KfaA== Age: 1018569
2024-11-15 14:59:17 UTC	15741	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 63 6f 6e 73 74 20 74 3d 7b 61 63 74 69 76 65 43 6c 61 73 73 3a 22 54 4b 2d 4e 61 76 2d 4f 76 65 72 6c 61 79 2d 2d 41 63 74 69 76 65 22 7d 3b 63 6c 61 73 73 20 65 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 2c 6e 29 7b 74 68 69 73 2e 6f 70 74 69 6f 6e 73 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 7b 7d 2c 74 2c 6e 29 2c 74 68 69 73 2e 65 6c 65 6d 65 6e 74 3d 65 2c 74 68 69 73 2e 61 63 74 69 76 65 43 6c 61 73 73 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 61 63 74 69 76 65 43 6c 61 73 73 2c 74 68 69 73 2e 68 69 64 64 65 6e 3d 21 30 7d 73 68 6f 77 28 29 7b 74 68 69 73 2e 68 69 64 64 65 6e 26 26 74 68 69 73 2e 65 6c 65 6d 65 6e 74 26 26 28 74 68 69 73 2e 65 6c 65 6d 65 6e 74 2e 63 6c 61 Data Ascii: !function(){"use strict";const t={activeClass:"TK-Nav-Overlay--Active"};class e{constructor(e,n){this.options=Object.assign({},t,n),this.element=e,this.activeClass=this.options.activeClass,this.hidden=!0}show(){this.hidden&&this.element&&(this.element.cla
2024-11-15 14:59:17 UTC	314	IN	Data Raw: 2c 62 72 65 61 6b 70 6f 69 6e 74 3a 31 32 34 30 7d 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 63 6f 6e 73 74 20 74 3d 45 28 22 23 6a 73 2d 74 6c 72 6b 2d 73 6b 69 70 2d 6c 69 6e 6b 22 29 2c 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 65 2e 63 6c 61 73 73 4c 69 73 74 2e 61 64 64 28 22 54 4b 2d 4e 61 76 2d 53 6b 69 70 70 65 72 22 29 2c 65 2e 74 61 62 49 6e 64 65 78 3d 30 2c 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 63 6c 69 63 6b 22 2c 28 6e 3d 3e 7b 4c 2e 61 66 74 65 72 28 65 29 2c 74 2e 62 6c 75 72 28 29 2c 65 2e 66 6f 63 75 73 28 29 2c 65 2e 72 65 6d 6f 76 65 28 29 2c 6e 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 7d 29 29 7d 28 29 2c 77 69 6e 64 6f 77 2e 54 4c 52 4b 5f 4e 41 56 5f Data Ascii: ,breakpoint:1240}),function(){const t=E("#js-tlrk-skip-link"),e=document.createElement("div");e.classList.add("TK-Nav-Skipper"),e.tabIndex=0,t.addEventListener("click",(n=>{L.after(e),t.blur(),e.focus(),e.remove(),n.preventDefault()}))}(),window.TLRK_NAV_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49733	104.18.86.42	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:17 UTC	573	OUT	GET /consent/3dfce4f2-dab6-4128-9f33-df7e0597da82/otSDKStub.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:17 UTC	988	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:17 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8e301ab02a1a6c0e-DFW CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 68737 Cache-Control: public, max-age=86400 Expires: Sat, 16 Nov 2024 14:59:17 GMT Last-Modified: Tue, 25 Jun 2024 13:14:54 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: 1C7BuQ3LGAlBcdxyvs3Sgw== Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 0db46d73-d01e-004a-774c-26a3ed000000 x-ms-version: 2009-09-19 Cross-Origin-Resource-Policy: cross-origin Server: cloudflare
2024-11-15 14:59:17 UTC	381	IN	Data Raw: 35 31 35 36 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 77 29 7b 66 75 6e 63 74 69 6f 6e 20 78 28 29 7b 76 61 72 20 61 3d 74 68 69 73 3b 74 68 69 73 2e 69 6d 70 6c 65 6d 65 6e 74 54 68 65 50 6f 6c 79 66 69 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 3d 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 3b 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 69 66 28 22 73 74 79 6c 65 22 21 3d 3d 63 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 26 26 62 2e 61 70 70 6c 79 28 74 68 69 73 2c 5b 63 2c 64 5d 29 2c 22 73 74 79 6c 65 22 21 3d 3d 63 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7c 7c 64 7c 7c 74 68 69 73 2e 72 65 6d 6f 76 65 41 74 Data Ascii: 5156(function(w){function x(){var a=this;this.implementThePolyfill=function(){var b=Element.prototype.setAttribute;Element.prototype.setAttribute=function(c,d){if("style"!==c.toLowerCase()&&b.apply(this,[c,d]),"style"!==c.toLowerCase()\|\|d\|\|this.removeAt
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 66 5d 7d 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 41 28 61 2c 62 2c 63 29 7b 66 75 6e 63 74 69 6f 6e 20 64 28 6c 29 7b 72 65 74 75 72 6e 20 6c 3f 28 22 3b 22 21 3d 3d 28 6c 3d 6c 2e 74 72 69 6d 28 29 29 2e 63 68 61 72 41 74 28 6c 2e 6c 65 6e 67 74 68 2d 31 29 26 26 28 6c 2b 3d 22 3b 22 29 2c 6c 2e 74 72 69 6d 28 29 29 3a 6e 75 6c 6c 7d 76 6f 69 64 20 30 3d 3d 3d 63 26 26 28 63 3d 0a 21 31 29 3b 76 61 72 20 66 3d 64 28 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 73 74 79 6c 65 22 29 29 2c 67 3d 64 28 62 29 3b 62 3d 22 22 3b 62 3d 63 26 26 66 3f 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 6c 3d 66 2e 73 70 6c 69 74 28 22 3b 22 29 2e 63 6f 6e 63 61 74 28 67 2e 73 70 6c 69 74 28 22 3b 22 29 29 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 42 Data Ascii: f]}}}}function A(a,b,c){function d(l){return l?(";"!==(l=l.trim()).charAt(l.length-1)&&(l+=";"),l.trim()):null}void 0===c&&(c=!1);var f=d(a.getAttribute("style")),g=d(b);b="";b=c&&f?function(){for(var l=f.split(";").concat(g.split(";")).filter(function(B
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 6c 61 74 65 73 2f 22 2b 65 2e 73 74 75 62 46 69 6c 65 4e 61 6d 65 2b 22 2e 6a 73 22 29 2c 65 2e 73 74 6f 72 61 67 65 42 61 73 65 55 52 4c 2b 22 2f 73 63 72 69 70 74 74 65 6d 70 6c 61 74 65 73 2f 6f 6c 64 2f 73 63 72 69 70 74 74 65 6d 70 6c 61 74 65 73 2f 35 2e 31 31 2e 30 2f 22 2b 65 2e 62 61 6e 6e 65 72 53 63 72 69 70 74 4e 61 6d 65 29 3a 28 65 2e 69 73 4d 69 67 72 61 74 65 64 55 52 4c 26 26 28 64 2e 73 72 63 3d 65 2e 73 74 6f 72 61 67 65 42 61 73 65 55 52 4c 2b 22 2f 73 63 72 69 70 74 74 65 6d 70 6c 61 74 65 73 2f 22 2b 65 2e 73 74 75 62 46 69 6c 65 4e 61 6d 65 2b 22 2e 6a 73 22 29 2c 65 2e 73 74 6f 72 61 67 65 42 61 73 65 55 52 4c 2b 22 2f 73 63 72 69 70 74 74 65 6d 70 6c 61 74 65 73 2f 22 2b 62 2e 56 65 72 73 69 6f 6e 2b 22 2f 22 2b 65 2e 62 61 6e 6e Data Ascii: lates/"+e.stubFileName+".js"),e.storageBaseURL+"/scripttemplates/old/scripttemplates/5.11.0/"+e.bannerScriptName):(e.isMigratedURL&&(d.src=e.storageBaseURL+"/scripttemplates/"+e.stubFileName+".js"),e.storageBaseURL+"/scripttemplates/"+b.Version+"/"+e.bann
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 69 76 65 4f 54 4d 65 73 73 61 67 65 2c 21 31 29 7d 3b 74 68 69 73 2e 61 64 64 49 61 62 46 72 61 6d 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 3d 77 69 6e 64 6f 77 3b 21 62 2e 66 72 61 6d 65 73 2e 5f 5f 74 63 66 61 70 69 4c 6f 63 61 74 6f 72 26 26 0a 28 62 2e 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3f 61 2e 61 64 64 4c 6f 63 61 74 6f 72 28 22 43 4d 50 22 29 3a 73 65 74 54 69 6d 65 6f 75 74 28 61 2e 61 64 64 49 61 62 46 72 61 6d 65 2c 35 29 29 7d 3b 74 68 69 73 2e 61 64 64 42 61 63 6b 77 61 72 64 49 61 62 46 72 61 6d 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 3d 77 69 6e 64 6f 77 3b 21 62 2e 66 72 61 6d 65 73 2e 5f 5f 74 63 66 61 70 69 4c 6f 63 61 74 6f 72 26 26 28 62 2e 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3f 61 2e 61 64 64 4c 6f 63 Data Ascii: iveOTMessage,!1)};this.addIabFrame=function(){var b=window;!b.frames.__tcfapiLocator&&(b.document.body?a.addLocator("CMP"):setTimeout(a.addIabFrame,5))};this.addBackwardIabFrame=function(){var b=window;!b.frames.__tcfapiLocator&&(b.document.body?a.addLoc
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 70 69 2e 61 3d 67 2e 5f 5f 74 63 66 61 70 69 2e 61 7c 7c 5b 5d 3b 67 2e 5f 5f 74 63 66 61 70 69 2e 61 2e 70 75 73 68 28 5b 62 2c 63 2c 64 2c 66 5d 29 7d 3b 74 68 69 73 2e 67 65 74 50 69 6e 67 52 65 71 75 65 73 74 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 2c 64 3b 76 6f 69 64 20 30 3d 3d 3d 63 26 26 28 63 3d 21 31 29 3b 62 26 26 28 64 3d 21 28 63 3d 7b 7d 29 2c 22 49 41 42 32 22 21 3d 3d 61 2e 69 61 62 54 79 70 65 26 26 22 49 41 42 32 56 32 22 21 3d 3d 61 2e 69 61 62 54 79 70 65 7c 7c 28 63 3d 7b 67 64 70 72 41 70 70 6c 69 65 73 3a 65 2e 6f 6e 65 54 72 75 73 74 49 41 42 67 64 70 72 41 70 70 6c 69 65 73 47 6c 6f 62 61 6c 6c 79 2c 63 6d 70 4c 6f 61 64 65 64 3a 21 31 2c 63 6d 70 53 74 61 74 75 73 3a 22 73 74 75 62 22 2c 0a 64 69 73 70 6c 61 79 53 Data Ascii: pi.a=g.__tcfapi.a\|\|[];g.__tcfapi.a.push([b,c,d,f])};this.getPingRequest=function(b){var c,d;void 0===c&&(c=!1);b&&(d=!(c={}),"IAB2"!==a.iabType&&"IAB2V2"!==a.iabType\|\|(c={gdprApplies:e.oneTrustIABgdprAppliesGlobally,cmpLoaded:!1,cmpStatus:"stub",displayS
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 68 2e 43 43 50 41 3d 22 75 73 63 61 76 31 22 3b 68 2e 43 44 50 41 3d 22 75 73 76 61 76 31 22 3b 68 2e 55 53 4e 41 54 49 4f 4e 41 4c 3d 22 75 73 6e 61 74 76 31 22 3b 68 2e 43 4f 4c 4f 52 41 44 4f 3d 22 75 73 63 6f 76 31 22 3b 68 2e 43 54 44 50 41 3d 22 75 73 63 74 76 31 22 3b 68 2e 55 43 50 41 3d 22 75 73 75 74 76 31 22 3b 68 2e 49 41 42 32 56 32 3d 22 74 63 66 65 75 76 32 22 3b 28 68 3d 76 3d 76 7c 7c 7b 7d 29 5b 68 2e 43 50 52 41 3d 38 5d 3d 22 43 50 52 41 22 3b 68 5b 68 2e 43 43 50 41 3d 38 5d 3d 22 43 43 50 41 22 3b 68 5b 68 2e 43 44 50 41 3d 39 5d 3d 22 43 44 50 41 22 3b 68 5b 68 2e 55 53 4e 41 54 49 4f 4e 41 4c 3d 37 5d 3d 22 55 53 4e 41 54 49 4f 4e 41 4c 22 3b 68 5b 68 2e 43 4f 4c 4f 52 41 44 4f 3d 31 30 5d 3d 22 43 4f 4c 4f 52 41 44 4f 22 3b 68 5b Data Ascii: h.CCPA="uscav1";h.CDPA="usvav1";h.USNATIONAL="usnatv1";h.COLORADO="uscov1";h.CTDPA="usctv1";h.UCPA="usutv1";h.IAB2V2="tcfeuv2";(h=v=v\|\|{})[h.CPRA=8]="CPRA";h[h.CCPA=8]="CCPA";h[h.CDPA=9]="CDPA";h[h.USNATIONAL=7]="USNATIONAL";h[h.COLORADO=10]="COLORADO";h[
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 54 4f 52 5f 4e 41 4d 45 29 29 7d 3b 74 68 69 73 2e 72 65 6d 6f 76 65 47 70 70 41 70 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 64 65 6c 65 74 65 20 61 2e 77 69 6e 2e 5f 5f 67 70 70 3b 0a 76 61 72 20 62 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 69 66 72 61 6d 65 5b 6e 61 6d 65 5c 78 33 64 22 2b 61 2e 4c 4f 43 41 54 4f 52 5f 4e 41 4d 45 2b 22 5d 22 29 5b 30 5d 3b 62 26 26 62 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 62 29 7d 3b 74 68 69 73 2e 65 78 65 63 75 74 65 47 70 70 41 70 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 62 3d 5b 5d 2c 63 3d 30 3b 63 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 62 5b 63 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 63 Data Ascii: TOR_NAME))};this.removeGppApi=function(){delete a.win.__gpp;var b=document.querySelectorAll("iframe[name\x3d"+a.LOCATOR_NAME+"]")[0];b&&b.parentElement.removeChild(b)};this.executeGppApi=function(){for(var b=[],c=0;c<arguments.length;c++)b[c]=arguments[c
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 6e 61 6d 65 3d 62 2c 63 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 69 74 6c 65 22 2c 22 47 50 50 20 4c 6f 63 61 74 6f 72 22 29 2c 64 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 29 29 3a 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 61 2e 61 64 64 46 72 61 6d 65 28 62 29 7d 2c 35 29 29 7d 3b 74 68 69 73 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 61 2e 77 69 6e 2e 5f 5f 67 70 70 3b 72 65 74 75 72 6e 20 64 2e 65 76 65 6e 74 73 3d 64 2e 65 76 65 6e 74 73 7c 7c 5b 5d 2c 6e 75 6c 6c 21 3d 64 26 26 64 2e 6c 61 73 74 49 64 7c 7c 28 64 2e 6c 61 73 74 49 64 3d 30 29 2c 64 2e 6c 61 73 74 49 64 2b 2b 2c 0a 64 2e 65 76 65 6e 74 73 2e 70 75 73 68 28 7b 69 64 3a Data Ascii: name=b,c.setAttribute("title","GPP Locator"),d.body.appendChild(c)):setTimeout(function(){a.addFrame(b)},5))};this.addEventListener=function(b,c){var d=a.win.__gpp;return d.events=d.events\|\|[],null!=d&&d.lastId\|\|(d.lastId=0),d.lastId++,d.events.push({id:
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6e 6f 6e 63 65 3d 65 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 6e 6f 6e 63 65 7c 7c 65 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 6e 6f 6e 63 65 22 29 7c 7c 6e 75 6c 6c 7d 2c 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 66 65 74 63 68 42 61 6e 6e 65 72 53 44 4b 44 65 70 65 6e 64 65 6e 63 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 73 65 74 44 6f 6d 61 69 6e 44 61 74 61 46 69 6c 65 55 52 4c 28 29 3b 74 68 69 73 2e 63 72 6f 73 73 4f 72 69 67 69 6e 3d 65 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 63 72 6f 73 73 6f 72 69 67 69 6e 22 29 7c 7c 6e 75 6c 6c 3b 74 68 69 73 2e 70 72 65 76 69 65 Data Ascii: unction(){this.nonce=e.stubScriptElement.nonce\|\|e.stubScriptElement.getAttribute("nonce")\|\|null},k.prototype.fetchBannerSDKDependency=function(){this.setDomainDataFileURL();this.crossOrigin=e.stubScriptElement.getAttribute("crossorigin")\|\|null;this.previe
2024-11-15 14:59:17 UTC	1369	IN	Data Raw: 6e 73 65 2c 74 68 69 73 2e 73 65 74 47 65 6f 4c 6f 63 61 74 69 6f 6e 28 63 2e 63 6f 75 6e 74 72 79 43 6f 64 65 2c 0a 63 2e 73 74 61 74 65 43 6f 64 65 29 2c 74 68 69 73 2e 61 64 64 42 61 6e 6e 65 72 53 44 4b 53 63 72 69 70 74 28 61 29 29 3a 28 63 3d 74 68 69 73 2e 72 65 61 64 43 6f 6f 6b 69 65 50 61 72 61 6d 28 65 2e 6f 70 74 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 2c 65 2e 67 65 6f 6c 6f 63 61 74 69 6f 6e 43 6f 6f 6b 69 65 73 50 61 72 61 6d 29 29 7c 7c 61 2e 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 3f 28 62 3d 63 2e 73 70 6c 69 74 28 22 3b 22 29 5b 30 5d 2c 63 3d 63 2e 73 70 6c 69 74 28 22 3b 22 29 5b 31 5d 2c 74 68 69 73 2e 73 65 74 47 65 6f 4c 6f 63 61 74 69 6f 6e 28 62 2c 63 29 2c 74 68 69 73 2e 61 64 64 42 61 6e 6e 65 72 53 44 4b 53 63 72 69 70 Data Ascii: nse,this.setGeoLocation(c.countryCode,c.stateCode),this.addBannerSDKScript(a)):(c=this.readCookieParam(e.optanonCookieName,e.geolocationCookiesParam))\|\|a.SkipGeolocation?(b=c.split(";")[0],c=c.split(";")[1],this.setGeoLocation(b,c),this.addBannerSDKScrip

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49722	18.245.206.63	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:17 UTC	606	OUT	GET /cache/b3485d7dde1ec57a3915d1079237c8c34a5198c1/telerik/js/dist/polyfills.min.js HTTP/1.1 Host: dtzbdy9anri2p.cloudfront.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:17 UTC	602	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 94660 Connection: close Cache-Control: public,max-age=31536000 Last-Modified: Thu, 07 Nov 2024 09:21:38 GMT Accept-Ranges: bytes X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 07 Nov 2024 14:39:08 GMT Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 374fdf88ed648e5489c948531e56e640.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LHR5-P3 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: 3ibKWahGSxta7tU-n944BuXRw7cl7mK5ZfYlArKtSpb7I54Ioi5BFQ== Age: 692409
2024-11-15 14:59:17 UTC	15782	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 4c 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 3f 77 69 6e 64 6f 77 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 3f 67 6c 6f 62 61 6c 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 73 65 6c 66 3f 73 65 6c 66 3a 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 74 28 65 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 2c 65 2e 65 78 70 6f 72 74 73 29 2c 65 2e 65 78 70 6f 72 74 73 7d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 72 65 74 75 72 6e Data Ascii: !function(){"use strict";var L="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function t(t,e){return t(e={exports:{}},e.exports),e.exports}function e(t){return
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 29 29 3f 28 68 6e 3d 62 6e 28 62 6e 28 70 6e 29 29 29 21 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 26 26 28 6c 6e 3d 68 6e 29 3a 77 6e 3d 21 30 29 2c 6e 75 6c 6c 21 3d 6c 6e 26 26 21 79 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 7b 7d 3b 72 65 74 75 72 6e 20 6c 6e 5b 6d 6e 5d 2e 63 61 6c 6c 28 74 29 21 3d 3d 74 7d 29 7c 7c 28 6c 6e 3d 7b 7d 29 2c 4f 28 6c 6e 5b 6d 6e 5d 29 7c 7c 6c 65 28 6c 6e 2c 6d 6e 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 45 6e 28 74 2c 65 2c 72 29 7b 74 26 26 21 63 74 28 74 3d 72 3f 74 3a 74 2e 70 72 6f 74 6f 74 79 70 65 2c 50 6e 29 26 26 41 6e 28 74 2c 50 6e 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 65 7d 29 7d 66 75 Data Ascii: ))?(hn=bn(bn(pn)))!==Object.prototype&&(ln=hn):wn=!0),null!=ln&&!y(function(){var t={};return ln[mn].call(t)!==t})\|\|(ln={}),O(ln[mn])\|\|le(ln,mn,function(){return this});function En(t,e,r){t&&!ct(t=r?t:t.prototype,Pn)&&An(t,Pn,{configurable:!0,value:e})}fu
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 7b 76 61 72 20 72 2c 6e 2c 6f 2c 69 2c 61 2c 75 2c 63 2c 73 2c 66 3d 64 28 74 68 69 73 29 2c 6c 3d 30 2c 68 3d 30 2c 70 3d 22 22 3b 69 66 28 6e 75 6c 6c 21 3d 74 29 7b 69 66 28 4e 69 28 74 29 26 26 28 72 3d 53 6f 28 64 28 22 66 6c 61 67 73 22 69 6e 20 4a 61 3f 74 2e 66 6c 61 67 73 3a 5a 61 28 74 29 29 29 2c 21 7e 74 75 28 72 2c 22 67 22 29 29 29 74 68 72 6f 77 20 51 61 28 22 60 2e 72 65 70 6c 61 63 65 41 6c 6c 60 20 64 6f 65 73 20 6e 6f 74 20 61 6c 6c 6f 77 20 6e 6f 6e 2d 67 6c 6f 62 61 6c 20 72 65 67 65 78 65 73 22 29 3b 69 66 28 6e 3d 55 28 74 2c 59 61 29 29 72 65 74 75 72 6e 20 6d 28 6e 2c 74 2c 66 2c 65 29 7d 66 6f 72 28 6f 3d 53 6f 28 66 29 2c 69 3d 53 6f 28 74 29 2c 28 61 3d 4f 28 65 29 29 7c 7c 28 65 3d 53 6f 28 65 29 29 2c 75 3d 69 2e 6c 65 6e 67 Data Ascii: {var r,n,o,i,a,u,c,s,f=d(this),l=0,h=0,p="";if(null!=t){if(Ni(t)&&(r=So(d("flags"in Ja?t.flags:Za(t))),!~tu(r,"g")))throw Qa("`.replaceAll` does not allow non-global regexes");if(n=U(t,Ya))return m(n,t,f,e)}for(o=So(f),i=So(t),(a=O(e))\|\|(e=So(e)),u=i.leng
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 72 2c 69 6e 64 65 78 3a 78 72 28 6e 75 6c 6c 29 2c 66 69 72 73 74 3a 76 6f 69 64 20 30 2c 6c 61 73 74 3a 76 6f 69 64 20 30 2c 73 69 7a 65 3a 30 7d 29 2c 68 7c 7c 28 74 2e 73 69 7a 65 3d 30 29 2c 6e 75 6c 6c 21 3d 65 26 26 47 63 28 65 2c 74 5b 6f 5d 2c 7b 74 68 61 74 3a 74 2c 41 53 5f 45 4e 54 52 49 45 53 3a 6e 7d 29 7d 29 2c 61 3d 65 2e 70 72 6f 74 6f 74 79 70 65 2c 75 3d 53 73 28 72 29 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 2c 6e 3d 75 28 74 29 2c 6f 3d 77 73 28 65 29 3b 69 66 28 22 46 22 21 3d 3d 6f 29 72 65 74 75 72 6e 20 6e 2e 69 6e 64 65 78 5b 6f 5d 3b 66 6f 72 28 72 3d 6e 2e 66 69 72 73 74 3b 72 3b 72 3d 72 2e 6e 65 78 74 29 69 66 28 72 2e 6b 65 79 3d 3d 65 29 72 65 74 75 72 6e 20 72 7d 3b 72 65 74 75 72 6e 20 67 73 28 61 Data Ascii: r,index:xr(null),first:void 0,last:void 0,size:0}),h\|\|(t.size=0),null!=e&&Gc(e,t[o],{that:t,AS_ENTRIES:n})}),a=e.prototype,u=Ss(r),c=function(t,e){var r,n=u(t),o=ws(e);if("F"!==o)return n.index[o];for(r=n.first;r;r=r.next)if(r.key==e)return r};return gs(a
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 22 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 7d 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 7d 2c 73 65 61 72 63 68 50 61 72 61 6d 73 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 28 74 68 69 73 2e 73 65 61 72 63 68 29 2c 6e 3d 74 68 69 73 3b 72 65 74 75 72 6e 5b 22 61 70 70 65 6e 64 22 2c 22 64 65 6c 65 74 65 22 2c 22 73 65 74 22 5d 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 72 5b 74 5d 3b 72 5b 74 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 65 2e 61 70 70 6c 79 28 72 2c 61 72 67 75 6d 65 6e 74 73 29 2c 6e 2e 73 65 61 72 63 68 3d 72 2e 74 6f 53 74 72 69 6e 67 28 29 7d Data Ascii: get:function(){return""},set:function(t){},enumerable:!0},searchParams:{get:function(){var r=new URLSearchParams(this.search),n=this;return["append","delete","set"].forEach(function(t){var e=r[t];r[t]=function(){e.apply(r,arguments),n.search=r.toString()}
2024-11-15 14:59:17 UTC	13342	IN	Data Raw: 30 2c 65 2e 63 6c 69 65 6e 74 59 7c 7c 30 2c 21 21 65 2e 63 74 72 6c 4b 65 79 2c 21 21 65 2e 61 6c 74 4b 65 79 2c 21 21 65 2e 73 68 69 66 74 4b 65 79 2c 21 21 65 2e 6d 65 74 61 4b 65 79 2c 65 2e 62 75 74 74 6f 6e 7c 7c 30 2c 65 2e 72 65 6c 61 74 65 64 54 61 72 67 65 74 7c 7c 6e 75 6c 6c 29 2c 72 7d 72 65 74 75 72 6e 20 65 2e 70 72 6f 74 6f 74 79 70 65 3d 74 2e 70 72 6f 74 6f 74 79 70 65 2c 65 7d 28 4f 2e 4d 6f 75 73 65 45 76 65 6e 74 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 2c 66 28 4f 2c 22 4d 6f 75 73 65 45 76 65 6e 74 22 2c 7b 76 61 6c 75 65 3a 74 7d 29 2c 4d 6f 75 73 65 45 76 65 6e 74 21 3d 3d 74 26 26 28 4d 6f 75 73 65 45 76 65 6e 74 3d 74 29 7d 66 75 6e 63 74 69 6f 6e 20 42 28 74 29 7b 76 61 72 20 72 3d 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f Data Ascii: 0,e.clientY\|\|0,!!e.ctrlKey,!!e.altKey,!!e.shiftKey,!!e.metaKey,e.button\|\|0,e.relatedTarget\|\|null),r}return e.prototype=t.prototype,e}(O.MouseEvent\|\|function(){}),f(O,"MouseEvent",{value:t}),MouseEvent!==t&&(MouseEvent=t)}function B(t){var r=t.querySelecto

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49723	18.245.206.63	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:17 UTC	609	OUT	GET /cache/3771543484f465487bb9712eed986edeb1f314a2/telerik/css/style.css HTTP/1.1 Host: dtzbdy9anri2p.cloudfront.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:17 UTC	589	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 284715 Connection: close Cache-Control: public,max-age=31536000 Last-Modified: Wed, 06 Nov 2024 17:14:48 GMT Accept-Ranges: bytes X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 07 Nov 2024 12:43:56 GMT Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 3e451e9597256bf0aa25b96dd37c1986.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LHR5-P3 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: K3QmSPN0h0r3qLZU0GOMIfzNzlVQaRzfSMNVN540GYXJ38VGS2hofA== Age: 699321
2024-11-15 14:59:17 UTC	15795	IN	Data Raw: 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 2e 42 6c 6f 63 6b 4c 69 6e 6b 73 2d 2d 62 75 74 74 6f 6e 73 20 61 2c 2e 42 74 6e 2c 2e 50 61 67 65 57 72 61 70 70 65 72 2c 2e 50 61 6e 65 6c 43 68 6f 69 63 65 20 6c 61 62 65 6c 2c 2e 52 61 64 45 64 69 74 6f 72 20 69 66 72 61 6d 65 2c 2e 53 65 61 72 63 68 52 65 73 75 6c 74 73 20 2a 2c 2e 53 65 63 74 69 6f 6e 2d 62 61 6e 6e 65 72 2c 2e 53 65 63 74 69 6f 6e 2d 63 6f 76 65 72 2c 2e 53 6c 69 64 65 72 2d 73 6c 69 64 65 2c 2e 54 4b 2d 54 61 67 2d 49 6e 70 75 74 2d 42 75 74 74 6f 6e 2c 2e 54 69 6d 65 4c 69 6e 65 20 3a 61 66 74 65 72 2c 2e 54 69 6d 65 4c 69 6e 65 20 3a 62 65 66 6f 72 65 2c 2e 63 6f 6c 2d 31 2c 2e 63 6f 6c 2d 31 30 2c 2e 63 6f 6c 2d 31 31 2c 2e 63 6f 6c 2d 31 32 2c 2e 63 6f 6c 2d 32 2c 2e 63 6f 6c Data Ascii: @charset "UTF-8";.BlockLinks--buttons a,.Btn,.PageWrapper,.PanelChoice label,.RadEditor iframe,.SearchResults *,.Section-banner,.Section-cover,.Slider-slide,.TK-Tag-Input-Button,.TimeLine :after,.TimeLine :before,.col-1,.col-10,.col-11,.col-12,.col-2,.col
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 62 67 2d 5d 20 68 32 2c 5b 63 6c 61 73 73 2a 3d 75 2d 62 67 2d 5d 20 68 33 2c 5b 63 6c 61 73 73 2a 3d 75 2d 62 67 2d 5d 20 68 34 2c 5b 63 6c 61 73 73 2a 3d 75 2d 62 67 2d 5d 20 68 35 2c 5b 63 6c 61 73 73 2a 3d 75 2d 62 67 2d 5d 20 68 36 7b 63 6f 6c 6f 72 3a 23 66 66 66 7d 5b 63 6c 61 73 73 2a 3d 75 2d 62 67 2d 5d 20 61 3a 6e 6f 74 28 2e 42 74 6e 29 7b 63 6f 6c 6f 72 3a 23 39 30 62 36 66 66 7d 5b 63 6c 61 73 73 2a 3d 75 2d 62 67 2d 5d 20 61 3a 6e 6f 74 28 2e 42 74 6e 29 3a 66 6f 63 75 73 2c 5b 63 6c 61 73 73 2a 3d 75 2d 62 67 2d 5d 20 61 3a 6e 6f 74 28 2e 42 74 6e 29 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 65 65 66 35 66 66 7d 2e 75 2d 62 67 2d 62 6c 75 65 2d 2d 67 72 61 64 69 65 6e 74 7b 62 61 63 6b 72 6f 67 75 6e 64 3a 23 32 38 32 66 38 39 3b 62 61 63 Data Ascii: bg-] h2,[class=u-bg-] h3,[class=u-bg-] h4,[class=u-bg-] h5,[class=u-bg-] h6{color:#fff}[class=u-bg-] a:not(.Btn){color:#90b6ff}[class=u-bg-] a:not(.Btn):focus,[class*=u-bg-] a:not(.Btn):hover{color:#eef5ff}.u-bg-blue--gradient{backrogund:#282f89;bac
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 72 2d 72 69 67 68 74 3a 31 70 78 20 73 6f 6c 69 64 20 68 73 6c 61 28 30 2c 30 25 2c 31 30 30 25 2c 2e 31 29 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 36 30 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 32 65 6d 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 65 6d 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 62 61 63 6b 67 72 6f 75 6e 64 20 2e 32 73 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 62 61 63 6b 67 72 6f 75 6e 64 20 2e 32 73 7d 2e 4e 61 76 41 6c 74 2d 61 6e 63 68 6f 72 2e 69 73 2d 61 63 74 69 76 65 2c 2e 4e 61 76 41 6c 74 2d 61 6e 63 68 6f 72 3a 61 63 74 69 76 65 2c 2e 4e 61 76 41 6c 74 2d 61 6e 63 68 Data Ascii: r-right:1px solid hsla(0,0%,100%,.1);color:#fff;display:inline-block;font-size:20px;line-height:60px;padding-left:2em;padding-right:2em;-webkit-transition:background .2s;transition:background .2s}.NavAlt-anchor.is-active,.NavAlt-anchor:active,.NavAlt-anch
2024-11-15 14:59:17 UTC	15922	IN	Data Raw: 2d 2d 62 6c 75 65 31 20 68 36 7b 63 6f 6c 6f 72 3a 23 38 31 38 36 39 32 7d 2e 53 65 63 74 69 6f 6e 2d 2d 67 72 65 65 6e 33 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 32 64 62 32 34 35 3b 63 6f 6c 6f 72 3a 23 30 30 30 7d 2e 53 65 63 74 69 6f 6e 2d 2d 62 6c 75 65 31 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 31 64 32 33 33 33 3b 63 6f 6c 6f 72 3a 23 30 30 30 7d 2e 53 65 63 74 69 6f 6e 2d 2d 62 6c 75 65 32 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 38 62 66 65 38 3b 63 6f 6c 6f 72 3a 23 30 30 30 7d 2e 53 65 63 74 69 6f 6e 2d 2d 62 6c 75 65 33 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 38 61 39 65 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 7d 2e 53 65 63 74 69 6f 6e 2d 2d 62 6c 75 65 31 31 7b 62 61 63 6b Data Ascii: --blue1 h6{color:#818692}.Section--green3{background-color:#2db245;color:#000}.Section--blue1{background-color:#1d2333;color:#000}.Section--blue2{background-color:#48bfe8;color:#000}.Section--blue3{background-color:#08a9e0;color:#000}.Section--blue11{back
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 3a 31 30 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 2e 69 65 37 20 69 6e 70 75 74 5b 74 79 70 65 3d 63 68 65 63 6b 62 6f 78 5d 2b 6c 61 62 65 6c 2c 2e 69 65 37 20 69 6e 70 75 74 5b 74 79 70 65 3d 72 61 64 69 6f 5d 2b 6c 61 62 65 6c 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 7a 6f 6f 6d 3a 31 7d 2e 70 6c 61 63 65 68 6f 6c 64 65 72 3a 3a 2d 77 65 62 6b 69 74 2d 69 6e 70 75 74 2d 70 6c 61 63 65 68 6f 6c 64 65 72 2c 69 6e 70 75 74 3a 3a 2d 77 65 62 6b 69 74 2d 69 6e 70 75 74 2d 70 6c 61 63 65 68 6f 6c 64 65 72 7b 63 6f 6c 6f 72 3a 23 61 39 61 39 61 39 3b 66 6f 6e 74 3a 34 30 30 20 31 35 70 78 2f 31 2e 32 20 4d 65 74 72 69 63 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 2e 70 6c 61 63 65 68 6f 6c 64 65 72 3a 3a 2d Data Ascii: :10px;vertical-align:middle}.ie7 input[type=checkbox]+label,.ie7 input[type=radio]+label{display:inline;zoom:1}.placeholder::-webkit-input-placeholder,input::-webkit-input-placeholder{color:#a9a9a9;font:400 15px/1.2 Metric,Arial,sans-serif}.placeholder::-
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 2d 62 67 2d 63 6f 6c 6f 72 29 20 31 30 25 2c 74 72 61 6e 73 70 61 72 65 6e 74 29 3b 72 69 67 68 74 3a 30 7d 2e 42 6c 6f 63 6b 4c 69 6e 6b 73 20 61 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 7d 2e 42 6c 6f 63 6b 4c 69 6e 6b 73 2d 2d 77 72 61 70 20 61 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 35 70 78 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 72 6d 61 6c 7d 2e 42 6c 6f 63 6b 4c 69 6e 6b 73 2d 2d 69 6e 6c 69 6e 65 20 61 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 42 6c 6f 63 6b 4c 69 6e 6b 73 2d 2d 69 6e 6c 69 6e 65 20 61 2b 61 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 30 70 78 7d 2e 42 6c 6f 63 6b 4c 69 6e 6b 73 2d 2d 62 75 Data Ascii: -bg-color) 10%,transparent);right:0}.BlockLinks a{display:block;white-space:nowrap}.BlockLinks--wrap a{margin-bottom:5px;white-space:normal}.BlockLinks--inline a{display:inline-block;margin-bottom:0}.BlockLinks--inline a+a{margin-left:10px}.BlockLinks--bu
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 27 20 72 3d 27 33 2e 33 27 20 66 69 6c 6c 3d 27 25 32 33 65 63 38 34 31 64 27 2f 25 33 45 25 33 43 2f 73 76 67 25 33 45 22 29 7d 2e 42 75 6c 6c 65 74 36 7b 6c 69 73 74 2d 73 74 79 6c 65 2d 69 6d 61 67 65 3a 75 72 6c 28 22 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 2c 25 33 43 73 76 67 20 78 6d 6c 6e 73 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 27 20 77 69 64 74 68 3d 27 38 27 20 68 65 69 67 68 74 3d 27 38 27 25 33 45 25 33 43 63 69 72 63 6c 65 20 63 78 3d 27 33 2e 33 27 20 63 79 3d 27 34 2e 31 27 20 72 3d 27 32 2e 36 27 20 66 69 6c 6c 3d 27 25 32 33 30 30 42 35 44 43 27 2f 25 33 45 25 33 43 2f 73 76 67 25 33 45 22 29 7d 2e 42 75 6c 6c 65 74 43 68 65 63 6b 7b 6c Data Ascii: ' r='3.3' fill='%23ec841d'/%3E%3C/svg%3E")}.Bullet6{list-style-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' width='8' height='8'%3E%3Ccircle cx='3.3' cy='4.1' r='2.6' fill='%2300B5DC'/%3E%3C/svg%3E")}.BulletCheck{l
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 61 6e 65 6c 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 50 61 6e 65 6c 20 2e 50 61 6e 65 6c 2d 74 6f 67 67 6c 65 2d 63 6f 6e 74 65 6e 74 2c 2e 50 61 6e 65 6c 2e 69 73 2d 74 6f 67 67 6c 65 64 20 2e 50 61 6e 65 6c 2d 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 50 61 6e 65 6c 2e 69 73 2d 74 6f 67 67 6c 65 64 20 2e 50 61 6e 65 6c 2d 74 6f 67 67 6c 65 2d 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 50 6f 70 75 70 46 69 78 65 64 7b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 66 61 63 65 2d 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 3b 62 61 63 6b 66 61 63 65 2d 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 38 66 38 66 38 3b 62 6f 72 64 65 72 2d 74 6f 70 Data Ascii: anel{position:relative}.Panel .Panel-toggle-content,.Panel.is-toggled .Panel-content{display:none}.Panel.is-toggled .Panel-toggle-content{display:block}.PopupFixed{-webkit-backface-visibility:hidden;backface-visibility:hidden;background:#f8f8f8;border-top
2024-11-15 14:59:17 UTC	12792	IN	Data Raw: 61 6e 73 70 61 72 65 6e 74 29 2c 63 6f 6c 6f 72 2d 73 74 6f 70 28 35 30 25 2c 23 66 66 34 64 34 64 29 29 2c 2d 77 65 62 6b 69 74 2d 67 72 61 64 69 65 6e 74 28 6c 69 6e 65 61 72 2c 6c 65 66 74 20 74 6f 70 2c 72 69 67 68 74 20 62 6f 74 74 6f 6d 2c 63 6f 6c 6f 72 2d 73 74 6f 70 28 34 39 25 2c 74 72 61 6e 73 70 61 72 65 6e 74 29 2c 63 6f 6c 6f 72 2d 73 74 6f 70 28 35 30 25 2c 23 66 66 34 64 34 64 29 29 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 74 6f 70 20 72 69 67 68 74 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 34 39 25 2c 23 66 66 34 64 34 64 20 35 30 25 29 2c 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 62 6f 74 74 6f 6d 20 72 69 67 68 74 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 34 39 25 2c 23 66 66 Data Ascii: ansparent),color-stop(50%,#ff4d4d)),-webkit-gradient(linear,left top,right bottom,color-stop(49%,transparent),color-stop(50%,#ff4d4d));background:linear-gradient(to top right,transparent 49%,#ff4d4d 50%),linear-gradient(to bottom right,transparent 49%,#ff
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 6f 6e 3a 6f 70 61 63 69 74 79 20 2e 33 73 20 65 61 73 65 2c 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 20 2e 33 73 20 65 61 73 65 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 6f 70 61 63 69 74 79 20 2e 33 73 20 65 61 73 65 2c 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 20 2e 33 73 20 65 61 73 65 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 74 72 61 6e 73 66 6f 72 6d 20 2e 33 73 20 65 61 73 65 2c 6f 70 61 63 69 74 79 20 2e 33 73 20 65 61 73 65 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 74 72 61 6e 73 66 6f 72 6d 20 2e 33 73 20 65 61 73 65 2c 6f 70 61 63 69 74 79 20 2e 33 73 20 65 61 73 65 2c 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 20 2e 33 73 20 65 61 73 65 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 3b 77 69 64 74 68 3a 30 7d 2e 46 65 61 74 75 Data Ascii: on:opacity .3s ease,-webkit-transform .3s ease;transition:opacity .3s ease,-webkit-transform .3s ease;transition:transform .3s ease,opacity .3s ease;transition:transform .3s ease,opacity .3s ease,-webkit-transform .3s ease;visibility:hidden;width:0}.Featu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49724	18.245.206.63	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:17 UTC	600	OUT	GET /cache/5466ecb2c23eafce4b55ab412dec4fc40c31abe5/telerik/js/dist/all.min.js HTTP/1.1 Host: dtzbdy9anri2p.cloudfront.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:17 UTC	603	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 259466 Connection: close Cache-Control: public,max-age=31536000 Last-Modified: Wed, 13 Nov 2024 07:29:36 GMT Accept-Ranges: bytes X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 13 Nov 2024 22:35:56 GMT Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 8a92b2b0171484a741fd7fa869ed518c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LHR5-P3 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: ecurQOYpNyG9By4GZqUrTDnFMpuaDIR4xKv1j1EKJpoXRctLsBpgSA== Age: 145400
2024-11-15 14:59:17 UTC	15781	IN	Data Raw: 28 4f 3d 3e 7b 76 61 72 20 55 2c 65 2c 44 2c 56 2c 4e 2c 42 2c 48 2c 71 2c 57 2c 46 2c 4b 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 3f 77 69 6e 64 6f 77 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 3f 67 6c 6f 62 61 6c 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 73 65 6c 66 3f 73 65 6c 66 3a 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 7a 28 74 29 7b 76 61 72 20 65 3d 37 2e 35 36 32 35 2c 6e 3d 32 2e 37 35 3b 72 65 74 75 72 6e 20 74 3c 31 2f 6e 3f 65 2a 74 2a 74 3a 74 3c 32 2f 6e 3f 65 2a 28 74 2d 3d 31 2e 35 2f 6e 29 2a 74 2b 2e 37 35 3a 74 3c 32 Data Ascii: (O=>{var U,e,D,V,N,B,H,q,W,F,K="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function z(t){var e=7.5625,n=2.75;return t<1/n?ett:t<2/n?e(t-=1.5/n)t+.75:t<2
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 28 65 29 2c 69 3d 74 2e 6c 65 6e 67 74 68 3b 72 65 74 75 72 6e 20 65 3c 30 7c 7c 69 3c 3d 65 3f 72 3f 22 22 3a 76 6f 69 64 20 30 3a 28 6e 3d 73 6f 28 74 2c 65 29 29 3c 35 35 32 39 36 7c 7c 35 36 33 31 39 3c 6e 7c 7c 65 2b 31 3d 3d 3d 69 7c 7c 28 69 3d 73 6f 28 74 2c 65 2b 31 29 29 3c 35 36 33 32 30 7c 7c 35 37 33 34 33 3c 69 3f 72 3f 6f 6f 28 74 2c 65 29 3a 6e 3a 72 3f 61 6f 28 74 2c 65 2c 65 2b 32 29 3a 69 2d 35 36 33 32 30 2b 28 6e 2d 35 35 32 39 36 3c 3c 31 30 29 2b 36 35 35 33 36 7d 7d 66 75 6e 63 74 69 6f 6e 20 4e 6e 28 29 7b 76 61 72 20 74 3d 78 28 74 68 69 73 29 2c 65 3d 22 22 3b 72 65 74 75 72 6e 20 74 2e 67 6c 6f 62 61 6c 26 26 28 65 2b 3d 22 67 22 29 2c 74 2e 69 67 6e 6f 72 65 43 61 73 65 26 26 28 65 2b 3d 22 69 22 29 2c 74 2e 6d 75 6c 74 69 6c Data Ascii: (e),i=t.length;return e<0\|\|i<=e?r?"":void 0:(n=so(t,e))<55296\|\|56319<n\|\|e+1===i\|\|(i=so(t,e+1))<56320\|\|57343<i?r?oo(t,e):n:r?ao(t,e,e+2):i-56320+(n-55296<<10)+65536}}function Nn(){var t=x(this),e="";return t.global&&(e+="g"),t.ignoreCase&&(e+="i"),t.multil
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 74 68 3f 7b 76 61 6c 75 65 3a 76 6f 69 64 20 30 2c 64 6f 6e 65 3a 21 30 7d 3a 28 65 3d 63 6f 28 65 2c 6e 29 2c 74 2e 69 6e 64 65 78 2b 3d 65 2e 6c 65 6e 67 74 68 2c 7b 76 61 6c 75 65 3a 65 2c 64 6f 6e 65 3a 21 31 7d 29 7d 29 2c 79 29 2c 66 6f 3d 28 70 6f 2e 41 72 72 61 79 2c 79 2e 52 65 67 45 78 70 29 2c 72 3d 28 61 3d 67 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 66 6f 28 22 61 22 2c 22 79 22 29 3b 72 65 74 75 72 6e 20 74 2e 6c 61 73 74 49 6e 64 65 78 3d 32 2c 6e 75 6c 6c 21 3d 74 2e 65 78 65 63 28 22 61 62 63 64 22 29 7d 29 29 7c 7c 67 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 66 6f 28 22 61 22 2c 22 79 22 29 2e 73 74 69 63 6b 79 7d 29 2c 73 3d 7b 42 52 4f 4b 45 4e 5f 43 41 52 45 54 3a 61 7c 7c 67 28 66 75 6e 63 74 69 6f 6e 28 Data Ascii: th?{value:void 0,done:!0}:(e=co(e,n),t.index+=e.length,{value:e,done:!1})}),y),fo=(po.Array,y.RegExp),r=(a=g(function(){var t=fo("a","y");return t.lastIndex=2,null!=t.exec("abcd")}))\|\|g(function(){return!fo("a","y").sticky}),s={BROKEN_CARET:a\|\|g(function(
2024-11-15 14:59:17 UTC	15921	IN	Data Raw: 6b 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 21 68 28 74 2c 73 29 29 7b 69 66 28 21 48 61 28 74 29 29 72 65 74 75 72 6e 21 30 3b 69 66 28 21 65 29 72 65 74 75 72 6e 21 31 3b 6e 28 74 29 7d 72 65 74 75 72 6e 20 74 5b 73 5d 2e 77 65 61 6b 44 61 74 61 7d 2c 6f 6e 46 72 65 65 7a 65 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 4e 61 26 26 69 26 26 48 61 28 74 29 26 26 21 68 28 74 2c 73 29 26 26 6e 28 74 29 2c 74 7d 7d 3b 78 65 5b 73 5d 3d 21 30 7d 29 2c 57 61 3d 28 71 61 2e 65 6e 61 62 6c 65 2c 71 61 2e 6f 6e 46 72 65 65 7a 65 29 2c 46 61 3d 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 2c 6c 3d 67 28 66 75 6e 63 74 69 6f 6e 28 29 7b 46 61 28 31 29 7d 29 2c 4b 61 3d 28 76 28 7b 74 61 72 67 65 74 3a 22 4f 62 6a 65 63 74 22 2c 73 Data Ascii: kData:function(t,e){if(!h(t,s)){if(!Ha(t))return!0;if(!e)return!1;n(t)}return t[s].weakData},onFreeze:function(t){return Na&&i&&Ha(t)&&!h(t,s)&&n(t),t}};xe[s]=!0}),Wa=(qa.enable,qa.onFreeze),Fa=Object.freeze,l=g(function(){Fa(1)}),Ka=(v({target:"Object",s
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 3f 65 5b 74 5d 5b 30 5d 3a 6e 75 6c 6c 7d 2c 74 2e 67 65 74 41 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 5b 4f 6c 5d 3b 72 65 74 75 72 6e 20 74 20 69 6e 20 65 3f 65 5b 74 5d 2e 73 6c 69 63 65 28 30 29 3a 5b 5d 7d 2c 74 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 20 69 6e 20 74 68 69 73 5b 4f 6c 5d 7d 2c 74 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 74 68 69 73 5b 4f 6c 5d 5b 74 5d 3d 5b 22 22 2b 65 5d 7d 2c 74 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 2c 65 2c 6e 2c 69 2c 72 3d 74 68 69 73 5b 4f 6c 5d 2c 6f 3d 5b 5d 3b 66 6f 72 28 65 20 69 6e 20 72 29 66 6f 72 28 6e 3d 44 6c 28 65 29 2c 74 3d 30 2c 69 3d 72 5b 65 5d 3b 74 3c 69 2e 6c 65 6e 67 Data Ascii: ?e[t][0]:null},t.getAll=function(t){var e=this[Ol];return t in e?e[t].slice(0):[]},t.has=function(t){return t in this[Ol]},t.set=function(t,e){this[Ol][t]=[""+e]},t.toString=function(){var t,e,n,i,r=this[Ol],o=[];for(e in r)for(n=Dl(e),t=0,i=r[e];t<i.leng
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 72 54 69 6d 65 6f 75 74 28 74 29 7d 29 29 2c 4c 2e 72 65 71 75 65 73 74 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 3d 4a 75 2c 4c 2e 63 61 6e 63 65 6c 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 3d 5a 75 3b 74 72 79 7b 6e 65 77 20 4c 2e 43 75 73 74 6f 6d 45 76 65 6e 74 28 22 3f 22 29 7d 63 61 74 63 68 28 74 29 7b 4c 2e 43 75 73 74 6f 6d 45 76 65 6e 74 3d 28 50 75 3d 4c 2e 43 75 73 74 6f 6d 45 76 65 6e 74 3f 22 43 75 73 74 6f 6d 45 76 65 6e 74 22 3a 22 45 76 65 6e 74 22 2c 49 75 3d 7b 62 75 62 62 6c 65 73 3a 21 31 2c 63 61 6e 63 65 6c 61 62 6c 65 3a 21 31 2c 64 65 74 61 69 6c 3a 6e 75 6c 6c 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 6a 75 2e 63 72 65 61 74 65 45 76 65 6e 74 28 50 75 29 3b 69 66 28 22 73 74 72 69 6e 67 22 21 3d 74 79 70 Data Ascii: rTimeout(t)})),L.requestAnimationFrame=Ju,L.cancelAnimationFrame=Zu;try{new L.CustomEvent("?")}catch(t){L.CustomEvent=(Pu=L.CustomEvent?"CustomEvent":"Event",Iu={bubbles:!1,cancelable:!1,detail:null},function(t,e){var n=ju.createEvent(Pu);if("string"!=typ
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 72 6f 6c 6c 49 6e 74 6f 56 69 65 77 49 66 4e 65 65 64 65 64 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 50 68 28 74 68 69 73 2c 7b 73 63 72 6f 6c 6c 4d 6f 64 65 3a 22 69 66 2d 6e 65 65 64 65 64 22 2c 62 6c 6f 63 6b 3a 28 74 3d 6e 75 6c 6c 3d 3d 74 7c 7c 21 21 74 29 3f 22 63 65 6e 74 65 72 22 3a 22 6e 65 61 72 65 73 74 22 7d 29 7d 29 3b 76 61 72 20 52 68 2c 41 68 2c 6a 68 2c 4d 68 2c 55 68 2c 44 68 2c 56 68 2c 4e 68 2c 42 68 2c 24 68 2c 48 68 2c 71 68 2c 57 68 2c 46 68 2c 4b 68 2c 7a 68 2c 58 68 2c 47 68 3d 7b 74 6f 70 3a 30 2c 62 6f 74 74 6f 6d 3a 30 2c 62 72 65 61 6b 70 6f 69 6e 74 3a 30 2c 72 65 73 69 7a 65 3a 21 31 2c 63 6c 61 73 73 4f 6e 6c 79 3a 21 30 2c 65 6c 65 76 61 74 69 6f 6e 3a 21 31 2c 66 69 78 43 6c 61 73 73 3a 22 69 73 2d 66 69 78 65 64 22 2c 73 Data Ascii: rollIntoViewIfNeeded=function(t){Ph(this,{scrollMode:"if-needed",block:(t=null==t\|\|!!t)?"center":"nearest"})});var Rh,Ah,jh,Mh,Uh,Dh,Vh,Nh,Bh,$h,Hh,qh,Wh,Fh,Kh,zh,Xh,Gh={top:0,bottom:0,breakpoint:0,resize:!1,classOnly:!0,elevation:!1,fixClass:"is-fixed",s
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 3d 65 3f 74 68 69 73 2e 74 75 72 6e 4f 66 66 3a 74 68 69 73 2e 74 75 72 6e 4f 6e 29 7d 2c 6d 2e 70 72 6f 74 6f 74 79 70 65 2e 62 72 65 61 6b 70 6f 69 6e 74 48 61 6e 64 6c 65 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 62 72 65 61 6b 70 6f 69 6e 74 2c 65 3d 4d 61 74 68 2e 6d 61 78 28 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 63 6c 69 65 6e 74 57 69 64 74 68 2c 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 7c 7c 30 29 3b 74 26 26 28 74 3c 3d 65 3f 74 68 69 73 2e 5f 62 72 65 61 6b 70 6f 69 6e 74 41 62 6f 76 65 48 61 6e 64 6c 65 72 45 78 65 63 75 74 65 64 7c 7c 28 74 68 69 73 2e 6f 6e 42 72 65 61 6b 70 6f 69 6e 74 41 62 6f 76 65 28 29 2c 74 68 69 73 2e 5f 62 72 65 61 6b Data Ascii: =e?this.turnOff:this.turnOn)},m.prototype.breakpointHandler=function(){var t=this.options.breakpoint,e=Math.max(document.documentElement.clientWidth,window.innerWidth\|\|0);t&&(t<=e?this._breakpointAboveHandlerExecuted\|\|(this.onBreakpointAbove(),this._break
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 6c 65 3f 6d 69 6e 69 3d 74 72 75 65 26 75 72 6c 3d 22 2b 72 2b 22 26 73 75 6d 6d 61 72 79 3d 22 2b 6f 3b 62 72 65 61 6b 3b 63 61 73 65 22 72 65 64 64 69 74 22 3a 69 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 65 64 64 69 74 2e 63 6f 6d 2f 6c 6f 67 69 6e 3f 72 65 64 69 72 65 63 74 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 65 64 64 69 74 2e 63 6f 6d 2f 73 75 62 6d 69 74 3f 75 72 6c 3d 22 2b 72 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 69 3d 22 68 74 74 70 73 3a 2f 2f 74 77 69 74 74 65 72 2e 63 6f 6d 2f 73 68 61 72 65 3f 75 72 6c 3d 22 2b 72 2b 22 26 74 65 78 74 3d 22 2b 6f 7d 72 65 74 75 72 6e 20 69 7d 2c 61 64 2e 5f 64 65 6c 65 67 61 74 65 64 54 6f 67 67 6c 65 53 68 61 72 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2e 74 61 72 67 65 Data Ascii: le?mini=true&url="+r+"&summary="+o;break;case"reddit":i="https://www.reddit.com/login?redirect=https://www.reddit.com/submit?url="+r;break;default:i="https://twitter.com/share?url="+r+"&text="+o}return i},ad._delegatedToggleShare=function(t){var e=t.targe
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 3d 30 2c 74 68 69 73 2e 73 65 6c 65 63 74 2e 73 74 79 6c 65 2e 70 61 64 64 69 6e 67 3d 30 2c 74 68 69 73 2e 73 65 6c 65 63 74 2e 73 74 79 6c 65 2e 6f 70 61 63 69 74 79 3d 30 2c 74 68 69 73 2e 73 65 6c 65 63 74 2e 73 74 79 6c 65 2e 66 6f 6e 74 53 69 7a 65 3d 30 2c 74 68 69 73 2e 73 65 6c 65 63 74 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 3d 22 6e 6f 6e 65 22 2c 74 68 69 73 2e 73 65 6c 65 63 74 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 61 62 73 6f 6c 75 74 65 22 2c 74 68 69 73 2e 73 65 6c 65 63 74 2e 73 74 79 6c 65 2e 74 72 61 6e 73 66 6f 72 6d 3d 22 73 63 61 6c 65 28 30 29 22 7d 2c 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 41 Data Ascii: =0,this.select.style.padding=0,this.select.style.opacity=0,this.select.style.fontSize=0,this.select.style.border="none",this.select.style.position="absolute",this.select.style.transform="scale(0)"},document.addEventListener("DOMContentLoaded",function(){A

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:17 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:17 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:17 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Thu, 14 Nov 2024 16:27:56 GMT ETag: "0x8DD04C94BD1CD28" x-ms-request-id: 95228c9c-001e-008d-1ac3-36d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145917Z-16547b76f7fnlcwwhC1DFWz6gw0000000ncg00000000def7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:17 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-15 14:59:17 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49716	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:18 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3cCfEDfTkrdh+vP&MD=KKfBweXO HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-15 14:59:19 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: bbaf0e03-ab86-44b8-a5d2-80d746ff235e MS-RequestId: 3de7a73f-e4e5-411d-8a96-b4e29eb99ea9 MS-CV: tWcPHVA+E0m3dyh3.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 15 Nov 2024 14:59:17 GMT Connection: close Content-Length: 24490
2024-11-15 14:59:19 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-15 14:59:19 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49739	18.66.107.176	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:18 UTC	673	OUT	GET /Frontend-Assembly/Web.SitefinityExtensions.EloquaConnector/Scripts/BrowserSessionStorage.min.js?package=PureMvc&v=Q2NzWmRUZmg5UHpIS3RyRDhtYkJmUT09 HTTP/1.1 Host: d585tldpucybw.cloudfront.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:19 UTC	776	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 667 Connection: close Last-Modified: Wed, 16 Oct 2024 11:44:58 GMT Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: http://localconverter.telerik.com Cache-Control: public, max-age=0 Expires: Tue, 19 Nov 2024 09:11:26 GMT Date: Fri, 15 Nov 2024 07:09:36 GMT Vary: Accept-Encoding,Cookie X-Cache: Hit from cloudfront Via: 1.1 7be6cb2d0156b563b6b1c8f2595ddd52.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P5 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: nMa6dYykcuQfRVp1U_SZ-xaSQ3HIVkQ4FnGE_fc3kHfJLd0TZ0BUew== Age: 28183
2024-11-15 14:59:19 UTC	667	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3d 22 62 73 63 22 3b 66 75 6e 63 74 69 6f 6e 20 69 28 6e 29 7b 66 6f 72 28 76 61 72 20 72 3d 6e 2b 22 3d 22 2c 66 3d 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 29 2c 75 3d 66 2e 73 70 6c 69 74 28 22 3b 22 29 2c 69 3d 30 3b 69 3c 75 2e 6c 65 6e 67 74 68 3b 69 2b 2b 29 7b 66 6f 72 28 76 61 72 20 74 3d 75 5b 69 5d 3b 74 2e 63 68 61 72 41 74 28 30 29 3d 3d 3d 22 20 22 3b 29 74 3d 74 2e 73 75 62 73 74 72 69 6e 67 28 31 29 3b 69 66 28 74 2e 69 6e 64 65 78 4f 66 28 72 29 3d 3d 3d 30 29 72 65 74 75 72 6e 20 74 2e 73 75 62 73 74 72 69 6e 67 28 72 2e 6c 65 6e 67 74 68 2c 74 2e 6c 65 6e 67 74 68 29 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f Data Ascii: (function(){var n="bsc";function i(n){for(var r=n+"=",f=decodeURIComponent(document.cookie),u=f.split(";"),i=0;i<u.length;i++){for(var t=u[i];t.charAt(0)===" ";)t=t.substring(1);if(t.indexOf(r)===0)return t.substring(r.length,t.length)}return null}functio

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49741	104.18.86.42	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:19 UTC	631	OUT	GET /consent/3dfce4f2-dab6-4128-9f33-df7e0597da82/3dfce4f2-dab6-4128-9f33-df7e0597da82.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.telerik.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:19 UTC	982	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:19 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Ray: 8e301abf6ba6e7fb-DFW CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 68038 Cache-Control: public, max-age=86400 Expires: Sat, 16 Nov 2024 14:59:19 GMT Last-Modified: Tue, 25 Jun 2024 13:14:55 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: aQ7zO/MRk403j7xrbyLrvA== Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: c8603ce4-701e-0065-134c-2622d7000000 x-ms-version: 2009-09-19 Cross-Origin-Resource-Policy: cross-origin Server: cloudflare
2024-11-15 14:59:19 UTC	387	IN	Data Raw: 31 33 34 66 0d 0a 7b 22 43 6f 6f 6b 69 65 53 50 41 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 53 61 6d 65 53 69 74 65 4e 6f 6e 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 56 32 43 53 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 4d 75 6c 74 69 56 61 72 69 61 6e 74 54 65 73 74 69 6e 67 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 55 73 65 56 32 22 3a 74 72 75 65 2c 22 4d 6f 62 69 6c 65 53 44 4b 22 3a 66 61 6c 73 65 2c 22 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 53 63 72 69 70 74 54 79 70 65 22 3a 22 50 52 4f 44 55 43 54 49 4f 4e 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 32 30 32 34 30 31 2e 32 2e 30 22 2c 22 4f 70 74 61 6e 6f 6e 44 61 74 61 4a 53 4f 4e 22 3a 22 33 64 66 63 Data Ascii: 134f{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202401.2.0","OptanonDataJSON":"3dfc
2024-11-15 14:59:19 UTC	1369	IN	Data Raw: 65 63 6b 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 63 6f 6f 6b 69 65 73 2d 64 61 74 61 2e 6f 6e 65 74 72 75 73 74 2e 69 6f 2f 62 61 6e 6e 65 72 73 64 6b 2f 76 31 2f 64 6f 6d 61 69 6e 67 72 6f 75 70 63 68 65 63 6b 22 2c 22 52 75 6c 65 53 65 74 22 3a 5b 7b 22 49 64 22 3a 22 30 31 38 66 33 39 38 64 2d 65 61 38 65 2d 37 34 61 32 2d 61 36 63 34 2d 33 39 36 30 61 63 32 65 34 36 64 61 22 2c 22 4e 61 6d 65 22 3a 22 45 55 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 64 65 22 2c 22 6e 6f 22 2c 22 62 65 22 2c 22 66 69 22 2c 22 70 74 22 2c 22 62 67 22 2c 22 64 6b 22 2c 22 6c 74 22 2c 22 6c 75 22 2c 22 6c 76 22 2c 22 68 72 22 2c 22 66 72 22 2c 22 68 75 22 2c 22 73 65 22 2c 22 6d 63 22 2c 22 73 69 22 2c 22 73 6b 22 2c 22 6d 66 22 2c 22 73 6d 22 2c 22 67 62 22 2c 22 Data Ascii: eckUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"018f398d-ea8e-74a2-a6c4-3960ac2e46da","Name":"EU","Countries":["de","no","be","fi","pt","bg","dk","lt","lu","lv","hr","fr","hu","se","mc","si","sk","mf","sm","gb","
2024-11-15 14:59:19 UTC	1369	IN	Data Raw: 62 6a 22 2c 22 62 6c 22 2c 22 62 6d 22 2c 22 62 6e 22 2c 22 62 6f 22 2c 22 73 61 22 2c 22 73 62 22 2c 22 62 71 22 2c 22 62 72 22 2c 22 73 63 22 2c 22 73 64 22 2c 22 62 73 22 2c 22 62 74 22 2c 22 73 67 22 2c 22 62 76 22 2c 22 62 77 22 2c 22 73 68 22 2c 22 73 6a 22 2c 22 62 79 22 2c 22 62 7a 22 2c 22 73 6c 22 2c 22 73 6e 22 2c 22 73 6f 22 2c 22 63 61 22 2c 22 73 72 22 2c 22 73 73 22 2c 22 63 63 22 2c 22 73 74 22 2c 22 63 64 22 2c 22 73 76 22 2c 22 63 66 22 2c 22 63 67 22 2c 22 73 78 22 2c 22 63 69 22 2c 22 73 79 22 2c 22 73 7a 22 2c 22 63 6b 22 2c 22 63 6c 22 2c 22 63 6d 22 2c 22 63 6e 22 2c 22 63 6f 22 2c 22 63 72 22 2c 22 74 63 22 2c 22 74 64 22 2c 22 63 75 22 2c 22 74 66 22 2c 22 63 76 22 2c 22 74 67 22 2c 22 74 68 22 2c 22 63 77 22 2c 22 63 78 22 2c 22 Data Ascii: bj","bl","bm","bn","bo","sa","sb","bq","br","sc","sd","bs","bt","sg","bv","bw","sh","sj","by","bz","sl","sn","so","ca","sr","ss","cc","st","cd","sv","cf","cg","sx","ci","sy","sz","ck","cl","cm","cn","co","cr","tc","td","cu","tf","cv","tg","th","cw","cx","
2024-11-15 14:59:19 UTC	1369	IN	Data Raw: 2e 30 36 31 36 38 35 38 37 35 22 2c 22 63 6d 70 49 64 22 3a 22 32 38 22 2c 22 63 6d 70 56 65 72 73 69 6f 6e 22 3a 22 31 22 2c 22 63 6f 6e 73 65 6e 74 53 63 72 65 65 6e 22 3a 22 31 22 2c 22 63 6f 6e 73 65 6e 74 4c 61 6e 67 75 61 67 65 22 3a 6e 75 6c 6c 2c 22 76 65 6e 64 6f 72 4c 69 73 74 56 65 72 73 69 6f 6e 22 3a 30 2c 22 6d 61 78 56 65 6e 64 6f 72 49 64 22 3a 30 2c 22 65 6e 63 6f 64 69 6e 67 54 79 70 65 22 3a 22 30 22 2c 22 67 6c 6f 62 61 6c 56 65 6e 64 6f 72 4c 69 73 74 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6f 6b 69 65 6c 61 77 2e 6f 72 67 2f 76 65 6e 64 6f 72 6c 69 73 74 2f 69 61 62 44 61 74 61 2e 6a 73 6f 6e 22 7d 2c 22 49 61 62 56 32 44 61 74 61 22 3a 7b 22 63 6f 6f 6b 69 65 56 65 72 73 69 6f 6e 22 3a 22 31 22 2c 22 63 72 65 61 Data Ascii: .061685875","cmpId":"28","cmpVersion":"1","consentScreen":"1","consentLanguage":null,"vendorListVersion":0,"maxVendorId":0,"encodingType":"0","globalVendorListUrl":"https://cdn.cookielaw.org/vendorlist/iabData.json"},"IabV2Data":{"cookieVersion":"1","crea
2024-11-15 14:59:19 UTC	457	IN	Data Raw: 6e 65 72 61 6c 56 65 6e 64 6f 72 73 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 50 50 22 3a 74 72 75 65 7d 2c 22 49 73 53 75 70 70 72 65 73 73 42 61 6e 6e 65 72 22 3a 66 61 6c 73 65 2c 22 49 73 53 75 70 70 72 65 73 73 50 43 22 3a 74 72 75 65 2c 22 50 75 62 6c 69 73 68 65 72 43 43 22 3a 22 55 53 22 2c 22 44 6f 6d 61 69 6e 22 3a 22 74 65 6c 65 72 69 6b 2e 63 6f 6d 22 2c 22 54 65 6e 61 6e 74 47 75 69 64 22 3a 22 30 37 62 30 35 63 64 66 2d 36 65 33 33 2d 34 62 32 39 2d 61 34 36 35 2d 37 36 38 31 33 39 65 62 33 34 38 65 22 2c 22 45 6e 76 49 64 22 3a 22 61 70 70 2d 70 72 6f 64 22 2c 22 52 65 6d 6f 74 65 41 63 74 69 6f 6e 73 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 47 65 6f 52 75 6c 65 47 72 6f 75 70 4e 61 6d 65 22 3a 22 54 65 6c 65 72 69 6b 2e 43 Data Ascii: neralVendors":true,"CookieV2GPP":true},"IsSuppressBanner":false,"IsSuppressPC":true,"PublisherCC":"US","Domain":"telerik.com","TenantGuid":"07b05cdf-6e33-4b29-a465-768139eb348e","EnvId":"app-prod","RemoteActionsEnabled":false,"GeoRuleGroupName":"Telerik.C
2024-11-15 14:59:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49742	50.56.19.112	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:19 UTC	647	OUT	GET /webapi/Announcements/GetPromo?url=https://www.telerik.com/download/fiddler/first-run HTTP/1.1 Host: www.telerik.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.telerik.com/download/fiddler/first-run Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:19 UTC	452	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 35 Content-Type: application/json; charset=utf-8 Expires: -1 Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: http://localconverter.telerik.com Date: Fri, 15 Nov 2024 14:59:19 GMT Connection: close
2024-11-15 14:59:19 UTC	35	IN	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 70 72 6f 6d 6f 56 69 65 77 4d 6f 64 65 6c 22 3a 6e 75 6c 6c 7d 7d Data Ascii: {"content":{"promoViewModel":null}}

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:21 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:22 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:21 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: db45c3c2-701e-0053-2e8e-363a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145921Z-164f84587bf7k72dhC1DFWvczs00000001a000000000mh9y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:22 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:21 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:22 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:21 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: a31f2de1-f01e-0096-7209-2d10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145921Z-16547b76f7fknvdnhC1DFWxnys0000000n7000000000py96 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:22 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:21 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:22 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:21 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: dcc6854f-e01e-0051-7b03-2d84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145921Z-16547b76f7fr28cchC1DFWnuws0000000nc000000000fwdp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:22 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:21 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:22 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:21 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 053649b2-001e-00ad-26a0-34554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145921Z-164f84587bf5rpzqhC1DFWmra800000001a000000000p97w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:22 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:21 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:22 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:21 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 6c84f393-101e-007a-65a5-36047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145921Z-1866b5c5fbbccpxfhC1DFWbkng000000019g00000000m3f0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:22 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49740	18.66.107.176	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:22 UTC	677	OUT	GET /Frontend-Assembly/Web.SitefinityExtensions.EloquaConnector/Scripts/SetBrowserSessionStorage.min.js?package=PureMvc&v=SURNTlNWL0Q2UU9sSFp4Z2dmYnp0UT09) HTTP/1.1 Host: d585tldpucybw.cloudfront.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:22 UTC	769	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 998 Connection: close Cache-Control: public, max-age=64378 Expires: Fri, 22 Nov 2024 08:52:20 GMT Last-Modified: Wed, 16 Oct 2024 11:44:58 GMT Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: http://localconverter.telerik.com Date: Fri, 15 Nov 2024 14:59:22 GMT Vary: Accept-Encoding,Cookie X-Cache: Miss from cloudfront Via: 1.1 0162e02b2d0212054988a68716227daa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P5 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: S1bYkRY_1aynGYM0ICpr92Qezsp0UsktLfOiGtnUvDrbXlWwz9HKjQ==
2024-11-15 14:59:22 UTC	998	IN	Data Raw: 77 69 6e 64 6f 77 2e 69 6e 76 6f 6b 65 54 72 61 63 6b 69 6e 67 53 63 72 69 70 74 28 74 68 69 73 2c 4f 70 74 61 6e 6f 6e 47 72 6f 75 70 73 2e 50 65 72 66 6f 72 6d 61 6e 63 65 43 6f 6f 6b 69 65 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 69 3d 22 61 64 57 6f 72 64 73 44 61 74 61 22 2c 6e 3d 22 65 78 70 54 72 61 63 6b 69 6e 67 22 3b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 7d 77 69 6e 64 6f 77 2e 62 72 6f 77 73 65 72 53 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 72 65 61 64 28 6e 29 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 74 2c 69 29 7b 76 61 72 20 72 3d 77 69 6e 64 6f 77 2e 62 72 6f 77 73 65 72 53 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 72 65 61 64 28 6e 29 3b 72 3d 72 3f 72 3a 7b Data Ascii: window.invokeTrackingScript(this,OptanonGroups.PerformanceCookies,function(){var i="adWordsData",n="expTracking";function e(){dataLayer.push(arguments)}window.browserSessionStorage.read(n);function o(t,i){var r=window.browserSessionStorage.read(n);r=r?r:{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49743	152.199.21.175	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:22 UTC	598	OUT	GET /sdk/sitefinity-insight-client.min.3.1.13.js HTTP/1.1 Host: cdn.insight.sitefinity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.telerik.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:22 UTC	644	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,x-ms-version Age: 81825 Cache-Control: max-age=604800 Content-MD5: 9ZCBkCxA3QMDG4yWQdr1rw== Content-Type: application/javascript Date: Fri, 15 Nov 2024 14:59:22 GMT Etag: 0x8DCEEC68191A198 Expires: Fri, 22 Nov 2024 14:59:22 GMT Last-Modified: Thu, 17 Oct 2024 16:12:32 GMT Server: ECAcc (lhc/78BB) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 009dcb23-301e-0070-42b0-369eea000000 x-ms-version: 2009-09-19 Content-Length: 53449 Connection: close
2024-11-15 14:59:22 UTC	16383	IN	Data Raw: 76 61 72 20 73 66 44 61 74 61 49 6e 74 65 6c 6c 3d 73 66 44 61 74 61 49 6e 74 65 6c 6c 7c 7c 7b 7d 3b 73 66 44 61 74 61 49 6e 74 65 6c 6c 2e 63 6f 6e 73 74 61 6e 74 73 3d 7b 73 64 6b 56 65 72 73 69 6f 6e 3a 22 6a 73 2d 33 2e 31 2e 34 31 22 2c 63 6f 6f 6b 69 65 4e 61 6d 65 3a 22 73 66 2d 64 61 74 61 2d 69 6e 74 65 6c 6c 2d 73 75 62 6a 65 63 74 22 2c 64 6f 63 73 43 6f 6f 6b 69 65 4e 61 6d 65 3a 22 73 66 2d 69 6e 73 2d 6c 73 74 2d 64 6f 63 2d 74 72 63 6b 64 22 2c 73 65 73 73 69 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 3a 22 73 66 2d 69 6e 73 2d 73 73 69 64 22 2c 70 61 67 65 56 69 73 69 74 49 64 43 6f 6f 6b 69 65 4e 61 6d 65 3a 22 73 66 2d 69 6e 73 2d 70 76 2d 69 64 22 2c 73 66 54 72 61 63 6b 69 6e 67 49 64 73 53 74 6f 72 61 67 65 4b 65 79 3a 22 73 66 2d 74 72 2d Data Ascii: var sfDataIntell=sfDataIntell\|\|{};sfDataIntell.constants={sdkVersion:"js-3.1.41",cookieName:"sf-data-intell-subject",docsCookieName:"sf-ins-lst-doc-trckd",sessionCookieName:"sf-ins-ssid",pageVisitIdCookieName:"sf-ins-pv-id",sfTrackingIdsStorageKey:"sf-tr-
2024-11-15 14:59:22 UTC	16383	IN	Data Raw: 7a 65 43 72 6f 73 73 44 6f 6d 61 69 6e 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 22 69 6e 73 69 67 68 74 2d 78 2d 64 6f 6d 61 69 6e 2d 68 75 62 22 2c 63 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 66 72 61 6d 65 22 29 3b 63 2e 73 72 63 3d 74 68 69 73 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 54 72 61 63 6b 69 6e 67 48 75 62 49 6e 73 74 72 75 6d 65 6e 74 61 74 69 6f 6e 55 72 6c 2c 63 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 62 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 2e 68 61 73 53 74 6f 72 61 67 65 41 63 63 65 73 73 3f 63 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 61 6e 64 62 6f 78 22 2c 22 61 6c 6c 6f 77 2d Data Ascii: zeCrossDomainCommunication:function(a){var b="insight-x-domain-hub",c=document.createElement("iframe");c.src=this.crossDomainTrackingHubInstrumentationUrl,c.setAttribute("id",b),"function"==typeof document.hasStorageAccess?c.setAttribute("sandbox","allow-
2024-11-15 14:59:22 UTC	2	IN	Data Raw: 50 6c Data Ascii: Pl
2024-11-15 14:59:22 UTC	16383	IN	Data Raw: 61 79 65 72 3f 61 28 29 3a 62 28 61 29 7d 7d 7d 7d 28 73 66 44 61 74 61 49 6e 74 65 6c 6c 29 3b 76 61 72 20 73 66 44 61 74 61 49 6e 74 65 6c 6c 3d 73 66 44 61 74 61 49 6e 74 65 6c 6c 7c 7c 7b 7d 3b 21 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 2e 46 65 74 63 68 43 6c 69 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 73 75 62 6a 65 63 74 3d 61 2e 73 75 62 6a 65 63 74 2c 74 68 69 73 2e 63 6f 6c 6c 65 63 74 45 6e 64 70 6f 69 6e 74 55 72 6c 3d 73 66 44 61 74 61 49 6e 74 65 6c 6c 2e 75 74 69 6c 73 2e 67 65 74 45 6e 64 70 6f 69 6e 74 55 72 6c 28 61 2e 61 70 69 53 65 72 76 65 72 55 72 6c 2c 61 2e 61 70 69 4b 65 79 2c 61 2e 73 6f 75 72 63 65 29 2c 74 68 69 73 2e 73 65 73 73 69 6f 6e 49 64 3d 61 2e 73 65 73 73 69 6f 6e 49 64 2c 74 68 69 73 2e 70 61 67 Data Ascii: ayer?a():b(a)}}}}(sfDataIntell);var sfDataIntell=sfDataIntell\|\|{};!function(a){a.FetchClient=function(a){this.subject=a.subject,this.collectEndpointUrl=sfDataIntell.utils.getEndpointUrl(a.apiServerUrl,a.apiKey,a.source),this.sessionId=a.sessionId,this.pag
2024-11-15 14:59:22 UTC	4298	IN	Data Raw: 6a 65 63 74 4b 65 79 3b 76 61 72 20 65 3d 7b 7d 3b 65 5b 73 66 44 61 74 61 49 6e 74 65 6c 6c 2e 63 6f 6e 73 74 61 6e 74 73 2e 68 65 61 64 65 72 73 2e 64 61 74 61 73 6f 75 72 63 65 5d 3d 74 68 69 73 2e 64 61 74 61 73 6f 75 72 63 65 2c 65 5b 73 66 44 61 74 61 49 6e 74 65 6c 6c 2e 63 6f 6e 73 74 61 6e 74 73 2e 68 65 61 64 65 72 73 2e 73 75 62 6a 65 63 74 5d 3d 64 2c 65 5b 73 66 44 61 74 61 49 6e 74 65 6c 6c 2e 63 6f 6e 73 74 61 6e 74 73 2e 68 65 61 64 65 72 73 2e 69 64 73 5d 3d 61 2c 74 68 69 73 2e 63 61 6c 6c 28 22 2f 61 6e 61 6c 79 74 69 63 73 2f 76 31 2f 73 63 6f 72 69 6e 67 73 2f 70 65 72 73 6f 6e 61 73 2f 69 6e 22 2c 65 2c 62 2c 63 29 7d 7d 7d 28 73 66 44 61 74 61 49 6e 74 65 6c 6c 29 3b 76 61 72 20 73 66 44 61 74 61 49 6e 74 65 6c 6c 3d 73 66 44 61 74 Data Ascii: jectKey;var e={};e[sfDataIntell.constants.headers.datasource]=this.datasource,e[sfDataIntell.constants.headers.subject]=d,e[sfDataIntell.constants.headers.ids]=a,this.call("/analytics/v1/scorings/personas/in",e,b,c)}}}(sfDataIntell);var sfDataIntell=sfDat

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49745	18.245.206.63	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:22 UTC	731	OUT	GET /cache/3771543484f465487bb9712eed986edeb1f314a2/telerik/iconfont/tlrk-icon-font-dc6cff9dd8.woff2 HTTP/1.1 Host: dtzbdy9anri2p.cloudfront.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.telerik.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://dtzbdy9anri2p.cloudfront.net/cache/3771543484f465487bb9712eed986edeb1f314a2/telerik/css/style.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:22 UTC	599	IN	HTTP/1.1 200 OK Content-Type: font/woff2 Content-Length: 12144 Connection: close Cache-Control: public,max-age=31536000 Last-Modified: Wed, 06 Nov 2024 17:14:32 GMT Accept-Ranges: bytes Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 06 Nov 2024 17:32:58 GMT X-Cache: Hit from cloudfront Via: 1.1 e631e36c34143e8e968e1b1f67c45cce.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LHR5-P3 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: gRKllufX0SiXPeXk238kxcjaJpNfLu1MYD7UeV-flYBjaY6XQ9BiPQ== Age: 768384
2024-11-15 14:59:22 UTC	12144	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 2f 70 00 0b 00 00 00 00 6c e8 00 00 2f 1e 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 54 06 56 00 8e 20 0a 81 b4 54 81 9b 1d 01 36 02 24 03 83 28 0b 81 56 00 04 20 05 84 5e 07 89 2d 1b 93 5e 75 c6 1c 6c 1c 30 20 f3 be 8d 22 2a 56 c5 28 4a e6 a8 94 fd ff 1f 93 93 c3 96 ab dc 71 90 e3 60 08 ef fc 20 64 50 a5 86 84 4d f1 d5 92 6a 95 01 17 43 6f 4a ac ba 8b 0e f4 a7 fa b2 69 a2 0f f3 90 31 1a 7e ba da c2 c4 f7 d3 7b 4b 54 22 7a 52 90 1e 99 fd fa 95 61 79 63 b5 0a 31 b1 ba 19 0d eb 5e 76 7b 3c 64 e2 88 46 9d 1d 92 14 4d fe 01 ee e5 77 de 6f ac 31 49 a2 40 32 0f 24 e0 db f2 28 a8 b1 d5 ac 82 e2 4f 8a 57 72 3e 10 c0 6d 33 8e 07 a5 a2 15 02 db 76 23 91 58 a7 25 13 7b 08 80 4d ad df 5f b9 17 ee a2 d9 a2 Data Ascii: wOF2/pl/TV T6$(V ^-^ul0 "*V(Jq` dPMjCoJi1~{KT"zRayc1^v{<dFMwo1I@2$(OWr>m3v#X%{M_

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:24 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:24 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:24 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 2cc20079-501e-00a0-320a-369d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145924Z-164f84587bf7jb9dhC1DFWkay40000000140000000009k3v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:24 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49754	104.18.32.137	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:24 UTC	597	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.telerik.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:24 UTC	370	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:24 GMT Content-Type: application/json Content-Length: 66 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8e301add8f6d2cdc-DFW
2024-11-15 14:59:24 UTC	66	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 54 58 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 54 65 78 61 73 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d Data Ascii: {"country":"US","state":"TX","stateName":"Texas","continent":"NA"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49759	50.56.19.112	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:25 UTC	1152	OUT	GET /RestApi/personalizations/render?pageNodeId=5ceb4be1-05bd-4c69-892a-2c2bbd37538b&pageDataId=1f960fad-aef2-4475-8978-52fb7a29dbc9&pageNodeKey=5CEB4BE1-05BD-4C69-892A-2C2BBD37538B/b31ca85c-a1c5-4a9d-8b5d-e7b0736a8b16/SitefinitySiteMap&url=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&controls=09f9bb4f-5990-40af-b361-7849c73c9604_1,0cd3f511-e7d9-4e23-8773-26005ae09893_1,25637a62-a321-49a0-8b7e-5962dc977e95_1,6b5ac4dc-8fd0-4043-bd0a-e9ffd31e3bc8_1&correlationId=m3iv7avxzpfywghsi2 HTTP/1.1 Host: www.telerik.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 SF_NO_URL_REFERER: true User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/json; charset=utf-8 Accept: application/json X-Requested-With: XMLHttpRequest sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.telerik.com/download/fiddler/first-run Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:25 UTC	467	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/json; charset=utf-8 Expires: -1 Vary: Accept Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: http://localconverter.telerik.com Date: Fri, 15 Nov 2024 14:59:25 GMT Content-Length: 953 Connection: close
2024-11-15 14:59:25 UTC	953	IN	Data Raw: 5b 7b 22 43 6f 6e 74 72 6f 6c 49 64 22 3a 22 30 39 66 39 62 62 34 66 2d 35 39 39 30 2d 34 30 61 66 2d 62 33 36 31 2d 37 38 34 39 63 37 33 63 39 36 30 34 22 2c 22 43 6f 6e 74 65 6e 74 22 3a 22 3c 68 72 20 63 6c 61 73 73 3d 5c 22 75 2d 6d 74 34 20 75 2d 6d 62 36 5c 22 20 2f 3e 3c 68 32 3e 44 6f 20 79 6f 75 20 6e 65 65 64 20 74 6f 20 62 75 69 6c 64 20 63 6f 6d 70 6c 65 78 20 55 49 20 66 61 73 74 3f 20 3c 2f 68 32 3e 22 7d 2c 7b 22 43 6f 6e 74 72 6f 6c 49 64 22 3a 22 30 63 64 33 66 35 31 31 2d 65 37 64 39 2d 34 65 32 33 2d 38 37 37 33 2d 32 36 30 30 35 61 65 30 39 38 39 33 22 2c 22 43 6f 6e 74 65 6e 74 22 3a 22 5c 72 5c 6e 5c 72 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 75 2d 74 61 72 5c 22 3e 5c 72 5c 6e 20 20 20 20 20 Data Ascii: [{"ControlId":"09f9bb4f-5990-40af-b361-7849c73c9604","Content":"<hr class=\"u-mt4 u-mb6\" /><h2>Do you need to build complex UI fast? </h2>"},{"ControlId":"0cd3f511-e7d9-4e23-8773-26005ae09893","Content":"\r\n\r\n <div class=\"u-tar\">\r\n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49760	50.56.19.112	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:25 UTC	620	OUT	GET /favicon.ico?v=rebv1 HTTP/1.1 Host: www.telerik.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telerik.com/download/fiddler/first-run Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:25 UTC	506	IN	HTTP/1.1 200 OK Cache-Control: max-age=2678400 Content-Type: image/x-icon Last-Modified: Wed, 16 Oct 2024 06:44:58 GMT Accept-Ranges: bytes ETag: "011a8ea961fdb1:0" Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: http://localconverter.telerik.com Date: Fri, 15 Nov 2024 14:59:24 GMT Content-Length: 21142 Connection: close
2024-11-15 14:59:25 UTC	13993	IN	Data Raw: 00 00 01 00 04 00 00 00 00 00 01 00 20 00 98 17 00 00 46 00 00 00 10 10 00 00 01 00 20 00 68 04 00 00 de 17 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 46 1c 00 00 30 30 00 00 01 00 20 00 a8 25 00 00 ee 2c 00 00 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 06 00 00 00 5c 72 a8 66 00 00 17 5f 49 44 41 54 78 9c ed 9d 79 dc 9e e3 95 c7 4f aa 54 85 b4 68 69 6a 69 c4 d2 0a 51 d5 b1 2f b1 54 33 68 3b 96 5a aa d5 aa 9d 62 c4 0c 52 aa d6 aa 41 a4 a5 44 45 69 ab 35 96 22 e8 42 4d 47 82 d0 a2 2a 24 48 67 46 33 8a 31 43 33 98 69 55 8b f4 fc 7a 72 7f f2 92 27 6f 9e fb 79 ae fb 3e d7 f2 fb 7e 3e bf 7f 78 df e7 3e 49 de fb bc d7 b9 ce 36 64 de bc 79 42 08 29 93 b7 78 1b 40 08 f1 e3 ad dd 7c d1 7e 4f 0f 69 da 0e d2 3c 4b a8 f6 52 ed ae fa a0 Data Ascii: F h F00 %,PNGIHDR\rf_IDATxyOThijiQ/T3h;ZbRADEi5"BMG*$HgF31C3iUzr'oy>~>x>I6dyB)x@\|~Oi<KR
2024-11-15 14:59:25 UTC	5792	IN	Data Raw: ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c dd ff ff ff 00 ff ff ff 00 ff ff ff 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 2e 00 e4 5c ce 00 e4 5c ff 00 e4 5c ff 00 e4 5c cd 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 41 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c b7 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 5e 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c dd ff ff ff 00 ff ff ff 00 ff ff ff 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 Data Ascii: \\\\\\\\\\\\\\\\\.\\\\\\\\\A\\\\\\\\\\\\\\\\^\\\\\\\\\\\\\\\
2024-11-15 14:59:25 UTC	1357	IN	Data Raw: 00 00 e4 5c 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 7d 00 e4 5c fd 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ee 00 e4 5c 5d 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 Data Ascii: \\\\\\\\\\\\\\\\\}\\\\\\\\\\\\\\\]\\\\\\\\\\\\\\\\\\\\\\\\\

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:25 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:25 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 48bb68ea-401e-0016-35ff-2c53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145925Z-16547b76f7frbg6bhC1DFWr5400000000n6g00000000d854 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:25 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:25 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: b0dd9ec7-701e-0001-4e30-36b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145925Z-1866b5c5fbbldb6rhC1DFW4bew00000001pg00000000a2c8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:25 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:25 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:25 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: ad5ef595-c01e-0082-42a3-34af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145925Z-164f84587bfbvgrghC1DFWbs7w000000017g00000000qh33 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:25 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:25 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:25 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: a2886317-b01e-00ab-6c01-2ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145925Z-16547b76f7fr28cchC1DFWnuws0000000nc000000000fwmt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:25 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49762	104.18.86.42	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:25 UTC	557	OUT	GET /scripttemplates/202401.2.0/otBannerSdk.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:25 UTC	948	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:25 GMT Content-Type: application/javascript Content-Length: 439670 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cf-Bgj: minify Cf-Polished: origSize=439756 Content-MD5: /uAp/tjl0E0OrWvE5WYCuw== ETag: 0x8DCA5DDD9C832F7 Last-Modified: Tue, 16 Jul 2024 21:25:43 GMT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 3fbe50a0-201e-00d7-5d09-24d9ad000000 x-ms-version: 2009-09-19 Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 23211 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Cross-Origin-Resource-Policy: cross-origin Server: cloudflare CF-RAY: 8e301ae49afde7b7-DFW
2024-11-15 14:59:25 UTC	421	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 4e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 4e 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 28 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 74 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 74 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 6f 29 26 26 28 65 5b 6f 5d 3d 74 5b 6f 5d 29 7d 29 29 28 65 2c 74 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 44 28 65 2c 74 29 7b 69 66 28 22 66 75 6e 63 Data Ascii: !function(){"use strict";var N=function(e,t){return(N=Object.setPrototypeOf\|\|({__proto__:[]}instanceof Array?function(e,t){e.__proto__=t}:function(e,t){for(var o in t)Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o])}))(e,t)};function D(e,t){if("func
2024-11-15 14:59:25 UTC	1369	IN	Data Raw: 6c 3d 3d 3d 74 3f 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 29 3a 28 6f 2e 70 72 6f 74 6f 74 79 70 65 3d 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 65 77 20 6f 29 7d 76 61 72 20 48 2c 52 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 52 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6f 3d 31 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 3c 6e 3b 6f 2b 2b 29 66 6f 72 28 76 61 72 20 72 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 72 29 26 26 28 65 5b 72 5d 3d 74 5b 72 5d 29 3b 72 65 74 75 72 6e 20 65 7d 29 2e 61 70 70 6c 79 28 74 68 69 73 Data Ascii: l===t?Object.create(t):(o.prototype=t.prototype,new o)}var H,R=function(){return(R=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this
2024-11-15 14:59:25 UTC	1369	IN	Data Raw: 2e 6c 61 62 65 6c 3c 61 5b 31 5d 29 6c 2e 6c 61 62 65 6c 3d 61 5b 31 5d 2c 61 3d 74 3b 65 6c 73 65 7b 69 66 28 21 28 61 26 26 6c 2e 6c 61 62 65 6c 3c 61 5b 32 5d 29 29 7b 61 5b 32 5d 26 26 6c 2e 6f 70 73 2e 70 6f 70 28 29 2c 6c 2e 74 72 79 73 2e 70 6f 70 28 29 3b 63 6f 6e 74 69 6e 75 65 7d 6c 2e 6c 61 62 65 6c 3d 61 5b 32 5d 2c 6c 2e 6f 70 73 2e 70 75 73 68 28 74 29 7d 7d 74 3d 72 2e 63 61 6c 6c 28 6e 2c 6c 29 7d 63 61 74 63 68 28 65 29 7b 74 3d 5b 36 2c 65 5d 2c 73 3d 30 7d 66 69 6e 61 6c 6c 79 7b 69 3d 61 3d 30 7d 69 66 28 35 26 74 5b 30 5d 29 74 68 72 6f 77 20 74 5b 31 5d 3b 72 65 74 75 72 6e 7b 76 61 6c 75 65 3a 74 5b 30 5d 3f 74 5b 31 5d 3a 76 6f 69 64 20 30 2c 64 6f 6e 65 3a 21 30 7d 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 71 28 29 7b 66 6f 72 28 76 61 Data Ascii: .label<a[1])l.label=a[1],a=t;else{if(!(a&&l.label<a[2])){a[2]&&l.ops.pop(),l.trys.pop();continue}l.label=a[2],l.ops.push(t)}}t=r.call(n,l)}catch(e){t=[6,e],s=0}finally{i=a=0}if(5&t[0])throw t[1];return{value:t[0]?t[1]:void 0,done:!0}}}}function q(){for(va
2024-11-15 14:59:25 UTC	1369	IN	Data Raw: 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 29 29 7b 76 61 72 20 6f 3d 65 2e 74 68 65 6e 3b 69 66 28 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 4b 29 72 65 74 75 72 6e 20 74 2e 5f 73 74 61 74 65 3d 33 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 76 6f 69 64 20 58 28 74 29 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6f 29 72 65 74 75 72 6e 20 76 6f 69 64 20 24 28 28 6e 3d 6f 2c 72 3d 65 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 61 70 70 6c 79 28 72 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2c 74 29 7d 74 2e 5f 73 74 61 74 65 3d 31 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 58 28 74 29 7d 63 61 74 63 68 28 65 29 7b 4a 28 74 2c 65 29 7d 76 61 72 20 6e 2c 72 7d 66 75 6e 63 74 69 6f 6e 20 4a 28 65 2c 74 29 7b 65 2e 5f 73 74 61 74 65 3d 32 2c 65 2e 5f 76 61 Data Ascii: tion"==typeof e)){var o=e.then;if(e instanceof K)return t._state=3,t._value=e,void X(t);if("function"==typeof o)return void $((n=o,r=e,function(){n.apply(r,arguments)}),t)}t._state=1,t._value=e,X(t)}catch(e){J(t,e)}var n,r}function J(e,t){e._state=2,e._va
2024-11-15 14:59:25 UTC	1369	IN	Data Raw: 65 29 29 7b 76 61 72 20 6e 3d 65 2e 74 68 65 6e 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6e 29 72 65 74 75 72 6e 20 76 6f 69 64 20 6e 2e 63 61 6c 6c 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 28 6f 2c 65 29 7d 2c 69 29 7d 73 5b 6f 5d 3d 65 2c 30 3d 3d 2d 2d 61 26 26 72 28 73 29 7d 63 61 74 63 68 28 65 29 7b 69 28 65 29 7d 7d 28 65 2c 73 5b 65 5d 29 7d 29 7d 2c 4b 2e 72 65 73 6f 6c 76 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 4b 3f 74 3a 6e 65 77 20 4b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 28 74 29 7d 29 7d 2c 4b 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 72 65 74 75 Data Ascii: e)){var n=e.then;if("function"==typeof n)return void n.call(e,function(e){t(o,e)},i)}s[o]=e,0==--a&&r(s)}catch(e){i(e)}}(e,s[e])})},K.resolve=function(t){return t&&"object"==typeof t&&t.constructor===K?t:new K(function(e){e(t)})},K.reject=function(o){retu
2024-11-15 14:59:25 UTC	1369	IN	Data Raw: 65 21 3d 65 26 26 73 21 3d 73 29 72 65 74 75 72 6e 21 30 3b 69 2b 2b 7d 7d 72 65 74 75 72 6e 21 31 7d 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 7d 2c 5a 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 45 6e 64 73 57 69 74 68 50 6f 6c 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 64 73 57 69 74 68 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2c 22 65 6e 64 73 57 69 74 68 22 2c 7b 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 74 3e 74 68 69 73 2e 6c 65 6e 67 74 68 29 26 26 28 74 3d 74 68 69 73 2e 6c 65 6e 67 74 68 29 2c Data Ascii: e!=e&&s!=s)return!0;i++}}return!1},writable:!0,configurable:!0})},Z.prototype.initEndsWithPoly=function(){String.prototype.endsWith\|\|Object.defineProperty(String.prototype,"endsWith",{value:function(e,t){return(void 0===t\|\|t>this.length)&&(t=this.length),
2024-11-15 14:59:25 UTC	1369	IN	Data Raw: 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 7d 2c 5a 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 41 72 72 61 79 46 69 6c 6c 50 6f 6c 79 66 69 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6c 6c 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2c 22 66 69 6c 6c 22 2c 7b 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 6e 75 6c 6c 3d 3d 74 68 69 73 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 74 68 69 73 20 69 73 20 6e 75 6c 6c 20 6f 72 20 6e 6f 74 20 64 65 66 69 6e 65 64 22 29 3b 66 6f 72 28 76 61 72 20 74 3d 4f 62 6a 65 63 74 28 74 68 69 73 29 2c 6f 3d 74 2e 6c Data Ascii: writable:!0,configurable:!0})},Z.prototype.initArrayFillPolyfill=function(){Array.prototype.fill\|\|Object.defineProperty(Array.prototype,"fill",{value:function(e){if(null==this)throw new TypeError("this is null or not defined");for(var t=Object(this),o=t.l
2024-11-15 14:59:25 UTC	1369	IN	Data Raw: 5b 65 2e 42 61 6e 6e 65 72 53 61 76 65 53 65 74 74 69 6e 67 73 3d 35 5d 3d 22 42 61 6e 6e 65 72 53 61 76 65 53 65 74 74 69 6e 67 73 22 2c 65 5b 65 2e 43 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 69 6e 67 42 75 74 74 6f 6e 3d 36 5d 3d 22 43 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 69 6e 67 42 75 74 74 6f 6e 22 2c 28 65 3d 74 65 3d 74 65 7c 7c 7b 7d 29 5b 65 2e 42 61 6e 6e 65 72 3d 31 5d 3d 22 42 61 6e 6e 65 72 22 2c 65 5b 65 2e 50 43 3d 32 5d 3d 22 50 43 22 2c 65 5b 65 2e 41 50 49 3d 33 5d 3d 22 41 50 49 22 2c 28 65 3d 6f 65 3d 6f 65 7c 7c 7b 7d 29 2e 41 63 63 65 70 74 41 6c 6c 3d 22 41 63 63 65 70 74 41 6c 6c 22 2c 65 2e 52 65 6a 65 63 74 41 6c 6c 3d 22 52 65 6a 65 63 74 41 6c 6c 22 2c 65 2e 55 70 64 61 74 65 43 6f 6e Data Ascii: [e.BannerSaveSettings=5]="BannerSaveSettings",e[e.ContinueWithoutAcceptingButton=6]="ContinueWithoutAcceptingButton",(e=te=te\|\|{})[e.Banner=1]="Banner",e[e.PC=2]="PC",e[e.API=3]="API",(e=oe=oe\|\|{}).AcceptAll="AcceptAll",e.RejectAll="RejectAll",e.UpdateCon
2024-11-15 14:59:25 UTC	1369	IN	Data Raw: 20 41 6c 6c 6f 77 20 41 6c 6c 22 2c 65 5b 65 5b 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 52 65 6a 65 63 74 20 41 6c 6c 22 5d 3d 35 5d 3d 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 52 65 6a 65 63 74 20 41 6c 6c 22 2c 65 5b 65 5b 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 43 6f 6e 66 69 72 6d 22 5d 3d 36 5d 3d 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 43 6f 6e 66 69 72 6d 22 2c 65 5b 65 5b 22 47 50 43 20 76 61 6c 75 65 20 63 68 61 6e 67 65 64 22 5d 3d 37 5d 3d 22 47 50 43 20 76 61 6c 75 65 20 63 68 61 6e 67 65 64 22 2c 28 65 3d 68 65 3d 68 65 7c 7c 7b 7d 29 2e 41 63 74 69 76 65 3d 22 31 22 2c 65 2e 49 6e 41 63 74 69 76 65 3d 22 30 22 2c 28 65 3d 43 65 3d 43 65 7c 7c 7b 7d 29 Data Ascii: Allow All",e[e["Preference Center - Reject All"]=5]="Preference Center - Reject All",e[e["Preference Center - Confirm"]=6]="Preference Center - Confirm",e[e["GPC value changed"]=7]="GPC value changed",(e=he=he\|\|{}).Active="1",e.InActive="0",(e=Ce=Ce\|\|{})
2024-11-15 14:59:25 UTC	1369	IN	Data Raw: 69 74 5f 66 6f 72 5f 75 70 64 61 74 65 3d 22 77 61 69 74 5f 66 6f 72 5f 75 70 64 61 74 65 22 2c 28 65 3d 49 65 3d 49 65 7c 7c 7b 7d 29 2e 67 72 61 6e 74 65 64 3d 22 67 72 61 6e 74 65 64 22 2c 65 2e 64 65 6e 69 65 64 3d 22 64 65 6e 69 65 64 22 2c 30 2c 28 65 3d 4c 65 3d 4c 65 7c 7c 7b 7d 29 2e 4f 42 4a 45 43 54 5f 54 4f 5f 4c 49 3d 22 4f 62 6a 65 63 74 54 6f 4c 49 22 2c 65 2e 4c 49 5f 41 43 54 49 56 45 5f 49 46 5f 4c 45 47 41 4c 5f 42 41 53 49 53 3d 22 4c 49 41 63 74 69 76 65 49 66 4c 65 67 61 6c 42 61 73 69 73 22 2c 28 65 3d 5f 65 3d 5f 65 7c 7c 7b 7d 29 2e 63 6f 6f 6b 69 65 73 3d 22 63 6f 6f 6b 69 65 73 22 2c 65 2e 76 65 6e 64 6f 72 73 3d 22 76 65 6e 64 6f 72 73 22 2c 28 65 3d 45 65 3d 45 65 7c 7c 7b 7d 29 2e 47 44 50 52 3d 22 47 44 50 52 22 2c 65 2e 43 Data Ascii: it_for_update="wait_for_update",(e=Ie=Ie\|\|{}).granted="granted",e.denied="denied",0,(e=Le=Le\|\|{}).OBJECT_TO_LI="ObjectToLI",e.LI_ACTIVE_IF_LEGAL_BASIS="LIActiveIfLegalBasis",(e=_e=_e\|\|{}).cookies="cookies",e.vendors="vendors",(e=Ee=Ee\|\|{}).GDPR="GDPR",e.C

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:26 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:26 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:26 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 2e71ae26-601e-0097-6701-2df33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145926Z-16547b76f7fk9g8vhC1DFW825400000002800000000082vw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 14:59:26 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49763	2.19.244.127	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:26 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-15 14:59:27 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=179175 Date: Fri, 15 Nov 2024 14:59:27 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:29 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:29 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 7b6b90c0-b01e-0097-2509-374f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145929Z-1866b5c5fbb5hnj5hC1DFW18sc00000001pg000000005uuq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:29 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:29 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:29 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 30929569-101e-008d-79ff-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145929Z-16547b76f7fnlcwwhC1DFWz6gw0000000n8g00000000rmgc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:29 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:29 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:29 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:29 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 52c466ac-c01e-007a-7901-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145929Z-16547b76f7f9bs6dhC1DFWt3rg0000000n5000000000p1k5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:29 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49769	50.56.19.112	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:29 UTC	692	OUT	GET /sfimages/default-source/productsimages/kendo-ui-complete/kendoka_icon.png?sfvrsn=922435fb_2 HTTP/1.1 Host: www.telerik.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telerik.com/download/fiddler/first-run Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:30 UTC	558	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000 Content-Length: 2588 Content-Type: image/png Expires: Thu, 13 Feb 2025 14:59:30 GMT Last-Modified: Fri, 03 Sep 2021 08:38:14 GMT Content-Disposition: inline; filename=kendoka_icon.png Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: http://localconverter.telerik.com Date: Fri, 15 Nov 2024 14:59:29 GMT Connection: close
2024-11-15 14:59:30 UTC	2357	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 41 00 00 00 41 08 06 00 00 00 8e f7 c9 45 00 00 00 09 70 48 59 73 00 00 2e 23 00 00 2e 23 01 78 a5 3f 76 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 09 a9 49 44 41 54 78 da e5 9c 0b 94 55 63 14 c7 a7 c9 ab 64 35 a2 24 c4 10 12 b1 28 a2 c8 63 5a de 16 2a cf 22 89 56 79 2c 0b 95 b2 f2 58 88 3c 32 94 47 13 95 32 91 47 ad 68 2a 46 2a 66 a8 bc 52 11 11 c6 90 92 68 cc d0 4c d3 cc 5c fb b3 7e 5f f6 3d 9d 73 ee 39 f7 31 37 6b 5a eb bf ee dc 73 bf e7 fe f6 b7 f7 7f ef ef 3b 65 64 a4 f8 df 98 31 63 9a 08 7a 08 86 09 26 0a 8a 04 25 82 32 41 8d 20 c2 67 19 cf 8b 28 37 94 7a 4d 32 fe 8f ff 64 e0 fb 31 e9 45 82 2a 26 1a 2f aa 68 c7 b4 d7 66 Data Ascii: PNGIHDRAAEpHYs.#.#x?vtEXtSoftwareAdobe ImageReadyqe<IDATxUcd5$(cZ"Vy,X<2G2GhFfRhL\~_=s917kZs;ed1cz&%2A g(7zM2d1E&/hf
2024-11-15 14:59:30 UTC	231	IN	Data Raw: 5c 70 8b e0 2b 25 fc 8b 7c b6 6d 7c f7 18 55 23 9e 37 5a c9 22 2f 24 7c b6 58 8d e4 0d e7 7f 93 5c c1 12 56 78 12 2f 77 75 f2 e9 af 2d 99 e9 5a 2c f9 5d d8 a8 83 48 b1 4f 70 39 83 fc ca a3 ad c4 6f b4 ba c4 15 71 5d ed 8d b3 cf 0e 68 90 93 21 56 70 46 f1 0c a7 55 43 dd 98 66 52 ef 36 ab 46 03 dd 72 4f 51 04 da 03 46 9a 13 eb f5 c0 94 dd 72 f7 d0 88 c2 fa ba e9 1a 62 7c a9 7d df c1 61 23 3c df 7c 49 a3 00 ea e7 cd 17 87 d7 68 b8 ef 40 39 78 44 5e 83 7d 1b ce 85 62 3b df 8b 1c d5 20 de 8b 74 b1 c8 0d f7 0d 59 97 7c 44 cf 00 ef 4a f7 8e f1 ae 74 6f f5 ae 74 e9 ff e2 5d 69 0f 81 b4 69 90 6f cd c7 48 bc f6 80 dd ed 90 ff 7f c2 3f b6 1f ec 9e dd 07 b4 b8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: \p+%\|m\|U#7Z"/$\|X\Vx/wu-Z,]HOp9oq]h!VpFUCfR6FrOQFrb\|}a#<\|Ih@9xD^}b; tY\|DJtot]iioH?IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49771	104.18.86.42	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:29 UTC	634	OUT	GET /consent/3dfce4f2-dab6-4128-9f33-df7e0597da82/018f398d-e7fe-774d-a988-aae80a524894/en.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.telerik.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:30 UTC	982	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:30 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Ray: 8e301b00881d4868-DFW CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 68099 Cache-Control: public, max-age=86400 Expires: Sat, 16 Nov 2024 14:59:30 GMT Last-Modified: Tue, 25 Jun 2024 13:14:56 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: 82Fy1aYQlT3U+oTlLTFHBg== Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 0be26b14-601e-0053-564c-268f85000000 x-ms-version: 2009-09-19 Cross-Origin-Resource-Policy: cross-origin Server: cloudflare
2024-11-15 14:59:30 UTC	387	IN	Data Raw: 37 62 63 61 0d 0a 7b 22 44 6f 6d 61 69 6e 44 61 74 61 22 3a 7b 22 70 63 6c 69 66 65 53 70 61 6e 59 72 22 3a 22 59 65 61 72 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 73 22 3a 22 59 65 61 72 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 53 65 63 73 22 3a 22 41 20 66 65 77 20 73 65 63 6f 6e 64 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 22 3a 22 57 65 65 6b 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 73 22 3a 22 57 65 65 6b 73 22 2c 22 70 63 63 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 54 65 78 74 22 3a 22 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 6f 75 74 20 41 63 63 65 70 74 69 6e 67 22 2c 22 70 63 63 6c 6f 73 65 42 75 74 74 6f 6e 54 79 70 65 22 3a 22 49 63 6f 6e 22 2c 22 4d 61 69 6e 54 65 78 74 22 3a 22 50 72 69 76 61 63 79 20 50 72 65 Data Ascii: 7bca{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","pccloseButtonType":"Icon","MainText":"Privacy Pre
2024-11-15 14:59:30 UTC	1369	IN	Data Raw: 6d 20 6f 66 20 63 6f 6f 6b 69 65 73 2e 20 54 68 69 73 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 6d 69 67 68 74 20 62 65 20 61 62 6f 75 74 20 79 6f 75 2c 20 79 6f 75 72 20 70 72 65 66 65 72 65 6e 63 65 73 20 6f 72 20 79 6f 75 72 20 64 65 76 69 63 65 20 61 6e 64 20 69 73 20 6d 6f 73 74 6c 79 20 75 73 65 64 20 74 6f 20 6d 61 6b 65 20 74 68 65 20 73 69 74 65 20 77 6f 72 6b 20 61 73 20 79 6f 75 20 65 78 70 65 63 74 20 69 74 20 74 6f 2e 20 54 68 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 64 6f 65 73 20 6e 6f 74 20 75 73 75 61 6c 6c 79 20 64 69 72 65 63 74 6c 79 20 69 64 65 6e 74 69 66 79 20 79 6f 75 2c 20 62 75 74 20 69 74 20 63 61 6e 20 67 69 76 65 20 79 6f 75 20 61 20 6d 6f 72 65 20 70 65 72 73 6f 6e 61 6c 69 73 65 64 20 77 65 62 20 65 78 70 65 72 69 65 6e 63 65 Data Ascii: m of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalised web experience
2024-11-15 14:59:30 UTC	1369	IN	Data Raw: 5f 62 6c 61 6e 6b 5c 22 3e 43 6f 6f 6b 69 65 20 50 6f 6c 69 63 79 3c 2f 61 3e 20 66 6f 72 20 61 20 6d 6f 72 65 20 64 65 74 61 69 6c 65 64 20 64 65 73 63 72 69 70 74 69 6f 6e 20 61 6e 64 20 63 6c 69 63 6b 20 6f 6e 20 74 68 65 20 73 65 74 74 69 6e 67 73 20 62 75 74 74 6f 6e 20 74 6f 20 63 75 73 74 6f 6d 69 7a 65 20 68 6f 77 20 74 68 65 20 73 69 74 65 20 75 73 65 73 20 63 6f 6f 6b 69 65 73 20 66 6f 72 20 79 6f 75 2e 22 2c 22 41 6c 65 72 74 43 6c 6f 73 65 54 65 78 74 22 3a 22 43 6c 6f 73 65 22 2c 22 41 6c 65 72 74 4d 6f 72 65 49 6e 66 6f 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 53 65 74 74 69 6e 67 73 22 2c 22 43 6f 6f 6b 69 65 53 65 74 74 69 6e 67 42 75 74 74 6f 6e 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 53 65 74 74 69 6e 67 73 22 2c 22 41 6c 65 72 Data Ascii: _blank\">Cookie Policy</a> for a more detailed description and click on the settings button to customize how the site uses cookies for you.","AlertCloseText":"Close","AlertMoreInfoText":"Cookies Settings","CookieSettingButtonText":"Cookies Settings","Aler
2024-11-15 14:59:30 UTC	1369	IN	Data Raw: 6d 61 69 6e 20 6f 66 20 74 68 65 20 77 65 62 73 69 74 65 20 79 6f 75 20 61 72 65 20 76 69 73 69 74 69 6e 67 20 e2 80 93 20 66 6f 72 20 6f 75 72 20 61 64 76 65 72 74 69 73 69 6e 67 20 61 6e 64 20 6d 61 72 6b 65 74 69 6e 67 20 65 66 66 6f 72 74 73 2e 20 4d 6f 72 65 20 73 70 65 63 69 66 69 63 61 6c 6c 79 2c 20 77 65 20 75 73 65 20 63 6f 6f 6b 69 65 73 20 61 6e 64 20 6f 74 68 65 72 20 74 72 61 63 6b 69 6e 67 20 74 65 63 68 6e 6f 6c 6f 67 69 65 73 20 66 6f 72 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 70 75 72 70 6f 73 65 73 3a 22 2c 22 47 72 6f 75 70 73 22 3a 5b 7b 22 53 68 6f 77 49 6e 50 6f 70 75 70 22 3a 74 72 75 65 2c 22 53 68 6f 77 49 6e 50 6f 70 75 70 4e 6f 6e 49 41 42 22 3a 74 72 75 65 2c 22 53 68 6f 77 53 44 4b 4c 69 73 74 4c 69 6e 6b 22 3a 74 72 75 Data Ascii: main of the website you are visiting for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:","Groups":[{"ShowInPopup":true,"ShowInPopupNonIAB":true,"ShowSDKListLink":tru
2024-11-15 14:59:30 UTC	1369	IN	Data Raw: 74 72 69 63 74 6c 79 20 4e 65 63 65 73 73 61 72 79 20 43 6f 6f 6b 69 65 73 22 2c 22 47 72 6f 75 70 4e 61 6d 65 4f 54 54 22 3a 22 53 74 72 69 63 74 6c 79 20 4e 65 63 65 73 73 61 72 79 20 43 6f 6f 6b 69 65 73 22 2c 22 47 72 6f 75 70 4e 61 6d 65 22 3a 22 53 74 72 69 63 74 6c 79 20 4e 65 63 65 73 73 61 72 79 20 43 6f 6f 6b 69 65 73 22 2c 22 49 73 49 61 62 50 75 72 70 6f 73 65 22 3a 66 61 6c 73 65 2c 22 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 73 49 64 73 22 3a 5b 5d 2c 22 46 69 72 73 74 50 61 72 74 79 43 6f 6f 6b 69 65 73 22 3a 5b 7b 22 69 64 22 3a 22 63 38 34 63 30 63 32 62 2d 33 39 30 30 2d 34 65 35 37 2d 38 61 64 39 2d 38 65 31 33 63 61 39 39 63 35 30 31 22 2c 22 4e 61 6d 65 22 3a 22 4f 70 74 61 6e 6f 6e 41 6c 65 72 74 42 6f 78 43 6c 6f 73 65 64 22 2c 22 48 Data Ascii: trictly Necessary Cookies","GroupNameOTT":"Strictly Necessary Cookies","GroupName":"Strictly Necessary Cookies","IsIabPurpose":false,"GeneralVendorsIds":[],"FirstPartyCookies":[{"id":"c84c0c2b-3900-4e57-8ad9-8e13ca99c501","Name":"OptanonAlertBoxClosed","H
2024-11-15 14:59:30 UTC	1369	IN	Data Raw: 73 20 61 20 6e 6f 72 6d 61 6c 20 6c 69 66 65 73 70 61 6e 20 6f 66 20 6f 6e 65 20 79 65 61 72 2c 20 73 6f 20 74 68 61 74 20 72 65 74 75 72 6e 69 6e 67 20 76 69 73 69 74 6f 72 73 20 74 6f 20 74 68 65 20 73 69 74 65 20 77 69 6c 6c 20 68 61 76 65 20 74 68 65 69 72 20 70 72 65 66 65 72 65 6e 63 65 73 20 72 65 6d 65 6d 62 65 72 65 64 2e 20 49 74 20 63 6f 6e 74 61 69 6e 73 20 6e 6f 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 68 61 74 20 63 61 6e 20 69 64 65 6e 74 69 66 79 20 74 68 65 20 73 69 74 65 20 76 69 73 69 74 6f 72 2e 22 2c 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 Data Ascii: s a normal lifespan of one year, so that returning visitors to the site will have their preferences remembered. It contains no information that can identify the site visitor.","thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKe
2024-11-15 14:59:30 UTC	1369	IN	Data Raw: 70 74 69 6f 6e 22 3a 22 22 2c 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 38 36 34 66 36 30 65 62 2d 64 32 38 63 2d 34 37 30 31 2d 61 36 64 37 2d 36 36 64 65 31 63 61 30 65 36 66 37 22 2c 22 4e 61 6d 65 22 3a 22 41 53 50 2e 4e 45 54 5f 53 65 73 73 69 6f 6e 49 64 22 2c 22 48 6f 73 74 22 3a 22 64 65 6d 6f 73 2e 74 65 6c 65 72 69 6b 2e 63 6f 6d 22 2c 22 49 73 53 65 73 Data Ascii: ption":"","thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":"","DurationType":1,"category":null,"isThirdParty":false},{"id":"864f60eb-d28c-4701-a6d7-66de1ca0e6f7","Name":"ASP.NET_SessionId","Host":"demos.telerik.com","IsSes
2024-11-15 14:59:30 UTC	1369	IN	Data Raw: 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 61 31 37 36 35 35 31 65 2d 39 31 36 63 2d 34 31 65 63 2d 38 39 62 64 2d 39 32 36 31 32 34 62 31 30 30 32 64 22 2c 22 4e 61 6d 65 22 3a 22 73 66 2d 74 72 61 63 6b 69 6e 67 2d 63 6f 6e 73 65 6e 74 22 2c 22 48 6f 73 74 22 3a 22 77 77 77 2e 74 65 6c 65 72 69 6b 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 39 39 39 39 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 74 68 69 72 64 50 61 Data Ascii: ull,"thirdPartyKey":"","firstPartyKey":"","DurationType":1,"category":null,"isThirdParty":false},{"id":"a176551e-916c-41ec-89bd-926124b1002d","Name":"sf-tracking-consent","Host":"www.telerik.com","IsSession":false,"Length":"9999","description":"","thirdPa
2024-11-15 14:59:30 UTC	1369	IN	Data Raw: 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 61 65 31 34 30 64 34 64 2d 39 61 30 66 2d 34 63 65 64 2d 39 35 37 33 2d 38 32 65 62 33 62 35 33 37 62 37 39 22 2c 22 4e 61 6d 65 22 3a 22 65 6c 71 5f 73 75 62 6d 69 74 22 2c 22 48 6f 73 74 22 3a 22 77 77 77 2e 74 65 6c 65 72 69 6b 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 74 72 75 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 Data Ascii: rtyDescription":null,"patternKey":null,"thirdPartyKey":null,"firstPartyKey":null,"DurationType":1,"category":null,"isThirdParty":false},{"id":"ae140d4d-9a0f-4ced-9573-82eb3b537b79","Name":"elq_submit","Host":"www.telerik.com","IsSession":true,"Length":"0"
2024-11-15 14:59:30 UTC	1369	IN	Data Raw: 74 79 22 3a 66 61 6c 73 65 7d 5d 7d 2c 7b 22 48 6f 73 74 4e 61 6d 65 22 3a 22 73 65 72 76 69 63 65 2e 66 6f 72 63 65 2e 63 6f 6d 22 2c 22 44 69 73 70 6c 61 79 4e 61 6d 65 22 3a 22 73 65 72 76 69 63 65 2e 66 6f 72 63 65 2e 63 6f 6d 22 2c 22 48 6f 73 74 49 64 22 3a 22 48 33 32 31 22 2c 22 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 50 72 69 76 61 63 79 50 6f 6c 69 63 79 22 3a 22 22 2c 22 43 6f 6f 6b 69 65 73 22 3a 5b 7b 22 69 64 22 3a 22 32 36 62 36 30 36 34 35 2d 64 31 65 38 2d 34 37 65 64 2d 61 61 37 62 2d 66 35 61 31 61 65 30 62 33 66 30 32 22 2c 22 4e 61 6d 65 22 3a 22 43 6f 6f 6b 69 65 43 6f 6e 73 65 6e 74 50 6f 6c 69 63 79 22 2c 22 48 6f 73 74 22 3a 22 73 65 72 76 69 63 65 2e 66 6f 72 63 65 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a Data Ascii: ty":false}]},{"HostName":"service.force.com","DisplayName":"service.force.com","HostId":"H321","Description":"","PrivacyPolicy":"","Cookies":[{"id":"26b60645-d1e8-47ed-aa7b-f5a1ae0b3f02","Name":"CookieConsentPolicy","Host":"service.force.com","IsSession":

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:29 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:30 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:29 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 09da145b-201e-0033-5108-32b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145929Z-16547b76f7flf9g6hC1DFWmcx80000000au000000000fuey x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 14:59:30 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:30 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:30 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:30 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: def873b9-d01e-0065-46f7-2cb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145930Z-16547b76f7fr28cchC1DFWnuws0000000nfg00000000380v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:30 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:32 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:32 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 3faa7a2c-701e-001e-5709-37f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145932Z-16547b76f7f7lhvnhC1DFWa2k00000000n8g00000000557u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:32 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49776	104.18.86.42	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:32 UTC	597	OUT	GET /scripttemplates/202401.2.0/assets/otCommonStyles.css HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.telerik.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:32 UTC	915	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:32 GMT Content-Type: text/css Content-Length: 21756 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cf-Bgj: minify Cf-Polished: origSize=21778 Content-MD5: c7xAZ9MSGAobGaTYg/Qtag== ETag: 0x8DCA5DDDD4DD7B2 Last-Modified: Tue, 16 Jul 2024 21:25:49 GMT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 413ac3d6-601e-0053-0551-e38f85000000 x-ms-version: 2009-09-19 Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 64655 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Cross-Origin-Resource-Policy: cross-origin Server: cloudflare CF-RAY: 8e301b0ffdf72869-DFW
2024-11-15 14:59:32 UTC	454	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 7b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 74 72 75 73 74 2d 76 65 6e 64 6f 72 73 2d 6c 69 73 74 2d 68 61 6e 64 6c 65 72 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 63 6f 6c 6f 72 3a 23 31 66 39 36 64 62 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 74 Data Ascii: #onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:700;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .onet
2024-11-15 14:59:32 UTC	1369	IN	Data Raw: 61 63 63 65 70 74 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 72 65 6a 65 63 74 2d 61 6c 6c 2d 68 61 6e 64 6c 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 7b 6f 75 74 6c 69 6e 65 2d 6f 66 66 73 65 74 3a 31 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 62 6e 72 2d 77 2d 6c 6f 67 6f 20 2e 6f 74 2d 62 6e 72 2d 6c 6f 67 6f 7b 68 65 69 67 68 74 3a 36 34 70 78 3b 77 69 64 74 68 3a 36 34 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 74 63 66 32 2d 76 65 6e 64 6f 72 2d 63 6f 75 6e 74 2e 6f 74 2d 74 65 78 74 Data Ascii: accept-btn-handler,#onetrust-banner-sdk #onetrust-reject-all-handler,#onetrust-banner-sdk #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-tcf2-vendor-count.ot-text
2024-11-15 14:59:32 UTC	1369	IN	Data Raw: 2d 73 64 6b 20 61 5b 64 61 74 61 2d 70 61 72 65 6e 74 2d 69 64 5d 20 2a 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 33 20 2a 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 34 20 2a 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 36 20 2a 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 62 75 74 74 6f 6e 20 2a 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 61 5b 64 61 74 61 2d 70 61 72 65 6e 74 2d 69 64 5d 20 2a 7b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 74 2d 73 79 6e 63 Data Ascii: -sdk a[data-parent-id] ,#ot-sync-ntfy h3 ,#ot-sync-ntfy h4 ,#ot-sync-ntfy h6 ,#ot-sync-ntfy button ,#ot-sync-ntfy a[data-parent-id] {font-size:inherit;font-weight:inherit;color:inherit}#onetrust-banner-sdk .ot-hide,#onetrust-pc-sdk .ot-hide,#ot-sync
2024-11-15 14:59:32 UTC	1369	IN	Data Raw: 31 65 78 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 70 63 2d 6c 6f 67 6f 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 70 63 2d 6c 6f 67 6f 7b 68 65 69 67 68 74 3a 36 30 70 78 3b 77 69 64 74 68 3a 31 38 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 63 65 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 70 63 2d 6c 6f 67 6f 20 69 6d 67 2c 23 Data Ascii: 1ex}#onetrust-pc-sdk .pc-logo,#onetrust-pc-sdk .ot-pc-logo{height:60px;width:180px;background-position:center;background-size:contain;background-repeat:no-repeat;display:inline-flex;justify-content:center;align-items:center}#onetrust-pc-sdk .pc-logo img,#
2024-11-15 14:59:32 UTC	1369	IN	Data Raw: 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 74 6f 70 3a 30 3b 62 6f 74 74 6f 6d 3a 30 3b 6c 65 66 74 3a 30 7d 40 6b 65 79 66 72 61 6d 65 73 20 6f 6e 65 74 72 75 73 74 2d 66 61 64 65 2d 69 6e 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 7d 2e 6f 74 2d 63 6f 6f 6b 69 65 2d 6c 61 62 65 6c 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 34 32 36 70 78 29 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 38 39 36 70 78 29 61 6e 64 20 28 6f 72 69 65 6e 74 61 74 69 6f 6e 3a 6c 61 6e 64 73 63 61 Data Ascii: 100%;height:100%;overflow:hidden;position:fixed;top:0;bottom:0;left:0}@keyframes onetrust-fade-in{0%{opacity:0}100%{opacity:1}}.ot-cookie-label{text-decoration:underline}@media only screen and (min-width:426px)and (max-width:896px)and (orientation:landsca
2024-11-15 14:59:32 UTC	1369	IN	Data Raw: 73 69 67 6e 61 6c 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 69 63 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 69 63 6f 6e 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 7b 68 65 69 67 68 74 3a 32 30 70 78 3b 77 69 64 74 68 3a 33 30 70 78 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 2e 35 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 Data Ascii: signal .ot-optout-icon,#onetrust-pc-sdk .ot-optout-signal .ot-optout-icon{display:inline;margin-right:5px}#onetrust-banner-sdk .ot-optout-signal svg,#onetrust-pc-sdk .ot-optout-signal svg{height:20px;width:30px;transform:scale(.5)}#onetrust-banner-sdk .ot
2024-11-15 14:59:32 UTC	1369	IN	Data Raw: 61 6e 6e 65 72 2d 73 64 6b 20 74 64 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 74 62 6f 64 79 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 74 6f 67 67 6c 65 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 74 2d 63 6f 6e 74 65 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 64 69 76 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 73 70 61 6e 2c 23 6f Data Ascii: anner-sdk td,#onetrust-banner-sdk tbody,#onetrust-banner-sdk .ot-main-content,#onetrust-banner-sdk .ot-toggle,#onetrust-banner-sdk #ot-content,#onetrust-banner-sdk #ot-pc-content,#onetrust-banner-sdk .checkbox,#onetrust-pc-sdk div,#onetrust-pc-sdk span,#o
2024-11-15 14:59:32 UTC	1369	IN	Data Raw: 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 61 62 6c 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 68 65 61 64 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 72 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 64 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 62 6f 64 79 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 74 6f 67 67 6c 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 23 6f 74 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 Data Ascii: -cookie-policy table,#ot-sdk-cookie-policy thead,#ot-sdk-cookie-policy tr,#ot-sdk-cookie-policy td,#ot-sdk-cookie-policy tbody,#ot-sdk-cookie-policy .ot-main-content,#ot-sdk-cookie-policy .ot-toggle,#ot-sdk-cookie-policy #ot-content,#ot-sdk-cookie-policy
2024-11-15 14:59:32 UTC	1369	IN	Data Raw: 6e 64 65 78 3a 61 75 74 6f 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 Data Ascii: ndex:auto;box-shadow:none}#onetrust-banner-sdk label:before,#onetrust-banner-sdk label:after,#onetrust-banner-sdk .checkbox:after,#onetrust-banner-sdk .checkbox:before,#onetrust-pc-sdk label:before,#onetrust-pc-sdk label:after,#onetrust-pc-sdk .checkbox:a
2024-11-15 14:59:32 UTC	1369	IN	Data Raw: 64 74 68 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 Data Ascii: dth:100%}#onetrust-banner-sdk .ot-sdk-column,#onetrust-banner-sdk .ot-sdk-columns,#onetrust-pc-sdk .ot-sdk-column,#onetrust-pc-sdk .ot-sdk-columns,#ot-sdk-cookie-policy .ot-sdk-column,#ot-sdk-cookie-policy .ot-sdk-columns{margin-left:4%}#onetrust-banner-s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49777	104.18.86.42	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:32 UTC	590	OUT	GET /scripttemplates/202401.2.0/assets/otFlat.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.telerik.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:32 UTC	852	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:32 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Content-MD5: Rtw1HeKUT+s7FdllH11+Yg== Last-Modified: Tue, 16 Jul 2024 21:25:36 GMT x-ms-request-id: 09abe6bc-e01e-00c1-1a7d-d81833000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 6964 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Cross-Origin-Resource-Policy: cross-origin Server: cloudflare CF-RAY: 8e301b0ff9e63aa6-DFW
2024-11-15 14:59:32 UTC	517	IN	Data Raw: 33 35 32 65 0d 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 6f 74 46 6c 61 74 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 68 74 6d 6c 22 3a 20 22 50 47 52 70 64 69 42 70 5a 44 30 69 62 32 35 6c 64 48 4a 31 63 33 51 74 59 6d 46 75 62 6d 56 79 4c 58 4e 6b 61 79 49 67 59 32 78 68 63 33 4d 39 49 6d 39 30 52 6d 78 68 64 43 49 2b 50 47 52 70 64 69 42 79 62 32 78 6c 50 53 4a 68 62 47 56 79 64 47 52 70 59 57 78 76 5a 79 49 67 59 58 4a 70 59 53 31 6b 5a 58 4e 6a 63 6d 6c 69 5a 57 52 69 65 54 30 69 62 32 35 6c 64 48 4a 31 63 33 51 74 63 47 39 73 61 57 4e 35 4c 58 52 6c 65 48 51 69 50 6a 78 6b 61 58 59 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 58 4e 6b 61 79 31 6a 62 32 35 Data Ascii: 352e { "name": "otFlat", "html": "PGRpdiBpZD0ib25ldHJ1c3QtYmFubmVyLXNkayIgY2xhc3M9Im90RmxhdCI+PGRpdiByb2xlPSJhbGVydGRpYWxvZyIgYXJpYS1kZXNjcmliZWRieT0ib25ldHJ1c3QtcG9saWN5LXRleHQiPjxkaXYgY2xhc3M9Im90LXNkay1jb25
2024-11-15 14:59:32 UTC	1369	IN	Data Raw: 43 39 6f 4d 6a 34 38 5a 47 6c 32 49 47 6c 6b 50 53 4a 76 62 6d 56 30 63 6e 56 7a 64 43 31 77 62 32 78 70 59 33 6b 74 64 47 56 34 64 43 49 2b 64 47 6c 30 62 47 55 38 59 53 42 6f 63 6d 56 6d 50 53 49 6a 49 6a 35 77 62 32 78 70 59 33 6b 38 4c 32 45 2b 50 43 39 6b 61 58 59 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 5a 48 42 6b 4c 57 4e 76 62 6e 52 68 61 57 35 6c 63 69 49 2b 50 47 67 7a 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 6b 63 47 51 74 64 47 6c 30 62 47 55 69 50 6c 64 6c 49 47 4e 76 62 47 78 6c 59 33 51 67 5a 47 46 30 59 53 42 70 62 69 42 76 63 6d 52 6c 63 69 42 30 62 79 42 77 63 6d 39 32 61 57 52 6c 4f 6a 77 76 61 44 4d 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 5a 48 42 6b 4c 57 4e 76 62 6e 52 6c 62 6e 51 69 Data Ascii: C9oMj48ZGl2IGlkPSJvbmV0cnVzdC1wb2xpY3ktdGV4dCI+dGl0bGU8YSBocmVmPSIjIj5wb2xpY3k8L2E+PC9kaXY+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRhaW5lciI+PGgzIGNsYXNzPSJvdC1kcGQtdGl0bGUiPldlIGNvbGxlY3QgZGF0YSBpbiBvcmRlciB0byBwcm92aWRlOjwvaDM+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRlbnQi
2024-11-15 14:59:32 UTC	1369	IN	Data Raw: 6b 67 59 6d 46 75 62 6d 56 79 4c 57 4e 73 62 33 4e 6c 4c 57 4a 31 64 48 52 76 62 69 42 76 64 43 31 6a 62 47 39 7a 5a 53 31 70 59 32 39 75 49 6a 34 38 4c 32 4a 31 64 48 52 76 62 6a 34 38 4c 32 52 70 64 6a 34 38 49 53 30 74 49 45 4e 73 62 33 4e 6c 49 45 4a 31 64 48 52 76 62 69 42 46 54 6b 51 74 4c 54 34 38 4c 32 52 70 64 6a 34 38 4c 32 52 70 64 6a 34 3d 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 63 73 73 22 3a 20 22 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 31 38 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 32 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 46 6c 61 74 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 7a 2d 69 6e 64 65 78 3a 32 31 34 Data Ascii: kgYmFubmVyLWNsb3NlLWJ1dHRvbiBvdC1jbG9zZS1pY29uIj48L2J1dHRvbj48L2Rpdj48IS0tIENsb3NlIEJ1dHRvbiBFTkQtLT48L2Rpdj48L2Rpdj4=", "css": "#onetrust-banner-sdk{box-shadow:0 0 18px rgba(0,0,0,.2)}#onetrust-banner-sdk.otFlat{position:fixed;z-index:214
2024-11-15 14:59:32 UTC	1369	IN	Data Raw: 68 74 3a 62 6f 6c 64 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 70 6f 6c 69 63 79 2d 74 69 74 6c 65 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 70 6f 6c 69 63 79 2d 74 65 78 74 7b 63 6f 6c 6f 72 3a 64 69 6d 67 72 61 79 3b 66 6c 6f 61 74 3a 6c 65 66 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 2d 70 61 72 65 6e 74 7b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 Data Ascii: ht:bold;margin-left:5px}#onetrust-banner-sdk #onetrust-policy-title,#onetrust-banner-sdk #onetrust-policy-text{color:dimgray;float:left}#onetrust-banner-sdk #onetrust-button-group-parent{min-height:1px;text-align:center}#onetrust-banner-sdk #onetrust-butt
2024-11-15 14:59:32 UTC	1369	IN	Data Raw: 68 3a 63 61 6c 63 28 31 30 30 25 20 2d 20 31 65 6d 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 2d 69 6e 70 75 74 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 77 69 64 74 68 3a 61 75 74 6f 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 33 70 78 3b 6d 61 72 67 69 6e 3a 30 20 30 20 31 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 32 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 2d 69 6e 70 75 74 20 2a 7b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 66 6f 6e 74 Data Ascii: h:calc(100% - 1em)}#onetrust-banner-sdk .banner-option-input{cursor:pointer;width:auto;height:auto;border:none;padding:0;padding-right:3px;margin:0 0 10px;font-size:.82em;line-height:1.4}#onetrust-banner-sdk .banner-option-input *{pointer-events:none;font
2024-11-15 14:59:32 UTC	1369	IN	Data Raw: 68 74 3a 69 6e 68 65 72 69 74 3b 63 6f 6c 6f 72 3a 64 69 6d 67 72 61 79 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 61 72 72 6f 77 2d 63 6f 6e 74 61 69 6e 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 2d 64 65 74 61 69 6c 73 7b 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 3b 2d 6d 6f 7a 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 3b 2d 6f 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 7d 23 Data Ascii: ht:inherit;color:dimgray}#onetrust-banner-sdk .ot-arrow-container,#onetrust-banner-sdk .banner-option-details{transition:all 300ms ease-in 0s;-webkit-transition:all 300ms ease-in 0s;-moz-transition:all 300ms ease-in 0s;-o-transition:all 300ms ease-in 0s}#
2024-11-15 14:59:32 UTC	1369	IN	Data Raw: 73 69 7a 65 3a 2e 38 31 33 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 64 70 64 2d 64 65 73 63 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 64 70 64 2d 64 65 73 63 3e 2e 6f 74 2d 62 2d 61 64 64 6c 2d 64 65 73 63 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 34 32 35 70 78 29 7b 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 63 6c Data Ascii: size:.813em;line-height:1.5}#onetrust-banner-sdk .ot-dpd-desc{margin-bottom:10px}#onetrust-banner-sdk .ot-dpd-desc>.ot-b-addl-desc{margin-top:10px;margin-bottom:10px;font-size:1em}@media only screen and (max-width: 425px){#onetrust-banner-sdk #onetrust-cl
2024-11-15 14:59:32 UTC	1369	IN	Data Raw: 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 20 62 75 74 74 6f 6e 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 68 61 73 2d 72 65 6a 65 63 74 2d 61 6c 6c 2d 62 75 74 74 6f 6e 20 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 7b 66 6c 6f 61 74 3a 6c 65 66 74 7d Data Ascii: on:relative;margin-left:0}#onetrust-banner-sdk #onetrust-button-group button{display:inline-block}#onetrust-banner-sdk #onetrust-button-group{margin-right:0;text-align:center}#onetrust-banner-sdk .has-reject-all-button #onetrust-pc-btn-handler{float:left}
2024-11-15 14:59:32 UTC	1369	IN	Data Raw: 72 2d 73 64 6b 2e 6f 74 2d 69 61 62 2d 32 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 20 23 6f 6e 65 74 72 75 73 74 2d 72 65 6a 65 63 74 2d 61 6c 6c 2d 68 61 6e 64 6c 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 69 61 62 2d 32 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 20 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 7b 77 69 64 74 68 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 69 61 62 2d 32 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 20 23 6f 6e 65 74 72 75 73 74 2d 61 63 63 65 70 74 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d Data Ascii: r-sdk.ot-iab-2 #onetrust-button-group #onetrust-reject-all-handler,#onetrust-banner-sdk.ot-iab-2 #onetrust-button-group #onetrust-pc-btn-handler{width:100%}#onetrust-banner-sdk.ot-iab-2 #onetrust-button-group #onetrust-accept-btn-handler,#onetrust-banner-
2024-11-15 14:59:32 UTC	1369	IN	Data Raw: 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 36 30 25 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 2d 35 30 25 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 7b 77 69 64 74 68 3a 35 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 69 61 62 2d 32 20 23 6f 6e 65 74 72 75 73 74 2d 70 6f 6c 69 63 79 2d 74 69 74 6c 65 7b 77 69 64 74 68 3a 35 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 69 61 62 2d 32 20 23 6f 6e 65 74 72 75 73 74 2d 70 6f 6c 69 63 79 2d 74 65 78 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 69 61 62 2d 32 20 3a 6e Data Ascii: ition:absolute;top:50%;left:60%;transform:translateY(-50%)}#onetrust-banner-sdk .ot-optout-signal{width:50%}#onetrust-banner-sdk.ot-iab-2 #onetrust-policy-title{width:50%}#onetrust-banner-sdk.ot-iab-2 #onetrust-policy-text,#onetrust-banner-sdk.ot-iab-2 :n

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:32 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:32 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a5983e6-f01e-001f-229b-365dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145932Z-164f84587bf7k72dhC1DFWvczs00000001d000000000cqq1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:32 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:32 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:32 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: bd6b8569-001e-0034-58a8-36dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145932Z-1866b5c5fbbldb6rhC1DFW4bew00000001q00000000084g1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:32 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:32 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:32 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: cc46dee9-d01e-007a-0efd-2cf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145932Z-16547b76f7fk9g8vhC1DFW8254000000029000000000477n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:32 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49778	2.19.244.127	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:32 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-15 14:59:32 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=179114 Date: Fri, 15 Nov 2024 14:59:32 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-15 14:59:32 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:33 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 0e1cc1b7-001e-0066-7a9a-36561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145933Z-164f84587bf5rpzqhC1DFWmra8000000019g00000000qw41 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:33 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:33 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:33 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 250e4edf-c01e-002b-6cfb-366e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145933Z-16547b76f7fmbrhqhC1DFWkds80000000n6g00000000q5rx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:33 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:33 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:33 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: ab7d284a-001e-005a-348d-36c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145933Z-164f84587bfbvgrghC1DFWbs7w00000001a000000000f6c2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:33 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49784	192.29.11.142	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	554	OUT	GET /visitor/v200/svrGP?pps=70&siteid=1325 HTTP/1.1 Host: s1325.t.eloqua.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:34 UTC	792	IN	HTTP/1.1 302 Found Cache-Control: no-store Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Location: https://s1325.t.eloqua.com/visitor/v200/svrGP.aspx?pps=70&siteid=1325&elqCookie=1 X-Robots-Tag: noindex, nofollow X-Xss-Protection: 1; mode=block Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Set-Cookie: ELOQUA=GUID=556417D9DDDE4E9DB23F8F04730AE93B; domain=.eloqua.com; expires=Mon, 15-Dec-2025 14:59:34 GMT; path=/;SameSite=None; secure Set-Cookie: ELQSTATUS=OK; domain=.eloqua.com; expires=Mon, 15-Dec-2025 14:59:34 GMT; path=/;SameSite=None; secure P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", X-Content-Type-Options: nosniff Date: Fri, 15 Nov 2024 14:59:33 GMT Connection: close Content-Length: 206
2024-11-15 14:59:34 UTC	206	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 31 33 32 35 2e 74 2e 65 6c 6f 71 75 61 2e 63 6f 6d 2f 76 69 73 69 74 6f 72 2f 76 32 30 30 2f 73 76 72 47 50 2e 61 73 70 78 3f 70 70 73 3d 37 30 26 61 6d 70 3b 73 69 74 65 69 64 3d 31 33 32 35 26 61 6d 70 3b 65 6c 71 43 6f 6f 6b 69 65 3d 31 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://s1325.t.eloqua.com/visitor/v200/svrGP.aspx?pps=70&siteid=1325&elqCookie=1">here</a>.</h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49782	18.66.17.64	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	578	OUT	GET /external-assets/1.0.22/utils/store-lead-data.min.js HTTP/1.1 Host: d6vtbcy3ong79.cloudfront.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:34 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 1504 Connection: close Cache-Control: public,max-age=31536000 Last-Modified: Tue, 05 Nov 2024 09:34:34 GMT Accept-Ranges: bytes X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 06 Nov 2024 11:31:25 GMT Vary: Origin,Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 c172ad3d6658cab7ff64a4a64dca4822.cloudfront.net (CloudFront) X-Amz-Cf-Pop: VIE50-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: -ZeR009frMJ7jXpbJPdgbjZJEMs5TePHJaJ7zEBQjs9sQvmWq2Tv7Q== Age: 790089
2024-11-15 14:59:34 UTC	1504	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 68 29 7b 66 6f 72 28 76 61 72 20 63 3d 6e 75 6c 6c 2c 66 3d 68 2e 73 70 6c 69 74 28 22 26 22 29 2c 64 3d 30 3b 64 3c 66 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 62 3d 66 5b 64 5d 2e 73 70 6c 69 74 28 22 3d 22 29 3b 69 66 28 62 5b 30 5d 3d 3d 3d 65 29 72 65 74 75 72 6e 20 62 5b 31 5d 3b 22 52 65 74 75 72 6e 55 72 6c 22 3d 3d 3d 62 5b 30 5d 26 26 28 63 3d 62 5b 31 5d 29 7d 69 66 28 63 29 7b 76 61 72 20 67 3d 75 6e 65 73 63 61 70 65 28 63 29 2e 73 70 6c 69 74 28 22 3f 22 29 3b 69 66 28 67 2e 6c 65 6e 67 74 68 3e 31 29 72 65 74 75 72 6e 20 61 28 65 2c 67 5b 31 5d 29 7d 7d 76 61 72 20 6a 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 Data Ascii: !function(){"use strict";function a(e,h){for(var c=null,f=h.split("&"),d=0;d<f.length;d++){var b=f[d].split("=");if(b[0]===e)return b[1];"ReturnUrl"===b[0]&&(c=b[1])}if(c){var g=unescape(c).split("?");if(g.length>1)return a(e,g[1])}}var j=function(){for(v

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:34 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 27141677-f01e-003c-23af-368cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145934Z-1866b5c5fbbfkdfghC1DFW4sv400000000dg000000006h0q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:34 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:34 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:34 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: d36f9ca3-a01e-0021-21af-36814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145934Z-16547b76f7fj5p7mhC1DFWf8w40000000ne0000000008upt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:34 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49792	50.56.19.112	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	1256	OUT	GET /WebResource.axd?d=HtQyXelCu6mzSPcVcvK_BiMPfgaXcXtBpU_p4oPRWdaaTkgqeBOpXuu1TRv9pAGD-FAzjGGeBeqirrj8SJpv3YU7eO6rv9kziBqvktqcdZzC15nZHrag4kg_mMMtSYLloBTL1HIRNuD4Iepyub_zCpOjm9RyH4DXkI1YDpCN_mnfRNsYUjpSNKzgKVak4AN3FQYzZOcP1Z4PmfVVfM_48qg3YrI1&t=638646398980000000 HTTP/1.1 Host: www.telerik.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sf-tracking-consent=true; sf-prs-ss=638672795720460000; sf-prs-lu=https://www.telerik.com/download/fiddler/first-run; sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; sf-ins-pv-id=dc2da7be-2d6c-4e3e-9a51-88b40d4f050e; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1
2024-11-15 14:59:34 UTC	500	IN	HTTP/1.1 200 OK Cache-Control: public Content-Type: application/x-javascript Expires: Sat, 15 Nov 2025 08:08:01 GMT Last-Modified: Wed, 16 Oct 2024 11:44:58 GMT Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: http://localconverter.telerik.com Date: Fri, 15 Nov 2024 14:59:33 GMT Content-Length: 2617 Connection: close
2024-11-15 14:59:34 UTC	2415	IN	Data Raw: ef bb bf 49 6e 73 69 67 68 74 49 6e 69 74 53 63 72 69 70 74 20 3d 20 7b 20 5f 73 65 74 74 69 6e 67 73 3a 20 6e 75 6c 6c 2c 20 5f 63 6c 69 65 6e 74 3a 20 6e 75 6c 6c 2c 20 5f 63 72 65 61 74 65 43 6c 69 65 6e 74 3a 20 66 75 6e 63 74 69 6f 6e 20 28 74 29 20 7b 20 49 6e 73 69 67 68 74 49 6e 69 74 53 63 72 69 70 74 2e 5f 63 6c 69 65 6e 74 20 3d 20 6e 65 77 20 73 66 44 61 74 61 49 6e 74 65 6c 6c 2e 43 6c 69 65 6e 74 28 7b 20 61 70 69 4b 65 79 3a 20 49 6e 73 69 67 68 74 49 6e 69 74 53 63 72 69 70 74 2e 5f 73 65 74 74 69 6e 67 73 2e 61 70 69 4b 65 79 2c 20 73 6f 75 72 63 65 3a 20 49 6e 73 69 67 68 74 49 6e 69 74 53 63 72 69 70 74 2e 5f 73 65 74 74 69 6e 67 73 2e 61 70 70 6c 69 63 61 74 69 6f 6e 4e 61 6d 65 2c 20 61 70 69 53 65 72 76 65 72 55 72 6c 3a 20 49 6e 73 Data Ascii: InsightInitScript = { _settings: null, _client: null, _createClient: function (t) { InsightInitScript._client = new sfDataIntell.Client({ apiKey: InsightInitScript._settings.apiKey, source: InsightInitScript._settings.applicationName, apiServerUrl: Ins
2024-11-15 14:59:34 UTC	202	IN	Data Raw: 43 6c 69 65 6e 74 29 2c 20 49 6e 73 69 67 68 74 49 6e 69 74 53 63 72 69 70 74 2e 5f 63 72 65 61 74 65 43 6c 69 65 6e 74 28 54 72 61 63 6b 69 6e 67 43 6f 6e 73 65 6e 74 4d 61 6e 61 67 65 72 2e 63 61 6e 54 72 61 63 6b 43 75 72 72 65 6e 74 55 73 65 72 28 29 29 29 20 3a 20 49 6e 73 69 67 68 74 49 6e 69 74 53 63 72 69 70 74 2e 5f 63 72 65 61 74 65 43 6c 69 65 6e 74 28 21 30 29 20 7d 20 7d 2c 20 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 69 6e 73 69 67 68 74 2d 73 64 6b 2d 72 65 61 64 79 22 2c 20 49 6e 73 69 67 68 74 49 6e 69 74 53 63 72 69 70 74 2e 6c 6f 61 64 29 3b Data Ascii: Client), InsightInitScript._createClient(TrackingConsentManager.canTrackCurrentUser())) : InsightInitScript._createClient(!0) } }, document.addEventListener("insight-sdk-ready", InsightInitScript.load);

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49793	50.56.19.112	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	1213	OUT	GET /WebResource.axd?d=DzHrpQl5URXarFHAtrmzFsPwWIExaUeLHf3gTuslFxiRsjc9gU89IWbLw9lFnSTXl5qZVz-0iBHHB3aQBiGWPYzKfk3ndhT8iH1RSf_M6Sk7X3EWbQzPMVpb-rxAUHFQlncyLjOo3RP6E9HfRXn18roSCYCGCRaVqv9jyNWgJTH95Urh0&t=638646398980000000 HTTP/1.1 Host: www.telerik.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sf-tracking-consent=true; sf-prs-ss=638672795720460000; sf-prs-lu=https://www.telerik.com/download/fiddler/first-run; sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; sf-ins-pv-id=dc2da7be-2d6c-4e3e-9a51-88b40d4f050e; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1
2024-11-15 14:59:34 UTC	500	IN	HTTP/1.1 200 OK Cache-Control: public Content-Type: application/x-javascript Expires: Sat, 15 Nov 2025 08:02:12 GMT Last-Modified: Wed, 16 Oct 2024 11:44:58 GMT Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: http://localconverter.telerik.com Date: Fri, 15 Nov 2024 14:59:33 GMT Content-Length: 3300 Connection: close
2024-11-15 14:59:34 UTC	2415	IN	Data Raw: 54 72 61 63 6b 69 6e 67 43 6f 6e 73 65 6e 74 4d 61 6e 61 67 65 72 3d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 63 6f 6e 73 65 6e 74 43 6f 6f 6b 69 65 4e 61 6d 65 3d 22 73 66 2d 74 72 61 63 6b 69 6e 67 2d 63 6f 6e 73 65 6e 74 22 3b 0a 76 61 72 20 63 6f 6e 73 65 6e 74 44 69 61 6c 6f 67 48 74 6d 6c 3d 22 22 3b 0a 76 61 72 20 63 6f 6e 73 65 6e 74 44 69 61 6c 6f 67 3d 6e 75 6c 6c 3b 0a 76 61 72 20 65 76 65 6e 74 4c 69 73 74 65 6e 65 72 73 3d 7b 41 66 74 65 72 44 69 61 6c 6f 67 44 69 73 70 6c 61 79 65 64 3a 5b 5d 2c 42 65 66 6f 72 65 44 69 61 6c 6f 67 43 6c 6f 73 65 64 3a 5b 5d 2c 43 6f 6e 73 65 6e 74 43 68 61 6e 67 65 64 3a 5b 5d 2c 7d 3b 0a 66 75 6e 63 74 69 6f 6e 20 63 6c 6f 73 65 43 6f 6e 73 65 6e 74 44 69 61 6c 6f 67 28 29 7b 69 66 28 63 6f 6e 73 65 Data Ascii: TrackingConsentManager=(function(){var consentCookieName="sf-tracking-consent";var consentDialogHtml="";var consentDialog=null;var eventListeners={AfterDialogDisplayed:[],BeforeDialogClosed:[],ConsentChanged:[],};function closeConsentDialog(){if(conse
2024-11-15 14:59:34 UTC	885	IN	Data Raw: 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 6c 6f 61 64 22 2c 6f 70 65 6e 44 69 61 6c 6f 67 49 66 43 6f 6e 73 65 6e 74 4e 6f 74 50 72 6f 76 69 64 65 64 29 3b 0a 7d 7d 72 65 74 75 72 6e 7b 63 61 6e 54 72 61 63 6b 43 75 72 72 65 6e 74 55 73 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 65 61 64 43 6f 6f 6b 69 65 28 63 6f 6e 73 65 6e 74 43 6f 6f 6b 69 65 4e 61 6d 65 29 3d 3d 22 74 72 75 65 22 3b 0a 7d 2c 61 73 6b 46 6f 72 55 73 65 72 43 6f 6e 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 70 65 6e 43 6f 6e 73 65 6e 74 44 69 61 6c 6f 67 28 29 3b 0a 7d 2c 75 70 64 61 74 65 55 73 65 72 43 6f 6e 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 63 6f 6e 73 65 6e 74 29 7b 76 61 72 20 61 63 63 65 70 74 65 64 3d 42 6f 6f 6c 65 61 6e 28 63 6f 6e 73 65 6e Data Ascii: tachEvent("onload",openDialogIfConsentNotProvided);}}return{canTrackCurrentUser:function(){return readCookie(consentCookieName)=="true";},askForUserConsent:function(){openConsentDialog();},updateUserConsent:function(consent){var accepted=Boolean(consen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49785	52.252.156.53	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	638	OUT	OPTIONS /collect/v2/data-centers/76766c2b-82f4-2453-81e5-fd840f3b455b/datasources/TelerikCom/interactions HTTP/1.1 Host: api.insight.sitefinity.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type,x-dataintelligence-sdk-version Origin: https://www.telerik.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:34 UTC	1396	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:34 GMT Content-Length: 0 Connection: close Access-Control-Allow-Headers: Content-Type, Content-Length, X-Requested-With, Authorization, x-dataintelligence-accountkey, x-dataintelligence-datacenterkey, x-dataintelligence-datasource, x-dataintelligence-sort, x-dataintelligence-skip, x-dataintelligence-take, x-dataintelligence-fields, x-dataintelligence-count, x-dataintelligence-filterby, x-dataintelligence-filter, x-dataintelligence-contains, x-dataintelligence-nextrowkey, x-dataintelligence-flush, x-dataintelligence-fromdate, x-dataintelligence-todate, x-dataintelligence-period, x-dataintelligence-scale, x-dataintelligence-predicate, x-dataintelligence-subject, x-dataintelligence-ids, x-dataintelligence-datasources, x-dataintelligence-imagecrop, x-dataintelligence-contacts, x-forwarded-for, x-dataintelligence-sdk-version, Referer, Origin, x-dataintelligence-clientid, x-dataintelligence-campaignids, x-dataintelligence-userid, x-dataintelligence-errorid, x-dataintelligence-correlationid, cf-connecting-ip, x-forwarded-for, http_x_forwarded_for, x-forwarde [TRUNCATED] Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS Access-Control-Allow-Origin: * request-context: appId=cid-v1:a33f2e3a-ec15-4d53-8ac6-897af884626b Strict-Transport-Security: max-age=31536000

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:34 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 0687e1b8-601e-0001-3ef1-36faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145934Z-164f84587bfgp2sdhC1DFWyhvn00000001ng00000000d21r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:34 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49799	104.17.25.14	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	396	OUT	GET /ajax/libs/jquery-migrate/3.4.1/jquery-migrate.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:34 UTC	956	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:34 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"63f822fd-1327" Last-Modified: Fri, 24 Feb 2023 02:37:49 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 161882 Expires: Wed, 05 Nov 2025 14:59:34 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0RtxRyWBPDiEyQwkADjXGK0cUvmWYI77kin8yHQGEjiijPLYaJ16LxGUPLW%2BwAOANqND0HsXp7SyhKYEpKNzGFk1YSlGKKge%2Fzp3ueipgF7AmuuH2gMr3iB2yJE2xOh7keh0bO1i"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8e301b1e0ad6e93e-DFW alt-svc: h3=":443"; ma=86400
2024-11-15 14:59:34 UTC	413	IN	Data Raw: 33 35 33 34 0d 0a 2f 2a 21 20 6a 51 75 65 72 79 20 4d 69 67 72 61 74 65 20 76 33 2e 34 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 6a 51 75 65 72 79 2e 6d 69 67 72 61 74 65 4d 75 74 65 26 26 28 6a 51 75 65 72 79 2e 6d 69 67 72 61 74 65 4d 75 74 65 3d 21 30 29 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 22 6a 71 75 65 72 79 22 5d 2c 66 75 6e 63 74 69 6f Data Ascii: 3534/! jQuery Migrate v3.4.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /"undefined"==typeof jQuery.migrateMute&&(jQuery.migrateMute=!0),function(t){"use strict";"function"==typeof define&&define.amd?define(["jquery"],functio
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 74 69 6f 6e 20 65 28 65 29 7b 72 65 74 75 72 6e 20 30 3c 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 72 3d 2f 5e 28 5c 64 2b 29 5c 2e 28 5c 64 2b 29 5c 2e 28 5c 64 2b 29 2f 2c 6e 3d 72 2e 65 78 65 63 28 65 29 7c 7c 5b 5d 2c 6f 3d 72 2e 65 78 65 63 28 74 29 7c 7c 5b 5d 2c 61 3d 31 3b 61 3c 3d 33 3b 61 2b 2b 29 7b 69 66 28 2b 6f 5b 61 5d 3c 2b 6e 5b 61 5d 29 72 65 74 75 72 6e 20 31 3b 69 66 28 2b 6e 5b 61 5d 3c 2b 6f 5b 61 5d 29 72 65 74 75 72 6e 2d 31 7d 72 65 74 75 72 6e 20 30 7d 28 73 2e 66 6e 2e 6a 71 75 65 72 79 2c 65 29 7d 73 2e 6d 69 67 72 61 74 65 56 65 72 73 69 6f 6e 3d 22 33 2e 34 2e 31 22 3b 76 61 72 20 74 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 6e 75 6c 6c 29 3b 73 2e 6d 69 67 72 61 74 65 44 69 73 61 62 6c 65 50 61 Data Ascii: tion e(e){return 0<=function(e,t){for(var r=/^(\d+)\.(\d+)\.(\d+)/,n=r.exec(e)\|\|[],o=r.exec(t)\|\|[],a=1;a<=3;a++){if(+o[a]<+n[a])return 1;if(+n[a]<+o[a])return-1}return 0}(s.fn.jquery,e)}s.migrateVersion="3.4.1";var t=Object.create(null);s.migrateDisablePa
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 72 65 74 75 72 6e 20 61 28 65 2c 74 2c 72 2c 6e 2c 6f 29 2c 30 7d 66 75 6e 63 74 69 6f 6e 20 69 28 65 2c 74 2c 72 2c 6e 29 7b 72 65 74 75 72 6e 20 61 28 65 2c 74 2c 72 2c 6e 29 2c 30 7d 73 2e 6d 69 67 72 61 74 65 44 65 64 75 70 6c 69 63 61 74 65 57 61 72 6e 69 6e 67 73 3d 21 30 2c 73 2e 6d 69 67 72 61 74 65 57 61 72 6e 69 6e 67 73 3d 5b 5d 2c 76 6f 69 64 20 30 3d 3d 3d 73 2e 6d 69 67 72 61 74 65 54 72 61 63 65 26 26 28 73 2e 6d 69 67 72 61 74 65 54 72 61 63 65 3d 21 30 29 2c 73 2e 6d 69 67 72 61 74 65 52 65 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 3d 7b 7d 2c 73 2e 6d 69 67 72 61 74 65 57 61 72 6e 69 6e 67 73 2e 6c 65 6e 67 74 68 3d 30 7d 2c 22 42 61 63 6b 43 6f 6d 70 61 74 22 3d 3d 3d 6e 2e 64 6f 63 75 6d 65 6e 74 2e 63 6f 6d 70 61 74 4d 6f 64 65 Data Ascii: return a(e,t,r,n,o),0}function i(e,t,r,n){return a(e,t,r,n),0}s.migrateDeduplicateWarnings=!0,s.migrateWarnings=[],void 0===s.migrateTrace&&(s.migrateTrace=!0),s.migrateReset=function(){o={},s.migrateWarnings.length=0},"BackCompat"===n.document.compatMode
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 72 79 2e 66 6e 2e 73 69 7a 65 28 29 20 69 73 20 64 65 70 72 65 63 61 74 65 64 20 61 6e 64 20 72 65 6d 6f 76 65 64 3b 20 75 73 65 20 74 68 65 20 2e 6c 65 6e 67 74 68 20 70 72 6f 70 65 72 74 79 22 29 2c 63 28 73 2c 22 70 61 72 73 65 4a 53 4f 4e 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4a 53 4f 4e 2e 70 61 72 73 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 61 72 67 75 6d 65 6e 74 73 29 7d 2c 22 70 61 72 73 65 4a 53 4f 4e 22 2c 22 6a 51 75 65 72 79 2e 70 61 72 73 65 4a 53 4f 4e 20 69 73 20 64 65 70 72 65 63 61 74 65 64 3b 20 75 73 65 20 4a 53 4f 4e 2e 70 61 72 73 65 22 29 2c 63 28 73 2c 22 68 6f 6c 64 52 65 61 64 79 22 2c 73 2e 68 6f 6c 64 52 65 61 64 79 2c 22 68 6f 6c 64 52 65 61 64 79 22 2c 22 6a 51 75 65 72 79 2e 68 6f 6c 64 52 65 61 64 79 20 Data Ascii: ry.fn.size() is deprecated and removed; use the .length property"),c(s,"parseJSON",function(){return JSON.parse.apply(null,arguments)},"parseJSON","jQuery.parseJSON is deprecated; use JSON.parse"),c(s,"holdReady",s.holdReady,"holdReady","jQuery.holdReady
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 53 74 72 69 6e 67 2e 63 61 6c 6c 28 65 29 5d 7c 7c 22 6f 62 6a 65 63 74 22 3a 74 79 70 65 6f 66 20 65 7d 2c 22 74 79 70 65 22 2c 22 6a 51 75 65 72 79 2e 74 79 70 65 20 69 73 20 64 65 70 72 65 63 61 74 65 64 22 29 2c 63 28 73 2c 22 69 73 46 75 6e 63 74 69 6f 6e 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 7d 2c 22 69 73 46 75 6e 63 74 69 6f 6e 22 2c 22 6a 51 75 65 72 79 2e 69 73 46 75 6e 63 74 69 6f 6e 28 29 20 69 73 20 64 65 70 72 65 63 61 74 65 64 22 29 2c 63 28 73 2c 22 69 73 57 69 6e 64 6f 77 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 65 26 26 65 3d 3d 3d 65 2e 77 69 6e 64 6f 77 7d 2c 22 69 73 57 69 6e 64 6f 77 22 2c 22 6a 51 75 65 72 79 2e Data Ascii: String.call(e)]\|\|"object":typeof e},"type","jQuery.type is deprecated"),c(s,"isFunction",function(e){return"function"==typeof e},"isFunction","jQuery.isFunction() is deprecated"),c(s,"isWindow",function(e){return null!=e&&e===e.window},"isWindow","jQuery.
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 6e 2c 22 74 6f 67 67 6c 65 43 6c 61 73 73 22 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 21 3d 3d 74 26 26 22 62 6f 6f 6c 65 61 6e 22 21 3d 74 79 70 65 6f 66 20 74 3f 62 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 3a 28 75 28 22 74 6f 67 67 6c 65 43 6c 61 73 73 2d 62 6f 6f 6c 22 2c 22 6a 51 75 65 72 79 2e 66 6e 2e 74 6f 67 67 6c 65 43 6c 61 73 73 28 20 62 6f 6f 6c 65 61 6e 20 29 20 69 73 20 64 65 70 72 65 63 61 74 65 64 22 29 2c 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 67 65 74 41 74 74 72 69 62 75 74 65 26 26 74 68 69 73 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 63 6c 61 73 73 22 29 7c 7c 22 22 3b 65 26 26 73 2e 64 61 74 61 28 74 68 69 73 2c Data Ascii: n,"toggleClass",function(t){return void 0!==t&&"boolean"!=typeof t?b.apply(this,arguments):(u("toggleClass-bool","jQuery.fn.toggleClass( boolean ) is deprecated"),this.each(function(){var e=this.getAttribute&&this.getAttribute("class")\|\|"";e&&s.data(this,
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 2c 6f 72 64 65 72 3a 21 30 2c 6f 72 70 68 61 6e 73 3a 21 30 2c 77 69 64 6f 77 73 3a 21 30 2c 7a 49 6e 64 65 78 3a 21 30 2c 7a 6f 6f 6d 3a 21 30 7d 2c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 78 79 3f 73 2e 63 73 73 4e 75 6d 62 65 72 3d 6e 65 77 20 50 72 6f 78 79 28 41 2c 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 28 22 63 73 73 2d 6e 75 6d 62 65 72 22 2c 22 6a 51 75 65 72 79 2e 63 73 73 4e 75 6d 62 65 72 20 69 73 20 64 65 70 72 65 63 61 74 65 64 22 29 2c 52 65 66 6c 65 63 74 2e 67 65 74 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 28 22 63 73 73 2d 6e 75 6d 62 65 72 22 2c 22 6a 51 75 65 72 79 2e 63 73 73 Data Ascii: ,order:!0,orphans:!0,widows:!0,zIndex:!0,zoom:!0},"undefined"!=typeof Proxy?s.cssNumber=new Proxy(A,{get:function(){return u("css-number","jQuery.cssNumber is deprecated"),Reflect.get.apply(this,arguments)},set:function(){return u("css-number","jQuery.css
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 2d 6f 6e 65 2d 61 72 67 22 2c 22 27 6a 51 75 65 72 79 2e 65 61 73 69 6e 67 2e 22 2b 74 68 69 73 2e 65 61 73 69 6e 67 2e 74 6f 53 74 72 69 6e 67 28 29 2b 22 27 20 73 68 6f 75 6c 64 20 75 73 65 20 6f 6e 6c 79 20 6f 6e 65 20 61 72 67 75 6d 65 6e 74 22 29 2c 73 2e 65 61 73 69 6e 67 5b 74 68 69 73 2e 65 61 73 69 6e 67 5d 3d 48 29 2c 6b 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 2c 22 65 61 73 69 6e 67 2d 6f 6e 65 2d 61 72 67 22 29 2c 53 3d 73 2e 66 78 2e 69 6e 74 65 72 76 61 6c 2c 50 3d 22 6a 51 75 65 72 79 2e 66 78 2e 69 6e 74 65 72 76 61 6c 20 69 73 20 64 65 70 72 65 63 61 74 65 64 22 2c 6e 2e 72 65 71 75 65 73 74 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 26 26 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 73 2e Data Ascii: -one-arg","'jQuery.easing."+this.easing.toString()+"' should use only one argument"),s.easing[this.easing]=H),k.apply(this,arguments)},"easing-one-arg"),S=s.fx.interval,P="jQuery.fx.interval is deprecated",n.requestAnimationFrame&&Object.defineProperty(s.
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 22 65 72 72 6f 72 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 28 73 2e 66 6e 2c 74 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 2c 30 29 3b 72 65 74 75 72 6e 22 6c 6f 61 64 22 3d 3d 3d 74 26 26 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 5b 30 5d 3f 4d 2e 61 70 70 6c 79 28 74 68 69 73 2c 65 29 3a 28 75 28 22 73 68 6f 72 74 68 61 6e 64 2d 72 65 6d 6f 76 65 64 2d 76 33 22 2c 22 6a 51 75 65 72 79 2e 66 6e 2e 22 2b 74 2b 22 28 29 20 69 73 20 64 65 70 72 65 63 61 74 65 64 22 29 2c 65 2e 73 70 6c 69 63 65 28 30 2c 30 2c 74 29 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3f 74 68 69 73 2e 6f 6e 2e 61 70 70 6c 79 28 74 68 Data Ascii: "error"],function(e,t){i(s.fn,t,function(){var e=Array.prototype.slice.call(arguments,0);return"load"===t&&"string"==typeof e[0]?M.apply(this,e):(u("shorthand-removed-v3","jQuery.fn."+t+"() is deprecated"),e.splice(0,0,t),arguments.length?this.on.apply(th
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 28 73 2e 66 6e 2c 22 68 6f 76 65 72 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6f 6e 28 22 6d 6f 75 73 65 65 6e 74 65 72 22 2c 65 29 2e 6f 6e 28 22 6d 6f 75 73 65 6c 65 61 76 65 22 2c 74 7c 7c 65 29 7d 2c 22 70 72 65 2d 6f 6e 2d 6d 65 74 68 6f 64 73 22 2c 22 6a 51 75 65 72 79 2e 66 6e 2e 68 6f 76 65 72 28 29 20 69 73 20 64 65 70 72 65 63 61 74 65 64 22 29 3b 66 75 6e 63 74 69 6f 6e 20 54 28 65 29 7b 76 61 72 20 74 3d 6e 2e 64 6f 63 75 6d 65 6e 74 2e 69 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 2e 63 72 65 61 74 65 48 54 4d 4c 44 6f 63 75 6d 65 6e 74 28 22 22 29 3b 72 65 74 75 72 6e 20 74 2e 62 6f 64 79 2e 69 6e 6e 65 72 48 54 4d 4c 3d 65 2c 74 2e 62 6f 64 79 26 26 74 2e 62 6f 64 79 2e 69 6e 6e 65 72 48 54 4d 4c 7d 76 Data Ascii: (s.fn,"hover",function(e,t){return this.on("mouseenter",e).on("mouseleave",t\|\|e)},"pre-on-methods","jQuery.fn.hover() is deprecated");function T(e){var t=n.document.implementation.createHTMLDocument("");return t.body.innerHTML=e,t.body&&t.body.innerHTML}v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49800	104.17.25.14	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	380	OUT	GET /ajax/libs/jquery/3.7.1/jquery.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:34 UTC	962	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:34 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"64ed75bb-76fe" Last-Modified: Tue, 29 Aug 2023 04:36:11 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 162549 Expires: Wed, 05 Nov 2025 14:59:34 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=30gIgc1yBkY3yUs2TSMYMfEuQHaGC0VBdfd3MS7BUXJn74PxT14Xo62wO0ZBoGVCKjiSY%2Ft9iCVZ6NkDLo%2FdeNaBqlXCscGudL1Jl89D63kj9bYT%2BTSGjwtoJzggFuhH8%2B%2FJsBpG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8e301b1e09334689-DFW alt-svc: h3=":443"; ma=86400
2024-11-15 14:59:34 UTC	407	IN	Data Raw: 33 39 37 39 0d 0a 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 37 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f Data Ascii: 3979/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Erro
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 2c 61 65 3d 6f 65 2e 73 6c 69 63 65 2c 67 3d 6f 65 2e 66 6c 61 74 3f 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 65 2e 66 6c 61 74 2e 63 61 6c 6c 28 65 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 65 2e 63 6f 6e 63 61 74 2e 61 70 70 6c 79 28 5b 5d 2c 65 29 7d 2c 73 3d 6f 65 2e 70 75 73 68 2c 73 65 3d 6f 65 2e 69 6e 64 65 78 4f 66 2c 6e 3d 7b 7d 2c 69 3d 6e 2e 74 6f 53 74 72 69 6e 67 2c 75 65 3d 6e 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 6f 3d 75 65 2e 74 6f 53 74 72 69 6e 67 2c 61 3d 6f 2e 63 61 6c 6c 28 4f 62 6a 65 63 74 29 2c 6c 65 3d 7b 7d 2c 76 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 Data Ascii: etPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 61 6c 6c 28 65 2c 74 2c 65 29 7d 29 29 7d 2c 73 6c 69 63 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 61 65 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 29 7d 2c 66 69 72 73 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 71 28 30 29 7d 2c 6c 61 73 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 71 28 2d 31 29 7d 2c 65 76 65 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 63 65 2e 67 72 65 70 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 74 2b 31 29 25 32 7d 29 29 7d 2c 6f 64 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 Data Ascii: all(e,t,e)}))},slice:function(){return this.pushStack(ae.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},even:function(){return this.pushStack(ce.grep(this,function(e,t){return(t+1)%2}))},odd:function(){retu
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 65 7d 2c 6e 29 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 30 3b 69 66 28 63 28 65 29 29 7b 66 6f 72 28 6e 3d 65 2e 6c 65 6e 67 74 68 3b 72 3c 6e 3b 72 2b 2b 29 69 66 28 21 31 3d 3d 3d 74 2e 63 61 6c 6c 28 65 5b 72 5d 2c 72 2c 65 5b 72 5d 29 29 62 72 65 61 6b 7d 65 6c 73 65 20 66 6f 72 28 72 20 69 6e 20 65 29 69 66 28 21 31 3d 3d 3d 74 2e 63 61 6c 6c 28 65 5b 72 5d 2c 72 2c 65 5b 72 5d 29 29 62 72 65 61 6b 3b 72 65 74 75 72 6e 20 65 7d 2c 74 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3d 22 22 2c 72 3d 30 2c 69 3d 65 2e 6e 6f 64 65 54 79 70 65 3b 69 66 28 21 69 29 77 68 69 6c 65 28 74 3d 65 5b 72 2b 2b 5d 29 6e 2b 3d 63 65 2e 74 65 78 74 28 74 29 3b 72 65 74 75 72 6e 20 31 3d 3d 3d 69 7c Data Ascii: e},n)},each:function(e,t){var n,r=0;if(c(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},text:function(e){var t,n="",r=0,i=e.nodeType;if(!i)while(t=e[r++])n+=ce.text(t);return 1===i\|
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 2e 63 6f 6e 74 61 69 6e 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 74 26 26 74 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 72 65 74 75 72 6e 20 65 3d 3d 3d 6e 7c 7c 21 28 21 6e 7c 7c 31 21 3d 3d 6e 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 28 65 2e 63 6f 6e 74 61 69 6e 73 3f 65 2e 63 6f 6e 74 61 69 6e 73 28 6e 29 3a 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 26 26 31 36 26 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 6e 29 29 29 7d 3b 76 61 72 20 66 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 78 38 30 2d 5c 75 46 46 46 46 5c 77 2d 5d 2f 67 3b 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3f 22 5c 30 22 3d 3d Data Ascii: .contains=function(e,t){var n=t&&t.parentNode;return e===n\|\|!(!n\|\|1!==n.nodeType\|\|!(e.contains?e.contains(n):e.compareDocumentPosition&&16&e.compareDocumentPosition(n)))};var f=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\x80-\uFFFF\w-]/g;function p(e,t){return t?"\0"==
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 5b 2b 2d 5d 7c 29 28 5c 5c 64 2a 29 6e 7c 29 22 2b 67 65 2b 22 2a 28 3f 3a 28 5b 2b 2d 5d 7c 29 22 2b 67 65 2b 22 2a 28 5c 5c 64 2b 29 7c 29 29 22 2b 67 65 2b 22 2a 5c 5c 29 7c 29 22 2c 22 69 22 29 2c 62 6f 6f 6c 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 3f 3a 22 2b 66 2b 22 29 24 22 2c 22 69 22 29 2c 6e 65 65 64 73 43 6f 6e 74 65 78 74 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 67 65 2b 22 2a 5b 3e 2b 7e 5d 7c 3a 28 65 76 65 6e 7c 6f 64 64 7c 65 71 7c 67 74 7c 6c 74 7c 6e 74 68 7c 66 69 72 73 74 7c 6c 61 73 74 29 28 3f 3a 5c 5c 28 22 2b 67 65 2b 22 2a 28 28 3f 3a 2d 5c 5c 64 29 3f 5c 5c 64 2a 29 22 2b 67 65 2b 22 2a 5c 5c 29 7c 29 28 3f 3d 5b 5e 2d 5d 7c 24 29 22 2c 22 69 22 29 7d 2c 4e 3d 2f 5e 28 3f 3a 69 6e 70 75 74 7c 73 65 6c 65 63 74 7c 74 Data Ascii: [+-]\|)(\\d)n\|)"+ge+"(?:([+-]\|)"+ge+"(\\d+)\|))"+ge+"\\)\|)","i"),bool:new RegExp("^(?:"+f+")$","i"),needsContext:new RegExp("^"+ge+"[>+~]\|:(even\|odd\|eq\|gt\|lt\|nth\|first\|last)(?:\$"+ge+"((?:-\\d)?\\d)"+ge+"\$\|)(?=[^-]\|$)","i")},N=/^(?:input\|select\|t
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 73 74 28 74 29 29 29 7b 69 66 28 63 3d 74 2c 66 3d 65 2c 31 3d 3d 3d 70 26 26 28 78 2e 74 65 73 74 28 74 29 7c 7c 6d 2e 74 65 73 74 28 74 29 29 29 7b 28 66 3d 48 2e 74 65 73 74 28 74 29 26 26 55 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 65 26 26 6c 65 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 63 65 2e 65 73 63 61 70 65 53 65 6c 65 63 74 6f 72 28 73 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 59 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 51 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b Data Ascii: st(t))){if(c=t,f=e,1===p&&(x.test(t)\|\|m.test(t))){(f=H.test(t)&&U(e.parentNode)\|\|e)==e&&le.scope\|\|((s=e.getAttribute("id"))?s=ce.escapeSelector(s):e.setAttribute("id",s=S)),o=(l=Y(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+Q(l[o]);c=l.join(",")}try{
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 65 6e 74 45 6c 65 6d 65 6e 74 26 26 28 72 3d 28 54 3d 6e 29 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2c 43 3d 21 63 65 2e 69 73 58 4d 4c 44 6f 63 28 54 29 2c 69 3d 72 2e 6d 61 74 63 68 65 73 7c 7c 72 2e 77 65 62 6b 69 74 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 7c 7c 72 2e 6d 73 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 2c 72 2e 6d 73 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 26 26 79 65 21 3d 54 26 26 28 74 3d 54 2e 64 65 66 61 75 6c 74 56 69 65 77 29 26 26 74 2e 74 6f 70 21 3d 3d 74 26 26 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 75 6e 6c 6f 61 64 22 2c 4d 29 2c 6c 65 2e 67 65 74 42 79 49 64 3d 24 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 72 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 2e 69 64 3d 63 Data Ascii: entElement&&(r=(T=n).documentElement,C=!ce.isXMLDoc(T),i=r.matches\|\|r.webkitMatchesSelector\|\|r.msMatchesSelector,r.msMatchesSelector&&ye!=T&&(t=T.defaultView)&&t.top!==t&&t.addEventListener("unload",M),le.getById=$(function(e){return r.appendChild(e).id=c
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 26 26 43 29 72 65 74 75 72 6e 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 65 29 7d 2c 64 3d 5b 5d 2c 24 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 69 64 3d 27 22 2b 53 2b 22 27 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 64 69 73 61 62 6c 65 64 27 3e 3c 2f 61 3e 3c 73 65 6c 65 63 74 20 69 64 3d 27 22 2b 53 2b 22 2d 5c 72 5c 5c 27 20 64 69 73 61 62 6c 65 64 3d 27 64 69 73 61 62 6c 65 64 27 3e 3c 6f 70 74 69 6f 6e 20 73 65 6c 65 63 74 65 64 3d 27 27 3e 3c 2f 6f 70 74 69 6f 6e 3e 3c 2f 73 65 6c 65 63 74 3e 22 2c 65 2e 71 75 65 72 79 53 65 Data Ascii: .getElementsByClassName&&C)return t.getElementsByClassName(e)},d=[],$(function(e){var t;r.appendChild(e).innerHTML="<a id='"+S+"' href='' disabled='disabled'></a><select id='"+S+"-\r\\' disabled='disabled'><option selected=''></option></select>",e.querySe
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 74 63 68 65 73 53 65 6c 65 63 74 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 56 28 65 29 2c 43 26 26 21 68 5b 74 2b 22 20 22 5d 26 26 28 21 64 7c 7c 21 64 2e 74 65 73 74 28 74 29 29 29 74 72 79 7b 76 61 72 20 6e 3d 69 2e 63 61 6c 6c 28 65 2c 74 29 3b 69 66 28 6e 7c 7c 6c 65 2e 64 69 73 63 6f 6e 6e 65 63 74 65 64 4d 61 74 63 68 7c 7c 65 2e 64 6f 63 75 6d 65 6e 74 26 26 31 31 21 3d 3d 65 2e 64 6f 63 75 6d 65 6e 74 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 65 29 7b 68 28 74 2c 21 30 29 7d 72 65 74 75 72 6e 20 30 3c 49 28 74 2c 54 2c 6e 75 6c 6c 2c 5b 65 5d 29 2e 6c 65 6e 67 74 68 7d 2c 49 2e 63 6f 6e 74 61 69 6e 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 65 2e 6f 77 6e 65 72 44 6f 63 Data Ascii: tchesSelector=function(e,t){if(V(e),C&&!h[t+" "]&&(!d\|\|!d.test(t)))try{var n=i.call(e,t);if(n\|\|le.disconnectedMatch\|\|e.document&&11!==e.document.nodeType)return n}catch(e){h(t,!0)}return 0<I(t,T,null,[e]).length},I.contains=function(e,t){return(e.ownerDoc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49798	50.56.19.112	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	1256	OUT	GET /WebResource.axd?d=NjxTqR2bqTw1rewxxlkHPoKtHrXAWC0HAaoiA_KkRcUyXkV02CSw2viy3BbwqQQWnOeUM4JljOrJ6SdN8P6xkcmc02D5IE0_hoR3ujKOHMUMV0D80Ax-2HQgUBn3JFGVcQMIptO-sbrJg4UhPcfKleFkBd3KXta5g771qRLz1--cqQWHZet4VERXE7zwP_V-_reX4bmQVhWS6yxLXOsj2Tnqll01&t=638646398980000000 HTTP/1.1 Host: www.telerik.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sf-tracking-consent=true; sf-prs-ss=638672795720460000; sf-prs-lu=https://www.telerik.com/download/fiddler/first-run; sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; sf-ins-pv-id=dc2da7be-2d6c-4e3e-9a51-88b40d4f050e; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1
2024-11-15 14:59:34 UTC	500	IN	HTTP/1.1 200 OK Cache-Control: public Content-Type: application/x-javascript Expires: Sat, 15 Nov 2025 08:02:19 GMT Last-Modified: Wed, 16 Oct 2024 11:44:58 GMT Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: http://localconverter.telerik.com Date: Fri, 15 Nov 2024 14:59:33 GMT Content-Length: 4191 Connection: close
2024-11-15 14:59:34 UTC	3863	IN	Data Raw: ef bb bf 76 61 72 20 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 54 72 61 63 6b 65 72 20 3d 20 6e 75 6c 6c 3b 20 21 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 22 75 73 65 20 73 74 72 69 63 74 22 3b 20 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 54 72 61 63 6b 65 72 20 3d 20 7b 20 5f 63 61 6e 54 72 61 63 6b 3a 20 21 31 2c 20 5f 70 61 67 65 49 64 3a 20 6e 75 6c 6c 2c 20 5f 75 72 6c 3a 20 21 31 2c 20 74 72 61 63 6b 3a 20 66 75 6e 63 74 69 6f 6e 20 28 65 29 20 7b 20 69 66 20 28 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 54 72 61 63 6b 65 72 2e 5f 63 61 6e 54 72 61 63 6b 20 3d 20 65 2c 20 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 54 72 61 63 6b 65 72 2e 5f 63 61 6e 54 72 61 63 6b 29 20 7b 20 69 66 20 28 21 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 54 Data Ascii: var PersonalizationTracker = null; !function () { "use strict"; PersonalizationTracker = { _canTrack: !1, _pageId: null, _url: !1, track: function (e) { if (PersonalizationTracker._canTrack = e, PersonalizationTracker._canTrack) { if (!PersonalizationT
2024-11-15 14:59:34 UTC	328	IN	Data Raw: 6e 54 72 61 63 6b 65 72 2e 74 72 61 63 6b 28 21 30 29 3b 20 76 61 72 20 65 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 54 72 61 63 6b 65 72 22 29 2c 20 72 20 3d 20 4a 53 4f 4e 2e 70 61 72 73 65 28 65 2e 69 6e 6e 65 72 54 65 78 74 29 3b 20 69 66 20 28 21 72 29 20 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 20 74 72 61 63 6b 65 72 20 61 72 67 75 6d 65 6e 74 73 20 61 72 65 20 77 72 6f 6e 67 21 22 29 3b 20 72 2e 49 73 50 61 67 65 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 54 61 72 67 65 74 20 26 26 20 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 54 72 61 63 6b 65 72 2e 74 72 61 63 6b 50 61 67 65 28 72 2e 50 61 67 65 49 64 Data Ascii: nTracker.track(!0); var e = document.getElementById("PersonalizationTracker"), r = JSON.parse(e.innerText); if (!r) throw new Error("Personalization tracker arguments are wrong!"); r.IsPagePersonalizationTarget && PersonalizationTracker.trackPage(r.PageId

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49801	104.18.87.42	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	398	OUT	GET /consent/3dfce4f2-dab6-4128-9f33-df7e0597da82/otSDKStub.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:34 UTC	988	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:34 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8e301b1e0945e92e-DFW CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 68754 Cache-Control: public, max-age=86400 Expires: Sat, 16 Nov 2024 14:59:34 GMT Last-Modified: Tue, 25 Jun 2024 13:14:54 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: 1C7BuQ3LGAlBcdxyvs3Sgw== Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 0db46d73-d01e-004a-774c-26a3ed000000 x-ms-version: 2009-09-19 Cross-Origin-Resource-Policy: cross-origin Server: cloudflare
2024-11-15 14:59:34 UTC	381	IN	Data Raw: 31 62 37 62 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 77 29 7b 66 75 6e 63 74 69 6f 6e 20 78 28 29 7b 76 61 72 20 61 3d 74 68 69 73 3b 74 68 69 73 2e 69 6d 70 6c 65 6d 65 6e 74 54 68 65 50 6f 6c 79 66 69 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 3d 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 3b 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 69 66 28 22 73 74 79 6c 65 22 21 3d 3d 63 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 26 26 62 2e 61 70 70 6c 79 28 74 68 69 73 2c 5b 63 2c 64 5d 29 2c 22 73 74 79 6c 65 22 21 3d 3d 63 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7c 7c 64 7c 7c 74 68 69 73 2e 72 65 6d 6f 76 65 41 74 Data Ascii: 1b7b(function(w){function x(){var a=this;this.implementThePolyfill=function(){var b=Element.prototype.setAttribute;Element.prototype.setAttribute=function(c,d){if("style"!==c.toLowerCase()&&b.apply(this,[c,d]),"style"!==c.toLowerCase()\|\|d\|\|this.removeAt
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 66 5d 7d 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 41 28 61 2c 62 2c 63 29 7b 66 75 6e 63 74 69 6f 6e 20 64 28 6c 29 7b 72 65 74 75 72 6e 20 6c 3f 28 22 3b 22 21 3d 3d 28 6c 3d 6c 2e 74 72 69 6d 28 29 29 2e 63 68 61 72 41 74 28 6c 2e 6c 65 6e 67 74 68 2d 31 29 26 26 28 6c 2b 3d 22 3b 22 29 2c 6c 2e 74 72 69 6d 28 29 29 3a 6e 75 6c 6c 7d 76 6f 69 64 20 30 3d 3d 3d 63 26 26 28 63 3d 0a 21 31 29 3b 76 61 72 20 66 3d 64 28 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 73 74 79 6c 65 22 29 29 2c 67 3d 64 28 62 29 3b 62 3d 22 22 3b 62 3d 63 26 26 66 3f 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 6c 3d 66 2e 73 70 6c 69 74 28 22 3b 22 29 2e 63 6f 6e 63 61 74 28 67 2e 73 70 6c 69 74 28 22 3b 22 29 29 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 42 Data Ascii: f]}}}}function A(a,b,c){function d(l){return l?(";"!==(l=l.trim()).charAt(l.length-1)&&(l+=";"),l.trim()):null}void 0===c&&(c=!1);var f=d(a.getAttribute("style")),g=d(b);b="";b=c&&f?function(){for(var l=f.split(";").concat(g.split(";")).filter(function(B
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 6c 61 74 65 73 2f 22 2b 65 2e 73 74 75 62 46 69 6c 65 4e 61 6d 65 2b 22 2e 6a 73 22 29 2c 65 2e 73 74 6f 72 61 67 65 42 61 73 65 55 52 4c 2b 22 2f 73 63 72 69 70 74 74 65 6d 70 6c 61 74 65 73 2f 6f 6c 64 2f 73 63 72 69 70 74 74 65 6d 70 6c 61 74 65 73 2f 35 2e 31 31 2e 30 2f 22 2b 65 2e 62 61 6e 6e 65 72 53 63 72 69 70 74 4e 61 6d 65 29 3a 28 65 2e 69 73 4d 69 67 72 61 74 65 64 55 52 4c 26 26 28 64 2e 73 72 63 3d 65 2e 73 74 6f 72 61 67 65 42 61 73 65 55 52 4c 2b 22 2f 73 63 72 69 70 74 74 65 6d 70 6c 61 74 65 73 2f 22 2b 65 2e 73 74 75 62 46 69 6c 65 4e 61 6d 65 2b 22 2e 6a 73 22 29 2c 65 2e 73 74 6f 72 61 67 65 42 61 73 65 55 52 4c 2b 22 2f 73 63 72 69 70 74 74 65 6d 70 6c 61 74 65 73 2f 22 2b 62 2e 56 65 72 73 69 6f 6e 2b 22 2f 22 2b 65 2e 62 61 6e 6e Data Ascii: lates/"+e.stubFileName+".js"),e.storageBaseURL+"/scripttemplates/old/scripttemplates/5.11.0/"+e.bannerScriptName):(e.isMigratedURL&&(d.src=e.storageBaseURL+"/scripttemplates/"+e.stubFileName+".js"),e.storageBaseURL+"/scripttemplates/"+b.Version+"/"+e.bann
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 69 76 65 4f 54 4d 65 73 73 61 67 65 2c 21 31 29 7d 3b 74 68 69 73 2e 61 64 64 49 61 62 46 72 61 6d 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 3d 77 69 6e 64 6f 77 3b 21 62 2e 66 72 61 6d 65 73 2e 5f 5f 74 63 66 61 70 69 4c 6f 63 61 74 6f 72 26 26 0a 28 62 2e 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3f 61 2e 61 64 64 4c 6f 63 61 74 6f 72 28 22 43 4d 50 22 29 3a 73 65 74 54 69 6d 65 6f 75 74 28 61 2e 61 64 64 49 61 62 46 72 61 6d 65 2c 35 29 29 7d 3b 74 68 69 73 2e 61 64 64 42 61 63 6b 77 61 72 64 49 61 62 46 72 61 6d 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 3d 77 69 6e 64 6f 77 3b 21 62 2e 66 72 61 6d 65 73 2e 5f 5f 74 63 66 61 70 69 4c 6f 63 61 74 6f 72 26 26 28 62 2e 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3f 61 2e 61 64 64 4c 6f 63 Data Ascii: iveOTMessage,!1)};this.addIabFrame=function(){var b=window;!b.frames.__tcfapiLocator&&(b.document.body?a.addLocator("CMP"):setTimeout(a.addIabFrame,5))};this.addBackwardIabFrame=function(){var b=window;!b.frames.__tcfapiLocator&&(b.document.body?a.addLoc
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 70 69 2e 61 3d 67 2e 5f 5f 74 63 66 61 70 69 2e 61 7c 7c 5b 5d 3b 67 2e 5f 5f 74 63 66 61 70 69 2e 61 2e 70 75 73 68 28 5b 62 2c 63 2c 64 2c 66 5d 29 7d 3b 74 68 69 73 2e 67 65 74 50 69 6e 67 52 65 71 75 65 73 74 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 2c 64 3b 76 6f 69 64 20 30 3d 3d 3d 63 26 26 28 63 3d 21 31 29 3b 62 26 26 28 64 3d 21 28 63 3d 7b 7d 29 2c 22 49 41 42 32 22 21 3d 3d 61 2e 69 61 62 54 79 70 65 26 26 22 49 41 42 32 56 32 22 21 3d 3d 61 2e 69 61 62 54 79 70 65 7c 7c 28 63 3d 7b 67 64 70 72 41 70 70 6c 69 65 73 3a 65 2e 6f 6e 65 54 72 75 73 74 49 41 42 67 64 70 72 41 70 70 6c 69 65 73 47 6c 6f 62 61 6c 6c 79 2c 63 6d 70 4c 6f 61 64 65 64 3a 21 31 2c 63 6d 70 53 74 61 74 75 73 3a 22 73 74 75 62 22 2c 0a 64 69 73 70 6c 61 79 53 Data Ascii: pi.a=g.__tcfapi.a\|\|[];g.__tcfapi.a.push([b,c,d,f])};this.getPingRequest=function(b){var c,d;void 0===c&&(c=!1);b&&(d=!(c={}),"IAB2"!==a.iabType&&"IAB2V2"!==a.iabType\|\|(c={gdprApplies:e.oneTrustIABgdprAppliesGlobally,cmpLoaded:!1,cmpStatus:"stub",displayS
2024-11-15 14:59:34 UTC	1186	IN	Data Raw: 68 2e 43 43 50 41 3d 22 75 73 63 61 76 31 22 3b 68 2e 43 44 50 41 3d 22 75 73 76 61 76 31 22 3b 68 2e 55 53 4e 41 54 49 4f 4e 41 4c 3d 22 75 73 6e 61 74 76 31 22 3b 68 2e 43 4f 4c 4f 52 41 44 4f 3d 22 75 73 63 6f 76 31 22 3b 68 2e 43 54 44 50 41 3d 22 75 73 63 74 76 31 22 3b 68 2e 55 43 50 41 3d 22 75 73 75 74 76 31 22 3b 68 2e 49 41 42 32 56 32 3d 22 74 63 66 65 75 76 32 22 3b 28 68 3d 76 3d 76 7c 7c 7b 7d 29 5b 68 2e 43 50 52 41 3d 38 5d 3d 22 43 50 52 41 22 3b 68 5b 68 2e 43 43 50 41 3d 38 5d 3d 22 43 43 50 41 22 3b 68 5b 68 2e 43 44 50 41 3d 39 5d 3d 22 43 44 50 41 22 3b 68 5b 68 2e 55 53 4e 41 54 49 4f 4e 41 4c 3d 37 5d 3d 22 55 53 4e 41 54 49 4f 4e 41 4c 22 3b 68 5b 68 2e 43 4f 4c 4f 52 41 44 4f 3d 31 30 5d 3d 22 43 4f 4c 4f 52 41 44 4f 22 3b 68 5b Data Ascii: h.CCPA="uscav1";h.CDPA="usvav1";h.USNATIONAL="usnatv1";h.COLORADO="uscov1";h.CTDPA="usctv1";h.UCPA="usutv1";h.IAB2V2="tcfeuv2";(h=v=v\|\|{})[h.CPRA=8]="CPRA";h[h.CCPA=8]="CCPA";h[h.CDPA=9]="CDPA";h[h.USNATIONAL=7]="USNATIONAL";h[h.COLORADO=10]="COLORADO";h[
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 33 35 64 62 0d 0a 49 6e 69 74 3d 22 43 55 53 54 4f 4d 49 4e 49 54 22 3b 74 68 69 73 2e 69 6e 69 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 61 2e 77 69 6e 2e 5f 5f 67 70 70 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 61 2e 77 69 6e 2e 5f 5f 67 70 70 7c 7c 28 61 2e 77 69 6e 2e 5f 5f 67 70 70 3d 61 2e 65 78 65 63 75 74 65 47 70 70 41 70 69 2c 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6d 65 73 73 61 67 65 22 2c 61 2e 6d 65 73 73 61 67 65 48 61 6e 64 6c 65 72 2c 21 31 29 2c 61 2e 61 64 64 46 72 61 6d 65 28 61 2e 4c 4f 43 41 54 4f 52 5f 4e 41 4d 45 29 29 7d 3b 74 68 69 73 2e 72 65 6d 6f 76 65 47 70 70 41 70 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 64 65 6c 65 74 65 20 61 2e 77 69 6e 2e 5f 5f 67 70 70 3b 0a 76 61 72 Data Ascii: 35dbInit="CUSTOMINIT";this.init=function(){a.win.__gpp&&"function"==typeof a.win.__gpp\|\|(a.win.__gpp=a.executeGppApi,window.addEventListener("message",a.messageHandler,!1),a.addFrame(a.LOCATOR_NAME))};this.removeGppApi=function(){delete a.win.__gpp;var
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 5d 2c 67 70 70 53 74 72 69 6e 67 3a 22 22 2c 70 61 72 73 65 64 53 65 63 74 69 6f 6e 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 62 26 26 62 28 66 2c 21 30 29 2c 66 7d 3b 74 68 69 73 2e 61 64 64 46 72 61 6d 65 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 2c 64 3d 61 2e 77 69 6e 2e 64 6f 63 75 6d 65 6e 74 3b 61 2e 77 69 6e 2e 66 72 61 6d 65 73 5b 62 5d 7c 7c 28 64 2e 62 6f 64 79 3f 28 28 63 3d 64 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 66 72 61 6d 65 22 29 29 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 2c 63 2e 6e 61 6d 65 3d 62 2c 63 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 69 74 6c 65 22 2c 22 47 50 50 20 4c 6f 63 61 74 6f 72 22 29 2c 64 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 Data Ascii: ],gppString:"",parsedSections:{}};return b&&b(f,!0),f};this.addFrame=function(b){var c,d=a.win.document;a.win.frames[b]\|\|(d.body?((c=d.createElement("iframe")).style.cssText="display:none",c.name=b,c.setAttribute("title","GPP Locator"),d.body.appendChild(
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 66 69 6c 6c 28 29 3b 74 68 69 73 2e 65 6e 73 75 72 65 48 74 6d 6c 47 72 6f 75 70 44 61 74 61 49 6e 69 74 69 61 6c 69 73 65 64 28 29 3b 74 68 69 73 2e 73 65 74 53 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 28 29 3b 0a 74 68 69 73 2e 73 65 74 4f 54 44 61 74 61 4c 61 79 65 72 28 29 3b 74 68 69 73 2e 67 65 74 50 61 72 61 6d 28 29 3b 74 68 69 73 2e 66 65 74 63 68 42 61 6e 6e 65 72 53 44 4b 44 65 70 65 6e 64 65 6e 63 79 28 29 3b 74 68 69 73 2e 63 61 70 74 75 72 65 4e 6f 6e 63 65 28 29 7d 2c 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 63 61 70 74 75 72 65 4e 6f 6e 63 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6e 6f 6e 63 65 3d 65 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 6e 6f 6e 63 65 7c 7c 65 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d Data Ascii: fill();this.ensureHtmlGroupDataInitialised();this.setStubScriptElement();this.setOTDataLayer();this.getParam();this.fetchBannerSDKDependency();this.captureNonce()},k.prototype.captureNonce=function(){this.nonce=e.stubScriptElement.nonce\|\|e.stubScriptElem
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 2e 69 61 62 54 79 70 65 41 64 64 65 64 3d 21 31 2c 77 69 6e 64 6f 77 2e 5f 5f 74 63 66 61 70 69 3d 74 68 69 73 2e 65 78 65 63 75 74 65 54 63 66 41 70 69 2c 74 68 69 73 2e 69 6e 74 69 61 6c 69 7a 65 49 61 62 53 74 75 62 28 29 2c 74 68 69 73 2e 61 64 64 42 61 6e 6e 65 72 53 44 4b 53 63 72 69 70 74 28 61 29 3b 76 61 72 20 62 2c 63 3d 77 69 6e 64 6f 77 3b 63 2e 4f 6e 65 54 72 75 73 74 26 26 63 2e 4f 6e 65 54 72 75 73 74 2e 67 65 6f 6c 6f 63 61 74 69 6f 6e 52 65 73 70 6f 6e 73 65 3f 28 63 3d 63 2e 4f 6e 65 54 72 75 73 74 2e 67 65 6f 6c 6f 63 61 74 69 6f 6e 52 65 73 70 6f 6e 73 65 2c 74 68 69 73 2e 73 65 74 47 65 6f 4c 6f 63 61 74 69 6f 6e 28 63 2e 63 6f 75 6e 74 72 79 43 6f 64 65 2c 0a 63 2e 73 74 61 74 65 43 6f 64 65 29 2c 74 68 69 73 2e 61 64 64 42 61 6e 6e Data Ascii: .iabTypeAdded=!1,window.__tcfapi=this.executeTcfApi,this.intializeIabStub(),this.addBannerSDKScript(a);var b,c=window;c.OneTrust&&c.OneTrust.geolocationResponse?(c=c.OneTrust.geolocationResponse,this.setGeoLocation(c.countryCode,c.stateCode),this.addBann

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:34 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 383c7f00-901e-008f-5aa8-3667a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145934Z-16547b76f7fhvzzthC1DFW557000000001k000000000b6bh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:34 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49797	50.56.19.112	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	1256	OUT	GET /WebResource.axd?d=wnB2OjhYopty-dCFa4b2kKCIWGgLoaj0QQ4I7F_PiSysmtqnVBUtsGpmlAymZDgXEXdRjhe5BdfNkuyybLSHMhRnbzI9oh6WXC-y-EwOrJPY0qCvfWaOo0ltV4TVm8apzRlzF5O244Y4u7-m5V8Vv2yC1Tun7PurVRoOxfv28sPwY-isOJNAi7MSqc1tycGYAkqZXHU_zlVNorSTBDv4W4jemDM1&t=638646398980000000 HTTP/1.1 Host: www.telerik.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sf-tracking-consent=true; sf-prs-ss=638672795720460000; sf-prs-lu=https://www.telerik.com/download/fiddler/first-run; sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; sf-ins-pv-id=dc2da7be-2d6c-4e3e-9a51-88b40d4f050e; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1
2024-11-15 14:59:34 UTC	500	IN	HTTP/1.1 200 OK Cache-Control: public Content-Type: application/x-javascript Expires: Sat, 15 Nov 2025 08:07:56 GMT Last-Modified: Wed, 16 Oct 2024 11:44:58 GMT Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: http://localconverter.telerik.com Date: Fri, 15 Nov 2024 14:59:34 GMT Content-Length: 7351 Connection: close
2024-11-15 14:59:34 UTC	6759	IN	Data Raw: ef bb bf 76 61 72 20 70 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 4d 61 6e 61 67 65 72 20 3d 20 6e 75 6c 6c 3b 20 77 69 6e 64 6f 77 2e 73 66 43 6f 72 72 65 6c 61 74 69 6f 6e 49 64 20 3d 20 44 61 74 65 2e 6e 6f 77 28 29 2e 74 6f 53 74 72 69 6e 67 28 33 36 29 20 2b 20 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2e 74 6f 53 74 72 69 6e 67 28 33 36 29 2e 73 75 62 73 74 72 69 6e 67 28 32 29 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 22 75 73 65 20 73 74 72 69 63 74 22 3b 20 76 61 72 20 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 4d 61 6e 61 67 65 72 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 74 68 69 73 2e 70 65 72 73 6f 6e 61 6c 69 7a 65 64 43 6f 6e 74 61 69 6e 65 72 73 20 3d 20 5b 5d 2c 20 74 68 69 73 2e 70 65 72 73 6f 6e 61 6c 69 7a 65 64 43 6f 6e Data Ascii: var personalizationManager = null; window.sfCorrelationId = Date.now().toString(36) + Math.random().toString(36).substring(2), function () { "use strict"; var PersonalizationManager = function () { this.personalizedContainers = [], this.personalizedCon
2024-11-15 14:59:34 UTC	592	IN	Data Raw: 65 2e 69 6e 64 65 78 4f 66 28 22 2e 22 2c 20 69 29 29 2c 20 31 30 29 20 7d 2c 20 69 73 44 65 73 63 65 6e 64 61 6e 74 4f 66 53 76 67 3a 20 66 75 6e 63 74 69 6f 6e 20 28 65 29 20 7b 20 66 6f 72 20 28 3b 20 65 3b 29 20 7b 20 69 66 20 28 22 73 76 67 22 20 3d 3d 3d 20 65 2e 74 61 67 4e 61 6d 65 29 20 72 65 74 75 72 6e 20 21 30 3b 20 65 20 3d 20 65 2e 70 61 72 65 6e 74 4e 6f 64 65 20 7d 20 72 65 74 75 72 6e 20 21 31 20 7d 20 7d 2c 20 70 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 4d 61 6e 61 67 65 72 20 3d 20 6e 65 77 20 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 4d 61 6e 61 67 65 72 2c 20 77 69 6e 64 6f 77 2e 6a 51 75 65 72 79 29 20 6a 51 75 65 72 79 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 70 65 72 73 6f 6e Data Ascii: e.indexOf(".", i)), 10) }, isDescendantOfSvg: function (e) { for (; e;) { if ("svg" === e.tagName) return !0; e = e.parentNode } return !1 } }, personalizationManager = new PersonalizationManager, window.jQuery) jQuery(document).ready(function () { person

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49805	104.18.87.42	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	427	OUT	GET /consent/3dfce4f2-dab6-4128-9f33-df7e0597da82/3dfce4f2-dab6-4128-9f33-df7e0597da82.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:34 UTC	982	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:34 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Ray: 8e301b1e7a97e85f-DFW CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 21968 Cache-Control: public, max-age=86400 Expires: Sat, 16 Nov 2024 14:59:34 GMT Last-Modified: Tue, 25 Jun 2024 13:14:55 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: aQ7zO/MRk403j7xrbyLrvA== Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 124762ee-601e-007a-1d4d-26f9c7000000 x-ms-version: 2009-09-19 Cross-Origin-Resource-Policy: cross-origin Server: cloudflare
2024-11-15 14:59:34 UTC	387	IN	Data Raw: 31 33 34 66 0d 0a 7b 22 43 6f 6f 6b 69 65 53 50 41 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 53 61 6d 65 53 69 74 65 4e 6f 6e 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 56 32 43 53 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 4d 75 6c 74 69 56 61 72 69 61 6e 74 54 65 73 74 69 6e 67 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 55 73 65 56 32 22 3a 74 72 75 65 2c 22 4d 6f 62 69 6c 65 53 44 4b 22 3a 66 61 6c 73 65 2c 22 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 53 63 72 69 70 74 54 79 70 65 22 3a 22 50 52 4f 44 55 43 54 49 4f 4e 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 32 30 32 34 30 31 2e 32 2e 30 22 2c 22 4f 70 74 61 6e 6f 6e 44 61 74 61 4a 53 4f 4e 22 3a 22 33 64 66 63 Data Ascii: 134f{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202401.2.0","OptanonDataJSON":"3dfc
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 65 63 6b 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 63 6f 6f 6b 69 65 73 2d 64 61 74 61 2e 6f 6e 65 74 72 75 73 74 2e 69 6f 2f 62 61 6e 6e 65 72 73 64 6b 2f 76 31 2f 64 6f 6d 61 69 6e 67 72 6f 75 70 63 68 65 63 6b 22 2c 22 52 75 6c 65 53 65 74 22 3a 5b 7b 22 49 64 22 3a 22 30 31 38 66 33 39 38 64 2d 65 61 38 65 2d 37 34 61 32 2d 61 36 63 34 2d 33 39 36 30 61 63 32 65 34 36 64 61 22 2c 22 4e 61 6d 65 22 3a 22 45 55 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 64 65 22 2c 22 6e 6f 22 2c 22 62 65 22 2c 22 66 69 22 2c 22 70 74 22 2c 22 62 67 22 2c 22 64 6b 22 2c 22 6c 74 22 2c 22 6c 75 22 2c 22 6c 76 22 2c 22 68 72 22 2c 22 66 72 22 2c 22 68 75 22 2c 22 73 65 22 2c 22 6d 63 22 2c 22 73 69 22 2c 22 73 6b 22 2c 22 6d 66 22 2c 22 73 6d 22 2c 22 67 62 22 2c 22 Data Ascii: eckUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"018f398d-ea8e-74a2-a6c4-3960ac2e46da","Name":"EU","Countries":["de","no","be","fi","pt","bg","dk","lt","lu","lv","hr","fr","hu","se","mc","si","sk","mf","sm","gb","
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 62 6a 22 2c 22 62 6c 22 2c 22 62 6d 22 2c 22 62 6e 22 2c 22 62 6f 22 2c 22 73 61 22 2c 22 73 62 22 2c 22 62 71 22 2c 22 62 72 22 2c 22 73 63 22 2c 22 73 64 22 2c 22 62 73 22 2c 22 62 74 22 2c 22 73 67 22 2c 22 62 76 22 2c 22 62 77 22 2c 22 73 68 22 2c 22 73 6a 22 2c 22 62 79 22 2c 22 62 7a 22 2c 22 73 6c 22 2c 22 73 6e 22 2c 22 73 6f 22 2c 22 63 61 22 2c 22 73 72 22 2c 22 73 73 22 2c 22 63 63 22 2c 22 73 74 22 2c 22 63 64 22 2c 22 73 76 22 2c 22 63 66 22 2c 22 63 67 22 2c 22 73 78 22 2c 22 63 69 22 2c 22 73 79 22 2c 22 73 7a 22 2c 22 63 6b 22 2c 22 63 6c 22 2c 22 63 6d 22 2c 22 63 6e 22 2c 22 63 6f 22 2c 22 63 72 22 2c 22 74 63 22 2c 22 74 64 22 2c 22 63 75 22 2c 22 74 66 22 2c 22 63 76 22 2c 22 74 67 22 2c 22 74 68 22 2c 22 63 77 22 2c 22 63 78 22 2c 22 Data Ascii: bj","bl","bm","bn","bo","sa","sb","bq","br","sc","sd","bs","bt","sg","bv","bw","sh","sj","by","bz","sl","sn","so","ca","sr","ss","cc","st","cd","sv","cf","cg","sx","ci","sy","sz","ck","cl","cm","cn","co","cr","tc","td","cu","tf","cv","tg","th","cw","cx","
2024-11-15 14:59:34 UTC	1369	IN	Data Raw: 2e 30 36 31 36 38 35 38 37 35 22 2c 22 63 6d 70 49 64 22 3a 22 32 38 22 2c 22 63 6d 70 56 65 72 73 69 6f 6e 22 3a 22 31 22 2c 22 63 6f 6e 73 65 6e 74 53 63 72 65 65 6e 22 3a 22 31 22 2c 22 63 6f 6e 73 65 6e 74 4c 61 6e 67 75 61 67 65 22 3a 6e 75 6c 6c 2c 22 76 65 6e 64 6f 72 4c 69 73 74 56 65 72 73 69 6f 6e 22 3a 30 2c 22 6d 61 78 56 65 6e 64 6f 72 49 64 22 3a 30 2c 22 65 6e 63 6f 64 69 6e 67 54 79 70 65 22 3a 22 30 22 2c 22 67 6c 6f 62 61 6c 56 65 6e 64 6f 72 4c 69 73 74 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6f 6b 69 65 6c 61 77 2e 6f 72 67 2f 76 65 6e 64 6f 72 6c 69 73 74 2f 69 61 62 44 61 74 61 2e 6a 73 6f 6e 22 7d 2c 22 49 61 62 56 32 44 61 74 61 22 3a 7b 22 63 6f 6f 6b 69 65 56 65 72 73 69 6f 6e 22 3a 22 31 22 2c 22 63 72 65 61 Data Ascii: .061685875","cmpId":"28","cmpVersion":"1","consentScreen":"1","consentLanguage":null,"vendorListVersion":0,"maxVendorId":0,"encodingType":"0","globalVendorListUrl":"https://cdn.cookielaw.org/vendorlist/iabData.json"},"IabV2Data":{"cookieVersion":"1","crea
2024-11-15 14:59:34 UTC	457	IN	Data Raw: 6e 65 72 61 6c 56 65 6e 64 6f 72 73 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 50 50 22 3a 74 72 75 65 7d 2c 22 49 73 53 75 70 70 72 65 73 73 42 61 6e 6e 65 72 22 3a 66 61 6c 73 65 2c 22 49 73 53 75 70 70 72 65 73 73 50 43 22 3a 74 72 75 65 2c 22 50 75 62 6c 69 73 68 65 72 43 43 22 3a 22 55 53 22 2c 22 44 6f 6d 61 69 6e 22 3a 22 74 65 6c 65 72 69 6b 2e 63 6f 6d 22 2c 22 54 65 6e 61 6e 74 47 75 69 64 22 3a 22 30 37 62 30 35 63 64 66 2d 36 65 33 33 2d 34 62 32 39 2d 61 34 36 35 2d 37 36 38 31 33 39 65 62 33 34 38 65 22 2c 22 45 6e 76 49 64 22 3a 22 61 70 70 2d 70 72 6f 64 22 2c 22 52 65 6d 6f 74 65 41 63 74 69 6f 6e 73 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 47 65 6f 52 75 6c 65 47 72 6f 75 70 4e 61 6d 65 22 3a 22 54 65 6c 65 72 69 6b 2e 43 Data Ascii: neralVendors":true,"CookieV2GPP":true},"IsSuppressBanner":false,"IsSuppressPC":true,"PublisherCC":"US","Domain":"telerik.com","TenantGuid":"07b05cdf-6e33-4b29-a465-768139eb348e","EnvId":"app-prod","RemoteActionsEnabled":false,"GeoRuleGroupName":"Telerik.C
2024-11-15 14:59:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:34 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:34 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 46322fa8-301e-001f-3c91-36aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145934Z-16547b76f7fp6mhthC1DFWrggn0000000ne0000000009kbc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 14:59:34 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49804	50.56.19.112	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	1081	OUT	GET /webapi/Announcements/GetPromo?url=https://www.telerik.com/download/fiddler/first-run HTTP/1.1 Host: www.telerik.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sf-tracking-consent=true; sf-prs-ss=638672795720460000; sf-prs-lu=https://www.telerik.com/download/fiddler/first-run; sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; sf-ins-pv-id=dc2da7be-2d6c-4e3e-9a51-88b40d4f050e; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1
2024-11-15 14:59:35 UTC	705	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 35 Content-Type: application/json; charset=utf-8 Expires: -1 Set-Cookie: sid=Ign+HyzgZ7TlYbEaYzCS1Qv5O0dyf+1lyBYaiIeMQXg1WEQXAxrWsADbjsUx/bhgAOJZyVs3RZhMFsPoAr77EjuXNlvpkRKGHkn79HuCvTFpn22ZU69sxxohJQYF4hP2cdotzOca3dT7Xk67NSvoLAmpJtg=; expires=Mon, 13-Nov-2034 14:59:34 GMT; path=/; secure; HttpOnly; SameSite=Lax Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: http://localconverter.telerik.com Date: Fri, 15 Nov 2024 14:59:34 GMT Connection: close
2024-11-15 14:59:35 UTC	35	IN	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 70 72 6f 6d 6f 56 69 65 77 4d 6f 64 65 6c 22 3a 6e 75 6c 6c 7d 7d Data Ascii: {"content":{"promoViewModel":null}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49802	3.160.156.198	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	431	OUT	GET /cache/b3485d7dde1ec57a3915d1079237c8c34a5198c1/telerik/js/dist/polyfills.min.js HTTP/1.1 Host: dtzbdy9anri2p.cloudfront.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:35 UTC	591	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 94660 Connection: close Cache-Control: public,max-age=31536000 Last-Modified: Wed, 13 Nov 2024 07:29:00 GMT Accept-Ranges: bytes X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 15 Nov 2024 14:59:34 GMT Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 f2a51982e289d888963f4f93b48c5f22.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P7 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: 5GGhmHTio5w7dOaybuA-m_LzU7OxRGHdgmlbNipcBDaIVblc_W8Ivg==
2024-11-15 14:59:35 UTC	2544	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 4c 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 3f 77 69 6e 64 6f 77 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 3f 67 6c 6f 62 61 6c 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 73 65 6c 66 3f 73 65 6c 66 3a 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 74 28 65 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 2c 65 2e 65 78 70 6f 72 74 73 29 2c 65 2e 65 78 70 6f 72 74 73 7d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 72 65 74 75 72 6e Data Ascii: !function(){"use strict";var L="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function t(t,e){return t(e={exports:{}},e.exports),e.exports}function e(t){return
2024-11-15 14:59:35 UTC	11584	IN	Data Raw: 65 29 7b 76 61 72 20 72 2c 6e 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 3d 65 26 26 4f 28 72 3d 74 2e 74 6f 53 74 72 69 6e 67 29 26 26 21 67 28 6e 3d 6d 28 72 2c 74 29 29 29 72 65 74 75 72 6e 20 6e 3b 69 66 28 4f 28 72 3d 74 2e 76 61 6c 75 65 4f 66 29 26 26 21 67 28 6e 3d 6d 28 72 2c 74 29 29 29 72 65 74 75 72 6e 20 6e 3b 69 66 28 22 73 74 72 69 6e 67 22 21 3d 3d 65 26 26 4f 28 72 3d 74 2e 74 6f 53 74 72 69 6e 67 29 26 26 21 67 28 6e 3d 6d 28 72 2c 74 29 29 29 72 65 74 75 72 6e 20 6e 3b 74 68 72 6f 77 20 65 74 28 22 43 61 6e 27 74 20 63 6f 6e 76 65 72 74 20 6f 62 6a 65 63 74 20 74 6f 20 70 72 69 6d 69 74 69 76 65 20 76 61 6c 75 65 22 29 7d 28 74 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 48 28 74 29 7b 76 61 72 20 65 3d 7a 28 74 2c 22 73 74 72 69 6e 67 22 29 Data Ascii: e){var r,n;if("string"===e&&O(r=t.toString)&&!g(n=m(r,t)))return n;if(O(r=t.valueOf)&&!g(n=m(r,t)))return n;if("string"!==e&&O(r=t.toString)&&!g(n=m(r,t)))return n;throw et("Can't convert object to primitive value")}(t,e)}function H(t){var e=z(t,"string")
2024-11-15 14:59:35 UTC	16384	IN	Data Raw: 26 26 41 72 72 61 79 28 31 29 5b 51 72 5d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5a 72 3d 21 31 7d 29 2c 65 65 28 7b 74 61 72 67 65 74 3a 22 41 72 72 61 79 22 2c 70 72 6f 74 6f 3a 21 30 2c 66 6f 72 63 65 64 3a 5a 72 7d 2c 7b 66 69 6e 64 49 6e 64 65 78 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 4a 72 28 74 68 69 73 2c 74 2c 31 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3f 65 3a 76 6f 69 64 20 30 29 7d 7d 29 2c 5f 72 28 51 72 29 3b 76 61 72 20 74 6e 3d 62 2e 54 79 70 65 45 72 72 6f 72 2c 65 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 2c 6e 2c 6f 2c 69 2c 61 2c 75 29 7b 66 6f 72 28 76 61 72 20 63 2c 73 2c 66 3d 6f 2c 6c 3d 30 2c 68 3d 21 21 61 26 26 72 65 28 61 2c 75 29 3b 6c 3c 6e 3b 29 7b 69 66 28 6c 20 69 6e 20 72 29 7b 69 Data Ascii: &&Array(1)[Qr](function(){Zr=!1}),ee({target:"Array",proto:!0,forced:Zr},{findIndex:function(t,e){return Jr(this,t,1<arguments.length?e:void 0)}}),_r(Qr);var tn=b.TypeError,en=function(t,e,r,n,o,i,a,u){for(var c,s,f=o,l=0,h=!!a&&re(a,u);l<n;){if(l in r){i
2024-11-15 14:59:35 UTC	16384	IN	Data Raw: 65 22 27 22 3a 72 65 74 75 72 6e 20 42 61 28 61 2c 66 29 3b 63 61 73 65 22 3c 22 3a 72 3d 73 5b 42 61 28 65 2c 31 2c 2d 31 29 5d 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 76 61 72 20 6e 3d 2b 65 3b 69 66 28 30 3d 3d 6e 29 72 65 74 75 72 6e 20 74 3b 69 66 28 6c 3c 6e 29 7b 76 61 72 20 6f 3d 43 61 28 6e 2f 31 30 29 3b 72 65 74 75 72 6e 20 30 3d 3d 3d 6f 3f 74 3a 6f 3c 3d 6c 3f 76 6f 69 64 20 30 3d 3d 3d 63 5b 6f 2d 31 5d 3f 46 61 28 65 2c 31 29 3a 63 5b 6f 2d 31 5d 2b 46 61 28 65 2c 31 29 3a 74 7d 72 3d 63 5b 6e 2d 31 5d 7d 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 72 3f 22 22 3a 72 7d 29 7d 76 61 72 20 43 61 3d 4d 61 74 68 2e 66 6c 6f 6f 72 2c 46 61 3d 53 28 22 22 2e 63 68 61 72 41 74 29 2c 4c 61 3d 53 28 22 22 2e 72 65 70 6c 61 63 65 29 2c 42 61 Data Ascii: e"'":return Ba(a,f);case"<":r=s[Ba(e,1,-1)];break;default:var n=+e;if(0==n)return t;if(l<n){var o=Ca(n/10);return 0===o?t:o<=l?void 0===c[o-1]?Fa(e,1):c[o-1]+Fa(e,1):t}r=c[n-1]}return void 0===r?"":r})}var Ca=Math.floor,Fa=S("".charAt),La=S("".replace),Ba
2024-11-15 14:59:35 UTC	12576	IN	Data Raw: 2c 22 52 65 66 6c 65 63 74 22 2c 21 30 29 3b 73 69 2e 4f 62 6a 65 63 74 3b 66 75 6e 63 74 69 6f 6e 20 76 73 28 74 2c 65 29 7b 69 66 28 54 28 65 2c 74 29 29 72 65 74 75 72 6e 20 74 3b 74 68 72 6f 77 20 62 73 28 22 49 6e 63 6f 72 72 65 63 74 20 69 6e 76 6f 63 61 74 69 6f 6e 22 29 7d 66 75 6e 63 74 69 6f 6e 20 79 73 28 74 2c 65 2c 72 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 74 29 7b 76 61 72 20 72 3d 53 28 63 5b 74 5d 29 3b 6c 65 28 63 2c 74 2c 22 61 64 64 22 3d 3d 74 3f 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 72 28 74 68 69 73 2c 30 3d 3d 3d 74 3f 30 3a 74 29 2c 74 68 69 73 7d 3a 22 64 65 6c 65 74 65 22 3d 3d 74 3f 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 21 28 69 26 26 21 67 28 74 29 29 26 26 72 28 74 68 69 73 2c 30 3d 3d 3d 74 Data Ascii: ,"Reflect",!0);si.Object;function vs(t,e){if(T(e,t))return t;throw bs("Incorrect invocation")}function ys(t,e,r){function n(t){var r=S(c[t]);le(c,t,"add"==t?function(t){return r(this,0===t?0:t),this}:"delete"==t?function(t){return!(i&&!g(t))&&r(this,0===t
2024-11-15 14:59:35 UTC	16384	IN	Data Raw: 72 2b 22 3d 22 2b 68 28 6e 5b 74 5d 29 29 3b 72 65 74 75 72 6e 20 69 2e 6a 6f 69 6e 28 22 26 22 29 7d 3b 76 61 72 20 73 3d 21 21 6f 26 26 65 26 26 21 6e 26 26 72 2e 50 72 6f 78 79 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 72 2c 22 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 22 2c 7b 76 61 6c 75 65 3a 73 3f 6e 65 77 20 50 72 6f 78 79 28 65 2c 7b 63 6f 6e 73 74 72 75 63 74 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 74 28 6e 65 77 20 6c 28 65 5b 30 5d 29 2e 74 6f 53 74 72 69 6e 67 28 29 29 7d 7d 29 3a 6c 7d 29 3b 76 61 72 20 66 3d 72 2e 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 2e 70 72 6f 74 6f 74 79 70 65 3b 66 2e 70 6f 6c 79 66 69 6c 6c 3d 21 30 2c 66 2e 66 6f 72 45 61 63 68 3d 66 2e 66 6f Data Ascii: r+"="+h(n[t]));return i.join("&")};var s=!!o&&e&&!n&&r.Proxy;Object.defineProperty(r,"URLSearchParams",{value:s?new Proxy(e,{construct:function(t,e){return new t(new l(e[0]).toString())}}):l});var f=r.URLSearchParams.prototype;f.polyfill=!0,f.forEach=f.fo
2024-11-15 14:59:35 UTC	16384	IN	Data Raw: 69 73 2e 6e 65 78 74 53 69 62 6c 69 6e 67 2c 72 3d 6e 28 61 72 67 75 6d 65 6e 74 73 29 3b 74 26 26 28 65 3f 74 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 72 2c 65 29 3a 74 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 72 29 29 7d 2c 22 74 6f 67 67 6c 65 41 74 74 72 69 62 75 74 65 22 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 3d 74 68 69 73 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 74 29 3b 72 65 74 75 72 6e 20 31 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3f 72 26 26 21 65 3f 74 68 69 73 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 74 29 3a 65 26 26 21 72 26 26 74 68 69 73 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 74 2c 22 22 29 3a 72 3f 74 68 69 73 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 74 29 3a 74 68 69 73 2e 73 65 74 Data Ascii: is.nextSibling,r=n(arguments);t&&(e?t.insertBefore(r,e):t.appendChild(r))},"toggleAttribute",function(t,e){var r=this.hasAttribute(t);return 1<arguments.length?r&&!e?this.removeAttribute(t):e&&!r&&this.setAttribute(t,""):r?this.removeAttribute(t):this.set
2024-11-15 14:59:35 UTC	2420	IN	Data Raw: 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 3f 69 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 21 3d 3d 69 7d 3b 69 66 28 21 4b 6c 28 74 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 49 6e 76 61 6c 69 64 20 74 61 72 67 65 74 22 29 3b 66 6f 72 28 76 61 72 20 63 3d 64 6f 63 75 6d 65 6e 74 2e 73 63 72 6f 6c 6c 69 6e 67 45 6c 65 6d 65 6e 74 7c 7c 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2c 73 3d 5b 5d 2c 66 3d 74 3b 4b 6c 28 66 29 26 26 75 28 66 29 3b 29 7b 69 66 28 28 66 3d 66 2e 70 61 72 65 6e 74 4e 6f 64 65 29 3d 3d 3d 63 29 7b 73 2e 70 75 73 68 28 66 29 3b 62 72 65 61 6b 7d 66 3d 3d 3d 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 26 26 71 6c 28 66 29 26 26 21 71 6c 28 64 6f 63 75 6d 65 6e 74 2e Data Ascii: on"==typeof i?i:function(t){return t!==i};if(!Kl(t))throw new TypeError("Invalid target");for(var c=document.scrollingElement\|\|document.documentElement,s=[],f=t;Kl(f)&&u(f);){if((f=f.parentNode)===c){s.push(f);break}f===document.body&&ql(f)&&!ql(document.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49803	3.160.156.198	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	425	OUT	GET /cache/5466ecb2c23eafce4b55ab412dec4fc40c31abe5/telerik/js/dist/all.min.js HTTP/1.1 Host: dtzbdy9anri2p.cloudfront.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:35 UTC	604	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 259466 Connection: close Cache-Control: public,max-age=31536000 Last-Modified: Wed, 13 Nov 2024 07:29:36 GMT Accept-Ranges: bytes X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 13 Nov 2024 14:35:13 GMT Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 d8006f736d3dc32a20a91813f2f50fa2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P7 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: E3DXPLu6CfFKBfFD8y81htSyGdUadMTDYIj-WI9fiCunlP-xLHgEjA== Age: 174262
2024-11-15 14:59:35 UTC	16384	IN	Data Raw: 28 4f 3d 3e 7b 76 61 72 20 55 2c 65 2c 44 2c 56 2c 4e 2c 42 2c 48 2c 71 2c 57 2c 46 2c 4b 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 3f 77 69 6e 64 6f 77 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 3f 67 6c 6f 62 61 6c 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 73 65 6c 66 3f 73 65 6c 66 3a 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 7a 28 74 29 7b 76 61 72 20 65 3d 37 2e 35 36 32 35 2c 6e 3d 32 2e 37 35 3b 72 65 74 75 72 6e 20 74 3c 31 2f 6e 3f 65 2a 74 2a 74 3a 74 3c 32 2f 6e 3f 65 2a 28 74 2d 3d 31 2e 35 2f 6e 29 2a 74 2b 2e 37 35 3a 74 3c 32 Data Ascii: (O=>{var U,e,D,V,N,B,H,q,W,F,K="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function z(t){var e=7.5625,n=2.75;return t<1/n?ett:t<2/n?e(t-=1.5/n)t+.75:t<2
2024-11-15 14:59:35 UTC	16384	IN	Data Raw: 6f 6e 20 71 6e 28 6e 2c 74 2c 65 2c 69 29 7b 76 61 72 20 73 2c 72 3d 63 28 6e 29 2c 61 3d 21 67 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 7b 7d 3b 72 65 74 75 72 6e 20 74 5b 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 37 7d 2c 37 21 3d 22 22 5b 6e 5d 28 74 29 7d 29 2c 6f 3d 61 26 26 21 67 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 21 31 2c 65 3d 2f 61 2f 3b 72 65 74 75 72 6e 22 73 70 6c 69 74 22 3d 3d 3d 6e 26 26 28 28 65 3d 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 7d 7d 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 5b 71 6f 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 7d 2c 65 2e 66 6c 61 67 73 3d 22 22 2c 65 5b 72 5d 3d 2f 2e 2f 5b 72 5d 29 2c 65 2e 65 78 65 63 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 Data Ascii: on qn(n,t,e,i){var s,r=c(n),a=!g(function(){var t={};return t[r]=function(){return 7},7!=""[n](t)}),o=a&&!g(function(){var t=!1,e=/a/;return"split"===n&&((e={constructor:{}}).constructor[qo]=function(){return e},e.flags="",e[r]=/./[r]),e.exec=function(){r
2024-11-15 14:59:35 UTC	16384	IN	Data Raw: 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 70 6c 61 63 65 29 2c 62 6f 3d 52 65 67 45 78 70 2e 70 72 6f 74 6f 74 79 70 65 2e 65 78 65 63 2c 77 6f 3d 62 6f 2c 45 6f 3d 62 28 22 22 2e 63 68 61 72 41 74 29 2c 53 6f 3d 62 28 22 22 2e 69 6e 64 65 78 4f 66 29 2c 54 6f 3d 62 28 22 22 2e 72 65 70 6c 61 63 65 29 2c 78 6f 3d 62 28 22 22 2e 73 6c 69 63 65 29 2c 6b 6f 3d 28 64 3d 2f 62 2a 2f 67 2c 53 28 62 6f 2c 75 3d 2f 61 2f 2c 22 61 22 29 2c 53 28 62 6f 2c 64 2c 22 61 22 29 2c 30 21 3d 3d 75 2e 6c 61 73 74 49 6e 64 65 78 7c 7c 30 21 3d 3d 64 2e 6c 61 73 74 49 6e 64 65 78 29 2c 43 6f 3d 73 2e 42 52 4f 4b 45 4e 5f 43 41 52 45 54 2c 4c 6f 3d 76 6f 69 64 20 30 21 3d 3d 2f 28 29 3f 3f 2f 2e 65 78 65 63 28 22 22 29 5b 31 5d 2c 50 6f 3d 77 6f 3d 6b 6f 7c 7c 4c Data Ascii: tring.prototype.replace),bo=RegExp.prototype.exec,wo=bo,Eo=b("".charAt),So=b("".indexOf),To=b("".replace),xo=b("".slice),ko=(d=/b*/g,S(bo,u=/a/,"a"),S(bo,d,"a"),0!==u.lastIndex\|\|0!==d.lastIndex),Co=s.BROKEN_CARET,Lo=void 0!==/()??/.exec("")[1],Po=wo=ko\|\|L
2024-11-15 14:59:35 UTC	16384	IN	Data Raw: 2c 65 29 7b 72 65 74 75 72 6e 20 58 61 28 4d 74 28 74 29 2c 65 29 7d 7d 29 2c 76 28 7b 74 61 72 67 65 74 3a 22 4f 62 6a 65 63 74 22 2c 73 74 61 74 3a 21 30 2c 73 68 61 6d 3a 21 66 7d 2c 7b 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 2c 6e 2c 69 3d 4d 74 28 74 29 2c 72 3d 66 65 2e 66 2c 6f 3d 46 65 28 69 29 2c 73 3d 7b 7d 2c 61 3d 30 3b 6f 2e 6c 65 6e 67 74 68 3e 61 3b 29 76 6f 69 64 20 30 21 3d 3d 28 6e 3d 72 28 69 2c 65 3d 6f 5b 61 2b 2b 5d 29 29 26 26 6d 6e 28 73 2c 65 2c 6e 29 3b 72 65 74 75 72 6e 20 73 7d 7d 29 2c 73 61 2e 66 29 2c 72 3d 67 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 Data Ascii: ,e){return Xa(Mt(t),e)}}),v({target:"Object",stat:!0,sham:!f},{getOwnPropertyDescriptors:function(t){for(var e,n,i=Mt(t),r=fe.f,o=Fe(i),s={},a=0;o.length>a;)void 0!==(n=r(i,e=o[a++]))&&mn(s,e,n);return s}}),sa.f),r=g(function(){return!Object.getOwnPropert
2024-11-15 14:59:35 UTC	16384	IN	Data Raw: 4e 6c 28 65 29 7d 2c 75 2e 65 6e 74 72 69 65 73 3d 75 2e 65 6e 74 72 69 65 73 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3d 5b 5d 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 6e 2e 70 75 73 68 28 5b 65 2c 74 5d 29 7d 29 2c 4e 6c 28 6e 29 7d 2c 52 6c 26 26 28 75 5b 49 6c 2e 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 75 5b 49 6c 2e 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 7c 7c 75 2e 65 6e 74 72 69 65 73 29 29 2c 41 6c 3d 76 6f 69 64 20 30 21 3d 3d 51 3f 51 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 3f 77 69 6e 64 6f 77 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 73 65 6c 66 3f 73 65 6c 66 3a 51 2c 6a 6c 3d 28 28 29 Data Ascii: Nl(e)},u.entries=u.entries\|\|function(){var n=[];return this.forEach(function(t,e){n.push([e,t])}),Nl(n)},Rl&&(u[Il.Symbol.iterator]=u[Il.Symbol.iterator]\|\|u.entries)),Al=void 0!==Q?Q:"undefined"!=typeof window?window:"undefined"!=typeof self?self:Q,jl=(()
2024-11-15 14:59:35 UTC	16384	IN	Data Raw: 2b 22 2c 33 2c 21 30 2c 21 31 2c 21 30 2c 21 31 2c 21 31 29 2c 54 3d 22 2b 22 3d 3d 28 65 2e 6b 65 79 49 64 65 6e 74 69 66 69 65 72 7c 7c 65 2e 6b 65 79 29 26 26 33 3d 3d 28 65 2e 6b 65 79 4c 6f 63 61 74 69 6f 6e 7c 7c 65 2e 6c 6f 63 61 74 69 6f 6e 29 26 26 28 65 2e 63 74 72 6c 4b 65 79 3f 65 2e 61 6c 74 4b 65 79 3f 31 3a 33 3a 65 2e 73 68 69 66 74 4b 65 79 3f 32 3a 34 29 7c 7c 39 7d 63 61 74 63 68 28 74 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 74 2c 65 29 7b 45 75 28 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 22 4b 65 79 62 6f 61 72 64 45 76 65 6e 74 22 29 2c 65 3d 28 28 74 2c 65 29 3d 3e 7b 66 6f 72 28 76 61 72 20 6e 20 69 6e 20 65 29 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 6e 29 26 26 21 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 Data Ascii: +",3,!0,!1,!0,!1,!1),T="+"==(e.keyIdentifier\|\|e.key)&&3==(e.keyLocation\|\|e.location)&&(e.ctrlKey?e.altKey?1:3:e.shiftKey?2:4)\|\|9}catch(t){}function n(t,e){Eu(arguments.length,"KeyboardEvent"),e=((t,e)=>{for(var n in e)e.hasOwnProperty(n)&&!e.hasOwnPropert
2024-11-15 14:59:35 UTC	16384	IN	Data Raw: 62 72 65 61 6b 70 6f 69 6e 74 48 61 6e 64 6c 65 72 2e 62 69 6e 64 28 74 68 69 73 29 2c 74 68 69 73 2e 6f 6e 42 72 65 61 6b 70 6f 69 6e 74 41 62 6f 76 65 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 6f 6e 42 72 65 61 6b 70 6f 69 6e 74 41 62 6f 76 65 2e 62 69 6e 64 28 74 68 69 73 29 2c 74 68 69 73 2e 6f 6e 42 72 65 61 6b 70 6f 69 6e 74 42 65 6c 6f 77 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 6f 6e 42 72 65 61 6b 70 6f 69 6e 74 42 65 6c 6f 77 2e 62 69 6e 64 28 74 68 69 73 29 2c 74 68 69 73 2e 74 75 72 6e 4f 6e 28 29 7d 66 75 6e 63 74 69 6f 6e 20 59 68 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 72 65 70 6c 61 63 65 28 2f 2d 28 5b 61 2d 7a 5d 29 2f 67 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 5b 31 5d 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 7d Data Ascii: breakpointHandler.bind(this),this.onBreakpointAbove=this.options.onBreakpointAbove.bind(this),this.onBreakpointBelow=this.options.onBreakpointBelow.bind(this),this.turnOn()}function Yh(t){return t.replace(/-([a-z])/g,function(t){return t[1].toUpperCase()}
2024-11-15 14:59:35 UTC	13742	IN	Data Raw: 7b 74 68 69 73 2e 5f 73 77 69 74 63 68 65 64 4f 6e 26 26 28 77 69 6e 64 6f 77 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 73 63 72 6f 6c 6c 22 2c 74 68 69 73 2e 62 6f 75 6e 64 4f 6e 53 63 72 6f 6c 6c 2c 21 31 29 2c 77 69 6e 64 6f 77 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 72 65 73 69 7a 65 22 2c 74 68 69 73 2e 62 6f 75 6e 64 4f 6e 52 65 73 69 7a 65 2c 21 31 29 2c 77 69 6e 64 6f 77 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 72 65 73 69 7a 65 22 2c 74 68 69 73 2e 62 6f 75 6e 64 42 72 65 61 6b 70 6f 69 6e 74 48 61 6e 64 6c 65 72 2c 21 31 29 2c 74 68 69 73 2e 72 65 73 65 74 28 29 2c 74 68 69 73 2e 5f 73 77 69 74 63 68 65 64 4f 6e 3d 21 31 29 7d 2c 6d 2e 63 72 65 61 74 65 3d 66 75 6e 63 74 Data Ascii: {this._switchedOn&&(window.removeEventListener("scroll",this.boundOnScroll,!1),window.removeEventListener("resize",this.boundOnResize,!1),window.removeEventListener("resize",this.boundBreakpointHandler,!1),this.reset(),this._switchedOn=!1)},m.create=funct
2024-11-15 14:59:35 UTC	1576	IN	Data Raw: 43 68 65 63 6b 43 6f 72 72 65 63 74 69 6f 6e 57 6f 72 64 2c 74 61 67 73 3a 74 2e 74 61 67 73 2c 70 61 67 65 3a 31 7d 29 2c 74 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 69 64 59 6f 75 4d 65 61 6e 54 65 78 74 2e 72 65 70 6c 61 63 65 28 22 7b 30 7d 22 2c 27 3c 61 20 68 72 65 66 3d 22 27 2b 65 2b 27 22 3e 27 2b 74 64 28 74 68 69 73 2e 5f 73 70 65 6c 6c 43 68 65 63 6b 43 6f 72 72 65 63 74 69 6f 6e 57 6f 72 64 29 2b 22 3c 2f 61 3e 22 29 3b 74 68 69 73 2e 63 6f 6e 74 61 69 6e 65 72 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 73 70 61 6e 3e 22 2b 74 2b 22 20 3c 2f 73 70 61 6e 3e 22 2c 74 68 69 73 2e 77 72 61 70 70 65 72 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 22 2c 74 68 69 73 2e 77 72 61 70 70 65 72 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 68 69 64 64 65 Data Ascii: CheckCorrectionWord,tags:t.tags,page:1}),t=this.options.didYouMeanText.replace("{0}",'<a href="'+e+'">'+td(this._spellCheckCorrectionWord)+"</a>");this.container.innerHTML="<span>"+t+" </span>",this.wrapper.innerHTML="",this.wrapper.removeAttribute("hidde
2024-11-15 14:59:35 UTC	16384	IN	Data Raw: 6c 65 3f 6d 69 6e 69 3d 74 72 75 65 26 75 72 6c 3d 22 2b 72 2b 22 26 73 75 6d 6d 61 72 79 3d 22 2b 6f 3b 62 72 65 61 6b 3b 63 61 73 65 22 72 65 64 64 69 74 22 3a 69 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 65 64 64 69 74 2e 63 6f 6d 2f 6c 6f 67 69 6e 3f 72 65 64 69 72 65 63 74 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 65 64 64 69 74 2e 63 6f 6d 2f 73 75 62 6d 69 74 3f 75 72 6c 3d 22 2b 72 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 69 3d 22 68 74 74 70 73 3a 2f 2f 74 77 69 74 74 65 72 2e 63 6f 6d 2f 73 68 61 72 65 3f 75 72 6c 3d 22 2b 72 2b 22 26 74 65 78 74 3d 22 2b 6f 7d 72 65 74 75 72 6e 20 69 7d 2c 61 64 2e 5f 64 65 6c 65 67 61 74 65 64 54 6f 67 67 6c 65 53 68 61 72 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2e 74 61 72 67 65 Data Ascii: le?mini=true&url="+r+"&summary="+o;break;case"reddit":i="https://www.reddit.com/login?redirect=https://www.reddit.com/submit?url="+r;break;default:i="https://twitter.com/share?url="+r+"&text="+o}return i},ad._delegatedToggleShare=function(t){var e=t.targe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49810	192.29.11.142	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	639	OUT	GET /visitor/v200/svrGP.aspx?pps=70&siteid=1325&elqCookie=1 HTTP/1.1 Host: s1325.t.eloqua.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ELOQUA=GUID=556417D9DDDE4E9DB23F8F04730AE93B; ELQSTATUS=OK
2024-11-15 14:59:35 UTC	446	IN	HTTP/1.1 200 OK Cache-Control: no-store Pragma: no-cache Content-Type: application/javascript; charset=utf-8 Expires: -1 X-Robots-Tag: noindex, nofollow X-Xss-Protection: 1; mode=block Strict-Transport-Security: max-age=31536000; includeSubDomains; preload P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", X-Content-Type-Options: nosniff Date: Fri, 15 Nov 2024 14:59:34 GMT Connection: close Content-Length: 79
2024-11-15 14:59:35 UTC	79	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 47 65 74 45 6c 71 43 75 73 74 6f 6d 65 72 47 55 49 44 28 29 7b 20 72 65 74 75 72 6e 20 27 35 35 36 34 31 37 64 39 2d 64 64 64 65 2d 34 65 39 64 2d 62 32 33 66 2d 38 66 30 34 37 33 30 61 65 39 33 62 27 3b 20 7d Data Ascii: function GetElqCustomerGUID(){ return '556417d9-ddde-4e9d-b23f-8f04730ae93b'; }

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49813	104.18.87.42	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	382	OUT	GET /scripttemplates/202401.2.0/otBannerSdk.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:35 UTC	948	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:35 GMT Content-Type: application/javascript Content-Length: 439670 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cf-Bgj: minify Cf-Polished: origSize=439756 Content-MD5: /uAp/tjl0E0OrWvE5WYCuw== ETag: 0x8DCA5DDD9C832F7 Last-Modified: Tue, 16 Jul 2024 21:25:43 GMT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 3fbe50a0-201e-00d7-5d09-24d9ad000000 x-ms-version: 2009-09-19 Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 23221 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Cross-Origin-Resource-Policy: cross-origin Server: cloudflare CF-RAY: 8e301b1feda2e832-DFW
2024-11-15 14:59:35 UTC	421	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 4e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 4e 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 28 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 74 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 74 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 6f 29 26 26 28 65 5b 6f 5d 3d 74 5b 6f 5d 29 7d 29 29 28 65 2c 74 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 44 28 65 2c 74 29 7b 69 66 28 22 66 75 6e 63 Data Ascii: !function(){"use strict";var N=function(e,t){return(N=Object.setPrototypeOf\|\|({__proto__:[]}instanceof Array?function(e,t){e.__proto__=t}:function(e,t){for(var o in t)Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o])}))(e,t)};function D(e,t){if("func
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 6c 3d 3d 3d 74 3f 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 29 3a 28 6f 2e 70 72 6f 74 6f 74 79 70 65 3d 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 65 77 20 6f 29 7d 76 61 72 20 48 2c 52 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 52 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6f 3d 31 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 3c 6e 3b 6f 2b 2b 29 66 6f 72 28 76 61 72 20 72 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 72 29 26 26 28 65 5b 72 5d 3d 74 5b 72 5d 29 3b 72 65 74 75 72 6e 20 65 7d 29 2e 61 70 70 6c 79 28 74 68 69 73 Data Ascii: l===t?Object.create(t):(o.prototype=t.prototype,new o)}var H,R=function(){return(R=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 2e 6c 61 62 65 6c 3c 61 5b 31 5d 29 6c 2e 6c 61 62 65 6c 3d 61 5b 31 5d 2c 61 3d 74 3b 65 6c 73 65 7b 69 66 28 21 28 61 26 26 6c 2e 6c 61 62 65 6c 3c 61 5b 32 5d 29 29 7b 61 5b 32 5d 26 26 6c 2e 6f 70 73 2e 70 6f 70 28 29 2c 6c 2e 74 72 79 73 2e 70 6f 70 28 29 3b 63 6f 6e 74 69 6e 75 65 7d 6c 2e 6c 61 62 65 6c 3d 61 5b 32 5d 2c 6c 2e 6f 70 73 2e 70 75 73 68 28 74 29 7d 7d 74 3d 72 2e 63 61 6c 6c 28 6e 2c 6c 29 7d 63 61 74 63 68 28 65 29 7b 74 3d 5b 36 2c 65 5d 2c 73 3d 30 7d 66 69 6e 61 6c 6c 79 7b 69 3d 61 3d 30 7d 69 66 28 35 26 74 5b 30 5d 29 74 68 72 6f 77 20 74 5b 31 5d 3b 72 65 74 75 72 6e 7b 76 61 6c 75 65 3a 74 5b 30 5d 3f 74 5b 31 5d 3a 76 6f 69 64 20 30 2c 64 6f 6e 65 3a 21 30 7d 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 71 28 29 7b 66 6f 72 28 76 61 Data Ascii: .label<a[1])l.label=a[1],a=t;else{if(!(a&&l.label<a[2])){a[2]&&l.ops.pop(),l.trys.pop();continue}l.label=a[2],l.ops.push(t)}}t=r.call(n,l)}catch(e){t=[6,e],s=0}finally{i=a=0}if(5&t[0])throw t[1];return{value:t[0]?t[1]:void 0,done:!0}}}}function q(){for(va
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 29 29 7b 76 61 72 20 6f 3d 65 2e 74 68 65 6e 3b 69 66 28 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 4b 29 72 65 74 75 72 6e 20 74 2e 5f 73 74 61 74 65 3d 33 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 76 6f 69 64 20 58 28 74 29 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6f 29 72 65 74 75 72 6e 20 76 6f 69 64 20 24 28 28 6e 3d 6f 2c 72 3d 65 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 61 70 70 6c 79 28 72 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2c 74 29 7d 74 2e 5f 73 74 61 74 65 3d 31 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 58 28 74 29 7d 63 61 74 63 68 28 65 29 7b 4a 28 74 2c 65 29 7d 76 61 72 20 6e 2c 72 7d 66 75 6e 63 74 69 6f 6e 20 4a 28 65 2c 74 29 7b 65 2e 5f 73 74 61 74 65 3d 32 2c 65 2e 5f 76 61 Data Ascii: tion"==typeof e)){var o=e.then;if(e instanceof K)return t._state=3,t._value=e,void X(t);if("function"==typeof o)return void $((n=o,r=e,function(){n.apply(r,arguments)}),t)}t._state=1,t._value=e,X(t)}catch(e){J(t,e)}var n,r}function J(e,t){e._state=2,e._va
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 65 29 29 7b 76 61 72 20 6e 3d 65 2e 74 68 65 6e 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6e 29 72 65 74 75 72 6e 20 76 6f 69 64 20 6e 2e 63 61 6c 6c 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 28 6f 2c 65 29 7d 2c 69 29 7d 73 5b 6f 5d 3d 65 2c 30 3d 3d 2d 2d 61 26 26 72 28 73 29 7d 63 61 74 63 68 28 65 29 7b 69 28 65 29 7d 7d 28 65 2c 73 5b 65 5d 29 7d 29 7d 2c 4b 2e 72 65 73 6f 6c 76 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 4b 3f 74 3a 6e 65 77 20 4b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 28 74 29 7d 29 7d 2c 4b 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 72 65 74 75 Data Ascii: e)){var n=e.then;if("function"==typeof n)return void n.call(e,function(e){t(o,e)},i)}s[o]=e,0==--a&&r(s)}catch(e){i(e)}}(e,s[e])})},K.resolve=function(t){return t&&"object"==typeof t&&t.constructor===K?t:new K(function(e){e(t)})},K.reject=function(o){retu
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 65 21 3d 65 26 26 73 21 3d 73 29 72 65 74 75 72 6e 21 30 3b 69 2b 2b 7d 7d 72 65 74 75 72 6e 21 31 7d 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 7d 2c 5a 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 45 6e 64 73 57 69 74 68 50 6f 6c 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 64 73 57 69 74 68 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2c 22 65 6e 64 73 57 69 74 68 22 2c 7b 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 74 3e 74 68 69 73 2e 6c 65 6e 67 74 68 29 26 26 28 74 3d 74 68 69 73 2e 6c 65 6e 67 74 68 29 2c Data Ascii: e!=e&&s!=s)return!0;i++}}return!1},writable:!0,configurable:!0})},Z.prototype.initEndsWithPoly=function(){String.prototype.endsWith\|\|Object.defineProperty(String.prototype,"endsWith",{value:function(e,t){return(void 0===t\|\|t>this.length)&&(t=this.length),
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 7d 2c 5a 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 41 72 72 61 79 46 69 6c 6c 50 6f 6c 79 66 69 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6c 6c 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2c 22 66 69 6c 6c 22 2c 7b 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 6e 75 6c 6c 3d 3d 74 68 69 73 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 74 68 69 73 20 69 73 20 6e 75 6c 6c 20 6f 72 20 6e 6f 74 20 64 65 66 69 6e 65 64 22 29 3b 66 6f 72 28 76 61 72 20 74 3d 4f 62 6a 65 63 74 28 74 68 69 73 29 2c 6f 3d 74 2e 6c Data Ascii: writable:!0,configurable:!0})},Z.prototype.initArrayFillPolyfill=function(){Array.prototype.fill\|\|Object.defineProperty(Array.prototype,"fill",{value:function(e){if(null==this)throw new TypeError("this is null or not defined");for(var t=Object(this),o=t.l
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 5b 65 2e 42 61 6e 6e 65 72 53 61 76 65 53 65 74 74 69 6e 67 73 3d 35 5d 3d 22 42 61 6e 6e 65 72 53 61 76 65 53 65 74 74 69 6e 67 73 22 2c 65 5b 65 2e 43 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 69 6e 67 42 75 74 74 6f 6e 3d 36 5d 3d 22 43 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 69 6e 67 42 75 74 74 6f 6e 22 2c 28 65 3d 74 65 3d 74 65 7c 7c 7b 7d 29 5b 65 2e 42 61 6e 6e 65 72 3d 31 5d 3d 22 42 61 6e 6e 65 72 22 2c 65 5b 65 2e 50 43 3d 32 5d 3d 22 50 43 22 2c 65 5b 65 2e 41 50 49 3d 33 5d 3d 22 41 50 49 22 2c 28 65 3d 6f 65 3d 6f 65 7c 7c 7b 7d 29 2e 41 63 63 65 70 74 41 6c 6c 3d 22 41 63 63 65 70 74 41 6c 6c 22 2c 65 2e 52 65 6a 65 63 74 41 6c 6c 3d 22 52 65 6a 65 63 74 41 6c 6c 22 2c 65 2e 55 70 64 61 74 65 43 6f 6e Data Ascii: [e.BannerSaveSettings=5]="BannerSaveSettings",e[e.ContinueWithoutAcceptingButton=6]="ContinueWithoutAcceptingButton",(e=te=te\|\|{})[e.Banner=1]="Banner",e[e.PC=2]="PC",e[e.API=3]="API",(e=oe=oe\|\|{}).AcceptAll="AcceptAll",e.RejectAll="RejectAll",e.UpdateCon
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 20 41 6c 6c 6f 77 20 41 6c 6c 22 2c 65 5b 65 5b 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 52 65 6a 65 63 74 20 41 6c 6c 22 5d 3d 35 5d 3d 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 52 65 6a 65 63 74 20 41 6c 6c 22 2c 65 5b 65 5b 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 43 6f 6e 66 69 72 6d 22 5d 3d 36 5d 3d 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 43 6f 6e 66 69 72 6d 22 2c 65 5b 65 5b 22 47 50 43 20 76 61 6c 75 65 20 63 68 61 6e 67 65 64 22 5d 3d 37 5d 3d 22 47 50 43 20 76 61 6c 75 65 20 63 68 61 6e 67 65 64 22 2c 28 65 3d 68 65 3d 68 65 7c 7c 7b 7d 29 2e 41 63 74 69 76 65 3d 22 31 22 2c 65 2e 49 6e 41 63 74 69 76 65 3d 22 30 22 2c 28 65 3d 43 65 3d 43 65 7c 7c 7b 7d 29 Data Ascii: Allow All",e[e["Preference Center - Reject All"]=5]="Preference Center - Reject All",e[e["Preference Center - Confirm"]=6]="Preference Center - Confirm",e[e["GPC value changed"]=7]="GPC value changed",(e=he=he\|\|{}).Active="1",e.InActive="0",(e=Ce=Ce\|\|{})
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 69 74 5f 66 6f 72 5f 75 70 64 61 74 65 3d 22 77 61 69 74 5f 66 6f 72 5f 75 70 64 61 74 65 22 2c 28 65 3d 49 65 3d 49 65 7c 7c 7b 7d 29 2e 67 72 61 6e 74 65 64 3d 22 67 72 61 6e 74 65 64 22 2c 65 2e 64 65 6e 69 65 64 3d 22 64 65 6e 69 65 64 22 2c 30 2c 28 65 3d 4c 65 3d 4c 65 7c 7c 7b 7d 29 2e 4f 42 4a 45 43 54 5f 54 4f 5f 4c 49 3d 22 4f 62 6a 65 63 74 54 6f 4c 49 22 2c 65 2e 4c 49 5f 41 43 54 49 56 45 5f 49 46 5f 4c 45 47 41 4c 5f 42 41 53 49 53 3d 22 4c 49 41 63 74 69 76 65 49 66 4c 65 67 61 6c 42 61 73 69 73 22 2c 28 65 3d 5f 65 3d 5f 65 7c 7c 7b 7d 29 2e 63 6f 6f 6b 69 65 73 3d 22 63 6f 6f 6b 69 65 73 22 2c 65 2e 76 65 6e 64 6f 72 73 3d 22 76 65 6e 64 6f 72 73 22 2c 28 65 3d 45 65 3d 45 65 7c 7c 7b 7d 29 2e 47 44 50 52 3d 22 47 44 50 52 22 2c 65 2e 43 Data Ascii: it_for_update="wait_for_update",(e=Ie=Ie\|\|{}).granted="granted",e.denied="denied",0,(e=Le=Le\|\|{}).OBJECT_TO_LI="ObjectToLI",e.LI_ACTIVE_IF_LEGAL_BASIS="LIActiveIfLegalBasis",(e=_e=_e\|\|{}).cookies="cookies",e.vendors="vendors",(e=Ee=Ee\|\|{}).GDPR="GDPR",e.C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49812	172.64.155.119	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	380	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:35 UTC	249	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:35 GMT Content-Type: text/javascript Content-Length: 77 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8e301b1ffc032cc6-DFW
2024-11-15 14:59:35 UTC	77	IN	Data Raw: 6a 73 6f 6e 46 65 65 64 28 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 54 58 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 54 65 78 61 73 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d 29 3b Data Ascii: jsonFeed({"country":"US","state":"TX","stateName":"Texas","continent":"NA"});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49806	18.66.107.59	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	498	OUT	GET /Frontend-Assembly/Web.SitefinityExtensions.EloquaConnector/Scripts/BrowserSessionStorage.min.js?package=PureMvc&v=Q2NzWmRUZmg5UHpIS3RyRDhtYkJmUT09 HTTP/1.1 Host: d585tldpucybw.cloudfront.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:35 UTC	776	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 667 Connection: close Last-Modified: Wed, 16 Oct 2024 11:44:58 GMT Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: http://localconverter.telerik.com Cache-Control: public, max-age=0 Expires: Tue, 19 Nov 2024 09:11:26 GMT Date: Fri, 15 Nov 2024 07:09:36 GMT Vary: Accept-Encoding,Cookie X-Cache: Hit from cloudfront Via: 1.1 b30b1c2659a3fb836783824fe37110ee.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P5 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: SGrLi-V9TsxbxB6Pt3jXhPkGd2m9MUlpSf6uIQcoyKm2R7JtYDwo-g== Age: 28199
2024-11-15 14:59:35 UTC	667	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3d 22 62 73 63 22 3b 66 75 6e 63 74 69 6f 6e 20 69 28 6e 29 7b 66 6f 72 28 76 61 72 20 72 3d 6e 2b 22 3d 22 2c 66 3d 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 29 2c 75 3d 66 2e 73 70 6c 69 74 28 22 3b 22 29 2c 69 3d 30 3b 69 3c 75 2e 6c 65 6e 67 74 68 3b 69 2b 2b 29 7b 66 6f 72 28 76 61 72 20 74 3d 75 5b 69 5d 3b 74 2e 63 68 61 72 41 74 28 30 29 3d 3d 3d 22 20 22 3b 29 74 3d 74 2e 73 75 62 73 74 72 69 6e 67 28 31 29 3b 69 66 28 74 2e 69 6e 64 65 78 4f 66 28 72 29 3d 3d 3d 30 29 72 65 74 75 72 6e 20 74 2e 73 75 62 73 74 72 69 6e 67 28 72 2e 6c 65 6e 67 74 68 2c 74 2e 6c 65 6e 67 74 68 29 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f Data Ascii: (function(){var n="bsc";function i(n){for(var r=n+"=",f=decodeURIComponent(document.cookie),u=f.split(";"),i=0;i<u.length;i++){for(var t=u[i];t.charAt(0)===" ";)t=t.substring(1);if(t.indexOf(r)===0)return t.substring(r.length,t.length)}return null}functio

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49816	104.18.87.42	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	430	OUT	GET /consent/3dfce4f2-dab6-4128-9f33-df7e0597da82/018f398d-e7fe-774d-a988-aae80a524894/en.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:35 UTC	982	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:35 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Ray: 8e301b200fa1e752-DFW CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 51200 Cache-Control: public, max-age=86400 Expires: Sat, 16 Nov 2024 14:59:35 GMT Last-Modified: Tue, 25 Jun 2024 13:14:56 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: 82Fy1aYQlT3U+oTlLTFHBg== Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: a7a7abc9-e01e-00e3-634d-267605000000 x-ms-version: 2009-09-19 Cross-Origin-Resource-Policy: cross-origin Server: cloudflare
2024-11-15 14:59:35 UTC	387	IN	Data Raw: 32 32 31 66 0d 0a 7b 22 44 6f 6d 61 69 6e 44 61 74 61 22 3a 7b 22 70 63 6c 69 66 65 53 70 61 6e 59 72 22 3a 22 59 65 61 72 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 73 22 3a 22 59 65 61 72 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 53 65 63 73 22 3a 22 41 20 66 65 77 20 73 65 63 6f 6e 64 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 22 3a 22 57 65 65 6b 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 73 22 3a 22 57 65 65 6b 73 22 2c 22 70 63 63 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 54 65 78 74 22 3a 22 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 6f 75 74 20 41 63 63 65 70 74 69 6e 67 22 2c 22 70 63 63 6c 6f 73 65 42 75 74 74 6f 6e 54 79 70 65 22 3a 22 49 63 6f 6e 22 2c 22 4d 61 69 6e 54 65 78 74 22 3a 22 50 72 69 76 61 63 79 20 50 72 65 Data Ascii: 221f{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","pccloseButtonType":"Icon","MainText":"Privacy Pre
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 6d 20 6f 66 20 63 6f 6f 6b 69 65 73 2e 20 54 68 69 73 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 6d 69 67 68 74 20 62 65 20 61 62 6f 75 74 20 79 6f 75 2c 20 79 6f 75 72 20 70 72 65 66 65 72 65 6e 63 65 73 20 6f 72 20 79 6f 75 72 20 64 65 76 69 63 65 20 61 6e 64 20 69 73 20 6d 6f 73 74 6c 79 20 75 73 65 64 20 74 6f 20 6d 61 6b 65 20 74 68 65 20 73 69 74 65 20 77 6f 72 6b 20 61 73 20 79 6f 75 20 65 78 70 65 63 74 20 69 74 20 74 6f 2e 20 54 68 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 64 6f 65 73 20 6e 6f 74 20 75 73 75 61 6c 6c 79 20 64 69 72 65 63 74 6c 79 20 69 64 65 6e 74 69 66 79 20 79 6f 75 2c 20 62 75 74 20 69 74 20 63 61 6e 20 67 69 76 65 20 79 6f 75 20 61 20 6d 6f 72 65 20 70 65 72 73 6f 6e 61 6c 69 73 65 64 20 77 65 62 20 65 78 70 65 72 69 65 6e 63 65 Data Ascii: m of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalised web experience
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 5f 62 6c 61 6e 6b 5c 22 3e 43 6f 6f 6b 69 65 20 50 6f 6c 69 63 79 3c 2f 61 3e 20 66 6f 72 20 61 20 6d 6f 72 65 20 64 65 74 61 69 6c 65 64 20 64 65 73 63 72 69 70 74 69 6f 6e 20 61 6e 64 20 63 6c 69 63 6b 20 6f 6e 20 74 68 65 20 73 65 74 74 69 6e 67 73 20 62 75 74 74 6f 6e 20 74 6f 20 63 75 73 74 6f 6d 69 7a 65 20 68 6f 77 20 74 68 65 20 73 69 74 65 20 75 73 65 73 20 63 6f 6f 6b 69 65 73 20 66 6f 72 20 79 6f 75 2e 22 2c 22 41 6c 65 72 74 43 6c 6f 73 65 54 65 78 74 22 3a 22 43 6c 6f 73 65 22 2c 22 41 6c 65 72 74 4d 6f 72 65 49 6e 66 6f 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 53 65 74 74 69 6e 67 73 22 2c 22 43 6f 6f 6b 69 65 53 65 74 74 69 6e 67 42 75 74 74 6f 6e 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 53 65 74 74 69 6e 67 73 22 2c 22 41 6c 65 72 Data Ascii: _blank\">Cookie Policy</a> for a more detailed description and click on the settings button to customize how the site uses cookies for you.","AlertCloseText":"Close","AlertMoreInfoText":"Cookies Settings","CookieSettingButtonText":"Cookies Settings","Aler
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 6d 61 69 6e 20 6f 66 20 74 68 65 20 77 65 62 73 69 74 65 20 79 6f 75 20 61 72 65 20 76 69 73 69 74 69 6e 67 20 e2 80 93 20 66 6f 72 20 6f 75 72 20 61 64 76 65 72 74 69 73 69 6e 67 20 61 6e 64 20 6d 61 72 6b 65 74 69 6e 67 20 65 66 66 6f 72 74 73 2e 20 4d 6f 72 65 20 73 70 65 63 69 66 69 63 61 6c 6c 79 2c 20 77 65 20 75 73 65 20 63 6f 6f 6b 69 65 73 20 61 6e 64 20 6f 74 68 65 72 20 74 72 61 63 6b 69 6e 67 20 74 65 63 68 6e 6f 6c 6f 67 69 65 73 20 66 6f 72 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 70 75 72 70 6f 73 65 73 3a 22 2c 22 47 72 6f 75 70 73 22 3a 5b 7b 22 53 68 6f 77 49 6e 50 6f 70 75 70 22 3a 74 72 75 65 2c 22 53 68 6f 77 49 6e 50 6f 70 75 70 4e 6f 6e 49 41 42 22 3a 74 72 75 65 2c 22 53 68 6f 77 53 44 4b 4c 69 73 74 4c 69 6e 6b 22 3a 74 72 75 Data Ascii: main of the website you are visiting for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:","Groups":[{"ShowInPopup":true,"ShowInPopupNonIAB":true,"ShowSDKListLink":tru
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 74 72 69 63 74 6c 79 20 4e 65 63 65 73 73 61 72 79 20 43 6f 6f 6b 69 65 73 22 2c 22 47 72 6f 75 70 4e 61 6d 65 4f 54 54 22 3a 22 53 74 72 69 63 74 6c 79 20 4e 65 63 65 73 73 61 72 79 20 43 6f 6f 6b 69 65 73 22 2c 22 47 72 6f 75 70 4e 61 6d 65 22 3a 22 53 74 72 69 63 74 6c 79 20 4e 65 63 65 73 73 61 72 79 20 43 6f 6f 6b 69 65 73 22 2c 22 49 73 49 61 62 50 75 72 70 6f 73 65 22 3a 66 61 6c 73 65 2c 22 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 73 49 64 73 22 3a 5b 5d 2c 22 46 69 72 73 74 50 61 72 74 79 43 6f 6f 6b 69 65 73 22 3a 5b 7b 22 69 64 22 3a 22 63 38 34 63 30 63 32 62 2d 33 39 30 30 2d 34 65 35 37 2d 38 61 64 39 2d 38 65 31 33 63 61 39 39 63 35 30 31 22 2c 22 4e 61 6d 65 22 3a 22 4f 70 74 61 6e 6f 6e 41 6c 65 72 74 42 6f 78 43 6c 6f 73 65 64 22 2c 22 48 Data Ascii: trictly Necessary Cookies","GroupNameOTT":"Strictly Necessary Cookies","GroupName":"Strictly Necessary Cookies","IsIabPurpose":false,"GeneralVendorsIds":[],"FirstPartyCookies":[{"id":"c84c0c2b-3900-4e57-8ad9-8e13ca99c501","Name":"OptanonAlertBoxClosed","H
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 73 20 61 20 6e 6f 72 6d 61 6c 20 6c 69 66 65 73 70 61 6e 20 6f 66 20 6f 6e 65 20 79 65 61 72 2c 20 73 6f 20 74 68 61 74 20 72 65 74 75 72 6e 69 6e 67 20 76 69 73 69 74 6f 72 73 20 74 6f 20 74 68 65 20 73 69 74 65 20 77 69 6c 6c 20 68 61 76 65 20 74 68 65 69 72 20 70 72 65 66 65 72 65 6e 63 65 73 20 72 65 6d 65 6d 62 65 72 65 64 2e 20 49 74 20 63 6f 6e 74 61 69 6e 73 20 6e 6f 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 68 61 74 20 63 61 6e 20 69 64 65 6e 74 69 66 79 20 74 68 65 20 73 69 74 65 20 76 69 73 69 74 6f 72 2e 22 2c 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 Data Ascii: s a normal lifespan of one year, so that returning visitors to the site will have their preferences remembered. It contains no information that can identify the site visitor.","thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKe
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 70 74 69 6f 6e 22 3a 22 22 2c 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 38 36 34 66 36 30 65 62 2d 64 32 38 63 2d 34 37 30 31 2d 61 36 64 37 2d 36 36 64 65 31 63 61 30 65 36 66 37 22 2c 22 4e 61 6d 65 22 3a 22 41 53 50 2e 4e 45 54 5f 53 65 73 73 69 6f 6e 49 64 22 2c 22 48 6f 73 74 22 3a 22 64 65 6d 6f 73 2e 74 65 6c 65 72 69 6b 2e 63 6f 6d 22 2c 22 49 73 53 65 73 Data Ascii: ption":"","thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":"","DurationType":1,"category":null,"isThirdParty":false},{"id":"864f60eb-d28c-4701-a6d7-66de1ca0e6f7","Name":"ASP.NET_SessionId","Host":"demos.telerik.com","IsSes
2024-11-15 14:59:35 UTC	142	IN	Data Raw: 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 61 31 37 36 35 35 31 65 2d 39 31 36 63 2d 34 31 65 63 2d 38 39 62 64 2d 39 32 36 31 32 34 62 31 30 30 32 64 0d 0a Data Ascii: ull,"thirdPartyKey":"","firstPartyKey":"","DurationType":1,"category":null,"isThirdParty":false},{"id":"a176551e-916c-41ec-89bd-926124b1002d
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 37 66 66 39 0d 0a 22 2c 22 4e 61 6d 65 22 3a 22 73 66 2d 74 72 61 63 6b 69 6e 67 2d 63 6f 6e 73 65 6e 74 22 2c 22 48 6f 73 74 22 3a 22 77 77 77 2e 74 65 6c 65 72 69 6b 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 39 39 39 39 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 Data Ascii: 7ff9","Name":"sf-tracking-consent","Host":"www.telerik.com","IsSession":false,"Length":"9999","description":"","thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":"","DurationType":1,"category":null,"isThirdParty":false},{"
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 7d 2c 7b 22 69 64 22 3a 22 61 65 31 34 30 64 34 64 2d 39 61 30 66 2d 34 63 65 64 2d 39 35 37 33 2d 38 32 65 62 33 62 35 33 37 62 37 39 22 2c 22 4e 61 6d 65 22 3a 22 65 6c 71 5f 73 75 62 6d 69 74 22 2c 22 48 6f 73 74 22 3a 22 77 77 77 2e 74 65 6c 65 72 69 6b 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 74 72 75 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 Data Ascii: },{"id":"ae140d4d-9a0f-4ced-9573-82eb3b537b79","Name":"elq_submit","Host":"www.telerik.com","IsSession":true,"Length":"0","description":"","thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":null,"firstPartyKey":null,"DurationType":1,"category"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49814	104.18.87.42	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	386	OUT	GET /scripttemplates/202401.2.0/assets/otFlat.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:35 UTC	853	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:35 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Content-MD5: Rtw1HeKUT+s7FdllH11+Yg== Last-Modified: Tue, 16 Jul 2024 21:25:36 GMT x-ms-request-id: e2122ef3-701e-0021-206d-d8febb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 20845 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Cross-Origin-Resource-Policy: cross-origin Server: cloudflare CF-RAY: 8e301b201c5d2e19-DFW
2024-11-15 14:59:35 UTC	516	IN	Data Raw: 33 35 32 65 0d 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 6f 74 46 6c 61 74 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 68 74 6d 6c 22 3a 20 22 50 47 52 70 64 69 42 70 5a 44 30 69 62 32 35 6c 64 48 4a 31 63 33 51 74 59 6d 46 75 62 6d 56 79 4c 58 4e 6b 61 79 49 67 59 32 78 68 63 33 4d 39 49 6d 39 30 52 6d 78 68 64 43 49 2b 50 47 52 70 64 69 42 79 62 32 78 6c 50 53 4a 68 62 47 56 79 64 47 52 70 59 57 78 76 5a 79 49 67 59 58 4a 70 59 53 31 6b 5a 58 4e 6a 63 6d 6c 69 5a 57 52 69 65 54 30 69 62 32 35 6c 64 48 4a 31 63 33 51 74 63 47 39 73 61 57 4e 35 4c 58 52 6c 65 48 51 69 50 6a 78 6b 61 58 59 67 59 32 78 68 63 33 4d 39 49 6d 39 30 4c 58 4e 6b 61 79 31 6a 62 32 35 Data Ascii: 352e { "name": "otFlat", "html": "PGRpdiBpZD0ib25ldHJ1c3QtYmFubmVyLXNkayIgY2xhc3M9Im90RmxhdCI+PGRpdiByb2xlPSJhbGVydGRpYWxvZyIgYXJpYS1kZXNjcmliZWRieT0ib25ldHJ1c3QtcG9saWN5LXRleHQiPjxkaXYgY2xhc3M9Im90LXNkay1jb25
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 50 43 39 6f 4d 6a 34 38 5a 47 6c 32 49 47 6c 6b 50 53 4a 76 62 6d 56 30 63 6e 56 7a 64 43 31 77 62 32 78 70 59 33 6b 74 64 47 56 34 64 43 49 2b 64 47 6c 30 62 47 55 38 59 53 42 6f 63 6d 56 6d 50 53 49 6a 49 6a 35 77 62 32 78 70 59 33 6b 38 4c 32 45 2b 50 43 39 6b 61 58 59 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 5a 48 42 6b 4c 57 4e 76 62 6e 52 68 61 57 35 6c 63 69 49 2b 50 47 67 7a 49 47 4e 73 59 58 4e 7a 50 53 4a 76 64 43 31 6b 63 47 51 74 64 47 6c 30 62 47 55 69 50 6c 64 6c 49 47 4e 76 62 47 78 6c 59 33 51 67 5a 47 46 30 59 53 42 70 62 69 42 76 63 6d 52 6c 63 69 42 30 62 79 42 77 63 6d 39 32 61 57 52 6c 4f 6a 77 76 61 44 4d 2b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 62 33 51 74 5a 48 42 6b 4c 57 4e 76 62 6e 52 6c 62 6e 51 Data Ascii: PC9oMj48ZGl2IGlkPSJvbmV0cnVzdC1wb2xpY3ktdGV4dCI+dGl0bGU8YSBocmVmPSIjIj5wb2xpY3k8L2E+PC9kaXY+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRhaW5lciI+PGgzIGNsYXNzPSJvdC1kcGQtdGl0bGUiPldlIGNvbGxlY3QgZGF0YSBpbiBvcmRlciB0byBwcm92aWRlOjwvaDM+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRlbnQ
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 57 6b 67 59 6d 46 75 62 6d 56 79 4c 57 4e 73 62 33 4e 6c 4c 57 4a 31 64 48 52 76 62 69 42 76 64 43 31 6a 62 47 39 7a 5a 53 31 70 59 32 39 75 49 6a 34 38 4c 32 4a 31 64 48 52 76 62 6a 34 38 4c 32 52 70 64 6a 34 38 49 53 30 74 49 45 4e 73 62 33 4e 6c 49 45 4a 31 64 48 52 76 62 69 42 46 54 6b 51 74 4c 54 34 38 4c 32 52 70 64 6a 34 38 4c 32 52 70 64 6a 34 3d 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 63 73 73 22 3a 20 22 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 31 38 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 32 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 46 6c 61 74 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 7a 2d 69 6e 64 65 78 3a 32 31 Data Ascii: WkgYmFubmVyLWNsb3NlLWJ1dHRvbiBvdC1jbG9zZS1pY29uIj48L2J1dHRvbj48L2Rpdj48IS0tIENsb3NlIEJ1dHRvbiBFTkQtLT48L2Rpdj48L2Rpdj4=", "css": "#onetrust-banner-sdk{box-shadow:0 0 18px rgba(0,0,0,.2)}#onetrust-banner-sdk.otFlat{position:fixed;z-index:21
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 67 68 74 3a 62 6f 6c 64 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 70 6f 6c 69 63 79 2d 74 69 74 6c 65 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 70 6f 6c 69 63 79 2d 74 65 78 74 7b 63 6f 6c 6f 72 3a 64 69 6d 67 72 61 79 3b 66 6c 6f 61 74 3a 6c 65 66 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 2d 70 61 72 65 6e 74 7b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 Data Ascii: ght:bold;margin-left:5px}#onetrust-banner-sdk #onetrust-policy-title,#onetrust-banner-sdk #onetrust-policy-text{color:dimgray;float:left}#onetrust-banner-sdk #onetrust-button-group-parent{min-height:1px;text-align:center}#onetrust-banner-sdk #onetrust-but
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 74 68 3a 63 61 6c 63 28 31 30 30 25 20 2d 20 31 65 6d 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 2d 69 6e 70 75 74 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 77 69 64 74 68 3a 61 75 74 6f 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 33 70 78 3b 6d 61 72 67 69 6e 3a 30 20 30 20 31 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 32 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 2d 69 6e 70 75 74 20 2a 7b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 66 6f 6e Data Ascii: th:calc(100% - 1em)}#onetrust-banner-sdk .banner-option-input{cursor:pointer;width:auto;height:auto;border:none;padding:0;padding-right:3px;margin:0 0 10px;font-size:.82em;line-height:1.4}#onetrust-banner-sdk .banner-option-input *{pointer-events:none;fon
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 67 68 74 3a 69 6e 68 65 72 69 74 3b 63 6f 6c 6f 72 3a 64 69 6d 67 72 61 79 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 61 72 72 6f 77 2d 63 6f 6e 74 61 69 6e 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 2d 64 65 74 61 69 6c 73 7b 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 3b 2d 6d 6f 7a 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 3b 2d 6f 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 33 30 30 6d 73 20 65 61 73 65 2d 69 6e 20 30 73 7d Data Ascii: ght:inherit;color:dimgray}#onetrust-banner-sdk .ot-arrow-container,#onetrust-banner-sdk .banner-option-details{transition:all 300ms ease-in 0s;-webkit-transition:all 300ms ease-in 0s;-moz-transition:all 300ms ease-in 0s;-o-transition:all 300ms ease-in 0s}
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 2d 73 69 7a 65 3a 2e 38 31 33 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 64 70 64 2d 64 65 73 63 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 64 70 64 2d 64 65 73 63 3e 2e 6f 74 2d 62 2d 61 64 64 6c 2d 64 65 73 63 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 34 32 35 70 78 29 7b 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 63 Data Ascii: -size:.813em;line-height:1.5}#onetrust-banner-sdk .ot-dpd-desc{margin-bottom:10px}#onetrust-banner-sdk .ot-dpd-desc>.ot-b-addl-desc{margin-top:10px;margin-bottom:10px;font-size:1em}@media only screen and (max-width: 425px){#onetrust-banner-sdk #onetrust-c
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 20 62 75 74 74 6f 6e 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 68 61 73 2d 72 65 6a 65 63 74 2d 61 6c 6c 2d 62 75 74 74 6f 6e 20 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 7b 66 6c 6f 61 74 3a 6c 65 66 74 Data Ascii: ion:relative;margin-left:0}#onetrust-banner-sdk #onetrust-button-group button{display:inline-block}#onetrust-banner-sdk #onetrust-button-group{margin-right:0;text-align:center}#onetrust-banner-sdk .has-reject-all-button #onetrust-pc-btn-handler{float:left
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 65 72 2d 73 64 6b 2e 6f 74 2d 69 61 62 2d 32 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 20 23 6f 6e 65 74 72 75 73 74 2d 72 65 6a 65 63 74 2d 61 6c 6c 2d 68 61 6e 64 6c 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 69 61 62 2d 32 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 20 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 7b 77 69 64 74 68 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 69 61 62 2d 32 20 23 6f 6e 65 74 72 75 73 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 20 23 6f 6e 65 74 72 75 73 74 2d 61 63 63 65 70 74 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 Data Ascii: er-sdk.ot-iab-2 #onetrust-button-group #onetrust-reject-all-handler,#onetrust-banner-sdk.ot-iab-2 #onetrust-button-group #onetrust-pc-btn-handler{width:100%}#onetrust-banner-sdk.ot-iab-2 #onetrust-button-group #onetrust-accept-btn-handler,#onetrust-banner
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 36 30 25 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 2d 35 30 25 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 7b 77 69 64 74 68 3a 35 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 69 61 62 2d 32 20 23 6f 6e 65 74 72 75 73 74 2d 70 6f 6c 69 63 79 2d 74 69 74 6c 65 7b 77 69 64 74 68 3a 35 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 69 61 62 2d 32 20 23 6f 6e 65 74 72 75 73 74 2d 70 6f 6c 69 63 79 2d 74 65 78 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 69 61 62 2d 32 20 3a Data Ascii: sition:absolute;top:50%;left:60%;transform:translateY(-50%)}#onetrust-banner-sdk .ot-optout-signal{width:50%}#onetrust-banner-sdk.ot-iab-2 #onetrust-policy-title{width:50%}#onetrust-banner-sdk.ot-iab-2 #onetrust-policy-text,#onetrust-banner-sdk.ot-iab-2 :

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49815	104.18.87.42	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	393	OUT	GET /scripttemplates/202401.2.0/assets/otCommonStyles.css HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:35 UTC	915	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:35 GMT Content-Type: text/css Content-Length: 21756 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cf-Bgj: minify Cf-Polished: origSize=21778 Content-MD5: c7xAZ9MSGAobGaTYg/Qtag== ETag: 0x8DCA5DDDD4DD7B2 Last-Modified: Tue, 16 Jul 2024 21:25:49 GMT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: da7e4690-d01e-0027-10cb-2409c3000000 x-ms-version: 2009-09-19 Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 11119 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Cross-Origin-Resource-Policy: cross-origin Server: cloudflare CF-RAY: 8e301b201ec02821-DFW
2024-11-15 14:59:35 UTC	454	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 7b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 74 72 75 73 74 2d 76 65 6e 64 6f 72 73 2d 6c 69 73 74 2d 68 61 6e 64 6c 65 72 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 63 6f 6c 6f 72 3a 23 31 66 39 36 64 62 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 74 Data Ascii: #onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:700;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .onet
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 61 63 63 65 70 74 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 72 65 6a 65 63 74 2d 61 6c 6c 2d 68 61 6e 64 6c 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 7b 6f 75 74 6c 69 6e 65 2d 6f 66 66 73 65 74 3a 31 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 62 6e 72 2d 77 2d 6c 6f 67 6f 20 2e 6f 74 2d 62 6e 72 2d 6c 6f 67 6f 7b 68 65 69 67 68 74 3a 36 34 70 78 3b 77 69 64 74 68 3a 36 34 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 74 63 66 32 2d 76 65 6e 64 6f 72 2d 63 6f 75 6e 74 2e 6f 74 2d 74 65 78 74 Data Ascii: accept-btn-handler,#onetrust-banner-sdk #onetrust-reject-all-handler,#onetrust-banner-sdk #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-tcf2-vendor-count.ot-text
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 2d 73 64 6b 20 61 5b 64 61 74 61 2d 70 61 72 65 6e 74 2d 69 64 5d 20 2a 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 33 20 2a 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 34 20 2a 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 36 20 2a 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 62 75 74 74 6f 6e 20 2a 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 61 5b 64 61 74 61 2d 70 61 72 65 6e 74 2d 69 64 5d 20 2a 7b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 74 2d 73 79 6e 63 Data Ascii: -sdk a[data-parent-id] ,#ot-sync-ntfy h3 ,#ot-sync-ntfy h4 ,#ot-sync-ntfy h6 ,#ot-sync-ntfy button ,#ot-sync-ntfy a[data-parent-id] {font-size:inherit;font-weight:inherit;color:inherit}#onetrust-banner-sdk .ot-hide,#onetrust-pc-sdk .ot-hide,#ot-sync
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 31 65 78 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 70 63 2d 6c 6f 67 6f 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 70 63 2d 6c 6f 67 6f 7b 68 65 69 67 68 74 3a 36 30 70 78 3b 77 69 64 74 68 3a 31 38 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 63 65 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 70 63 2d 6c 6f 67 6f 20 69 6d 67 2c 23 Data Ascii: 1ex}#onetrust-pc-sdk .pc-logo,#onetrust-pc-sdk .ot-pc-logo{height:60px;width:180px;background-position:center;background-size:contain;background-repeat:no-repeat;display:inline-flex;justify-content:center;align-items:center}#onetrust-pc-sdk .pc-logo img,#
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 74 6f 70 3a 30 3b 62 6f 74 74 6f 6d 3a 30 3b 6c 65 66 74 3a 30 7d 40 6b 65 79 66 72 61 6d 65 73 20 6f 6e 65 74 72 75 73 74 2d 66 61 64 65 2d 69 6e 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 7d 2e 6f 74 2d 63 6f 6f 6b 69 65 2d 6c 61 62 65 6c 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 34 32 36 70 78 29 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 38 39 36 70 78 29 61 6e 64 20 28 6f 72 69 65 6e 74 61 74 69 6f 6e 3a 6c 61 6e 64 73 63 61 Data Ascii: 100%;height:100%;overflow:hidden;position:fixed;top:0;bottom:0;left:0}@keyframes onetrust-fade-in{0%{opacity:0}100%{opacity:1}}.ot-cookie-label{text-decoration:underline}@media only screen and (min-width:426px)and (max-width:896px)and (orientation:landsca
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 73 69 67 6e 61 6c 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 69 63 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 69 63 6f 6e 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 7b 68 65 69 67 68 74 3a 32 30 70 78 3b 77 69 64 74 68 3a 33 30 70 78 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 2e 35 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 Data Ascii: signal .ot-optout-icon,#onetrust-pc-sdk .ot-optout-signal .ot-optout-icon{display:inline;margin-right:5px}#onetrust-banner-sdk .ot-optout-signal svg,#onetrust-pc-sdk .ot-optout-signal svg{height:20px;width:30px;transform:scale(.5)}#onetrust-banner-sdk .ot
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 61 6e 6e 65 72 2d 73 64 6b 20 74 64 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 74 62 6f 64 79 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 74 6f 67 67 6c 65 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 74 2d 63 6f 6e 74 65 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 64 69 76 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 73 70 61 6e 2c 23 6f Data Ascii: anner-sdk td,#onetrust-banner-sdk tbody,#onetrust-banner-sdk .ot-main-content,#onetrust-banner-sdk .ot-toggle,#onetrust-banner-sdk #ot-content,#onetrust-banner-sdk #ot-pc-content,#onetrust-banner-sdk .checkbox,#onetrust-pc-sdk div,#onetrust-pc-sdk span,#o
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 61 62 6c 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 68 65 61 64 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 72 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 64 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 62 6f 64 79 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 74 6f 67 67 6c 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 23 6f 74 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 Data Ascii: -cookie-policy table,#ot-sdk-cookie-policy thead,#ot-sdk-cookie-policy tr,#ot-sdk-cookie-policy td,#ot-sdk-cookie-policy tbody,#ot-sdk-cookie-policy .ot-main-content,#ot-sdk-cookie-policy .ot-toggle,#ot-sdk-cookie-policy #ot-content,#ot-sdk-cookie-policy
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 6e 64 65 78 3a 61 75 74 6f 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 Data Ascii: ndex:auto;box-shadow:none}#onetrust-banner-sdk label:before,#onetrust-banner-sdk label:after,#onetrust-banner-sdk .checkbox:after,#onetrust-banner-sdk .checkbox:before,#onetrust-pc-sdk label:before,#onetrust-pc-sdk label:after,#onetrust-pc-sdk .checkbox:a
2024-11-15 14:59:35 UTC	1369	IN	Data Raw: 64 74 68 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 Data Ascii: dth:100%}#onetrust-banner-sdk .ot-sdk-column,#onetrust-banner-sdk .ot-sdk-columns,#onetrust-pc-sdk .ot-sdk-column,#onetrust-pc-sdk .ot-sdk-columns,#ot-sdk-cookie-policy .ot-sdk-column,#ot-sdk-cookie-policy .ot-sdk-columns{margin-left:4%}#onetrust-banner-s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49807	18.66.17.64	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:34 UTC	394	OUT	GET /telerik-navigation/3.5.50/js/index.min.mjs HTTP/1.1 Host: d6vtbcy3ong79.cloudfront.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:35 UTC	610	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 16055 Connection: close Cache-Control: public,max-age=31536000 Last-Modified: Fri, 08 Nov 2024 14:58:52 GMT Accept-Ranges: bytes X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 09 Nov 2024 12:26:15 GMT Vary: Origin,Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 4f04fd3192b8e206f3b06830e1587d80.cloudfront.net (CloudFront) X-Amz-Cf-Pop: VIE50-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: MZU1H9zXMSgDRNOgJc03uztICFAr54gLFnsV2_d41kvN9qq7ifnKNw== Age: 527600
2024-11-15 14:59:35 UTC	15774	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 63 6f 6e 73 74 20 74 3d 7b 61 63 74 69 76 65 43 6c 61 73 73 3a 22 54 4b 2d 4e 61 76 2d 4f 76 65 72 6c 61 79 2d 2d 41 63 74 69 76 65 22 7d 3b 63 6c 61 73 73 20 65 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 2c 6e 29 7b 74 68 69 73 2e 6f 70 74 69 6f 6e 73 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 7b 7d 2c 74 2c 6e 29 2c 74 68 69 73 2e 65 6c 65 6d 65 6e 74 3d 65 2c 74 68 69 73 2e 61 63 74 69 76 65 43 6c 61 73 73 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 61 63 74 69 76 65 43 6c 61 73 73 2c 74 68 69 73 2e 68 69 64 64 65 6e 3d 21 30 7d 73 68 6f 77 28 29 7b 74 68 69 73 2e 68 69 64 64 65 6e 26 26 74 68 69 73 2e 65 6c 65 6d 65 6e 74 26 26 28 74 68 69 73 2e 65 6c 65 6d 65 6e 74 2e 63 6c 61 Data Ascii: !function(){"use strict";const t={activeClass:"TK-Nav-Overlay--Active"};class e{constructor(e,n){this.options=Object.assign({},t,n),this.element=e,this.activeClass=this.options.activeClass,this.hidden=!0}show(){this.hidden&&this.element&&(this.element.cla
2024-11-15 14:59:35 UTC	281	IN	Data Raw: 73 74 20 74 3d 45 28 22 23 6a 73 2d 74 6c 72 6b 2d 73 6b 69 70 2d 6c 69 6e 6b 22 29 2c 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 65 2e 63 6c 61 73 73 4c 69 73 74 2e 61 64 64 28 22 54 4b 2d 4e 61 76 2d 53 6b 69 70 70 65 72 22 29 2c 65 2e 74 61 62 49 6e 64 65 78 3d 30 2c 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 63 6c 69 63 6b 22 2c 28 6e 3d 3e 7b 4c 2e 61 66 74 65 72 28 65 29 2c 74 2e 62 6c 75 72 28 29 2c 65 2e 66 6f 63 75 73 28 29 2c 65 2e 72 65 6d 6f 76 65 28 29 2c 6e 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 7d 29 29 7d 28 29 2c 77 69 6e 64 6f 77 2e 54 4c 52 4b 5f 4e 41 56 5f 49 4e 49 54 49 41 4c 49 5a 45 44 3d 21 30 29 7d 28 29 3b 0a 2f 2f 23 20 73 6f 75 72 63 65 4d 61 70 Data Ascii: st t=E("#js-tlrk-skip-link"),e=document.createElement("div");e.classList.add("TK-Nav-Skipper"),e.tabIndex=0,t.addEventListener("click",(n=>{L.after(e),t.blur(),e.focus(),e.remove(),n.preventDefault()}))}(),window.TLRK_NAV_INITIALIZED=!0)}();//# sourceMap

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49811	50.56.19.112	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:35 UTC	1493	OUT	GET /RestApi/personalizations/render?pageNodeId=5ceb4be1-05bd-4c69-892a-2c2bbd37538b&pageDataId=1f960fad-aef2-4475-8978-52fb7a29dbc9&pageNodeKey=5CEB4BE1-05BD-4C69-892A-2C2BBD37538B/b31ca85c-a1c5-4a9d-8b5d-e7b0736a8b16/SitefinitySiteMap&url=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&controls=09f9bb4f-5990-40af-b361-7849c73c9604_1,0cd3f511-e7d9-4e23-8773-26005ae09893_1,25637a62-a321-49a0-8b7e-5962dc977e95_1,6b5ac4dc-8fd0-4043-bd0a-e9ffd31e3bc8_1&correlationId=m3iv7avxzpfywghsi2 HTTP/1.1 Host: www.telerik.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sf-tracking-consent=true; sf-prs-ss=638672795720460000; sf-prs-lu=https://www.telerik.com/download/fiddler/first-run; sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; sf-ins-pv-id=dc2da7be-2d6c-4e3e-9a51-88b40d4f050e; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1
2024-11-15 14:59:35 UTC	700	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: text/html Expires: -1 Vary: Accept Set-Cookie: sid=YxW8GAjBgx2p10xHZz5t5yXmV7LzvocY1wIicsrE7tUwsKqzcdO1M/Z4cK1eBm/jl1SSYNkKEe9ubKCPWllx7x1IBbbairnu6uMUZRe7fVUG2KNH41TXpdL61Ull9iy/A26Kc8bXzsLFCbo5XnnjNw8le/c=; expires=Mon, 13-Nov-2034 14:59:35 GMT; path=/; secure; HttpOnly; SameSite=Lax Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: http://localconverter.telerik.com Date: Fri, 15 Nov 2024 14:59:34 GMT Content-Length: 13911 Connection: close
2024-11-15 14:59:35 UTC	13799	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 43 6f 6e 74 72 6f 6c 44 61 74 61 4d 65 73 73 61 67 65 20 53 6e 61 70 73 68 6f 74 20 6f 66 20 31 31 2f 31 35 2f 32 30 32 34 20 32 3a 35 39 3a 33 35 20 50 4d 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 42 4f 44 59 2c 20 48 31 2c 20 48 32 2c 20 48 33 2c 20 48 34 2c 20 48 35 2c 20 48 36 2c 20 44 4c 2c 20 44 54 2c 20 44 44 20 7b 0d 0a 20 20 Data Ascii: <!doctype html><html lang="en-us"><head><title>ControlDataMessage Snapshot of 11/15/2024 2:59:35 PM</title><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><style type="text/css">BODY, H1, H2, H3, H4, H5, H6, DL, DT, DD {
2024-11-15 14:59:35 UTC	112	IN	Data Raw: 3d 64 61 74 65 28 76 31 29 3b 20 76 32 3d 64 61 74 65 28 76 32 29 20 7d 0d 0a 20 20 69 66 20 28 76 31 20 3d 3d 3d 20 76 32 29 20 72 65 74 75 72 6e 20 30 0d 0a 20 20 72 65 74 75 72 6e 20 76 31 20 3e 20 76 32 20 3f 20 31 20 3a 20 2d 31 0d 0a 7d 0d 0a 0d 0a 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: =date(v1); v2=date(v2) } if (v1 === v2) return 0 return v1 > v2 ? 1 : -1}</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:35 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:35 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: a0c6f192-101e-007a-2f09-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145935Z-16547b76f7fw2955hC1DFWsptc00000001v000000000qkqe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:35 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:35 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 30a84257-201e-006e-3afb-36bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145935Z-16547b76f7ffx24hhC1DFW9px4000000010000000000cz4u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49808	18.66.107.59	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:35 UTC	502	OUT	GET /Frontend-Assembly/Web.SitefinityExtensions.EloquaConnector/Scripts/SetBrowserSessionStorage.min.js?package=PureMvc&v=SURNTlNWL0Q2UU9sSFp4Z2dmYnp0UT09) HTTP/1.1 Host: d585tldpucybw.cloudfront.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:35 UTC	777	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 998 Connection: close Cache-Control: public, max-age=64378 Expires: Fri, 22 Nov 2024 08:52:20 GMT Last-Modified: Wed, 16 Oct 2024 11:44:58 GMT Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: http://localconverter.telerik.com Date: Fri, 15 Nov 2024 14:59:22 GMT Vary: Accept-Encoding,Cookie X-Cache: Hit from cloudfront Via: 1.1 fc562aab29280948aa0691960bee3d6a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P5 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: bS12bP8XYuv79XfoqyH57fYPkLutGgojLXSSHHW1sIqbRi34a1m1BA== Age: 13
2024-11-15 14:59:35 UTC	998	IN	Data Raw: 77 69 6e 64 6f 77 2e 69 6e 76 6f 6b 65 54 72 61 63 6b 69 6e 67 53 63 72 69 70 74 28 74 68 69 73 2c 4f 70 74 61 6e 6f 6e 47 72 6f 75 70 73 2e 50 65 72 66 6f 72 6d 61 6e 63 65 43 6f 6f 6b 69 65 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 69 3d 22 61 64 57 6f 72 64 73 44 61 74 61 22 2c 6e 3d 22 65 78 70 54 72 61 63 6b 69 6e 67 22 3b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 7d 77 69 6e 64 6f 77 2e 62 72 6f 77 73 65 72 53 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 72 65 61 64 28 6e 29 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 74 2c 69 29 7b 76 61 72 20 72 3d 77 69 6e 64 6f 77 2e 62 72 6f 77 73 65 72 53 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 72 65 61 64 28 6e 29 3b 72 3d 72 3f 72 3a 7b Data Ascii: window.invokeTrackingScript(this,OptanonGroups.PerformanceCookies,function(){var i="adWordsData",n="expTracking";function e(){dataLayer.push(arguments)}window.browserSessionStorage.read(n);function o(t,i){var r=window.browserSessionStorage.read(n);r=r?r:{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49822	50.56.19.112	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:35 UTC	1016	OUT	GET /favicon.ico?v=rebv1 HTTP/1.1 Host: www.telerik.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sf-tracking-consent=true; sf-prs-ss=638672795720460000; sf-prs-lu=https://www.telerik.com/download/fiddler/first-run; sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; sf-ins-pv-id=dc2da7be-2d6c-4e3e-9a51-88b40d4f050e; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1
2024-11-15 14:59:35 UTC	751	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: image/x-icon Last-Modified: Wed, 16 Oct 2024 06:44:58 GMT Accept-Ranges: bytes ETag: "011a8ea961fdb1:0" Set-Cookie: sid=xBCrjFUphsqgZGPslUBESQVw6GQ1oAN53HzIBgqv8heKwKQVIOJQokTWwtXNgUTgNt1wnqqR+PTMAFrtsMcpwXQrAR/Ii8bBKs7RFd15LHMwIdbkZYDbUgtkjbSkmk1+UyHoxh9Kvw+lfC+kB9VJT0l9ydQ=; expires=Mon, 13-Nov-2034 14:59:35 GMT; path=/; secure; HttpOnly; SameSite=Lax Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: http://localconverter.telerik.com Date: Fri, 15 Nov 2024 14:59:34 GMT Content-Length: 21142 Connection: close
2024-11-15 14:59:35 UTC	15633	IN	Data Raw: 00 00 01 00 04 00 00 00 00 00 01 00 20 00 98 17 00 00 46 00 00 00 10 10 00 00 01 00 20 00 68 04 00 00 de 17 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 46 1c 00 00 30 30 00 00 01 00 20 00 a8 25 00 00 ee 2c 00 00 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 06 00 00 00 5c 72 a8 66 00 00 17 5f 49 44 41 54 78 9c ed 9d 79 dc 9e e3 95 c7 4f aa 54 85 b4 68 69 6a 69 c4 d2 0a 51 d5 b1 2f b1 54 33 68 3b 96 5a aa d5 aa 9d 62 c4 0c 52 aa d6 aa 41 a4 a5 44 45 69 ab 35 96 22 e8 42 4d 47 82 d0 a2 2a 24 48 67 46 33 8a 31 43 33 98 69 55 8b f4 fc 7a 72 7f f2 92 27 6f 9e fb 79 ae fb 3e d7 f2 fb 7e 3e bf 7f 78 df e7 3e 49 de fb bc d7 b9 ce 36 64 de bc 79 42 08 29 93 b7 78 1b 40 08 f1 e3 ad dd 7c d1 7e 4f 0f 69 da 0e d2 3c 4b a8 f6 52 ed ae fa a0 Data Ascii: F h F00 %,PNGIHDR\rf_IDATxyOThijiQ/T3h;ZbRADEi5"BMG*$HgF31C3iUzr'oy>~>x>I6dyB)x@\|~Oi<KR
2024-11-15 14:59:35 UTC	3907	IN	Data Raw: ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c b7 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 5e 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c dd ff ff ff 00 ff ff ff 00 ff ff ff 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 22 00 e4 5c c7 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c b7 00 e4 5c 00 00 e4 Data Ascii: \\\\\\\\\\\\\\\\\\\^\\\\\\\\\\\\\\\\\\\\\\"\\\\\\\\\\\\\\\\\\\
2024-11-15 14:59:35 UTC	1448	IN	Data Raw: 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c a5 00 e4 5c 12 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 4f 00 e4 5c ee 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c ff 00 e4 5c d3 00 e4 5c 30 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 00 e4 5c 00 ff ff ff 00 ff Data Ascii: \\\\\\\\\\\\\\\\\\\\\\\\\\\\\O\\\\\\\\\\\\\\\\\\\0\\\\\\\\\\\\
2024-11-15 14:59:35 UTC	154	IN	Data Raw: ff ff f0 00 03 fc 00 03 ff ff fc 00 0f f0 00 03 ff ff fe 00 1f c0 00 03 ff ff ff 80 7f 80 00 03 ff ff ff e1 fe 00 00 03 ff ff ff f3 f8 00 00 03 ff ff ff ff f0 00 00 03 ff ff ff ff c0 00 00 0f ff ff ff ff 00 00 00 3f ff ff ff fc 00 00 00 7f ff ff ff f8 00 00 01 ff ff ff ff f0 00 00 07 ff ff ff ff f0 00 00 0f ff ff ff ff fc 00 00 3f ff ff ff ff ff 00 00 ff ff ff ff ff ff 80 01 ff ff ff ff ff ff e0 07 ff ff ff ff ff ff f8 1f ff ff ff ff ff ff fc 7f ff ff ff ff Data Ascii: ??

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49820	50.56.19.112	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:35 UTC	1088	OUT	GET /sfimages/default-source/productsimages/kendo-ui-complete/kendoka_icon.png?sfvrsn=922435fb_2 HTTP/1.1 Host: www.telerik.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sf-tracking-consent=true; sf-prs-ss=638672795720460000; sf-prs-lu=https://www.telerik.com/download/fiddler/first-run; sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; sf-ins-pv-id=dc2da7be-2d6c-4e3e-9a51-88b40d4f050e; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1
2024-11-15 14:59:35 UTC	811	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000 Content-Length: 2588 Content-Type: image/png Expires: Thu, 13 Feb 2025 14:59:35 GMT Last-Modified: Fri, 03 Sep 2021 08:38:14 GMT Set-Cookie: sid=Gnx9sazngTYXOuIX9IR8mNrpK3v80hydx90VNN/bQb1u/RW4BEoa8nd6CUSowziXCGCdU79MLCmpWchtpCaYVySR5d+MX0YDFFMIsA9fvQZuR6/79dFRPHMe/O4TtSQouj2RktF+rL+O5Hu5dIlKrQVeB/Q=; expires=Mon, 13-Nov-2034 14:59:35 GMT; path=/; secure; HttpOnly; SameSite=Lax Content-Disposition: inline; filename=kendoka_icon.png Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: http://localconverter.telerik.com Date: Fri, 15 Nov 2024 14:59:34 GMT Connection: close
2024-11-15 14:59:35 UTC	2104	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 41 00 00 00 41 08 06 00 00 00 8e f7 c9 45 00 00 00 09 70 48 59 73 00 00 2e 23 00 00 2e 23 01 78 a5 3f 76 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 09 a9 49 44 41 54 78 da e5 9c 0b 94 55 63 14 c7 a7 c9 ab 64 35 a2 24 c4 10 12 b1 28 a2 c8 63 5a de 16 2a cf 22 89 56 79 2c 0b 95 b2 f2 58 88 3c 32 94 47 13 95 32 91 47 ad 68 2a 46 2a 66 a8 bc 52 11 11 c6 90 92 68 cc d0 4c d3 cc 5c fb b3 7e 5f f6 3d 9d 73 ee 39 f7 31 37 6b 5a eb bf ee dc 73 bf e7 fe f6 b7 f7 7f ef ef 3b 65 64 a4 f8 df 98 31 63 9a 08 7a 08 86 09 26 0a 8a 04 25 82 32 41 8d 20 c2 67 19 cf 8b 28 37 94 7a 4d 32 fe 8f ff 64 e0 fb 31 e9 45 82 2a 26 1a 2f aa 68 c7 b4 d7 66 Data Ascii: PNGIHDRAAEpHYs.#.#x?vtEXtSoftwareAdobe ImageReadyqe<IDATxUcd5$(cZ"Vy,X<2G2GhFfRhL\~_=s917kZs;ed1cz&%2A g(7zM2d1E&/hf
2024-11-15 14:59:35 UTC	484	IN	Data Raw: d5 cd 92 95 8a 55 46 f8 7e ae cf c1 cd b2 10 89 9c 55 9e 57 0c 83 9e 4a a3 fa 05 aa c1 de 89 24 66 f1 08 c5 6a c2 6f 61 38 0b b0 01 6d 62 d4 37 e5 17 c6 28 13 fb 54 5a a9 56 cc fb 09 ca c5 dc 66 04 92 a0 21 3d 1e e2 62 5d 68 1e cf 9b 62 00 77 09 d0 c6 12 9b 78 f5 29 13 ec 7e 02 85 63 de 54 c1 c5 99 3d 7c 64 82 02 18 a8 52 e9 4b f1 28 2d e2 3c c2 7b da e7 f7 e0 37 55 54 a5 3c bf 3b 4b e4 01 cb d4 95 fe eb c3 64 7b 59 e5 29 ea 58 ed f0 6d 3c 3e bc 00 5a 30 b9 21 1e bf 87 bf b3 a4 88 8e ef ed 35 79 f6 32 2b b0 5c 19 33 c3 09 ce f5 b9 f1 da 02 eb be 1a 8f 70 27 b4 ba 09 36 60 be ce 42 05 a0 e3 67 b0 15 4c 1c 71 b0 c7 f6 8e ef f6 1a 0d f8 de 63 c4 9a 97 93 e9 99 86 77 a8 54 c1 d2 62 b8 c2 2c 0e 4c 7e 50 86 cf 94 ed ee 68 af 1f 5b 63 33 37 62 b3 3c c6 d5 5c 70 Data Ascii: UF~UWJ$fjoa8mb7(TZVf!=b]hbwx)~cT=\|dRK(-<{7UT<;Kd{Y)Xm<>Z0!5y2+\3p'6`BgLqcwTb,L~Ph[c37b<\p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49821	52.252.156.53	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:35 UTC	748	OUT	POST /collect/v2/data-centers/76766c2b-82f4-2453-81e5-fd840f3b455b/datasources/TelerikCom/interactions HTTP/1.1 Host: api.insight.sitefinity.com Connection: keep-alive Content-Length: 1895 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json x-dataintelligence-sdk-version: js-3.1.41 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.telerik.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:35 UTC	1895	OUT	Data Raw: 5b 7b 22 53 22 3a 22 31 37 33 31 36 38 32 37 37 32 30 34 37 2d 66 63 64 62 36 37 30 66 2d 33 61 66 61 2d 34 30 34 35 2d 61 37 31 34 2d 35 31 31 63 34 33 34 34 37 30 32 33 22 2c 22 53 4d 22 3a 7b 22 55 73 65 72 41 67 65 6e 74 22 3a 22 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 31 31 37 2e 30 2e 30 2e 30 20 53 61 66 61 72 69 2f 35 33 37 2e 33 36 22 2c 22 42 72 6f 77 73 65 72 20 6c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 7d 2c 22 49 4d 22 3a 7b 22 49 6e 74 65 72 61 63 74 69 6f 6e 49 64 22 3a 22 33 64 64 61 35 37 32 65 2d 37 31 31 63 Data Ascii: [{"S":"1731682772047-fcdb670f-3afa-4045-a714-511c43447023","SM":{"UserAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","Browser language":"en-US"},"IM":{"InteractionId":"3dda572e-711c
2024-11-15 14:59:35 UTC	1484	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:35 GMT Content-Type: application/json; charset=utf-8 Content-Length: 1 Connection: close Access-Control-Allow-Headers: Content-Type, Content-Length, X-Requested-With, Authorization, x-dataintelligence-accountkey, x-dataintelligence-datacenterkey, x-dataintelligence-datasource, x-dataintelligence-sort, x-dataintelligence-skip, x-dataintelligence-take, x-dataintelligence-fields, x-dataintelligence-count, x-dataintelligence-filterby, x-dataintelligence-filter, x-dataintelligence-contains, x-dataintelligence-nextrowkey, x-dataintelligence-flush, x-dataintelligence-fromdate, x-dataintelligence-todate, x-dataintelligence-period, x-dataintelligence-scale, x-dataintelligence-predicate, x-dataintelligence-subject, x-dataintelligence-ids, x-dataintelligence-datasources, x-dataintelligence-imagecrop, x-dataintelligence-contacts, x-forwarded-for, x-dataintelligence-sdk-version, Referer, Origin, x-dataintelligence-clientid, x-dataintelligence-campaignids, x-dataintelligence-userid, x-dataintelligence-errorid, x-dataintelligence-correlationid, cf-connecting-ip, x-forwarded-for, http_x_forwarded_for, x-forwarde [TRUNCATED] Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS Access-Control-Allow-Origin: * ETag: W/"1-d95o2uzYI7q7tY7bHI4U1xBug7s" request-context: appId=cid-v1:a33f2e3a-ec15-4d53-8ac6-897af884626b Strict-Transport-Security: max-age=31536000
2024-11-15 14:59:35 UTC	1	IN	Data Raw: 33 Data Ascii: 3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49809	152.199.21.175	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:35 UTC	393	OUT	GET /sdk/sitefinity-insight-client.min.3.1.13.js HTTP/1.1 Host: cdn.insight.sitefinity.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:35 UTC	644	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,x-ms-version Age: 81838 Cache-Control: max-age=604800 Content-MD5: 9ZCBkCxA3QMDG4yWQdr1rw== Content-Type: application/javascript Date: Fri, 15 Nov 2024 14:59:35 GMT Etag: 0x8DCEEC68191A198 Expires: Fri, 22 Nov 2024 14:59:35 GMT Last-Modified: Thu, 17 Oct 2024 16:12:32 GMT Server: ECAcc (lhc/78BB) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 009dcb23-301e-0070-42b0-369eea000000 x-ms-version: 2009-09-19 Content-Length: 53449 Connection: close
2024-11-15 14:59:35 UTC	15758	IN	Data Raw: 76 61 72 20 73 66 44 61 74 61 49 6e 74 65 6c 6c 3d 73 66 44 61 74 61 49 6e 74 65 6c 6c 7c 7c 7b 7d 3b 73 66 44 61 74 61 49 6e 74 65 6c 6c 2e 63 6f 6e 73 74 61 6e 74 73 3d 7b 73 64 6b 56 65 72 73 69 6f 6e 3a 22 6a 73 2d 33 2e 31 2e 34 31 22 2c 63 6f 6f 6b 69 65 4e 61 6d 65 3a 22 73 66 2d 64 61 74 61 2d 69 6e 74 65 6c 6c 2d 73 75 62 6a 65 63 74 22 2c 64 6f 63 73 43 6f 6f 6b 69 65 4e 61 6d 65 3a 22 73 66 2d 69 6e 73 2d 6c 73 74 2d 64 6f 63 2d 74 72 63 6b 64 22 2c 73 65 73 73 69 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 3a 22 73 66 2d 69 6e 73 2d 73 73 69 64 22 2c 70 61 67 65 56 69 73 69 74 49 64 43 6f 6f 6b 69 65 4e 61 6d 65 3a 22 73 66 2d 69 6e 73 2d 70 76 2d 69 64 22 2c 73 66 54 72 61 63 6b 69 6e 67 49 64 73 53 74 6f 72 61 67 65 4b 65 79 3a 22 73 66 2d 74 72 2d Data Ascii: var sfDataIntell=sfDataIntell\|\|{};sfDataIntell.constants={sdkVersion:"js-3.1.41",cookieName:"sf-data-intell-subject",docsCookieName:"sf-ins-lst-doc-trckd",sessionCookieName:"sf-ins-ssid",pageVisitIdCookieName:"sf-ins-pv-id",sfTrackingIdsStorageKey:"sf-tr-
2024-11-15 14:59:35 UTC	16383	IN	Data Raw: 2e 68 65 61 64 65 72 73 2e 64 61 74 61 63 65 6e 74 65 72 6b 65 79 5d 3d 74 68 69 73 2e 61 70 69 4b 65 79 3b 76 61 72 20 64 3d 74 68 69 73 2e 61 70 69 53 65 72 76 65 72 55 72 6c 2b 22 61 6e 61 6c 79 74 69 63 73 2f 76 31 2f 63 6f 6e 76 65 72 73 69 6f 6e 73 2f 69 73 69 6e 22 2c 65 3d 73 66 44 61 74 61 49 6e 74 65 6c 6c 2e 75 74 69 6c 73 2e 67 65 74 52 65 71 75 65 73 74 4f 70 74 69 6f 6e 73 28 6e 75 6c 6c 2c 22 47 45 54 22 2c 64 2c 63 29 3b 74 68 69 73 2e 72 65 71 75 65 73 74 65 72 2e 61 6a 61 78 43 61 6c 6c 28 65 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 61 7c 7c 21 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 29 72 65 74 75 72 6e 20 62 28 21 31 29 3b 66 6f 72 28 76 61 72 20 63 3d 21 31 2c 64 3d 21 31 2c 65 3d 30 3b 65 3c 61 2e 6c 65 6e 67 74 68 Data Ascii: .headers.datacenterkey]=this.apiKey;var d=this.apiServerUrl+"analytics/v1/conversions/isin",e=sfDataIntell.utils.getRequestOptions(null,"GET",d,c);this.requester.ajaxCall(e,function(a){if(!a\|\|!Array.isArray(a))return b(!1);for(var c=!1,d=!1,e=0;e<a.length
2024-11-15 14:59:35 UTC	16383	IN	Data Raw: 61 74 61 49 6e 74 65 6c 6c 2e 63 6f 6e 73 74 61 6e 74 73 2e 76 69 64 65 6f 54 72 61 63 6b 69 6e 67 2e 70 72 6f 67 72 65 73 73 54 68 72 65 73 68 6f 6c 64 73 2e 6c 65 6e 67 74 68 26 26 28 65 5b 63 5d 3d 73 66 44 61 74 61 49 6e 74 65 6c 6c 2e 63 6f 6e 73 74 61 6e 74 73 2e 76 69 64 65 6f 54 72 61 63 6b 69 6e 67 2e 70 72 6f 67 72 65 73 73 54 68 72 65 73 68 6f 6c 64 73 5b 6b 5d 29 7d 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 67 28 61 2c 62 29 7b 66 5b 62 2e 69 64 5d 5b 61 5d 7c 7c 28 68 2e 73 65 6e 74 65 6e 63 65 43 6c 69 65 6e 74 2e 77 72 69 74 65 53 65 6e 74 65 6e 63 65 28 7b 70 72 65 64 69 63 61 74 65 3a 61 2c 6f 62 6a 65 63 74 3a 62 2e 75 72 6c 2c 6f 62 6a 65 63 74 4d 65 74 61 64 61 74 61 3a 7b 43 6f 6e 74 65 6e 74 54 79 70 65 3a 22 56 69 6d 65 6f 56 69 64 65 6f Data Ascii: ataIntell.constants.videoTracking.progressThresholds.length&&(e[c]=sfDataIntell.constants.videoTracking.progressThresholds[k])}})}function g(a,b){f[b.id][a]\|\|(h.sentenceClient.writeSentence({predicate:a,object:b.url,objectMetadata:{ContentType:"VimeoVideo
2024-11-15 14:59:35 UTC	4925	IN	Data Raw: 73 66 44 61 74 61 49 6e 74 65 6c 6c 2e 63 6f 6e 73 74 61 6e 74 73 2e 68 65 61 64 65 72 73 2e 73 75 62 6a 65 63 74 5d 3d 74 68 69 73 2e 73 75 62 6a 65 63 74 4b 65 79 2c 64 5b 73 66 44 61 74 61 49 6e 74 65 6c 6c 2e 63 6f 6e 73 74 61 6e 74 73 2e 68 65 61 64 65 72 73 2e 69 64 73 5d 3d 61 2c 64 5b 73 66 44 61 74 61 49 6e 74 65 6c 6c 2e 63 6f 6e 73 74 61 6e 74 73 2e 68 65 61 64 65 72 73 2e 64 61 74 61 73 6f 75 72 63 65 5d 3d 74 68 69 73 2e 64 61 74 61 73 6f 75 72 63 65 2c 74 68 69 73 2e 63 61 6c 6c 28 22 2f 61 6e 61 6c 79 74 69 63 73 2f 76 31 2f 63 61 6d 70 61 69 67 6e 73 2f 69 73 69 6e 22 2c 64 2c 62 2c 63 29 7d 2c 69 73 49 6e 4c 65 61 64 73 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 69 66 28 21 61 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 Data Ascii: sfDataIntell.constants.headers.subject]=this.subjectKey,d[sfDataIntell.constants.headers.ids]=a,d[sfDataIntell.constants.headers.datasource]=this.datasource,this.call("/analytics/v1/campaigns/isin",d,b,c)},isInLeads:function(a,b,c,d){if(!a)throw new Error

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49819	18.66.17.64	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:35 UTC	403	OUT	GET /external-assets/1.0.22/utils/store-lead-data.min.js HTTP/1.1 Host: d6vtbcy3ong79.cloudfront.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:35 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 1504 Connection: close Cache-Control: public,max-age=31536000 Last-Modified: Tue, 05 Nov 2024 09:34:34 GMT Accept-Ranges: bytes X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 06 Nov 2024 11:31:25 GMT Vary: Origin,Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a17242a6cf9be61e0412ecea1610cbde.cloudfront.net (CloudFront) X-Amz-Cf-Pop: VIE50-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: xH09wG8mx5oFtGnBzD8R9b2Kl1D7zWuR7arVD542eRnd4KmzpjXsSg== Age: 790090
2024-11-15 14:59:35 UTC	1504	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 68 29 7b 66 6f 72 28 76 61 72 20 63 3d 6e 75 6c 6c 2c 66 3d 68 2e 73 70 6c 69 74 28 22 26 22 29 2c 64 3d 30 3b 64 3c 66 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 62 3d 66 5b 64 5d 2e 73 70 6c 69 74 28 22 3d 22 29 3b 69 66 28 62 5b 30 5d 3d 3d 3d 65 29 72 65 74 75 72 6e 20 62 5b 31 5d 3b 22 52 65 74 75 72 6e 55 72 6c 22 3d 3d 3d 62 5b 30 5d 26 26 28 63 3d 62 5b 31 5d 29 7d 69 66 28 63 29 7b 76 61 72 20 67 3d 75 6e 65 73 63 61 70 65 28 63 29 2e 73 70 6c 69 74 28 22 3f 22 29 3b 69 66 28 67 2e 6c 65 6e 67 74 68 3e 31 29 72 65 74 75 72 6e 20 61 28 65 2c 67 5b 31 5d 29 7d 7d 76 61 72 20 6a 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 Data Ascii: !function(){"use strict";function a(e,h){for(var c=null,f=h.split("&"),d=0;d<f.length;d++){var b=f[d].split("=");if(b[0]===e)return b[1];"ReturnUrl"===b[0]&&(c=b[1])}if(c){var g=unescape(c).split("?");if(g.length>1)return a(e,g[1])}}var j=function(){for(v

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:35 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:35 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: a0d12520-501e-0029-67fa-36d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145935Z-164f84587bft9l9khC1DFW32rc00000001eg000000008bp6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:35 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:36 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:36 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:36 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 7f617d81-b01e-0021-0b30-36cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145936Z-1866b5c5fbbzzh8chC1DFWdrc4000000016g000000001pq2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:36 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:36 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:36 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:36 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ceff4d6f-101e-007a-10c7-2c047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145936Z-16547b76f7fmbrhqhC1DFWkds80000000n8g00000000hzzg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:36 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	49831	104.17.247.203	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:36 UTC	542	OUT	GET /web-vitals/dist/web-vitals.iife.js HTTP/1.1 Host: unpkg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:36 UTC	548	IN	HTTP/1.1 302 Found Date: Fri, 15 Nov 2024 14:59:36 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-origin: * cache-control: public, s-maxage=600, max-age=60 location: /web-vitals@4.2.4/dist/web-vitals.iife.js vary: Accept via: 1.1 fly.io fly-request-id: 01JCR51ZY8VHAVTH450ZM72AWC-dfw CF-Cache-Status: HIT Age: 341 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8e301b2b4e25e5f2-DFW
2024-11-15 14:59:36 UTC	69	IN	Data Raw: 33 66 0d 0a 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 2f 77 65 62 2d 76 69 74 61 6c 73 40 34 2e 32 2e 34 2f 64 69 73 74 2f 77 65 62 2d 76 69 74 61 6c 73 2e 69 69 66 65 2e 6a 73 0d 0a Data Ascii: 3fFound. Redirecting to /web-vitals@4.2.4/dist/web-vitals.iife.js
2024-11-15 14:59:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	49829	192.29.11.142	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:36 UTC	464	OUT	GET /visitor/v200/svrGP.aspx?pps=70&siteid=1325&elqCookie=1 HTTP/1.1 Host: s1325.t.eloqua.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ELOQUA=GUID=556417D9DDDE4E9DB23F8F04730AE93B; ELQSTATUS=OK
2024-11-15 14:59:36 UTC	446	IN	HTTP/1.1 200 OK Cache-Control: no-store Pragma: no-cache Content-Type: application/javascript; charset=utf-8 Expires: -1 X-Robots-Tag: noindex, nofollow X-Xss-Protection: 1; mode=block Strict-Transport-Security: max-age=31536000; includeSubDomains; preload P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", X-Content-Type-Options: nosniff Date: Fri, 15 Nov 2024 14:59:36 GMT Connection: close Content-Length: 79
2024-11-15 14:59:36 UTC	79	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 47 65 74 45 6c 71 43 75 73 74 6f 6d 65 72 47 55 49 44 28 29 7b 20 72 65 74 75 72 6e 20 27 35 35 36 34 31 37 64 39 2d 64 64 64 65 2d 34 65 39 64 2d 62 32 33 66 2d 38 66 30 34 37 33 30 61 65 39 33 62 27 3b 20 7d Data Ascii: function GetElqCustomerGUID(){ return '556417d9-ddde-4e9d-b23f-8f04730ae93b'; }

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:36 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:37 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:36 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: a9c4265b-101e-000b-57af-365e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145936Z-1866b5c5fbbz7hb5hC1DFWru7c000000019000000000faka x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:37 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49830	13.224.245.89	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:36 UTC	538	OUT	GET /c/hotjar-66905.js?sv=7 HTTP/1.1 Host: static.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:37 UTC	639	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=2592000; includeSubDomains X-Cache-Hit: 1 X-Content-Type-Options: nosniff Date: Fri, 15 Nov 2024 14:59:37 GMT Cache-Control: max-age=60 ETag: W/b1cc08f7e26dfbaedd1f3546a4061fcf Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 8a2dbe2d91170aaa26a5c93eeaf49e5c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LHR62-C3 X-Amz-Cf-Id: 0o9saG_-OfTLS4DYGcdn2vJOk95vZiETQROQnjrnVoFW_jzQtSzG8g==
2024-11-15 14:59:37 UTC	13111	IN	Data Raw: 33 33 32 66 0d 0a 77 69 6e 64 6f 77 2e 68 6a 53 69 74 65 53 65 74 74 69 6e 67 73 20 3d 20 77 69 6e 64 6f 77 2e 68 6a 53 69 74 65 53 65 74 74 69 6e 67 73 20 7c 7c 20 7b 22 73 69 74 65 5f 69 64 22 3a 36 36 39 30 35 2c 22 72 65 63 5f 76 61 6c 75 65 22 3a 30 2e 30 2c 22 73 74 61 74 65 5f 63 68 61 6e 67 65 5f 6c 69 73 74 65 6e 5f 6d 6f 64 65 22 3a 22 6d 61 6e 75 61 6c 22 2c 22 72 65 63 6f 72 64 22 3a 74 72 75 65 2c 22 63 6f 6e 74 69 6e 75 6f 75 73 5f 63 61 70 74 75 72 65 5f 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 72 65 63 6f 72 64 69 6e 67 5f 63 61 70 74 75 72 65 5f 6b 65 79 73 74 72 6f 6b 65 73 22 3a 66 61 6c 73 65 2c 22 73 65 73 73 69 6f 6e 5f 63 61 70 74 75 72 65 5f 63 6f 6e 73 6f 6c 65 5f 63 6f 6e 73 65 6e 74 22 3a 66 61 6c 73 65 2c 22 61 6e 6f 6e 79 Data Ascii: 332fwindow.hjSiteSettings = window.hjSiteSettings \|\| {"site_id":66905,"rec_value":0.0,"state_change_listen_mode":"manual","record":true,"continuous_capture_enabled":true,"recording_capture_keystrokes":false,"session_capture_console_consent":false,"anony
2024-11-15 14:59:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49832	18.66.122.127	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:36 UTC	1098	OUT	GET /sxp/i/940047942047f9f048d2c1e1f6b78492.js HTTP/1.1 Host: euob.ytwohlcq.telerik.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1; gauuid=d2144829-e324-4fbe-8dab-96fd3d3ecb59
2024-11-15 14:59:37 UTC	503	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Content-Length: 110668 Connection: close Server: Caddy Date: Fri, 15 Nov 2024 14:59:37 GMT Cache-Control: max-age=43200 Expires: Sat, 16 Nov 2024 01:11:31 GMT ETag: "1b04c-jTMVm5l3tKuSTTnih8nZ1aNoBcc" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 9905602b8526d2635024f3edbf1df702.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P2 X-Amz-Cf-Id: Zm0MQ5iF-ENHVwS7Jeh5ILSuYvuGIgwDkywDMyagZzPLQmm1Kcov0w== Age: 6486
2024-11-15 14:59:37 UTC	16384	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 72 28 65 29 7b 69 66 28 6e 5b 65 5d 29 72 65 74 75 72 6e 20 6e 5b 65 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 69 3d 6e 5b 65 5d 3d 7b 69 3a 65 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 74 5b 65 5d 2e 63 61 6c 6c 28 69 2e 65 78 70 6f 72 74 73 2c 69 2c 69 2e 65 78 70 6f 72 74 73 2c 72 29 2c 69 2e 6c 3d 21 30 2c 69 2e 65 78 70 6f 72 74 73 7d 72 2e 6d 3d 74 2c 72 2e 63 3d 6e 2c 72 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 65 29 7b 72 2e 6f 28 74 2c 6e 29 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 6e 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 65 7d 29 7d 2c 72 2e 72 3d 66 75 6e Data Ascii: !function(t){var n={};function r(e){if(n[e])return n[e].exports;var i=n[e]={i:e,l:!1,exports:{}};return t[e].call(i.exports,i,i.exports,r),i.l=!0,i.exports}r.m=t,r.c=n,r.d=function(t,n,e){r.o(t,n)\|\|Object.defineProperty(t,n,{enumerable:!0,get:e})},r.r=fun
2024-11-15 14:59:37 UTC	16384	IN	Data Raw: 78 2e 24 74 28 22 5f 75 65 74 76 69 64 22 29 7c 7c 22 2d 22 7d 63 61 74 63 68 28 74 29 7b 7d 72 65 74 75 72 6e 22 2d 22 7d 2c 4b 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 74 3d 61 2e 63 6f 6f 6b 69 65 2e 6d 61 74 63 68 28 2f 5f 67 61 63 5f 55 41 5c 2d 5c 64 2b 5c 2d 5c 64 2b 5c 3d 28 2e 2a 3f 29 5c 3b 2f 29 5b 31 5d 3b 69 66 28 33 3d 3d 3d 74 2e 73 70 6c 69 74 28 22 2e 22 29 2e 6c 65 6e 67 74 68 29 7b 76 61 72 20 6e 3d 74 2e 73 70 6c 69 74 28 22 2e 22 29 5b 31 5d 3b 69 66 28 6d 2e 47 28 6e 29 29 72 65 74 75 72 6e 20 6d 2e 56 28 28 78 2e 48 74 28 29 2d 31 65 33 2a 6d 2e 56 28 6e 29 29 2f 31 65 33 29 7d 7d 63 61 74 63 68 28 74 29 7b 7d 72 65 74 75 72 6e 22 2d 22 7d 2c 5a 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 69 66 28 69 2e Data Ascii: x.$t("_uetvid")\|\|"-"}catch(t){}return"-"},Kn:function(){try{var t=a.cookie.match(/_gac_UA\-\d+\-\d+\=(.?)\;/)[1];if(3===t.split(".").length){var n=t.split(".")[1];if(m.G(n))return m.V((x.Ht()-1e3m.V(n))/1e3)}}catch(t){}return"-"},Zn:function(){try{if(i.
2024-11-15 14:59:37 UTC	16384	IN	Data Raw: 64 22 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6e 29 2c 64 2e 64 6f 6d 45 6c 65 6d 65 6e 74 73 2e 70 75 73 68 28 6e 29 7d 3b 6a 3f 79 2e 58 6e 28 22 63 74 22 2c 4f 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 74 72 79 7b 69 66 28 6e 29 4f 3d 28 4f 2b 3d 22 26 78 65 72 3d 22 2b 43 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 6e 29 29 29 2e 72 65 70 6c 61 63 65 28 2f 26 61 62 5c 3d 2e 2a 3f 28 26 7c 24 29 2f 2c 22 26 61 62 3d 6a 78 2e 34 2e 32 3b 24 31 22 29 2c 52 28 4f 29 2c 67 5b 4a 5d 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 2c 65 2c 69 2c 61 2c 6f 2c 63 29 7b 56 28 74 2c 6e 2c 72 2c 65 2c 69 2c 61 2c 6f 2c 63 29 7d 3b 65 6c 73 65 20 69 66 28 74 29 7b 76 61 72 20 72 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 74 29 2c 65 3d 72 2e 63 7c 7c 22 22 Data Ascii: d")[0].appendChild(n),d.domElements.push(n)};j?y.Xn("ct",O,function(t,n){try{if(n)O=(O+="&xer="+C(JSON.stringify(n))).replace(/&ab\=.*?(&\|$)/,"&ab=jx.4.2;$1"),R(O),g[J]=function(t,n,r,e,i,a,o,c){V(t,n,r,e,i,a,o,c)};else if(t){var r=JSON.parse(t),e=r.c\|\|""
2024-11-15 14:59:37 UTC	16384	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 21 74 7c 7c 30 3d 3d 3d 74 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 21 31 3b 66 6f 72 28 76 61 72 20 6e 3d 74 5b 30 5d 2c 72 3d 74 5b 30 5d 2c 65 3d 31 3b 65 3c 74 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 74 5b 65 5d 3c 6e 26 26 28 6e 3d 74 5b 65 5d 29 2c 74 5b 65 5d 3e 72 26 26 28 72 3d 74 5b 65 5d 29 3b 72 65 74 75 72 6e 20 72 2d 6e 7d 28 65 29 3c 3d 36 29 72 65 74 75 72 6e 20 5f 74 28 38 32 2c 74 5b 72 5d 29 2c 21 30 7d 7d 2c 72 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 21 63 2e 71 72 28 29 7d 2c 65 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 21 75 5b 6f 2e 58 28 22 4e 4e 61 66 58 7f 78 65 42 72 63 78 61 65 62 22 2c 31 37 29 5d 7d 2c 69 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 Data Ascii: function(t){if(!t\|\|0===t.length)return!1;for(var n=t[0],r=t[0],e=1;e<t.length;e++)t[e]<n&&(n=t[e]),t[e]>r&&(r=t[e]);return r-n}(e)<=6)return _t(82,t[r]),!0}},rr=function(){return!!c.qr()},er=function(){return!!u[o.X("NNafXxeBrcxaeb",17)]},ir=function(){v
2024-11-15 14:59:37 UTC	11216	IN	Data Raw: 72 67 65 74 3b 6e 2e 70 75 73 68 28 65 2e 74 61 67 4e 61 6d 65 29 2c 6e 2e 70 75 73 68 28 72 2e 78 29 2c 6e 2e 70 75 73 68 28 72 2e 79 29 2c 6e 2e 70 75 73 68 28 65 2e 69 64 29 2c 6e 2e 70 75 73 68 28 65 2e 63 6c 61 73 73 4e 61 6d 65 29 7d 72 65 74 75 72 6e 20 6e 2e 6a 6f 69 6e 28 22 2c 22 29 7d 72 65 74 75 72 6e 22 30 22 7d 7d 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 75 2e 49 6e 74 6c 2e 44 61 74 65 54 69 6d 65 46 6f 72 6d 61 74 28 29 2e 72 65 73 6f 6c 76 65 64 4f 70 74 69 6f 6e 73 28 29 3b 72 65 74 75 72 6e 5b 74 2e 74 69 6d 65 5a 6f 6e 65 2c 74 2e 6c 6f 63 61 6c 65 2c 74 2e 6e 75 6d 62 65 72 69 6e 67 53 79 73 74 65 6d 2c 74 2e 63 61 6c 65 6e 64 61 72 5d 2e 6a 6f 69 6e 28 22 2c 22 29 7d 3b 6e 65 2e 49 65 3d 21 30 3b 76 61 72 20 72 Data Ascii: rget;n.push(e.tagName),n.push(r.x),n.push(r.y),n.push(e.id),n.push(e.className)}return n.join(",")}return"0"}},ne=function(){var t=u.Intl.DateTimeFormat().resolvedOptions();return[t.timeZone,t.locale,t.numberingSystem,t.calendar].join(",")};ne.Ie=!0;var r
2024-11-15 14:59:37 UTC	16384	IN	Data Raw: 6e 64 65 78 4f 66 28 22 2f 72 65 6e 64 65 72 5f 61 64 5f 74 61 67 22 29 26 26 72 7d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 26 26 22 67 6f 6f 67 6c 65 61 64 73 2e 67 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 22 3d 3d 3d 76 26 26 30 3d 3d 3d 73 2e 69 6e 64 65 78 4f 66 28 22 2f 70 61 67 65 61 64 2f 61 64 73 22 29 26 26 69 2e 63 6e 28 22 75 72 6c 22 29 3d 3d 3d 65 7d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 26 26 22 61 6d 73 31 2d 69 62 2e 61 64 6e 78 73 2e 63 6f 6d 22 3d 3d 3d 76 26 26 30 3d 3d 3d 73 2e 69 6e 64 65 78 4f 66 28 22 2f 61 62 22 29 26 26 69 2e 63 6e 28 22 72 65 66 65 72 72 65 72 22 29 3d 3d 3d 65 7d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 26 26 28 2f 5c 2e 61 6d 70 70 72 6f 6a 65 Data Ascii: ndexOf("/render_ad_tag")&&r},function(){return e&&"googleads.g.doubleclick.net"===v&&0===s.indexOf("/pagead/ads")&&i.cn("url")===e},function(){return e&&"ams1-ib.adnxs.com"===v&&0===s.indexOf("/ab")&&i.cn("referrer")===e},function(){return e&&(/\.ampproje
2024-11-15 14:59:37 UTC	16384	IN	Data Raw: 72 61 3d 22 74 61 69 6b 6f 2d 71 73 61 22 29 7d 5d 29 2c 68 28 22 73 63 72 6f 6c 6c 42 79 22 2c 22 73 63 72 62 22 2c 5b 76 5d 29 2c 68 28 22 73 63 72 6f 6c 6c 54 6f 22 2c 22 73 63 72 74 22 2c 5b 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 72 3d 74 2e 65 5f 73 74 2e 6d 61 74 63 68 28 2f 3c 61 6e 6f 6e 79 6d 6f 75 73 3e 5c 3a 32 5c 3a 31 39 2f 29 26 26 74 2e 65 5f 73 74 2e 6d 61 74 63 68 28 2f 3c 61 6e 6f 6e 79 6d 6f 75 73 3e 5c 3a 33 5c 3a 35 2f 29 3b 72 65 74 75 72 6e 20 33 30 38 33 39 34 30 36 36 38 3d 3d 3d 6f 2e 5a 28 6e 2e 63 61 6c 6c 65 65 2e 63 61 6c 6c 65 72 2e 74 6f 53 74 72 69 6e 67 28 29 29 26 26 72 26 26 28 74 2e 65 78 74 72 61 3d 22 63 6c 73 2d 73 63 72 74 22 29 7d 2c 76 5d 29 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d Data Ascii: ra="taiko-qsa")}]),h("scrollBy","scrb",[v]),h("scrollTo","scrt",[function(t,n){var r=t.e_st.match(/<anonymous>\:2\:19/)&&t.e_st.match(/<anonymous>\:3\:5/);return 3083940668===o.Z(n.callee.caller.toString())&&r&&(t.extra="cls-scrt")},v]);!function(){var a=
2024-11-15 14:59:37 UTC	1148	IN	Data Raw: 66 79 69 6e 67 50 6c 61 74 66 6f 72 6d 41 75 74 68 65 6e 74 69 63 61 74 6f 72 41 76 61 69 6c 61 62 6c 65 29 29 72 65 74 75 72 6e 20 74 28 7b 73 3a 32 2c 66 3a 63 2e 46 72 28 63 61 6e 76 61 73 2e 67 65 74 43 6f 6e 74 65 78 74 2c 7b 4e 72 3a 31 65 33 7d 29 7d 29 3b 50 75 62 6c 69 63 4b 65 79 43 72 65 64 65 6e 74 69 61 6c 2e 69 73 55 73 65 72 56 65 72 69 66 79 69 6e 67 50 6c 61 74 66 6f 72 6d 41 75 74 68 65 6e 74 69 63 61 74 6f 72 41 76 61 69 6c 61 62 6c 65 28 29 2e 74 68 65 6e 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 74 28 7b 73 3a 33 2c 75 76 70 61 3a 2b 6e 7d 29 7d 29 2e 63 61 74 63 68 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 74 28 7b 73 3a 31 2c 65 3a 6e 2e 6d 65 73 73 61 67 65 7d 29 7d 29 7d 63 61 74 63 68 28 6e 29 7b 74 28 7b 73 3a 30 2c 65 3a 6e 2e 6d 65 Data Ascii: fyingPlatformAuthenticatorAvailable))return t({s:2,f:c.Fr(canvas.getContext,{Nr:1e3})});PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable().then(function(n){t({s:3,uvpa:+n})}).catch(function(n){t({s:1,e:n.message})})}catch(n){t({s:0,e:n.me

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:36 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:37 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:36 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: fdac4f62-e01e-0085-71ab-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145936Z-16547b76f7fmbrhqhC1DFWkds80000000nc0000000008re6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:37 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49838	150.171.28.10	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:36 UTC	517	OUT	GET /bat.js HTTP/1.1 Host: bat.bing.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:37 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: private,max-age=1800 Content-Length: 51385 Content-Type: application/javascript Last-Modified: Wed, 16 Oct 2024 22:47:44 GMT Accept-Ranges: bytes ETag: "028e0691d20db1:0" Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 73D1D6EF581E4BC88E7FEDB9F3015568 Ref B: DFW311000107045 Ref C: 2024-11-15T14:59:37Z Date: Fri, 15 Nov 2024 14:59:36 GMT Connection: close
2024-11-15 14:59:37 UTC	2399	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 55 45 54 28 6f 29 7b 74 68 69 73 2e 73 74 72 69 6e 67 45 78 69 73 74 73 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 6e 26 26 6e 2e 6c 65 6e 67 74 68 3e 30 7d 3b 74 68 69 73 2e 64 6f 6d 61 69 6e 3d 22 62 61 74 2e 62 69 6e 67 2e 63 6f 6d 22 3b 74 68 69 73 2e 64 6f 6d 61 69 6e 43 6c 3d 22 62 61 74 2e 62 69 6e 67 2e 6e 65 74 22 3b 74 68 69 73 2e 55 52 4c 4c 45 4e 47 54 48 4c 49 4d 49 54 3d 34 30 39 36 3b 74 68 69 73 2e 70 61 67 65 4c 6f 61 64 45 76 74 3d 22 70 61 67 65 4c 6f 61 64 22 3b 74 68 69 73 2e 63 75 73 74 6f 6d 45 76 74 3d 22 63 75 73 74 6f 6d 22 3b 74 68 69 73 2e 70 61 67 65 56 69 65 77 45 76 74 3d 22 70 61 67 65 5f 76 69 65 77 22 3b 6f 2e 56 65 72 3d 6f 2e 56 65 72 21 3d 3d 75 6e 64 65 66 69 6e 65 64 26 26 Data Ascii: function UET(o){this.stringExists=function(n){return n&&n.length>0};this.domain="bat.bing.com";this.domainCl="bat.bing.net";this.URLLENGTHLIMIT=4096;this.pageLoadEvt="pageLoad";this.customEvt="custom";this.pageViewEvt="page_view";o.Ver=o.Ver!==undefined&&
2024-11-15 14:59:37 UTC	8192	IN	Data Raw: 22 65 6e 75 6d 22 2c 76 61 6c 75 65 73 3a 5b 22 68 6f 6d 65 22 2c 22 73 65 61 72 63 68 72 65 73 75 6c 74 73 22 2c 22 6f 66 66 65 72 64 65 74 61 69 6c 22 2c 22 63 61 72 74 22 2c 22 70 75 72 63 68 61 73 65 22 2c 22 63 61 6e 63 65 6c 22 2c 22 6f 74 68 65 72 22 5d 7d 2c 66 6c 69 67 68 74 5f 73 74 61 72 74 64 61 74 65 3a 7b 74 79 70 65 3a 22 64 61 74 65 22 7d 2c 66 6c 69 67 68 74 5f 65 6e 64 64 61 74 65 3a 7b 74 79 70 65 3a 22 64 61 74 65 22 7d 2c 66 6c 69 67 68 74 5f 74 6f 74 61 6c 76 61 6c 75 65 3a 7b 74 79 70 65 3a 22 6e 75 6d 62 65 72 22 7d 2c 61 66 66 69 6c 69 61 74 69 6f 6e 3a 7b 7d 2c 62 72 73 5f 72 65 73 70 6f 6e 73 65 5f 69 64 3a 7b 7d 2c 63 68 65 63 6b 6f 75 74 5f 6f 70 74 69 6f 6e 3a 7b 7d 2c 63 68 65 63 6b 6f 75 74 5f 73 74 65 70 3a 7b 74 79 70 65 Data Ascii: "enum",values:["home","searchresults","offerdetail","cart","purchase","cancel","other"]},flight_startdate:{type:"date"},flight_enddate:{type:"date"},flight_totalvalue:{type:"number"},affiliation:{},brs_response_id:{},checkout_option:{},checkout_step:{type
2024-11-15 14:59:37 UTC	5417	IN	Data Raw: 6e 67 41 70 69 3d 21 30 29 3b 74 68 69 73 2e 75 65 74 43 6f 6e 66 69 67 2e 65 72 72 6f 72 42 65 61 63 6f 6e 4c 65 76 65 6c 3d 30 3b 6f 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 65 72 72 6f 72 42 65 61 63 6f 6e 4c 65 76 65 6c 22 29 26 26 28 75 3d 6f 2e 65 72 72 6f 72 42 65 61 63 6f 6e 4c 65 76 65 6c 2c 74 79 70 65 6f 66 20 75 3d 3d 22 6e 75 6d 62 65 72 22 26 26 75 25 31 3d 3d 30 26 26 75 3e 3d 30 26 26 75 3c 3d 32 26 26 28 74 68 69 73 2e 75 65 74 43 6f 6e 66 69 67 2e 65 72 72 6f 72 42 65 61 63 6f 6e 4c 65 76 65 6c 3d 75 29 29 3b 74 68 69 73 2e 75 65 74 43 6f 6e 66 69 67 2e 64 69 73 61 62 6c 65 41 75 74 6f 50 61 67 65 56 69 65 77 3d 21 31 3b 6f 2e 64 69 73 61 62 6c 65 41 75 74 6f 50 61 67 65 56 69 65 77 3d 3d 3d 21 30 26 26 28 74 68 69 73 2e 75 65 Data Ascii: ngApi=!0);this.uetConfig.errorBeaconLevel=0;o.hasOwnProperty("errorBeaconLevel")&&(u=o.errorBeaconLevel,typeof u=="number"&&u%1==0&&u>=0&&u<=2&&(this.uetConfig.errorBeaconLevel=u));this.uetConfig.disableAutoPageView=!1;o.disableAutoPageView===!0&&(this.ue
2024-11-15 14:59:37 UTC	8192	IN	Data Raw: 68 3e 31 26 26 6e 5b 30 5d 21 3d 3d 74 68 69 73 2e 70 61 67 65 4c 6f 61 64 45 76 74 29 74 3d 6e 5b 30 5d 2c 69 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 6e 2c 31 29 3b 65 6c 73 65 20 72 65 74 75 72 6e 3b 74 68 69 73 2e 75 65 74 49 6e 73 74 61 6e 63 65 2e 75 65 74 4c 6f 61 64 65 64 7c 7c 74 68 69 73 2e 65 76 71 43 44 69 73 70 61 74 63 68 26 26 74 68 69 73 2e 70 72 6f 63 65 73 73 45 61 72 6c 79 5b 74 5d 3f 74 68 69 73 2e 75 65 74 49 6e 73 74 61 6e 63 65 2e 5f 70 75 73 68 28 5b 74 2c 69 2c 72 5d 29 3a 74 68 69 73 2e 75 65 74 49 6e 73 74 61 6e 63 65 2e 65 76 65 6e 74 50 75 73 68 51 75 65 75 65 2e 70 75 73 68 28 5b 74 2c 69 2c 72 5d 29 7d 3b 74 68 69 73 2e 5f 70 75 73 68 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 Data Ascii: h>1&&n[0]!==this.pageLoadEvt)t=n[0],i=Array.prototype.slice.call(n,1);else return;this.uetInstance.uetLoaded\|\|this.evqCDispatch&&this.processEarly[t]?this.uetInstance._push([t,i,r]):this.uetInstance.eventPushQueue.push([t,i,r])};this._push=function(n){var
2024-11-15 14:59:37 UTC	8192	IN	Data Raw: 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 6d 65 74 61 22 29 2e 6b 65 79 77 6f 72 64 73 26 26 28 75 3d 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 6d 65 74 61 22 29 2e 6b 65 79 77 6f 72 64 73 2e 63 6f 6e 74 65 6e 74 2c 74 68 69 73 2e 73 74 72 69 6e 67 45 78 69 73 74 73 28 75 29 26 26 28 6e 2e 6b 77 3d 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 75 29 2e 72 65 70 6c 61 63 65 28 2f 25 32 43 2f 67 69 2c 22 2c 22 29 29 29 2c 74 3f 74 68 69 73 2e 73 74 72 69 6e 67 45 78 69 73 74 73 28 74 68 69 73 2e 70 72 65 76 69 6f 75 73 50 61 67 65 29 26 26 21 6e 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 72 22 29 26 26 28 6e 2e 72 3d 74 68 69 73 Data Ascii: getElementsByTagName("meta").keywords&&(u=window.document.head.getElementsByTagName("meta").keywords.content,this.stringExists(u)&&(n.kw=encodeURIComponent(u).replace(/%2C/gi,","))),t?this.stringExists(this.previousPage)&&!n.hasOwnProperty("r")&&(n.r=this
2024-11-15 14:59:37 UTC	8192	IN	Data Raw: 26 26 28 74 2e 70 72 6f 64 69 64 3d 74 2e 65 63 6f 6d 6d 5f 70 72 6f 64 69 64 2c 64 65 6c 65 74 65 20 74 2e 65 63 6f 6d 6d 5f 70 72 6f 64 69 64 29 3b 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 65 63 6f 6d 6d 5f 70 61 67 65 74 79 70 65 22 29 3e 30 26 26 28 74 2e 70 61 67 65 74 79 70 65 3d 74 2e 65 63 6f 6d 6d 5f 70 61 67 65 74 79 70 65 2c 64 65 6c 65 74 65 20 74 2e 65 63 6f 6d 6d 5f 70 61 67 65 74 79 70 65 29 3b 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 70 61 67 65 74 79 70 65 22 29 26 26 28 74 2e 70 61 67 65 74 79 70 65 3d 3d 6e 75 6c 6c 7c 7c 74 2e 70 61 67 65 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 28 29 3d 3d 3d 22 22 29 26 26 64 65 6c 65 74 65 20 74 2e 70 61 67 65 74 79 70 65 3b 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 Data Ascii: &&(t.prodid=t.ecomm_prodid,delete t.ecomm_prodid);t.hasOwnProperty("ecomm_pagetype")>0&&(t.pagetype=t.ecomm_pagetype,delete t.ecomm_pagetype);t.hasOwnProperty("pagetype")&&(t.pagetype==null\|\|t.pagetype.toString()==="")&&delete t.pagetype;t.hasOwnProperty(
2024-11-15 14:59:37 UTC	8192	IN	Data Raw: 76 61 72 20 69 3d 74 68 69 73 2e 63 6c 6f 6e 65 28 6e 29 3b 72 65 74 75 72 6e 20 69 2e 61 6c 74 26 26 64 65 6c 65 74 65 20 69 2e 61 6c 74 2c 74 68 69 73 2e 63 6c 6f 6e 65 28 74 2c 69 29 7d 3b 74 68 69 73 2e 66 69 72 65 42 65 61 63 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 66 6f 72 28 76 61 72 20 69 2c 73 2c 65 3d 74 68 69 73 2e 67 65 74 43 6c 55 72 6c 28 74 68 69 73 2e 75 72 6c 50 72 65 66 69 78 29 2c 74 3d 74 68 69 73 2e 63 6f 6d 62 69 6e 65 28 74 68 69 73 2e 62 65 61 63 6f 6e 50 61 72 61 6d 73 2c 6e 29 2c 72 3d 74 68 69 73 2e 73 74 72 69 6e 67 69 66 79 54 6f 52 65 71 75 65 73 74 28 74 29 2c 66 3d 74 68 69 73 2e 72 65 6d 6f 76 65 54 72 61 69 6c 69 6e 67 41 6d 70 28 65 2b 72 29 2c 6f 3d 5b 22 72 22 2c 22 65 6c 32 22 2c 22 65 63 32 22 2c 22 65 61 32 22 Data Ascii: var i=this.clone(n);return i.alt&&delete i.alt,this.clone(t,i)};this.fireBeacon=function(n){for(var i,s,e=this.getClUrl(this.urlPrefix),t=this.combine(this.beaconParams,n),r=this.stringifyToRequest(t),f=this.removeTrailingAmp(e+r),o=["r","el2","ec2","ea2"
2024-11-15 14:59:37 UTC	2609	IN	Data Raw: 6f 6d 6d 5f 74 6f 74 61 6c 76 61 6c 75 65 22 29 3b 74 68 69 73 2e 6d 61 70 47 74 6d 55 61 73 50 72 6f 64 75 63 74 73 28 6e 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 75 61 5f 65 22 3a 74 68 69 73 2e 6d 61 70 47 74 6d 45 63 6f 6d 6d 65 72 63 65 50 75 72 63 68 61 73 65 28 6e 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 67 61 34 22 3a 74 68 69 73 2e 72 65 70 6c 61 63 65 47 74 6d 50 61 72 61 6d 28 6e 2c 22 76 61 6c 75 65 22 2c 22 65 76 65 6e 74 5f 76 61 6c 75 65 22 29 3b 74 68 69 73 2e 6d 61 70 47 74 6d 47 61 34 49 74 65 6d 73 28 6e 29 7d 72 65 74 75 72 6e 20 6e 7d 3b 76 61 72 20 74 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3b 74 68 69 73 2e 64 6f 63 75 6d 65 6e 74 55 72 6c 43 68 61 6e 67 65 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3d Data Ascii: omm_totalvalue");this.mapGtmUasProducts(n);break;case"ua_e":this.mapGtmEcommercePurchase(n);break;case"ga4":this.replaceGtmParam(n,"value","event_value");this.mapGtmGa4Items(n)}return n};var t=window.location.href;this.documentUrlChanged=function(){var n=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49840	146.75.120.157	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:37 UTC	527	OUT	GET /uwt.js HTTP/1.1 Host: static.ads-twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:37 UTC	543	IN	HTTP/1.1 200 OK Connection: close Content-Length: 58876 Last-Modified: Tue, 29 Oct 2024 01:22:31 GMT ETag: "4328e910de583ad53b3a7a76455af005" x-amz-server-side-encryption: AES256 Cache-Control: no-cache Content-Type: application/javascript; charset=utf-8 Accept-Ranges: bytes Date: Fri, 15 Nov 2024 14:59:37 GMT X-Served-By: cache-iad-kiad7000145-IAD, cache-fra-etou8220051-FRA X-Cache: HIT, HIT Vary: Accept-Encoding,Host P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" x-tw-cdn: FT
2024-11-15 14:59:37 UTC	1378	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 7b 36 31 37 33 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3b 74 2e 65 78 70 6f 72 74 73 3d 28 72 3d 72 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 3b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 26 26 28 72 3d 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 29 2c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2e 63 72 79 70 74 6f 26 26 28 72 3d 73 65 6c 66 2e 63 72 79 70 74 6f 29 2c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 26 26 28 72 3d Data Ascii: !function(){var t={6173:function(t,e,n){var r;t.exports=(r=r\|\|function(t,e){var r;if("undefined"!=typeof window&&window.crypto&&(r=window.crypto),"undefined"!=typeof self&&self.crypto&&(r=self.crypto),"undefined"!=typeof globalThis&&globalThis.crypto&&(r=
2024-11-15 14:59:37 UTC	1378	IN	Data Raw: 74 68 69 73 2e 77 6f 72 64 73 3d 74 7c 7c 5b 5d 2c 74 68 69 73 2e 73 69 67 42 79 74 65 73 3d 6e 75 6c 6c 21 3d 65 3f 65 3a 34 2a 74 2e 6c 65 6e 67 74 68 7d 2c 74 6f 53 74 72 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 28 74 7c 7c 66 29 2e 73 74 72 69 6e 67 69 66 79 28 74 68 69 73 29 7d 2c 63 6f 6e 63 61 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 77 6f 72 64 73 2c 6e 3d 74 2e 77 6f 72 64 73 2c 72 3d 74 68 69 73 2e 73 69 67 42 79 74 65 73 2c 69 3d 74 2e 73 69 67 42 79 74 65 73 3b 69 66 28 74 68 69 73 2e 63 6c 61 6d 70 28 29 2c 72 25 34 29 66 6f 72 28 76 61 72 20 6f 3d 30 3b 6f 3c 69 3b 6f 2b 2b 29 7b 76 61 72 20 61 3d 6e 5b 6f 3e 3e 3e 32 5d 3e 3e 3e 32 34 2d 6f 25 34 2a 38 26 32 35 35 3b 65 5b 72 2b 6f Data Ascii: this.words=t\|\|[],this.sigBytes=null!=e?e:4t.length},toString:function(t){return(t\|\|f).stringify(this)},concat:function(t){var e=this.words,n=t.words,r=this.sigBytes,i=t.sigBytes;if(this.clamp(),r%4)for(var o=0;o<i;o++){var a=n[o>>>2]>>>24-o%48&255;e[r+o
2024-11-15 14:59:37 UTC	1378	IN	Data Raw: 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 64 2e 70 61 72 73 65 28 75 6e 65 73 63 61 70 65 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 74 29 29 29 7d 7d 2c 70 3d 63 2e 42 75 66 66 65 72 65 64 42 6c 6f 63 6b 41 6c 67 6f 72 69 74 68 6d 3d 75 2e 65 78 74 65 6e 64 28 7b 72 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 64 61 74 61 3d 6e 65 77 20 73 2e 69 6e 69 74 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 3d 30 7d 2c 5f 61 70 70 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 28 74 3d 68 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 Data Ascii: ion(t){return d.parse(unescape(encodeURIComponent(t)))}},p=c.BufferedBlockAlgorithm=u.extend({reset:function(){this._data=new s.init,this._nDataBytes=0},_append:function(t){"string"==typeof t&&(t=h.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigByt
2024-11-15 14:59:37 UTC	1378	IN	Data Raw: 72 28 76 61 72 20 72 3d 32 2c 69 3d 30 3b 69 3c 36 34 3b 29 65 28 72 29 26 26 28 69 3c 38 26 26 28 63 5b 69 5d 3d 6e 28 74 2e 70 6f 77 28 72 2c 2e 35 29 29 29 2c 75 5b 69 5d 3d 6e 28 74 2e 70 6f 77 28 72 2c 31 2f 33 29 29 2c 69 2b 2b 29 2c 72 2b 2b 7d 28 29 3b 76 61 72 20 73 3d 5b 5d 2c 6c 3d 61 2e 53 48 41 32 35 36 3d 6f 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 69 2e 69 6e 69 74 28 63 2e 73 6c 69 63 65 28 30 29 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 6e 3d 74 68 69 73 2e 5f 68 61 73 68 2e 77 6f 72 64 73 2c 72 3d 6e 5b 30 5d 2c 69 3d 6e 5b 31 5d 2c 6f 3d 6e 5b 32 5d 2c 61 3d 6e 5b 33 Data Ascii: r(var r=2,i=0;i<64;)e(r)&&(i<8&&(c[i]=n(t.pow(r,.5))),u[i]=n(t.pow(r,1/3)),i++),r++}();var s=[],l=a.SHA256=o.extend({_doReset:function(){this._hash=new i.init(c.slice(0))},_doProcessBlock:function(t,e){for(var n=this._hash.words,r=n[0],i=n[1],o=n[2],a=n[3
2024-11-15 14:59:37 UTC	1378	IN	Data Raw: 72 20 69 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 74 68 69 73 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 21 74 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 6e 28 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 74 79 70 65 6f 66 20 74 2b 22 20 22 2b 74 2b 22 20 69 73 20 6e 6f 74 20 69 74 65 72 61 62 6c 65 28 63 61 6e 6e 6f 74 20 72 65 61 64 20 70 72 6f 70 65 72 74 79 20 53 79 6d 62 6f 6c 28 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 29 29 22 29 29 3b 76 61 72 20 72 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 74 29 3b 69 66 28 30 3d 3d 3d 72 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 65 28 5b 5d 29 3b 76 61 72 20 69 3d 72 2e 6c 65 6e 67 74 Data Ascii: r i=function(t){return new this((function(e,n){if(!t\|\|void 0===t.length)return n(new TypeError(typeof t+" "+t+" is not iterable(cannot read property Symbol(Symbol.iterator))"));var r=Array.prototype.slice.call(t);if(0===r.length)return e([]);var i=r.lengt
2024-11-15 14:59:37 UTC	1378	IN	Data Raw: 76 6f 69 64 20 64 28 74 29 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6e 29 72 65 74 75 72 6e 20 76 6f 69 64 20 70 28 28 72 3d 6e 2c 69 3d 65 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 2e 61 70 70 6c 79 28 69 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2c 74 29 7d 74 2e 5f 73 74 61 74 65 3d 31 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 64 28 74 29 7d 63 61 74 63 68 28 65 29 7b 66 28 74 2c 65 29 7d 76 61 72 20 72 2c 69 7d 66 75 6e 63 74 69 6f 6e 20 66 28 74 2c 65 29 7b 74 2e 5f 73 74 61 74 65 3d 32 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 64 28 74 29 7d 66 75 6e 63 74 69 6f 6e 20 64 28 74 29 7b 32 3d 3d 3d 74 2e 5f 73 74 61 74 65 26 26 30 3d 3d 3d 74 2e 5f 64 65 66 65 72 72 65 64 73 2e 6c 65 6e 67 74 68 26 26 75 2e 5f 69 6d 6d 65 64 69 61 74 65 46 6e Data Ascii: void d(t);if("function"==typeof n)return void p((r=n,i=e,function(){r.apply(i,arguments)}),t)}t._state=1,t._value=e,d(t)}catch(e){f(t,e)}var r,i}function f(t,e){t._state=2,t._value=e,d(t)}function d(t){2===t._state&&0===t._deferreds.length&&u._immediateFn
2024-11-15 14:59:37 UTC	1378	IN	Data Raw: 74 75 72 6e 20 6e 65 77 20 75 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 6e 28 74 29 7d 29 29 7d 2c 75 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 75 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 21 61 28 74 29 29 72 65 74 75 72 6e 20 6e 28 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 50 72 6f 6d 69 73 65 2e 72 61 63 65 20 61 63 63 65 70 74 73 20 61 6e 20 61 72 72 61 79 22 29 29 3b 66 6f 72 28 76 61 72 20 72 3d 30 2c 69 3d 74 2e 6c 65 6e 67 74 68 3b 72 3c 69 3b 72 2b 2b 29 75 2e 72 65 73 6f 6c 76 65 28 74 5b 72 5d 29 2e 74 68 65 6e 28 65 2c 6e 29 7d 29 29 7d 2c 75 2e 5f 69 6d 6d 65 64 69 61 74 65 46 6e 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 73 65 74 49 6d 6d 65 64 69 61 74 65 Data Ascii: turn new u((function(e,n){n(t)}))},u.race=function(t){return new u((function(e,n){if(!a(t))return n(new TypeError("Promise.race accepts an array"));for(var r=0,i=t.length;r<i;r++)u.resolve(t[r]).then(e,n)}))},u._immediateFn="function"==typeof setImmediate
2024-11-15 14:59:37 UTC	1378	IN	Data Raw: 68 72 6f 77 22 3d 3d 3d 69 29 74 68 72 6f 77 20 6f 3b 72 65 74 75 72 6e 20 43 28 29 7d 66 6f 72 28 6e 2e 6d 65 74 68 6f 64 3d 69 2c 6e 2e 61 72 67 3d 6f 3b 3b 29 7b 76 61 72 20 61 3d 6e 2e 64 65 6c 65 67 61 74 65 3b 69 66 28 61 29 7b 76 61 72 20 63 3d 67 28 61 2c 6e 29 3b 69 66 28 63 29 7b 69 66 28 63 3d 3d 3d 6c 29 63 6f 6e 74 69 6e 75 65 3b 72 65 74 75 72 6e 20 63 7d 7d 69 66 28 22 6e 65 78 74 22 3d 3d 3d 6e 2e 6d 65 74 68 6f 64 29 6e 2e 73 65 6e 74 3d 6e 2e 5f 73 65 6e 74 3d 6e 2e 61 72 67 3b 65 6c 73 65 20 69 66 28 22 74 68 72 6f 77 22 3d 3d 3d 6e 2e 6d 65 74 68 6f 64 29 7b 69 66 28 22 73 75 73 70 65 6e 64 65 64 53 74 61 72 74 22 3d 3d 3d 72 29 74 68 72 6f 77 20 72 3d 22 63 6f 6d 70 6c 65 74 65 64 22 2c 6e 2e 61 72 67 3b 6e 2e 64 69 73 70 61 74 63 68 Data Ascii: hrow"===i)throw o;return C()}for(n.method=i,n.arg=o;;){var a=n.delegate;if(a){var c=g(a,n);if(c){if(c===l)continue;return c}}if("next"===n.method)n.sent=n._sent=n.arg;else if("throw"===n.method){if("suspendedStart"===r)throw r="completed",n.arg;n.dispatch
2024-11-15 14:59:37 UTC	1378	IN	Data Raw: 29 7d 28 69 2c 6f 2c 72 2c 61 29 7d 29 29 7d 72 65 74 75 72 6e 20 72 3d 72 3f 72 2e 74 68 65 6e 28 61 2c 61 29 3a 61 28 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 67 28 74 2c 65 29 7b 76 61 72 20 6e 3d 74 2e 69 74 65 72 61 74 6f 72 5b 65 2e 6d 65 74 68 6f 64 5d 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 6e 29 7b 69 66 28 65 2e 64 65 6c 65 67 61 74 65 3d 6e 75 6c 6c 2c 22 74 68 72 6f 77 22 3d 3d 3d 65 2e 6d 65 74 68 6f 64 29 7b 69 66 28 74 2e 69 74 65 72 61 74 6f 72 2e 72 65 74 75 72 6e 26 26 28 65 2e 6d 65 74 68 6f 64 3d 22 72 65 74 75 72 6e 22 2c 65 2e 61 72 67 3d 76 6f 69 64 20 30 2c 67 28 74 2c 65 29 2c 22 74 68 72 6f 77 22 3d 3d 3d 65 2e 6d 65 74 68 6f 64 29 29 72 65 74 75 72 6e 20 6c 3b 65 2e 6d 65 74 68 6f 64 3d 22 74 68 72 6f 77 22 2c 65 2e 61 72 67 3d 6e 65 Data Ascii: )}(i,o,r,a)}))}return r=r?r.then(a,a):a()}}function g(t,e){var n=t.iterator[e.method];if(void 0===n){if(e.delegate=null,"throw"===e.method){if(t.iterator.return&&(e.method="return",e.arg=void 0,g(t,e),"throw"===e.method))return l;e.method="throw",e.arg=ne
2024-11-15 14:59:37 UTC	1378	IN	Data Raw: 61 74 6f 72 46 75 6e 63 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 72 65 74 75 72 6e 21 21 65 26 26 28 65 3d 3d 3d 64 7c 7c 22 47 65 6e 65 72 61 74 6f 72 46 75 6e 63 74 69 6f 6e 22 3d 3d 3d 28 65 2e 64 69 73 70 6c 61 79 4e 61 6d 65 7c 7c 65 2e 6e 61 6d 65 29 29 7d 2c 74 2e 6d 61 72 6b 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3f 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 74 2c 68 29 3a 28 74 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 68 2c 63 28 74 2c 61 2c 22 47 65 6e 65 72 61 74 6f 72 46 75 6e 63 74 69 6f 6e 22 29 29 2c 74 2e 70 Data Ascii: atorFunction=function(t){var e="function"==typeof t&&t.constructor;return!!e&&(e===d\|\|"GeneratorFunction"===(e.displayName\|\|e.name))},t.mark=function(t){return Object.setPrototypeOf?Object.setPrototypeOf(t,h):(t.__proto__=h,c(t,a,"GeneratorFunction")),t.p

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:37 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:37 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:37 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 0304051c-b01e-0070-43af-361cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145937Z-16547b76f7fw2955hC1DFWsptc00000001x000000000hmtc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:37 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	49843	104.17.247.203	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:37 UTC	548	OUT	GET /web-vitals@4.2.4/dist/web-vitals.iife.js HTTP/1.1 Host: unpkg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:37 UTC	575	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:37 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-origin: * cache-control: public, max-age=31536000 last-modified: Sat, 26 Oct 1985 08:15:00 GMT etag: W/"1c3a-LeUC6s/Gcko0wscq5NFJGfOy9Yg" via: 1.1 fly.io fly-request-id: 01JC08R81X17YVA0X68YQ736HG-dfw CF-Cache-Status: HIT Age: 801759 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8e301b317c1addb3-DFW
2024-11-15 14:59:37 UTC	794	IN	Data Raw: 31 63 33 61 0d 0a 76 61 72 20 77 65 62 56 69 74 61 6c 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 2c 74 2c 72 2c 69 2c 6f 2c 61 3d 2d 31 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 70 61 67 65 73 68 6f 77 22 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6e 2e 70 65 72 73 69 73 74 65 64 26 26 28 61 3d 6e 2e 74 69 6d 65 53 74 61 6d 70 2c 65 28 6e 29 29 7d 29 2c 21 30 29 7d 2c 75 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 26 26 70 65 72 66 6f 72 6d 61 6e 63 65 2e 67 65 74 45 6e 74 72 69 65 73 42 79 54 79 70 65 26 26 70 65 72 66 6f 72 6d 61 6e 63 65 2e 67 65 74 45 6e 74 72 69 65 73 42 79 54 79 70 65 Data Ascii: 1c3avar webVitals=function(e){"use strict";var n,t,r,i,o,a=-1,c=function(e){addEventListener("pageshow",(function(n){n.persisted&&(a=n.timeStamp,e(n))}),!0)},u=function(){var e=self.performance&&performance.getEntriesByType&&performance.getEntriesByType
2024-11-15 14:59:37 UTC	1369	IN	Data Raw: 73 65 72 76 65 72 2e 73 75 70 70 6f 72 74 65 64 45 6e 74 72 79 54 79 70 65 73 2e 69 6e 63 6c 75 64 65 73 28 65 29 29 7b 76 61 72 20 72 3d 6e 65 77 20 50 65 72 66 6f 72 6d 61 6e 63 65 4f 62 73 65 72 76 65 72 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 28 65 2e 67 65 74 45 6e 74 72 69 65 73 28 29 29 7d 29 29 7d 29 29 3b 72 65 74 75 72 6e 20 72 2e 6f 62 73 65 72 76 65 28 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 7b 74 79 70 65 3a 65 2c 62 75 66 66 65 72 65 64 3a 21 30 7d 2c 74 7c 7c 7b 7d 29 29 2c 72 7d 7d 63 61 74 63 68 28 65 29 7b 7d 7d 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 2c 72 29 7b 76 61 72 20 69 2c 6f 3b 72 65 74 75 72 6e 20 66 75 6e Data Ascii: server.supportedEntryTypes.includes(e)){var r=new PerformanceObserver((function(e){Promise.resolve().then((function(){n(e.getEntries())}))}));return r.observe(Object.assign({type:e,buffered:!0},t\|\|{})),r}}catch(e){}},l=function(e,n,t,r){var i,o;return fun
2024-11-15 14:59:37 UTC	1369	IN	Data Raw: 62 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 6e 3d 6e 7c 7c 7b 7d 2c 4c 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 2c 72 3d 43 28 29 2c 69 3d 66 28 22 46 43 50 22 29 2c 6f 3d 64 28 22 70 61 69 6e 74 22 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 66 69 72 73 74 2d 63 6f 6e 74 65 6e 74 66 75 6c 2d 70 61 69 6e 74 22 3d 3d 3d 65 2e 6e 61 6d 65 26 26 28 6f 2e 64 69 73 63 6f 6e 6e 65 63 74 28 29 2c 65 2e 73 74 61 72 74 54 69 6d 65 3c 72 2e 66 69 72 73 74 48 69 64 64 65 6e 54 69 6d 65 26 26 28 69 2e 76 61 6c 75 65 3d 4d 61 74 68 2e 6d 61 78 28 65 2e 73 74 61 72 74 54 69 6d 65 2d 73 28 29 2c 30 29 2c 69 2e 65 6e 74 72 69 65 73 2e 70 75 73 68 28 65 29 2c 74 28 21 30 29 29 29 7d 29 Data Ascii: b=function(e,n){n=n\|\|{},L((function(){var t,r=C(),i=f("FCP"),o=d("paint",(function(e){e.forEach((function(e){"first-contentful-paint"===e.name&&(o.disconnect(),e.startTime<r.firstHiddenTime&&(i.value=Math.max(e.startTime-s(),0),i.entries.push(e),t(!0)))})
2024-11-15 14:59:37 UTC	1369	IN	Data Raw: 65 74 75 72 6e 20 42 2e 64 65 6c 65 74 65 28 65 2e 69 64 29 7d 29 29 7d 7d 7d 2c 71 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 73 65 6c 66 2e 72 65 71 75 65 73 74 49 64 6c 65 43 61 6c 6c 62 61 63 6b 7c 7c 73 65 6c 66 2e 73 65 74 54 69 6d 65 6f 75 74 2c 74 3d 2d 31 3b 72 65 74 75 72 6e 20 65 3d 6d 28 65 29 2c 22 68 69 64 64 65 6e 22 3d 3d 3d 64 6f 63 75 6d 65 6e 74 2e 76 69 73 69 62 69 6c 69 74 79 53 74 61 74 65 3f 65 28 29 3a 28 74 3d 6e 28 65 29 2c 76 28 65 29 29 2c 74 7d 2c 4f 3d 5b 32 30 30 2c 35 30 30 5d 2c 6a 3d 5b 32 35 30 30 2c 34 65 33 5d 2c 56 3d 7b 7d 2c 5f 3d 5b 38 30 30 2c 31 38 30 30 5d 2c 7a 3d 66 75 6e 63 74 69 6f 6e 20 65 28 6e 29 7b 64 6f 63 75 6d 65 6e 74 2e 70 72 65 72 65 6e 64 65 72 69 6e 67 3f 4c 28 28 66 75 6e 63 74 69 Data Ascii: eturn B.delete(e.id)}))}}},q=function(e){var n=self.requestIdleCallback\|\|self.setTimeout,t=-1;return e=m(e),"hidden"===document.visibilityState?e():(t=n(e),v(e)),t},O=[200,500],j=[2500,4e3],V={},_=[800,1800],z=function e(n){document.prerendering?L((functi
2024-11-15 14:59:37 UTC	1369	IN	Data Raw: 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 68 61 64 52 65 63 65 6e 74 49 6e 70 75 74 29 7b 76 61 72 20 6e 3d 6f 5b 30 5d 2c 74 3d 6f 5b 6f 2e 6c 65 6e 67 74 68 2d 31 5d 3b 69 26 26 65 2e 73 74 61 72 74 54 69 6d 65 2d 74 2e 73 74 61 72 74 54 69 6d 65 3c 31 65 33 26 26 65 2e 73 74 61 72 74 54 69 6d 65 2d 6e 2e 73 74 61 72 74 54 69 6d 65 3c 35 65 33 3f 28 69 2b 3d 65 2e 76 61 6c 75 65 2c 6f 2e 70 75 73 68 28 65 29 29 3a 28 69 3d 65 2e 76 61 6c 75 65 2c 6f 3d 5b 65 5d 29 7d 7d 29 29 2c 69 3e 72 2e 76 61 6c 75 65 26 26 28 72 2e 76 61 6c 75 65 3d 69 2c 72 2e 65 6e 74 72 69 65 73 3d 6f 2c 74 28 29 29 7d 2c 75 3d 64 28 22 6c 61 79 6f 75 74 2d 73 68 69 66 74 22 2c 61 29 3b 75 26 26 28 74 3d 6c 28 65 2c 72 2c 77 2c 6e 2e 72 65 70 Data Ascii: orEach((function(e){if(!e.hadRecentInput){var n=o[0],t=o[o.length-1];i&&e.startTime-t.startTime<1e3&&e.startTime-n.startTime<5e3?(i+=e.value,o.push(e)):(i=e.value,o=[e])}})),i>r.value&&(r.value=i,r.entries=o,t())},u=d("layout-shift",a);u&&(t=l(e,r,w,n.rep
2024-11-15 14:59:37 UTC	964	IN	Data Raw: 29 7b 52 3d 4d 28 29 2c 44 2e 6c 65 6e 67 74 68 3d 30 2c 42 2e 63 6c 65 61 72 28 29 2c 69 3d 66 28 22 49 4e 50 22 29 2c 72 3d 6c 28 65 2c 69 2c 4f 2c 6e 2e 72 65 70 6f 72 74 41 6c 6c 43 68 61 6e 67 65 73 29 7d 29 29 29 7d 29 29 29 7d 2c 65 2e 6f 6e 4c 43 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 6e 3d 6e 7c 7c 7b 7d 2c 4c 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 2c 72 3d 43 28 29 2c 69 3d 66 28 22 4c 43 50 22 29 2c 6f 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 2e 72 65 70 6f 72 74 41 6c 6c 43 68 61 6e 67 65 73 7c 7c 28 65 3d 65 2e 73 6c 69 63 65 28 2d 31 29 29 2c 65 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 73 74 61 72 74 54 69 6d 65 3c 72 2e 66 69 72 73 74 48 69 64 64 65 6e 54 69 6d 65 26 26 28 69 2e 76 61 Data Ascii: ){R=M(),D.length=0,B.clear(),i=f("INP"),r=l(e,i,O,n.reportAllChanges)})))})))},e.onLCP=function(e,n){n=n\|\|{},L((function(){var t,r=C(),i=f("LCP"),o=function(e){n.reportAllChanges\|\|(e=e.slice(-1)),e.forEach((function(e){e.startTime<r.firstHiddenTime&&(i.va
2024-11-15 14:59:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:37 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:37 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 7bf77406-901e-0083-6cab-36bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145937Z-1866b5c5fbbtpjhjhC1DFWr6tw000000017g00000000pqkp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:38 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:37 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:37 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 9563ae3e-601e-0084-6b86-366b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145937Z-164f84587bf6h2bxhC1DFWbcm800000001p0000000007t14 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:38 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:37 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:37 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a8264c91-f01e-0052-7a79-369224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145937Z-164f84587bf28gjzhC1DFW35kg00000001d000000000a8wt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:38 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:38 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:38 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: a4cce2d9-d01e-008e-4d40-36387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145938Z-1866b5c5fbbqmbqjhC1DFWwgvc000000011g000000006x55 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:38 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	49848	104.22.54.104	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:38 UTC	532	OUT	GET /prum.min.js HTTP/1.1 Host: rum-static.pingdom.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:38 UTC	394	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:38 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close last-modified: Fri, 14 Oct 2022 06:22:29 GMT vary: Accept-Encoding etag: W/"63490025-1849" access-control-allow-origin: * Cache-Control: max-age=43200 CF-Cache-Status: HIT Age: 144 Server: cloudflare CF-RAY: 8e301b371cf18d2c-DFW
2024-11-15 14:59:38 UTC	975	IN	Data Raw: 31 38 34 39 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 29 2e 6d 61 70 28 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 6e 2b 22 3d 22 2b 28 65 3f 74 5b 6e 5d 3a 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 74 5b 6e 5d 29 29 7d 29 29 2e 6a 6f 69 6e 28 22 26 22 29 7d 66 75 6e 63 74 69 6f 6e 20 65 28 74 2c 65 29 7b 76 61 72 20 6e 2c 6f 2c 72 3d 7b 7d 3b 72 65 74 75 72 6e 20 74 26 26 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 3f 28 74 2e 74 72 69 6d 28 29 2e 73 70 6c 69 74 28 22 26 22 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 6e 3d 74 2e 69 6e 64 65 78 Data Ascii: 1849!function(){"use strict";function t(t,e){return Object.keys(t).map((function(n){return n+"="+(e?t[n]:encodeURIComponent(t[n]))})).join("&")}function e(t,e){var n,o,r={};return t&&"string"==typeof t?(t.trim().split("&").forEach((function(t){n=t.index
2024-11-15 14:59:38 UTC	1369	IN	Data Raw: 2e 61 70 70 4e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 22 29 29 7b 76 61 72 20 64 3d 65 2e 6e 61 76 69 67 61 74 6f 72 2e 61 70 70 56 65 72 73 69 6f 6e 2e 6d 61 74 63 68 28 2f 4d 53 49 45 20 28 5c 64 2b 29 2f 29 3b 64 26 26 70 61 72 73 65 49 6e 74 28 64 5b 31 5d 29 3c 3d 39 26 26 28 75 3d 21 30 29 7d 69 66 28 65 2e 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 26 26 21 75 29 7b 76 61 72 20 66 3d 6e 65 77 20 65 2e 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 3b 66 2e 6f 70 65 6e 28 73 2c 72 29 2c 22 47 45 54 22 3d 3d 3d 73 3f 66 2e 73 65 6e 64 28 74 28 63 29 29 3a 66 2e 73 65 6e 64 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 63 29 29 7d 65 6c 73 65 20 65 2e 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 Data Ascii: .appName.indexOf("Internet Explorer")){var d=e.navigator.appVersion.match(/MSIE (\d+)/);d&&parseInt(d[1])<=9&&(u=!0)}if(e.XMLHttpRequest&&!u){var f=new e.XMLHttpRequest;f.open(s,r),"GET"===s?f.send(t(c)):f.send(JSON.stringify(c))}else e.document.createEle
2024-11-15 14:59:38 UTC	1369	IN	Data Raw: 65 2e 67 65 74 28 22 72 76 22 29 7c 7c 22 30 22 2c 76 3a 64 2e 76 65 72 7d 3a 64 2e 73 65 73 73 69 6f 6e 53 74 61 72 74 28 21 31 29 7d 2c 67 65 6e 65 72 61 74 65 53 65 73 73 69 6f 6e 49 44 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 37 38 33 36 34 31 36 34 30 39 36 2b 4d 61 74 68 2e 66 6c 6f 6f 72 28 32 37 34 32 37 34 35 37 34 33 33 35 39 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 29 29 2e 74 6f 53 74 72 69 6e 67 28 33 36 29 7d 2c 73 65 73 73 69 6f 6e 53 74 61 72 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 3d 74 3f 22 31 22 3a 22 30 22 3b 76 61 72 20 65 3d 64 2e 67 65 6e 65 72 61 74 65 53 65 73 73 69 6f 6e 49 44 28 29 3b 64 2e 73 74 6f 72 61 67 65 2e 73 65 74 28 22 73 69 64 22 2c 65 29 3b 76 61 72 20 6e 3d 64 2e 73 65 73 73 69 6f 6e 4d 61 72 Data Ascii: e.get("rv")\|\|"0",v:d.ver}:d.sessionStart(!1)},generateSessionID:function(){return(78364164096+Math.floor(2742745743359*Math.random())).toString(36)},sessionStart:function(t){t=t?"1":"0";var e=d.generateSessionID();d.storage.set("sid",e);var n=d.sessionMar
2024-11-15 14:59:38 UTC	1369	IN	Data Raw: 29 3b 72 65 74 75 72 6e 20 6e 3f 6e 5b 74 5d 3a 22 22 7d 72 65 74 75 72 6e 22 22 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 69 29 7b 69 66 28 72 26 26 6e 29 74 72 79 7b 76 61 72 20 61 3d 72 2e 67 65 74 49 74 65 6d 28 6f 2e 73 74 6f 72 61 67 65 4b 65 79 29 2c 73 3d 61 3f 65 28 61 29 3a 7b 7d 3b 73 5b 6e 5d 3d 69 2c 72 2e 73 65 74 49 74 65 6d 28 6f 2e 73 74 6f 72 61 67 65 4b 65 79 2c 74 28 73 29 29 7d 63 61 74 63 68 28 74 29 7b 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 22 75 6e 61 62 6c 65 20 74 6f 20 73 74 6f 72 65 20 22 2b 6e 2b 22 20 69 6e 20 73 74 6f 72 61 67 65 2e 22 2c 74 29 7d 7d 2c 72 65 6d 6f 76 65 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 26 26 74 26 26 72 2e 72 65 6d 6f 76 65 49 74 65 6d 28 74 29 7d 7d 7d 28 63 2c 64 29 2c 64 2e 67 65 74 Data Ascii: );return n?n[t]:""}return""},set:function(n,i){if(r&&n)try{var a=r.getItem(o.storageKey),s=a?e(a):{};s[n]=i,r.setItem(o.storageKey,t(s))}catch(t){console.error("unable to store "+n+" in storage.",t)}},remove:function(t){r&&t&&r.removeItem(t)}}}(c,d),d.get
2024-11-15 14:59:38 UTC	1143	IN	Data Raw: 65 69 67 68 74 2c 70 44 3a 74 2e 73 63 72 65 65 6e 2e 70 69 78 65 6c 44 65 70 74 68 2c 64 50 52 3a 31 7c 74 2e 64 65 76 69 63 65 50 69 78 65 6c 52 61 74 69 6f 2c 6f 72 3a 74 2e 73 63 72 65 65 6e 2e 6f 72 69 65 6e 74 61 74 69 6f 6e 26 26 74 2e 73 63 72 65 65 6e 2e 6f 72 69 65 6e 74 61 74 69 6f 6e 2e 74 79 70 65 7c 7c 22 22 7d 7d 28 74 29 29 2c 75 2e 70 75 73 68 28 7b 6e 54 3a 69 2e 6e 61 76 69 67 61 74 69 6f 6e 2e 74 79 70 65 2c 72 43 3a 69 2e 6e 61 76 69 67 61 74 69 6f 6e 2e 72 65 64 69 72 65 63 74 43 6f 75 6e 74 7d 29 2c 75 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 7b 6e 53 3a 30 2c 63 53 3a 73 28 74 2e 63 6f 6e 6e 65 63 74 53 74 61 72 74 29 2c 63 45 3a 73 28 74 2e 63 6f 6e 6e 65 63 74 45 6e 64 29 2c 64 4c 45 3a 73 28 74 2e Data Ascii: eight,pD:t.screen.pixelDepth,dPR:1\|t.devicePixelRatio,or:t.screen.orientation&&t.screen.orientation.type\|\|""}}(t)),u.push({nT:i.navigation.type,rC:i.navigation.redirectCount}),u.push(function(t){return{nS:0,cS:s(t.connectStart),cE:s(t.connectEnd),dLE:s(t.
2024-11-15 14:59:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	49850	18.172.112.30	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:38 UTC	532	OUT	GET /monitor/stat.js HTTP/1.1 Host: www.clickcease.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:39 UTC	929	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 145222 Connection: close Last-Modified: Tue, 12 Sep 2023 09:05:15 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: Cf02rYNryv9UIBzoGOQeQJTZ2QU2vf2Y Accept-Ranges: bytes Server: AmazonS3 Date: Fri, 15 Nov 2024 14:59:40 GMT ETag: "e112b8bf96f23bc2970347a3c98e37fc" X-Cache: RefreshHit from cloudfront Via: 1.1 d60e84ebd0183f97f50eb1677fb4b7be.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P8 X-Amz-Cf-Id: 0YoMyYPjrMQ98qH06ewQ70xYVOgT8WfPvyFJDRbr6S9K_FtNs-s3GQ== X-Frame-Options: SAMEORIGIN Referrer-Policy: no-referrer-when-downgrade Content-Security-Policy: frame-ancestors 'self' https://clickceasebiz.com https://*.clickceasebiz.com; upgrade-insecure-requests; X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: microphone 'none'; camera 'none'; Vary: Origin
2024-11-15 14:59:39 UTC	15455	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 6b 28 29 7b 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 3b 76 61 72 20 63 2c 61 3d 7b 7d 2c 65 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6c 3d 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 75 3d 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 65 5b 74 5d 3d 6e 2e 76 61 6c 75 65 7d 2c 74 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3f 53 79 6d 62 6f 6c 3a 7b 7d 2c 72 3d 74 2e 69 74 65 72 61 74 6f 72 7c 7c 22 40 40 69 74 65 72 61 74 6f 72 22 2c 6e 3d 74 2e 61 73 79 6e 63 49 74 65 72 61 74 6f 72 7c 7c 22 40 40 61 73 79 Data Ascii: !function(){"use strict";function k(){k=function(){return a};var c,a={},e=Object.prototype,l=e.hasOwnProperty,u=Object.defineProperty\|\|function(e,t,n){e[t]=n.value},t="function"==typeof Symbol?Symbol:{},r=t.iterator\|\|"@@iterator",n=t.asyncIterator\|\|"@@asy
2024-11-15 14:59:39 UTC	16384	IN	Data Raw: 72 65 67 65 6e 65 72 61 74 6f 72 52 75 6e 74 69 6d 65 26 26 30 3c 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 4e 61 6d 65 73 28 74 29 2e 69 6e 64 65 78 4f 66 28 22 72 65 67 65 6e 65 72 61 74 6f 72 52 75 6e 74 69 6d 65 22 29 2c 64 3d 65 26 26 74 2e 72 65 67 65 6e 65 72 61 74 6f 72 52 75 6e 74 69 6d 65 3b 69 66 28 74 2e 72 65 67 65 6e 65 72 61 74 6f 72 52 75 6e 74 69 6d 65 3d 76 6f 69 64 20 30 2c 65 29 74 2e 72 65 67 65 6e 65 72 61 74 6f 72 52 75 6e 74 69 6d 65 3d 64 3b 65 6c 73 65 20 74 72 79 7b 64 65 6c 65 74 65 20 74 2e 72 65 67 65 6e 65 72 61 74 6f 72 52 75 6e 74 69 6d 65 7d 63 61 74 63 68 28 65 29 7b 74 2e 72 65 67 65 6e 65 72 61 74 6f 72 52 75 6e 74 69 6d 65 3d 76 6f 69 64 20 30 7d 76 61 72 20 66 3d 22 75 6e 64 65 66 69 6e 65 64 Data Ascii: regeneratorRuntime&&0<=Object.getOwnPropertyNames(t).indexOf("regeneratorRuntime"),d=e&&t.regeneratorRuntime;if(t.regeneratorRuntime=void 0,e)t.regeneratorRuntime=d;else try{delete t.regeneratorRuntime}catch(e){t.regeneratorRuntime=void 0}var f="undefined
2024-11-15 14:59:39 UTC	16384	IN	Data Raw: 23 22 21 3d 3d 72 5b 30 5d 7c 7c 22 62 61 63 6b 67 72 6f 75 6e 64 22 3d 3d 3d 6e 26 26 72 26 26 28 22 74 61 62 6c 65 22 3d 3d 3d 74 7c 7c 22 74 64 22 3d 3d 3d 74 7c 7c 22 74 68 22 3d 3d 3d 74 29 29 72 65 74 75 72 6e 20 67 28 65 2c 72 29 3b 69 66 28 22 73 72 63 73 65 74 22 3d 3d 3d 6e 26 26 72 29 7b 76 61 72 20 6f 3d 65 2c 69 3d 72 3b 69 66 28 22 22 3d 3d 3d 69 2e 74 72 69 6d 28 29 29 72 65 74 75 72 6e 20 69 3b 76 61 72 20 61 3d 30 3b 66 75 6e 63 74 69 6f 6e 20 73 28 65 29 7b 76 61 72 20 65 3d 65 2e 65 78 65 63 28 69 2e 73 75 62 73 74 72 69 6e 67 28 61 29 29 3b 72 65 74 75 72 6e 20 65 3f 28 65 3d 65 5b 30 5d 2c 61 2b 3d 65 2e 6c 65 6e 67 74 68 2c 65 29 3a 22 22 7d 66 6f 72 28 76 61 72 20 63 3d 5b 5d 3b 73 28 79 29 2c 21 28 61 3e 3d 69 2e 6c 65 6e 67 74 68 Data Ascii: #"!==r[0]\|\|"background"===n&&r&&("table"===t\|\|"td"===t\|\|"th"===t))return g(e,r);if("srcset"===n&&r){var o=e,i=r;if(""===i.trim())return i;var a=0;function s(e){var e=e.exec(i.substring(a));return e?(e=e[0],a+=e.length,e):""}for(var c=[];s(y),!(a>=i.length
2024-11-15 14:59:39 UTC	16384	IN	Data Raw: 76 61 72 20 72 3d 22 74 65 78 74 61 72 65 61 22 3d 3d 3d 66 26 26 22 76 61 6c 75 65 22 3d 3d 3d 65 2c 6f 3d 22 73 74 79 6c 65 22 3d 3d 3d 66 26 26 22 5f 63 73 73 54 65 78 74 22 3d 3d 3d 65 3b 69 66 28 6f 26 26 75 26 26 28 6e 3d 6b 28 6e 2c 64 29 29 2c 72 7c 7c 6f 29 7b 66 6f 72 28 76 61 72 20 72 3d 6c 2e 63 72 65 61 74 65 54 65 78 74 4e 6f 64 65 28 6e 29 2c 69 3d 30 2c 61 3d 41 72 72 61 79 2e 66 72 6f 6d 28 70 2e 63 68 69 6c 64 4e 6f 64 65 73 29 3b 69 3c 61 2e 6c 65 6e 67 74 68 3b 69 2b 2b 29 7b 76 61 72 20 73 3d 61 5b 69 5d 3b 73 2e 6e 6f 64 65 54 79 70 65 3d 3d 3d 70 2e 54 45 58 54 5f 4e 4f 44 45 26 26 70 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 73 29 7d 72 65 74 75 72 6e 20 70 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 72 29 7d 74 72 79 7b 69 66 28 63 2e 69 Data Ascii: var r="textarea"===f&&"value"===e,o="style"===f&&"_cssText"===e;if(o&&u&&(n=k(n,d)),r\|\|o){for(var r=l.createTextNode(n),i=0,a=Array.from(p.childNodes);i<a.length;i++){var s=a[i];s.nodeType===p.TEXT_NODE&&p.removeChild(s)}return p.appendChild(r)}try{if(c.i
2024-11-15 14:59:39 UTC	16384	IN	Data Raw: 65 77 20 53 65 74 2c 62 2e 64 72 6f 70 70 65 64 53 65 74 3d 6e 65 77 20 53 65 74 2c 62 2e 6d 6f 76 65 64 4d 61 70 3d 7b 7d 2c 62 2e 6d 75 74 61 74 69 6f 6e 43 62 28 67 29 29 7d 7d 2c 74 68 69 73 2e 70 72 6f 63 65 73 73 4d 75 74 61 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 72 29 7b 76 61 72 20 74 2c 65 2c 6e 2c 6f 3b 69 66 28 21 24 28 72 2e 74 61 72 67 65 74 29 29 73 77 69 74 63 68 28 72 2e 74 79 70 65 29 7b 63 61 73 65 22 63 68 61 72 61 63 74 65 72 44 61 74 61 22 3a 76 61 72 20 69 3d 72 2e 74 61 72 67 65 74 2e 74 65 78 74 43 6f 6e 74 65 6e 74 3b 4e 65 28 72 2e 74 61 72 67 65 74 2c 62 2e 62 6c 6f 63 6b 43 6c 61 73 73 29 7c 7c 69 3d 3d 3d 72 2e 6f 6c 64 56 61 6c 75 65 7c 7c 62 2e 74 65 78 74 73 2e 70 75 73 68 28 7b 76 61 6c 75 65 3a 58 28 72 2e 74 61 72 67 Data Ascii: ew Set,b.droppedSet=new Set,b.movedMap={},b.mutationCb(g))}},this.processMutation=function(r){var t,e,n,o;if(!$(r.target))switch(r.type){case"characterData":var i=r.target.textContent;Ne(r.target,b.blockClass)\|\|i===r.oldValue\|\|b.texts.push({value:X(r.targ
2024-11-15 14:59:39 UTC	16384	IN	Data Raw: 2c 22 67 65 74 43 6f 6e 74 65 78 74 22 2c 66 75 6e 63 74 69 6f 6e 28 72 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6e 3d 31 3b 6e 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 74 5b 6e 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 3b 72 65 74 75 72 6e 20 4e 65 28 74 68 69 73 2c 6f 29 7c 7c 22 5f 5f 63 6f 6e 74 65 78 74 22 69 6e 20 74 68 69 73 7c 7c 28 74 68 69 73 2e 5f 5f 63 6f 6e 74 65 78 74 3d 65 29 2c 72 2e 61 70 70 6c 79 28 74 68 69 73 2c 43 65 28 5b 65 5d 2c 74 29 29 7d 7d 29 3b 74 2e 70 75 73 68 28 6e 29 7d 63 61 74 63 68 28 65 29 7b 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 22 66 61 69 6c 65 64 20 74 6f 20 70 61 74 63 68 20 48 54 4d 4c 43 61 6e 76 61 73 45 6c 65 6d 65 Data Ascii: ,"getContext",function(r){return function(e){for(var t=[],n=1;n<arguments.length;n++)t[n-1]=arguments[n];return Ne(this,o)\|\|"__context"in this\|\|(this.__context=e),r.apply(this,Ce([e],t))}});t.push(n)}catch(e){console.error("failed to patch HTMLCanvasEleme
2024-11-15 14:59:39 UTC	16384	IN	Data Raw: 6f 74 6f 74 79 70 65 2e 69 73 41 63 74 69 76 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 74 68 69 73 2e 72 61 66 7d 2c 63 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6e 64 41 63 74 69 6f 6e 49 6e 64 65 78 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 30 2c 6e 3d 74 68 69 73 2e 61 63 74 69 6f 6e 73 2e 6c 65 6e 67 74 68 2d 31 3b 74 3c 3d 6e 3b 29 7b 76 61 72 20 72 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 28 74 2b 6e 29 2f 32 29 3b 69 66 28 74 68 69 73 2e 61 63 74 69 6f 6e 73 5b 72 5d 2e 64 65 6c 61 79 3c 65 2e 64 65 6c 61 79 29 74 3d 72 2b 31 3b 65 6c 73 65 7b 69 66 28 21 28 74 68 69 73 2e 61 63 74 69 6f 6e 73 5b 72 5d 2e 64 65 6c 61 79 3e 65 2e 64 65 6c 61 79 29 29 72 65 74 75 72 6e 20 72 2b 31 3b 6e 3d 72 Data Ascii: ototype.isActive=function(){return null!==this.raf},c.prototype.findActionIndex=function(e){for(var t=0,n=this.actions.length-1;t<=n;){var r=Math.floor((t+n)/2);if(this.actions[r].delay<e.delay)t=r+1;else{if(!(this.actions[r].delay>e.delay))return r+1;n=r
2024-11-15 14:59:39 UTC	16384	IN	Data Raw: 74 28 45 65 2e 52 65 70 6c 61 79 65 72 45 76 65 6e 74 73 2e 45 76 65 6e 74 43 61 73 74 2c 61 29 7d 7d 2c 64 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 62 75 69 6c 64 46 75 6c 6c 53 6e 61 70 73 68 6f 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 74 68 69 73 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 21 31 29 2c 21 74 68 69 73 2e 69 66 72 61 6d 65 2e 63 6f 6e 74 65 6e 74 44 6f 63 75 6d 65 6e 74 29 72 65 74 75 72 6e 20 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 4c 6f 6f 6b 73 20 6c 69 6b 65 20 79 6f 75 72 20 72 65 70 6c 61 79 65 72 20 68 61 73 20 62 65 65 6e 20 64 65 73 74 72 6f 79 65 64 2e 22 29 3b 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 68 69 73 2e 6c 65 67 61 63 79 5f 6d 69 73 73 69 6e 67 4e 6f 64 65 52 65 74 72 79 4d 61 70 29 Data Ascii: t(Ee.ReplayerEvents.EventCast,a)}},d.prototype.rebuildFullSnapshot=function(e,t){var n=this;if(void 0===t&&(t=!1),!this.iframe.contentDocument)return console.warn("Looks like your replayer has been destroyed.");Object.keys(this.legacy_missingNodeRetryMap)
2024-11-15 14:59:39 UTC	15079	IN	Data Raw: 2e 70 72 65 76 69 6f 75 73 49 64 2c 72 3d 72 2e 6e 65 78 74 49 64 2c 61 3d 61 26 26 65 5b 61 5d 2c 72 3d 72 26 26 65 5b 72 5d 3b 61 26 26 28 6f 3d 61 2e 6e 6f 64 65 2c 69 3d 61 2e 6d 75 74 61 74 69 6f 6e 2c 74 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 6f 2c 6e 29 2c 64 65 6c 65 74 65 20 65 5b 69 2e 6e 6f 64 65 2e 69 64 5d 2c 64 65 6c 65 74 65 20 74 68 69 73 2e 6c 65 67 61 63 79 5f 6d 69 73 73 69 6e 67 4e 6f 64 65 52 65 74 72 79 4d 61 70 5b 69 2e 6e 6f 64 65 2e 69 64 5d 2c 69 2e 70 72 65 76 69 6f 75 73 49 64 7c 7c 69 2e 6e 65 78 74 49 64 29 26 26 74 68 69 73 2e 6c 65 67 61 63 79 5f 72 65 73 6f 6c 76 65 4d 69 73 73 69 6e 67 4e 6f 64 65 28 65 2c 74 2c 6f 2c 69 29 2c 72 26 26 28 6f 3d 72 2e 6e 6f 64 65 2c 69 3d 72 2e 6d 75 74 61 74 69 6f 6e 2c 74 2e 69 6e 73 Data Ascii: .previousId,r=r.nextId,a=a&&e[a],r=r&&e[r];a&&(o=a.node,i=a.mutation,t.insertBefore(o,n),delete e[i.node.id],delete this.legacy_missingNodeRetryMap[i.node.id],i.previousId\|\|i.nextId)&&this.legacy_resolveMissingNode(e,t,o,i),r&&(o=r.node,i=r.mutation,t.ins

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:39 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:39 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:39 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 0fe31a08-b01e-001e-2cae-360214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145939Z-16547b76f7f67wxlhC1DFWah9w0000000n7g00000000g9nv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:39 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:39 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:39 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:39 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 79c751c3-501e-0078-3aa2-3406cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145939Z-1866b5c5fbbqjkpbhC1DFWt4h400000001p000000000adzv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:39 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:39 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:39 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:39 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 86e20b26-901e-00a0-18ab-366a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145939Z-16547b76f7fcrtpchC1DFW52e80000000nc0000000008zhw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:39 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:39 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:39 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:39 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 4e6a8ad7-601e-000d-69a9-362618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145939Z-16547b76f7f9s8x7hC1DFWywrg000000019g000000006q8d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:39 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49859	216.239.34.181	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:39 UTC	1788	OUT	POST /g/collect?v=2&tid=G-9JSNBCSF54&gtm=45je4bc0h1v9167661709z8536291za200zb536291&_p=1731682771989&_gaz=1&gcs=G111&gcd=13v3v3v3v5l1&npa=0&dma=0&tag_exp=101925629~102067554~102067808~102077855&cid=146950673.1731682778&ul=en-us&sr=1280x1024&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&dl=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&dr=&sid=1731682777&sct=1&seg=0&dt=First%20run&en=page_view&_fv=1&_nsi=1&_ss=1&ep.gtm_container_id=GTM-6X92&ep.gtm_container_version=1146&ep.user_agent_string=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&ep.timestamp=2024-11-15T09%3A59%3A34.607-05%3A00&ep.blog_article_topics=&ep.page_product_tags=fiddler-classic&ep.previous_url=&ep.gtm_tag_name=GA4%20-%20Pageview%20-%20Standard&upn.timezone_offset=-5&up.telerikid=&up.u [TRUNCATED] Host: analytics.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.telerik.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:39 UTC	846	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://www.telerik.com Date: Fri, 15 Nov 2024 14:59:39 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Credentials: true Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=coop_reporting Report-To: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	49863	192.29.11.142	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:39 UTC	791	OUT	GET /visitor/v200/svrGP?pps=3&siteid=1325&ref=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&ref2=elqNone&tzo=300&ms=666&optin=disabled HTTP/1.1 Host: s1325.t.eloqua.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ELOQUA=GUID=556417D9DDDE4E9DB23F8F04730AE93B; ELQSTATUS=OK
2024-11-15 14:59:39 UTC	418	IN	HTTP/1.1 200 OK Cache-Control: no-store Pragma: no-cache Content-Type: image/gif Expires: -1 X-Robots-Tag: noindex, nofollow X-Xss-Protection: 1; mode=block Strict-Transport-Security: max-age=31536000; includeSubDomains; preload P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", X-Content-Type-Options: nosniff Date: Fri, 15 Nov 2024 14:59:39 GMT Connection: close Content-Length: 49
2024-11-15 14:59:39 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 ff 00 ff ff ff 00 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 02 00 2c 00 00 00 00 01 00 01 00 00 02 02 54 01 00 3b Data Ascii: GIF89a!,T;

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:39 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:39 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:39 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 46e97820-b01e-0097-069a-364f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145939Z-164f84587bf2rt9xhC1DFW8drg00000001b0000000004r2s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:39 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	49862	150.171.28.10	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:39 UTC	530	OUT	GET /p/action/5614127.js HTTP/1.1 Host: bat.bing.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:39 UTC	572	IN	HTTP/1.1 200 OK Cache-Control: private,max-age=1800 Content-Length: 363 Content-Type: application/javascript; charset=utf-8 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 4D27041DA7024B80A7A58483A1E3211B Ref B: DFW311000107045 Ref C: 2024-11-15T14:59:39Z Date: Fri, 15 Nov 2024 14:59:39 GMT Connection: close
2024-11-15 14:59:39 UTC	363	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 2c 63 2c 6b 2c 61 2c 62 2c 74 2c 65 29 20 7b 0a 20 20 20 20 76 61 72 20 63 73 20 3d 20 64 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 3b 0a 20 20 20 20 69 66 20 28 63 73 29 20 7b 0a 20 20 20 20 20 20 20 20 76 61 72 20 75 6f 20 3d 20 63 73 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 27 64 61 74 61 2d 75 65 74 6f 27 29 3b 0a 20 20 20 20 20 20 20 20 69 66 20 28 75 6f 20 26 26 20 77 5b 75 6f 5d 20 26 26 20 74 79 70 65 6f 66 20 77 5b 75 6f 5d 2e 73 65 74 55 73 65 72 53 69 67 6e 61 6c 73 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 5b 75 6f 5d 2e 73 65 74 55 73 65 72 53 69 67 6e 61 6c 73 28 7b 27 65 61 27 3a 20 63 2c 20 27 6b 63 27 3a 20 6b 2c 20 27 61 74 27 3a 20 61 2c 20 27 Data Ascii: (function(w,d,c,k,a,b,t,e) { var cs = d.currentScript; if (cs) { var uo = cs.getAttribute('data-ueto'); if (uo && w[uo] && typeof w[uo].setUserSignals === 'function') { w[uo].setUserSignals({'ea': c, 'kc': k, 'at': a, '

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	49860	172.217.18.98	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:39 UTC	1008	OUT	GET /td/ga/rul?tid=G-9JSNBCSF54&gacid=146950673.1731682778&gtm=45je4bc0h1v9167661709z8536291za200zb536291&dma=0&gcs=G111&gcd=13v3v3v3v5l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067554~102067808~102077855&z=903480811 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:40 UTC	785	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 15 Nov 2024 14:59:39 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Fri, 15-Nov-2024 15:14:39 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-15 14:59:40 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-11-15 14:59:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	49864	3.165.206.67	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:39 UTC	547	OUT	GET /modules.6f60e575cf8ad7cb10f7.js HTTP/1.1 Host: script.hotjar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:40 UTC	719	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 226966 Connection: close Date: Mon, 04 Nov 2024 14:20:08 GMT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: max-age=31536000 Cross-Origin-Resource-Policy: cross-origin ETag: "4eec238587f7f82d91a29f25d83a5fb6" Last-Modified: Mon, 04 Nov 2024 14:19:24 GMT Strict-Transport-Security: max-age=2592000; includeSubDomains X-Content-Type-Options: nosniff X-Robots-Tag: none Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 d619c47997370e0eec10214d0a828f18.cloudfront.net (CloudFront) X-Amz-Cf-Pop: VIE50-P3 X-Amz-Cf-Id: W8Bq08TDsoU6uNk465LvG4kKUSntIpj1s6eYdnfRIgb2qn2fcFJdXQ== Age: 952771
2024-11-15 14:59:40 UTC	15665	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6d 6f 64 75 6c 65 73 2e 36 66 36 30 65 35 37 35 63 66 38 61 64 37 63 62 31 30 66 37 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 34 37 38 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 7d 29 3b 63 6f 6e 73 74 20 72 3d 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 28 7b 49 44 45 4e 54 49 46 59 5f 55 53 45 52 3a 22 69 64 65 6e 74 69 66 79 5f 75 73 65 72 22 2c 41 55 54 4f 54 41 47 5f 52 45 43 4f 52 44 49 4e 47 3a 22 61 75 74 6f 74 61 67 5f 72 65 63 6f Data Ascii: /! For license information please see modules.6f60e575cf8ad7cb10f7.js.LICENSE.txt /!function(){var e={4788:function(e,t,n){"use strict";n.d(t,{s:function(){return r}});const r=Object.freeze({IDENTIFY_USER:"identify_user",AUTOTAG_RECORDING:"autotag_reco
2024-11-15 14:59:40 UTC	16384	IN	Data Raw: 6f 77 6e 5f 66 61 69 6c 75 72 65 22 29 7d 29 2c 22 75 73 65 72 41 74 74 72 69 62 75 74 65 73 22 29 29 29 2c 68 6a 2e 62 72 69 64 67 65 2e 66 6c 75 73 68 55 73 65 72 41 74 74 72 69 62 75 74 65 73 28 6f 2e 69 64 2c 6f 2e 61 74 74 72 69 62 75 74 65 73 29 2c 65 28 6e 75 6c 6c 2c 6f 2e 69 64 2c 6f 2e 61 74 74 72 69 62 75 74 65 73 29 7d 65 6c 73 65 20 65 28 45 72 72 6f 72 28 22 6e 6f 5f 75 73 65 72 22 29 29 7d 29 2c 22 75 73 65 72 41 74 74 72 69 62 75 74 65 73 2e 66 6c 75 73 68 22 29 2c 67 65 74 3a 68 6a 2e 74 72 79 43 61 74 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 75 73 65 72 5f 69 64 22 3d 3d 3d 65 3f 6f 2e 69 64 3a 65 26 26 6f 2e 61 74 74 72 69 62 75 74 65 73 5b 65 5d 7d 29 2c 22 75 73 65 72 41 74 74 72 69 62 75 74 65 73 2e 67 65 Data Ascii: own_failure")}),"userAttributes"))),hj.bridge.flushUserAttributes(o.id,o.attributes),e(null,o.id,o.attributes)}else e(Error("no_user"))}),"userAttributes.flush"),get:hj.tryCatch((function(e){return"user_id"===e?o.id:e&&o.attributes[e]}),"userAttributes.ge
2024-11-15 14:59:40 UTC	16384	IN	Data Raw: 48 54 43 28 2e 46 6c 79 65 72 7c 5c 5f 46 6c 79 65 72 29 7c 53 70 72 69 6e 74 2e 41 54 50 35 31 7c 56 69 65 77 50 61 64 37 7c 70 61 6e 64 69 67 69 74 61 6c 28 73 70 72 6e 6f 76 61 7c 6e 6f 76 61 29 7c 49 64 65 6f 73 2e 53 37 7c 44 65 6c 6c 2e 53 74 72 65 61 6b 2e 37 7c 41 64 76 65 6e 74 2e 56 65 67 61 7c 41 31 30 31 49 54 7c 41 37 30 42 48 54 7c 4d 49 44 37 30 31 35 7c 4e 65 78 74 32 7c 6e 6f 6f 6b 2f 69 29 7c 7c 74 28 2f 4d 42 35 31 31 2f 69 29 26 26 74 28 2f 52 55 54 45 4d 2f 69 29 3f 22 74 61 62 6c 65 74 22 3a 74 28 2f 42 4f 4c 54 7c 46 65 6e 6e 65 63 7c 49 72 69 73 7c 4d 61 65 6d 6f 7c 4d 69 6e 69 6d 6f 7c 4d 6f 62 69 7c 6d 6f 77 73 65 72 7c 4e 65 74 46 72 6f 6e 74 7c 4e 6f 76 61 72 72 61 7c 50 72 69 73 6d 7c 52 58 2d 33 34 7c 53 6b 79 66 69 72 65 7c Data Ascii: HTC(.Flyer\|\_Flyer)\|Sprint.ATP51\|ViewPad7\|pandigital(sprnova\|nova)\|Ideos.S7\|Dell.Streak.7\|Advent.Vega\|A101IT\|A70BHT\|MID7015\|Next2\|nook/i)\|\|t(/MB511/i)&&t(/RUTEM/i)?"tablet":t(/BOLT\|Fennec\|Iris\|Maemo\|Minimo\|Mobi\|mowser\|NetFront\|Novarra\|Prism\|RX-34\|Skyfire\|
2024-11-15 14:59:40 UTC	16384	IN	Data Raw: 65 28 32 29 3a 65 7d 2c 77 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 31 3d 3d 3d 65 2e 6c 65 6e 67 74 68 26 26 22 2d 22 3d 3d 3d 65 7d 2c 53 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 3d 5b 5d 3b 72 65 74 75 72 6e 21 28 76 6f 69 64 20 30 3d 3d 3d 28 65 3d 68 6a 2e 68 71 2e 74 72 69 6d 28 28 65 7c 7c 22 22 29 2e 72 65 70 6c 61 63 65 28 2f 5c 73 5c 73 2b 2f 67 2c 22 20 22 29 29 29 7c 7c 22 22 3d 3d 3d 65 7c 7c 65 2e 69 6e 64 65 78 4f 66 28 22 79 75 69 5f 22 29 3e 2d 31 7c 7c 77 28 65 29 29 26 26 28 28 65 3d 65 2e 72 65 70 6c 61 63 65 28 6e 2c 22 5c 5c 24 31 22 29 29 2e 73 70 6c 69 74 28 2f 5c 73 2f 67 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 21 28 72 2e 6c 65 6e 67 74 68 3c 74 2e 6d 61 78 43 6c 61 73 Data Ascii: e(2):e},w=function(e){return 1===e.length&&"-"===e},S=function(e){var r=[];return!(void 0===(e=hj.hq.trim((e\|\|"").replace(/\s\s+/g," ")))\|\|""===e\|\|e.indexOf("yui_")>-1\|\|w(e))&&((e=e.replace(n,"\\$1")).split(/\s/g).forEach((function(e){!(r.length<t.maxClas
2024-11-15 14:59:40 UTC	16384	IN	Data Raw: 2c 21 30 29 2e 66 6c 75 73 68 28 29 2c 42 2e 79 2e 73 65 74 28 22 61 75 74 6f 54 61 67 73 54 6f 50 72 6f 63 65 73 73 22 2c 5b 5d 29 29 2c 68 6a 2e 73 65 74 74 69 6e 67 73 2e 75 73 65 72 5f 61 74 74 72 69 62 75 74 65 73 5f 65 6e 61 62 6c 65 64 26 26 61 2e 72 2e 66 6c 75 73 68 28 29 7d 29 2c 22 62 65 68 61 76 69 6f 72 2d 64 61 74 61 2e 72 65 63 6f 72 64 69 6e 67 2e 73 74 61 72 74 22 29 2c 73 65 74 41 6e 64 53 65 6e 64 50 61 67 65 43 6f 6e 74 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 7a 2e 51 2e 67 65 74 28 22 73 65 73 73 69 6f 6e 41 63 63 65 70 74 65 64 22 29 3b 7a 2e 51 2e 6f 6e 28 22 73 65 73 73 69 6f 6e 41 63 63 65 70 74 65 64 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 68 6a 2e 65 76 65 6e 74 53 74 72 65 Data Ascii: ,!0).flush(),B.y.set("autoTagsToProcess",[])),hj.settings.user_attributes_enabled&&a.r.flush()}),"behavior-data.recording.start"),setAndSendPageContent:function(e,t){var n=z.Q.get("sessionAccepted");z.Q.on("sessionAccepted",(function(){return hj.eventStre
2024-11-15 14:59:40 UTC	16384	IN	Data Raw: 2e 61 74 74 72 69 62 75 74 65 4f 6c 64 56 61 6c 75 65 73 7c 7c 28 6e 2e 61 74 74 72 69 62 75 74 65 4f 6c 64 56 61 6c 75 65 73 5b 65 5d 3d 74 29 7d 29 2c 22 4e 6f 64 65 43 68 61 6e 67 65 2e 61 74 74 72 69 62 75 74 65 4d 75 74 61 74 65 64 22 29 2c 74 68 69 73 2e 63 68 61 72 61 63 74 65 72 44 61 74 61 4d 75 74 61 74 65 64 3d 68 6a 2e 74 72 79 43 61 74 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 2e 63 68 61 72 61 63 74 65 72 44 61 74 61 7c 7c 28 6e 2e 63 68 61 72 61 63 74 65 72 44 61 74 61 3d 21 30 2c 6e 2e 63 68 61 72 61 63 74 65 72 44 61 74 61 4f 6c 64 56 61 6c 75 65 3d 65 29 7d 29 2c 22 4e 6f 64 65 43 68 61 6e 67 65 2e 63 68 61 72 61 63 74 65 72 44 61 74 61 4d 75 74 61 74 65 64 22 29 2c 74 68 69 73 2e 72 65 6d 6f 76 65 64 46 72 6f 6d 50 61 72 65 6e Data Ascii: .attributeOldValues\|\|(n.attributeOldValues[e]=t)}),"NodeChange.attributeMutated"),this.characterDataMutated=hj.tryCatch((function(e){n.characterData\|\|(n.characterData=!0,n.characterDataOldValue=e)}),"NodeChange.characterDataMutated"),this.removedFromParen
2024-11-15 14:59:40 UTC	16384	IN	Data Raw: 6f 75 73 53 69 62 6c 69 6e 67 26 26 65 2e 68 61 73 28 72 2e 70 72 65 76 69 6f 75 73 53 69 62 6c 69 6e 67 29 3b 29 72 3d 72 2e 70 72 65 76 69 6f 75 73 53 69 62 6c 69 6e 67 3b 66 6f 72 28 3b 72 26 26 65 2e 68 61 73 28 72 29 3b 29 7b 76 61 72 20 69 3d 6f 2e 73 65 72 69 61 6c 69 7a 65 4e 6f 64 65 28 72 29 3b 72 2e 70 72 65 76 69 6f 75 73 53 69 62 6c 69 6e 67 26 26 28 69 2e 70 72 65 76 69 6f 75 73 53 69 62 6c 69 6e 67 3d 6f 2e 73 65 72 69 61 6c 69 7a 65 4e 6f 64 65 28 72 2e 70 72 65 76 69 6f 75 73 53 69 62 6c 69 6e 67 29 29 3b 76 61 72 20 73 3d 72 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 76 6f 69 64 20 30 2c 28 74 3d 73 2e 68 6f 73 74 29 26 26 70 65 28 74 29 3f 28 69 2e 70 61 72 65 6e 74 4e 6f 64 65 3d 6f 2e 73 65 72 69 61 6c 69 7a 65 4e 6f 64 65 28 73 2e 68 6f 73 Data Ascii: ousSibling&&e.has(r.previousSibling);)r=r.previousSibling;for(;r&&e.has(r);){var i=o.serializeNode(r);r.previousSibling&&(i.previousSibling=o.serializeNode(r.previousSibling));var s=r.parentNode;void 0,(t=s.host)&&pe(t)?(i.parentNode=o.serializeNode(s.hos
2024-11-15 14:59:40 UTC	16384	IN	Data Raw: 3b 6e 2e 72 28 74 29 3b 76 61 72 20 72 3d 6e 28 35 35 34 37 29 3b 68 6a 2e 74 72 79 43 61 74 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 68 6a 2e 69 6e 73 65 72 74 65 64 52 75 6c 65 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 3d 7b 7d 2c 6e 3d 5b 5d 2c 6f 3d 21 31 2c 69 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 2c 6f 29 7b 76 61 72 20 69 2c 61 3d 7b 7d 3b 72 65 74 75 72 6e 20 61 2e 69 73 4f 6e 44 6f 63 75 6d 65 6e 74 3d 6f 2c 61 2e 72 75 6c 65 3d 74 2c 61 2e 69 6e 64 65 78 3d 6e 2c 61 2e 70 61 72 65 6e 74 53 65 6c 65 63 74 6f 72 3d 6f 3f 6e 75 6c 6c 3a 28 69 3d 65 2c 68 6a 2e 73 65 6c 65 63 74 6f 72 28 29 2e 67 65 74 28 68 6a 2e 68 71 28 69 29 29 29 2c 61 2e 6e 6f 64 65 49 64 3d 68 6a 2e 74 72 65 65 4d 69 72 72 6f 72 2e 67 65 74 Data Ascii: ;n.r(t);var r=n(5547);hj.tryCatch((function(){hj.insertedRules=function(){var e,t={},n=[],o=!1,i=function(e,t,n,r,o){var i,a={};return a.isOnDocument=o,a.rule=t,a.index=n,a.parentSelector=o?null:(i=e,hj.selector().get(hj.hq(i))),a.nodeId=hj.treeMirror.get
2024-11-15 14:59:40 UTC	16384	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 53 2e 77 72 69 74 65 28 65 2c 74 2c 21 30 2c 72 29 7d 29 29 2c 53 3b 76 61 72 20 69 3d 65 3b 69 66 28 21 72 26 26 21 53 2e 5f 77 73 2e 63 6f 6e 6e 65 63 74 28 29 29 7b 69 66 28 21 53 2e 5f 77 73 2e 73 65 73 73 69 6f 6e 54 69 6d 65 64 4f 75 74 44 75 65 54 6f 49 6e 61 63 74 69 76 69 74 79 7c 7c 21 43 28 69 29 29 72 65 74 75 72 6e 20 53 3b 53 2e 5f 77 73 3d 6e 65 77 20 79 28 53 2e 66 6c 75 73 68 29 2c 68 6a 2e 5f 69 6e 69 74 2e 72 65 69 6e 69 74 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2c 21 30 29 2c 53 2e 5f 77 73 2e 63 6f 6e 6e 65 63 74 28 29 7d 76 61 72 20 61 3d 6e 75 6c 6c 21 3d 3d 28 6f 3d 53 2e 65 76 65 6e 74 73 2e 70 6f 70 28 29 29 26 26 76 6f 69 64 20 30 21 3d 3d 6f 3f 6f 3a 5f 28 70 29 3b 72 65 74 75 Data Ascii: ion(e,t){S.write(e,t,!0,r)})),S;var i=e;if(!r&&!S._ws.connect()){if(!S._ws.sessionTimedOutDueToInactivity\|\|!C(i))return S;S._ws=new y(S.flush),hj._init.reinit(window.location.href,!0),S._ws.connect()}var a=null!==(o=S.events.pop())&&void 0!==o?o:_(p);retu
2024-11-15 14:59:40 UTC	16384	IN	Data Raw: 2c 22 63 6c 65 61 72 2d 63 6f 6f 6b 69 65 22 29 7d 7d 29 2c 6f 29 7d 72 65 74 75 72 6e 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 6e 26 26 72 2e 66 5f 2e 6e 6f 77 28 29 3e 3d 6e 2b 69 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 20 73 28 65 2c 22 63 68 65 63 6b 2d 63 6f 6f 6b 69 65 22 29 2c 21 30 7d 7d 7d 2c 33 38 38 33 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 51 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 7d 29 3b 76 61 72 20 72 3d 28 30 2c 6e 28 34 35 35 37 29 2e 4d 29 28 7b 73 65 73 73 69 6f 6e 41 63 63 65 70 74 65 64 3a 21 31 2c 73 65 73 73 69 6f 6e 3a 6e 75 6c 6c 2c 75 73 65 72 3a 7b 7d 7d 2c 22 73 65 73 73 69 6f 6e 22 29 7d 2c 35 31 34 38 3a 66 75 6e Data Ascii: ,"clear-cookie")}}),o)}return"number"==typeof n&&r.f_.now()>=n+i}catch(e){return s(e,"check-cookie"),!0}}},3883:function(e,t,n){"use strict";n.d(t,{Q:function(){return r}});var r=(0,n(4557).M)({sessionAccepted:!1,session:null,user:{}},"session")},5148:fun

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	49868	52.252.156.53	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:39 UTC	446	OUT	GET /collect/v2/data-centers/76766c2b-82f4-2453-81e5-fd840f3b455b/datasources/TelerikCom/interactions HTTP/1.1 Host: api.insight.sitefinity.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:39 UTC	1523	IN	HTTP/1.1 404 Not Found Date: Fri, 15 Nov 2024 14:59:39 GMT Content-Type: text/html; charset=utf-8 Content-Length: 235 Connection: close Access-Control-Allow-Headers: Content-Type, Content-Length, X-Requested-With, Authorization, x-dataintelligence-accountkey, x-dataintelligence-datacenterkey, x-dataintelligence-datasource, x-dataintelligence-sort, x-dataintelligence-skip, x-dataintelligence-take, x-dataintelligence-fields, x-dataintelligence-count, x-dataintelligence-filterby, x-dataintelligence-filter, x-dataintelligence-contains, x-dataintelligence-nextrowkey, x-dataintelligence-flush, x-dataintelligence-fromdate, x-dataintelligence-todate, x-dataintelligence-period, x-dataintelligence-scale, x-dataintelligence-predicate, x-dataintelligence-subject, x-dataintelligence-ids, x-dataintelligence-datasources, x-dataintelligence-imagecrop, x-dataintelligence-contacts, x-forwarded-for, x-dataintelligence-sdk-version, Referer, Origin, x-dataintelligence-clientid, x-dataintelligence-campaignids, x-dataintelligence-userid, x-dataintelligence-errorid, x-dataintelligence-correlationid, cf-connecting-ip, x-forwarded-for, http_x_forwarded_for, x-forwarde [TRUNCATED] Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS Access-Control-Allow-Origin: * request-context: appId=cid-v1:a33f2e3a-ec15-4d53-8ac6-897af884626b Content-Security-Policy: default-src 'none' X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000
2024-11-15 14:59:39 UTC	235	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 70 72 65 3e 43 61 6e 6e 6f 74 20 47 45 54 20 2f 63 6f 6c 6c 65 63 74 2f 76 32 2f 64 61 74 61 2d 63 65 6e 74 65 72 73 2f 37 36 37 36 36 63 32 62 2d 38 32 66 34 2d 32 34 35 33 2d 38 31 65 35 2d 66 64 38 34 30 66 33 62 34 35 35 62 2f 64 61 74 61 73 6f 75 72 63 65 73 2f 54 65 6c 65 72 69 6b 43 6f 6d 2f 69 6e 74 65 72 61 63 74 69 6f 6e 73 3c 2f 70 72 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot GET /collect/v2/data-centers/76766c2b-82f4-2453-81e5-fd840f3b455b/datasources/TelerikCom/interactions</pre></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	49828	192.29.11.142	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:39 UTC	556	OUT	GET /visitor/v200/svrGP?pps=3&siteid=1325&ref=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&ref2=elqNone&tzo=300&ms=666&optin=disabled HTTP/1.1 Host: s1325.t.eloqua.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ELOQUA=GUID=556417D9DDDE4E9DB23F8F04730AE93B; ELQSTATUS=OK
2024-11-15 14:59:40 UTC	418	IN	HTTP/1.1 200 OK Cache-Control: no-store Pragma: no-cache Content-Type: image/gif Expires: -1 X-Robots-Tag: noindex, nofollow X-Xss-Protection: 1; mode=block Strict-Transport-Security: max-age=31536000; includeSubDomains; preload P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", X-Content-Type-Options: nosniff Date: Fri, 15 Nov 2024 14:59:39 GMT Connection: close Content-Length: 49
2024-11-15 14:59:40 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 ff 00 ff ff ff 00 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 02 00 2c 00 00 00 00 01 00 01 00 00 02 02 54 01 00 3b Data Ascii: GIF89a!,T;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49877	172.67.5.216	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:39 UTC	357	OUT	GET /prum.min.js HTTP/1.1 Host: rum-static.pingdom.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:39 UTC	394	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:39 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close last-modified: Fri, 14 Oct 2022 06:22:29 GMT vary: Accept-Encoding etag: W/"63490025-1849" access-control-allow-origin: * Cache-Control: max-age=43200 CF-Cache-Status: HIT Age: 145 Server: cloudflare CF-RAY: 8e301b3e6861e9ca-DFW
2024-11-15 14:59:39 UTC	975	IN	Data Raw: 31 38 34 39 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 29 2e 6d 61 70 28 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 6e 2b 22 3d 22 2b 28 65 3f 74 5b 6e 5d 3a 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 74 5b 6e 5d 29 29 7d 29 29 2e 6a 6f 69 6e 28 22 26 22 29 7d 66 75 6e 63 74 69 6f 6e 20 65 28 74 2c 65 29 7b 76 61 72 20 6e 2c 6f 2c 72 3d 7b 7d 3b 72 65 74 75 72 6e 20 74 26 26 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 3f 28 74 2e 74 72 69 6d 28 29 2e 73 70 6c 69 74 28 22 26 22 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 6e 3d 74 2e 69 6e 64 65 78 Data Ascii: 1849!function(){"use strict";function t(t,e){return Object.keys(t).map((function(n){return n+"="+(e?t[n]:encodeURIComponent(t[n]))})).join("&")}function e(t,e){var n,o,r={};return t&&"string"==typeof t?(t.trim().split("&").forEach((function(t){n=t.index
2024-11-15 14:59:39 UTC	1369	IN	Data Raw: 2e 61 70 70 4e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 22 29 29 7b 76 61 72 20 64 3d 65 2e 6e 61 76 69 67 61 74 6f 72 2e 61 70 70 56 65 72 73 69 6f 6e 2e 6d 61 74 63 68 28 2f 4d 53 49 45 20 28 5c 64 2b 29 2f 29 3b 64 26 26 70 61 72 73 65 49 6e 74 28 64 5b 31 5d 29 3c 3d 39 26 26 28 75 3d 21 30 29 7d 69 66 28 65 2e 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 26 26 21 75 29 7b 76 61 72 20 66 3d 6e 65 77 20 65 2e 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 3b 66 2e 6f 70 65 6e 28 73 2c 72 29 2c 22 47 45 54 22 3d 3d 3d 73 3f 66 2e 73 65 6e 64 28 74 28 63 29 29 3a 66 2e 73 65 6e 64 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 63 29 29 7d 65 6c 73 65 20 65 2e 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 Data Ascii: .appName.indexOf("Internet Explorer")){var d=e.navigator.appVersion.match(/MSIE (\d+)/);d&&parseInt(d[1])<=9&&(u=!0)}if(e.XMLHttpRequest&&!u){var f=new e.XMLHttpRequest;f.open(s,r),"GET"===s?f.send(t(c)):f.send(JSON.stringify(c))}else e.document.createEle
2024-11-15 14:59:39 UTC	1369	IN	Data Raw: 65 2e 67 65 74 28 22 72 76 22 29 7c 7c 22 30 22 2c 76 3a 64 2e 76 65 72 7d 3a 64 2e 73 65 73 73 69 6f 6e 53 74 61 72 74 28 21 31 29 7d 2c 67 65 6e 65 72 61 74 65 53 65 73 73 69 6f 6e 49 44 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 37 38 33 36 34 31 36 34 30 39 36 2b 4d 61 74 68 2e 66 6c 6f 6f 72 28 32 37 34 32 37 34 35 37 34 33 33 35 39 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 29 29 2e 74 6f 53 74 72 69 6e 67 28 33 36 29 7d 2c 73 65 73 73 69 6f 6e 53 74 61 72 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 3d 74 3f 22 31 22 3a 22 30 22 3b 76 61 72 20 65 3d 64 2e 67 65 6e 65 72 61 74 65 53 65 73 73 69 6f 6e 49 44 28 29 3b 64 2e 73 74 6f 72 61 67 65 2e 73 65 74 28 22 73 69 64 22 2c 65 29 3b 76 61 72 20 6e 3d 64 2e 73 65 73 73 69 6f 6e 4d 61 72 Data Ascii: e.get("rv")\|\|"0",v:d.ver}:d.sessionStart(!1)},generateSessionID:function(){return(78364164096+Math.floor(2742745743359*Math.random())).toString(36)},sessionStart:function(t){t=t?"1":"0";var e=d.generateSessionID();d.storage.set("sid",e);var n=d.sessionMar
2024-11-15 14:59:39 UTC	1369	IN	Data Raw: 29 3b 72 65 74 75 72 6e 20 6e 3f 6e 5b 74 5d 3a 22 22 7d 72 65 74 75 72 6e 22 22 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 69 29 7b 69 66 28 72 26 26 6e 29 74 72 79 7b 76 61 72 20 61 3d 72 2e 67 65 74 49 74 65 6d 28 6f 2e 73 74 6f 72 61 67 65 4b 65 79 29 2c 73 3d 61 3f 65 28 61 29 3a 7b 7d 3b 73 5b 6e 5d 3d 69 2c 72 2e 73 65 74 49 74 65 6d 28 6f 2e 73 74 6f 72 61 67 65 4b 65 79 2c 74 28 73 29 29 7d 63 61 74 63 68 28 74 29 7b 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 22 75 6e 61 62 6c 65 20 74 6f 20 73 74 6f 72 65 20 22 2b 6e 2b 22 20 69 6e 20 73 74 6f 72 61 67 65 2e 22 2c 74 29 7d 7d 2c 72 65 6d 6f 76 65 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 26 26 74 26 26 72 2e 72 65 6d 6f 76 65 49 74 65 6d 28 74 29 7d 7d 7d 28 63 2c 64 29 2c 64 2e 67 65 74 Data Ascii: );return n?n[t]:""}return""},set:function(n,i){if(r&&n)try{var a=r.getItem(o.storageKey),s=a?e(a):{};s[n]=i,r.setItem(o.storageKey,t(s))}catch(t){console.error("unable to store "+n+" in storage.",t)}},remove:function(t){r&&t&&r.removeItem(t)}}}(c,d),d.get
2024-11-15 14:59:39 UTC	1143	IN	Data Raw: 65 69 67 68 74 2c 70 44 3a 74 2e 73 63 72 65 65 6e 2e 70 69 78 65 6c 44 65 70 74 68 2c 64 50 52 3a 31 7c 74 2e 64 65 76 69 63 65 50 69 78 65 6c 52 61 74 69 6f 2c 6f 72 3a 74 2e 73 63 72 65 65 6e 2e 6f 72 69 65 6e 74 61 74 69 6f 6e 26 26 74 2e 73 63 72 65 65 6e 2e 6f 72 69 65 6e 74 61 74 69 6f 6e 2e 74 79 70 65 7c 7c 22 22 7d 7d 28 74 29 29 2c 75 2e 70 75 73 68 28 7b 6e 54 3a 69 2e 6e 61 76 69 67 61 74 69 6f 6e 2e 74 79 70 65 2c 72 43 3a 69 2e 6e 61 76 69 67 61 74 69 6f 6e 2e 72 65 64 69 72 65 63 74 43 6f 75 6e 74 7d 29 2c 75 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 7b 6e 53 3a 30 2c 63 53 3a 73 28 74 2e 63 6f 6e 6e 65 63 74 53 74 61 72 74 29 2c 63 45 3a 73 28 74 2e 63 6f 6e 6e 65 63 74 45 6e 64 29 2c 64 4c 45 3a 73 28 74 2e Data Ascii: eight,pD:t.screen.pixelDepth,dPR:1\|t.devicePixelRatio,or:t.screen.orientation&&t.screen.orientation.type\|\|""}}(t)),u.push({nT:i.navigation.type,rC:i.navigation.redirectCount}),u.push(function(t){return{nS:0,cS:s(t.connectStart),cE:s(t.connectEnd),dLE:s(t.
2024-11-15 14:59:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49875	104.17.247.203	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:39 UTC	373	OUT	GET /web-vitals@4.2.4/dist/web-vitals.iife.js HTTP/1.1 Host: unpkg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:39 UTC	575	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:39 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-origin: * cache-control: public, max-age=31536000 last-modified: Sat, 26 Oct 1985 08:15:00 GMT etag: W/"1c3a-LeUC6s/Gcko0wscq5NFJGfOy9Yg" via: 1.1 fly.io fly-request-id: 01JC08R81X17YVA0X68YQ736HG-dfw CF-Cache-Status: HIT Age: 801761 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8e301b3e6e9be746-DFW
2024-11-15 14:59:39 UTC	794	IN	Data Raw: 31 63 33 61 0d 0a 76 61 72 20 77 65 62 56 69 74 61 6c 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 2c 74 2c 72 2c 69 2c 6f 2c 61 3d 2d 31 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 70 61 67 65 73 68 6f 77 22 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6e 2e 70 65 72 73 69 73 74 65 64 26 26 28 61 3d 6e 2e 74 69 6d 65 53 74 61 6d 70 2c 65 28 6e 29 29 7d 29 2c 21 30 29 7d 2c 75 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 26 26 70 65 72 66 6f 72 6d 61 6e 63 65 2e 67 65 74 45 6e 74 72 69 65 73 42 79 54 79 70 65 26 26 70 65 72 66 6f 72 6d 61 6e 63 65 2e 67 65 74 45 6e 74 72 69 65 73 42 79 54 79 70 65 Data Ascii: 1c3avar webVitals=function(e){"use strict";var n,t,r,i,o,a=-1,c=function(e){addEventListener("pageshow",(function(n){n.persisted&&(a=n.timeStamp,e(n))}),!0)},u=function(){var e=self.performance&&performance.getEntriesByType&&performance.getEntriesByType
2024-11-15 14:59:39 UTC	1369	IN	Data Raw: 73 65 72 76 65 72 2e 73 75 70 70 6f 72 74 65 64 45 6e 74 72 79 54 79 70 65 73 2e 69 6e 63 6c 75 64 65 73 28 65 29 29 7b 76 61 72 20 72 3d 6e 65 77 20 50 65 72 66 6f 72 6d 61 6e 63 65 4f 62 73 65 72 76 65 72 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 28 65 2e 67 65 74 45 6e 74 72 69 65 73 28 29 29 7d 29 29 7d 29 29 3b 72 65 74 75 72 6e 20 72 2e 6f 62 73 65 72 76 65 28 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 7b 74 79 70 65 3a 65 2c 62 75 66 66 65 72 65 64 3a 21 30 7d 2c 74 7c 7c 7b 7d 29 29 2c 72 7d 7d 63 61 74 63 68 28 65 29 7b 7d 7d 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 2c 72 29 7b 76 61 72 20 69 2c 6f 3b 72 65 74 75 72 6e 20 66 75 6e Data Ascii: server.supportedEntryTypes.includes(e)){var r=new PerformanceObserver((function(e){Promise.resolve().then((function(){n(e.getEntries())}))}));return r.observe(Object.assign({type:e,buffered:!0},t\|\|{})),r}}catch(e){}},l=function(e,n,t,r){var i,o;return fun
2024-11-15 14:59:39 UTC	1369	IN	Data Raw: 62 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 6e 3d 6e 7c 7c 7b 7d 2c 4c 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 2c 72 3d 43 28 29 2c 69 3d 66 28 22 46 43 50 22 29 2c 6f 3d 64 28 22 70 61 69 6e 74 22 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 66 69 72 73 74 2d 63 6f 6e 74 65 6e 74 66 75 6c 2d 70 61 69 6e 74 22 3d 3d 3d 65 2e 6e 61 6d 65 26 26 28 6f 2e 64 69 73 63 6f 6e 6e 65 63 74 28 29 2c 65 2e 73 74 61 72 74 54 69 6d 65 3c 72 2e 66 69 72 73 74 48 69 64 64 65 6e 54 69 6d 65 26 26 28 69 2e 76 61 6c 75 65 3d 4d 61 74 68 2e 6d 61 78 28 65 2e 73 74 61 72 74 54 69 6d 65 2d 73 28 29 2c 30 29 2c 69 2e 65 6e 74 72 69 65 73 2e 70 75 73 68 28 65 29 2c 74 28 21 30 29 29 29 7d 29 Data Ascii: b=function(e,n){n=n\|\|{},L((function(){var t,r=C(),i=f("FCP"),o=d("paint",(function(e){e.forEach((function(e){"first-contentful-paint"===e.name&&(o.disconnect(),e.startTime<r.firstHiddenTime&&(i.value=Math.max(e.startTime-s(),0),i.entries.push(e),t(!0)))})
2024-11-15 14:59:39 UTC	1369	IN	Data Raw: 65 74 75 72 6e 20 42 2e 64 65 6c 65 74 65 28 65 2e 69 64 29 7d 29 29 7d 7d 7d 2c 71 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 73 65 6c 66 2e 72 65 71 75 65 73 74 49 64 6c 65 43 61 6c 6c 62 61 63 6b 7c 7c 73 65 6c 66 2e 73 65 74 54 69 6d 65 6f 75 74 2c 74 3d 2d 31 3b 72 65 74 75 72 6e 20 65 3d 6d 28 65 29 2c 22 68 69 64 64 65 6e 22 3d 3d 3d 64 6f 63 75 6d 65 6e 74 2e 76 69 73 69 62 69 6c 69 74 79 53 74 61 74 65 3f 65 28 29 3a 28 74 3d 6e 28 65 29 2c 76 28 65 29 29 2c 74 7d 2c 4f 3d 5b 32 30 30 2c 35 30 30 5d 2c 6a 3d 5b 32 35 30 30 2c 34 65 33 5d 2c 56 3d 7b 7d 2c 5f 3d 5b 38 30 30 2c 31 38 30 30 5d 2c 7a 3d 66 75 6e 63 74 69 6f 6e 20 65 28 6e 29 7b 64 6f 63 75 6d 65 6e 74 2e 70 72 65 72 65 6e 64 65 72 69 6e 67 3f 4c 28 28 66 75 6e 63 74 69 Data Ascii: eturn B.delete(e.id)}))}}},q=function(e){var n=self.requestIdleCallback\|\|self.setTimeout,t=-1;return e=m(e),"hidden"===document.visibilityState?e():(t=n(e),v(e)),t},O=[200,500],j=[2500,4e3],V={},_=[800,1800],z=function e(n){document.prerendering?L((functi
2024-11-15 14:59:39 UTC	1369	IN	Data Raw: 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 68 61 64 52 65 63 65 6e 74 49 6e 70 75 74 29 7b 76 61 72 20 6e 3d 6f 5b 30 5d 2c 74 3d 6f 5b 6f 2e 6c 65 6e 67 74 68 2d 31 5d 3b 69 26 26 65 2e 73 74 61 72 74 54 69 6d 65 2d 74 2e 73 74 61 72 74 54 69 6d 65 3c 31 65 33 26 26 65 2e 73 74 61 72 74 54 69 6d 65 2d 6e 2e 73 74 61 72 74 54 69 6d 65 3c 35 65 33 3f 28 69 2b 3d 65 2e 76 61 6c 75 65 2c 6f 2e 70 75 73 68 28 65 29 29 3a 28 69 3d 65 2e 76 61 6c 75 65 2c 6f 3d 5b 65 5d 29 7d 7d 29 29 2c 69 3e 72 2e 76 61 6c 75 65 26 26 28 72 2e 76 61 6c 75 65 3d 69 2c 72 2e 65 6e 74 72 69 65 73 3d 6f 2c 74 28 29 29 7d 2c 75 3d 64 28 22 6c 61 79 6f 75 74 2d 73 68 69 66 74 22 2c 61 29 3b 75 26 26 28 74 3d 6c 28 65 2c 72 2c 77 2c 6e 2e 72 65 70 Data Ascii: orEach((function(e){if(!e.hadRecentInput){var n=o[0],t=o[o.length-1];i&&e.startTime-t.startTime<1e3&&e.startTime-n.startTime<5e3?(i+=e.value,o.push(e)):(i=e.value,o=[e])}})),i>r.value&&(r.value=i,r.entries=o,t())},u=d("layout-shift",a);u&&(t=l(e,r,w,n.rep
2024-11-15 14:59:39 UTC	964	IN	Data Raw: 29 7b 52 3d 4d 28 29 2c 44 2e 6c 65 6e 67 74 68 3d 30 2c 42 2e 63 6c 65 61 72 28 29 2c 69 3d 66 28 22 49 4e 50 22 29 2c 72 3d 6c 28 65 2c 69 2c 4f 2c 6e 2e 72 65 70 6f 72 74 41 6c 6c 43 68 61 6e 67 65 73 29 7d 29 29 29 7d 29 29 29 7d 2c 65 2e 6f 6e 4c 43 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 6e 3d 6e 7c 7c 7b 7d 2c 4c 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 2c 72 3d 43 28 29 2c 69 3d 66 28 22 4c 43 50 22 29 2c 6f 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 2e 72 65 70 6f 72 74 41 6c 6c 43 68 61 6e 67 65 73 7c 7c 28 65 3d 65 2e 73 6c 69 63 65 28 2d 31 29 29 2c 65 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 73 74 61 72 74 54 69 6d 65 3c 72 2e 66 69 72 73 74 48 69 64 64 65 6e 54 69 6d 65 26 26 28 69 2e 76 61 Data Ascii: ){R=M(),D.length=0,B.clear(),i=f("INP"),r=l(e,i,O,n.reportAllChanges)})))})))},e.onLCP=function(e,n){n=n\|\|{},L((function(){var t,r=C(),i=f("LCP"),o=function(e){n.reportAllChanges\|\|(e=e.slice(-1)),e.forEach((function(e){e.startTime<r.firstHiddenTime&&(i.va
2024-11-15 14:59:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	49870	150.171.28.10	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:39 UTC	342	OUT	GET /bat.js HTTP/1.1 Host: bat.bing.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:40 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: private,max-age=1800 Content-Length: 51385 Content-Type: application/javascript Last-Modified: Wed, 16 Oct 2024 22:47:44 GMT Accept-Ranges: bytes ETag: "028e0691d20db1:0" Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: EDC2A8B6769A467581ACEAC551E128CA Ref B: DFW311000102049 Ref C: 2024-11-15T14:59:40Z Date: Fri, 15 Nov 2024 14:59:39 GMT Connection: close
2024-11-15 14:59:40 UTC	3672	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 55 45 54 28 6f 29 7b 74 68 69 73 2e 73 74 72 69 6e 67 45 78 69 73 74 73 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 6e 26 26 6e 2e 6c 65 6e 67 74 68 3e 30 7d 3b 74 68 69 73 2e 64 6f 6d 61 69 6e 3d 22 62 61 74 2e 62 69 6e 67 2e 63 6f 6d 22 3b 74 68 69 73 2e 64 6f 6d 61 69 6e 43 6c 3d 22 62 61 74 2e 62 69 6e 67 2e 6e 65 74 22 3b 74 68 69 73 2e 55 52 4c 4c 45 4e 47 54 48 4c 49 4d 49 54 3d 34 30 39 36 3b 74 68 69 73 2e 70 61 67 65 4c 6f 61 64 45 76 74 3d 22 70 61 67 65 4c 6f 61 64 22 3b 74 68 69 73 2e 63 75 73 74 6f 6d 45 76 74 3d 22 63 75 73 74 6f 6d 22 3b 74 68 69 73 2e 70 61 67 65 56 69 65 77 45 76 74 3d 22 70 61 67 65 5f 76 69 65 77 22 3b 6f 2e 56 65 72 3d 6f 2e 56 65 72 21 3d 3d 75 6e 64 65 66 69 6e 65 64 26 26 Data Ascii: function UET(o){this.stringExists=function(n){return n&&n.length>0};this.domain="bat.bing.com";this.domainCl="bat.bing.net";this.URLLENGTHLIMIT=4096;this.pageLoadEvt="pageLoad";this.customEvt="custom";this.pageViewEvt="page_view";o.Ver=o.Ver!==undefined&&
2024-11-15 14:59:40 UTC	8192	IN	Data Raw: 22 2c 22 69 74 65 6d 73 22 5d 2c 62 65 67 69 6e 5f 63 68 65 63 6b 6f 75 74 3a 5b 22 72 65 76 65 6e 75 65 5f 76 61 6c 75 65 22 2c 22 63 75 72 72 65 6e 63 79 22 2c 22 69 74 65 6d 73 22 2c 22 63 6f 75 70 6f 6e 22 5d 2c 63 68 65 63 6b 6f 75 74 5f 70 72 6f 67 72 65 73 73 3a 5b 22 72 65 76 65 6e 75 65 5f 76 61 6c 75 65 22 2c 22 63 75 72 72 65 6e 63 79 22 2c 22 69 74 65 6d 73 22 2c 22 63 6f 75 70 6f 6e 22 2c 22 63 68 65 63 6b 6f 75 74 5f 73 74 65 70 22 2c 22 63 68 65 63 6b 6f 75 74 5f 6f 70 74 69 6f 6e 22 5d 2c 65 78 63 65 70 74 69 6f 6e 3a 5b 22 64 65 73 63 72 69 70 74 69 6f 6e 22 2c 22 66 61 74 61 6c 22 5d 2c 67 65 6e 65 72 61 74 65 5f 6c 65 61 64 3a 5b 22 72 65 76 65 6e 75 65 5f 76 61 6c 75 65 22 2c 22 63 75 72 72 65 6e 63 79 22 2c 22 74 72 61 6e 73 61 63 74 Data Ascii: ","items"],begin_checkout:["revenue_value","currency","items","coupon"],checkout_progress:["revenue_value","currency","items","coupon","checkout_step","checkout_option"],exception:["description","fatal"],generate_lead:["revenue_value","currency","transact
2024-11-15 14:59:40 UTC	4144	IN	Data Raw: 73 2e 70 61 67 65 4c 65 76 65 6c 50 61 72 61 6d 73 2e 70 69 64 3d 6f 2e 70 61 67 65 50 69 64 3a 6f 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 67 74 61 67 50 69 64 22 29 26 26 6f 2e 67 74 61 67 50 69 64 3d 3d 3d 21 30 26 26 28 74 68 69 73 2e 75 65 74 43 6f 6e 66 69 67 2e 67 74 61 67 50 69 64 3d 21 30 29 3b 74 68 69 73 2e 75 65 74 43 6f 6e 66 69 67 2e 65 6e 61 62 6c 65 41 75 74 6f 53 70 61 54 72 61 63 6b 69 6e 67 3d 21 31 3b 6f 2e 65 6e 61 62 6c 65 41 75 74 6f 53 70 61 54 72 61 63 6b 69 6e 67 3d 3d 3d 21 30 26 26 28 74 68 69 73 2e 75 65 74 43 6f 6e 66 69 67 2e 65 6e 61 62 6c 65 41 75 74 6f 53 70 61 54 72 61 63 6b 69 6e 67 3d 21 30 29 3b 74 68 69 73 2e 75 65 74 43 6f 6e 66 69 67 2e 64 69 73 61 62 6c 65 43 6f 6e 74 61 69 6e 65 72 3d 21 31 3b 6f 2e 68 Data Ascii: s.pageLevelParams.pid=o.pagePid:o.hasOwnProperty("gtagPid")&&o.gtagPid===!0&&(this.uetConfig.gtagPid=!0);this.uetConfig.enableAutoSpaTracking=!1;o.enableAutoSpaTracking===!0&&(this.uetConfig.enableAutoSpaTracking=!0);this.uetConfig.disableContainer=!1;o.h
2024-11-15 14:59:40 UTC	8192	IN	Data Raw: 68 3e 31 26 26 6e 5b 30 5d 21 3d 3d 74 68 69 73 2e 70 61 67 65 4c 6f 61 64 45 76 74 29 74 3d 6e 5b 30 5d 2c 69 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 6e 2c 31 29 3b 65 6c 73 65 20 72 65 74 75 72 6e 3b 74 68 69 73 2e 75 65 74 49 6e 73 74 61 6e 63 65 2e 75 65 74 4c 6f 61 64 65 64 7c 7c 74 68 69 73 2e 65 76 71 43 44 69 73 70 61 74 63 68 26 26 74 68 69 73 2e 70 72 6f 63 65 73 73 45 61 72 6c 79 5b 74 5d 3f 74 68 69 73 2e 75 65 74 49 6e 73 74 61 6e 63 65 2e 5f 70 75 73 68 28 5b 74 2c 69 2c 72 5d 29 3a 74 68 69 73 2e 75 65 74 49 6e 73 74 61 6e 63 65 2e 65 76 65 6e 74 50 75 73 68 51 75 65 75 65 2e 70 75 73 68 28 5b 74 2c 69 2c 72 5d 29 7d 3b 74 68 69 73 2e 5f 70 75 73 68 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 Data Ascii: h>1&&n[0]!==this.pageLoadEvt)t=n[0],i=Array.prototype.slice.call(n,1);else return;this.uetInstance.uetLoaded\|\|this.evqCDispatch&&this.processEarly[t]?this.uetInstance._push([t,i,r]):this.uetInstance.eventPushQueue.push([t,i,r])};this._push=function(n){var
2024-11-15 14:59:40 UTC	8192	IN	Data Raw: 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 6d 65 74 61 22 29 2e 6b 65 79 77 6f 72 64 73 26 26 28 75 3d 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 6d 65 74 61 22 29 2e 6b 65 79 77 6f 72 64 73 2e 63 6f 6e 74 65 6e 74 2c 74 68 69 73 2e 73 74 72 69 6e 67 45 78 69 73 74 73 28 75 29 26 26 28 6e 2e 6b 77 3d 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 75 29 2e 72 65 70 6c 61 63 65 28 2f 25 32 43 2f 67 69 2c 22 2c 22 29 29 29 2c 74 3f 74 68 69 73 2e 73 74 72 69 6e 67 45 78 69 73 74 73 28 74 68 69 73 2e 70 72 65 76 69 6f 75 73 50 61 67 65 29 26 26 21 6e 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 72 22 29 26 26 28 6e 2e 72 3d 74 68 69 73 Data Ascii: getElementsByTagName("meta").keywords&&(u=window.document.head.getElementsByTagName("meta").keywords.content,this.stringExists(u)&&(n.kw=encodeURIComponent(u).replace(/%2C/gi,","))),t?this.stringExists(this.previousPage)&&!n.hasOwnProperty("r")&&(n.r=this
2024-11-15 14:59:40 UTC	8192	IN	Data Raw: 26 26 28 74 2e 70 72 6f 64 69 64 3d 74 2e 65 63 6f 6d 6d 5f 70 72 6f 64 69 64 2c 64 65 6c 65 74 65 20 74 2e 65 63 6f 6d 6d 5f 70 72 6f 64 69 64 29 3b 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 65 63 6f 6d 6d 5f 70 61 67 65 74 79 70 65 22 29 3e 30 26 26 28 74 2e 70 61 67 65 74 79 70 65 3d 74 2e 65 63 6f 6d 6d 5f 70 61 67 65 74 79 70 65 2c 64 65 6c 65 74 65 20 74 2e 65 63 6f 6d 6d 5f 70 61 67 65 74 79 70 65 29 3b 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 70 61 67 65 74 79 70 65 22 29 26 26 28 74 2e 70 61 67 65 74 79 70 65 3d 3d 6e 75 6c 6c 7c 7c 74 2e 70 61 67 65 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 28 29 3d 3d 3d 22 22 29 26 26 64 65 6c 65 74 65 20 74 2e 70 61 67 65 74 79 70 65 3b 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 Data Ascii: &&(t.prodid=t.ecomm_prodid,delete t.ecomm_prodid);t.hasOwnProperty("ecomm_pagetype")>0&&(t.pagetype=t.ecomm_pagetype,delete t.ecomm_pagetype);t.hasOwnProperty("pagetype")&&(t.pagetype==null\|\|t.pagetype.toString()==="")&&delete t.pagetype;t.hasOwnProperty(
2024-11-15 14:59:40 UTC	8192	IN	Data Raw: 76 61 72 20 69 3d 74 68 69 73 2e 63 6c 6f 6e 65 28 6e 29 3b 72 65 74 75 72 6e 20 69 2e 61 6c 74 26 26 64 65 6c 65 74 65 20 69 2e 61 6c 74 2c 74 68 69 73 2e 63 6c 6f 6e 65 28 74 2c 69 29 7d 3b 74 68 69 73 2e 66 69 72 65 42 65 61 63 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 66 6f 72 28 76 61 72 20 69 2c 73 2c 65 3d 74 68 69 73 2e 67 65 74 43 6c 55 72 6c 28 74 68 69 73 2e 75 72 6c 50 72 65 66 69 78 29 2c 74 3d 74 68 69 73 2e 63 6f 6d 62 69 6e 65 28 74 68 69 73 2e 62 65 61 63 6f 6e 50 61 72 61 6d 73 2c 6e 29 2c 72 3d 74 68 69 73 2e 73 74 72 69 6e 67 69 66 79 54 6f 52 65 71 75 65 73 74 28 74 29 2c 66 3d 74 68 69 73 2e 72 65 6d 6f 76 65 54 72 61 69 6c 69 6e 67 41 6d 70 28 65 2b 72 29 2c 6f 3d 5b 22 72 22 2c 22 65 6c 32 22 2c 22 65 63 32 22 2c 22 65 61 32 22 Data Ascii: var i=this.clone(n);return i.alt&&delete i.alt,this.clone(t,i)};this.fireBeacon=function(n){for(var i,s,e=this.getClUrl(this.urlPrefix),t=this.combine(this.beaconParams,n),r=this.stringifyToRequest(t),f=this.removeTrailingAmp(e+r),o=["r","el2","ec2","ea2"
2024-11-15 14:59:40 UTC	2609	IN	Data Raw: 6f 6d 6d 5f 74 6f 74 61 6c 76 61 6c 75 65 22 29 3b 74 68 69 73 2e 6d 61 70 47 74 6d 55 61 73 50 72 6f 64 75 63 74 73 28 6e 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 75 61 5f 65 22 3a 74 68 69 73 2e 6d 61 70 47 74 6d 45 63 6f 6d 6d 65 72 63 65 50 75 72 63 68 61 73 65 28 6e 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 67 61 34 22 3a 74 68 69 73 2e 72 65 70 6c 61 63 65 47 74 6d 50 61 72 61 6d 28 6e 2c 22 76 61 6c 75 65 22 2c 22 65 76 65 6e 74 5f 76 61 6c 75 65 22 29 3b 74 68 69 73 2e 6d 61 70 47 74 6d 47 61 34 49 74 65 6d 73 28 6e 29 7d 72 65 74 75 72 6e 20 6e 7d 3b 76 61 72 20 74 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3b 74 68 69 73 2e 64 6f 63 75 6d 65 6e 74 55 72 6c 43 68 61 6e 67 65 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3d Data Ascii: omm_totalvalue");this.mapGtmUasProducts(n);break;case"ua_e":this.mapGtmEcommercePurchase(n);break;case"ga4":this.replaceGtmParam(n,"value","event_value");this.mapGtmGa4Items(n)}return n};var t=window.location.href;this.documentUrlChanged=function(){var n=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	49865	54.217.99.7	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:39 UTC	996	OUT	GET /img/beacon.gif?id=54328dddabe53db9497b23c6&sAW=1280&sAH=984&bIW=1034&bIH=870&pD=24&dPR=1&or=landscape-primary&nT=0&rC=0&nS=0&cS=1740&cE=2590&dLE=1740&dLS=1732&fS=1719&hS=1740&rE=-1&rS=-1&reS=2607&resS=2883&resE=3006&uEE=-1&uES=-1&dL=2920&dI=6111&dCLES=12491&dCLEE=12493&dC=12525&lES=12525&lEE=12525&s=nt&title=First%20run&path=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&ref=&sId=6d4mnwic&sST=1731682778&sIS=1&rV=0&v=1.4.1 HTTP/1.1 Host: rum-collector-2.pingdom.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.telerik.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:40 UTC	208	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Cache-Control: no-cache, no-store, must-revalidate Date: Fri, 15 Nov 2024 14:59:40 GMT Expires: 0 Pragma: no-cache Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	49869	13.224.245.27	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:40 UTC	363	OUT	GET /c/hotjar-66905.js?sv=7 HTTP/1.1 Host: static.hotjar.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:40 UTC	640	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=2592000; includeSubDomains X-Cache-Hit: 1 X-Content-Type-Options: nosniff Date: Fri, 15 Nov 2024 14:59:37 GMT Cache-Control: max-age=60 ETag: W/b1cc08f7e26dfbaedd1f3546a4061fcf Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 1b05f9178c1c0be702b00f1d1f0bcff6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LHR62-C3 X-Amz-Cf-Id: veMLOYitgN8hQ_hzDkzkgfZkHATqtcDDLg8yOTSwYdwXMJ-cS99NJg== Age: 3
2024-11-15 14:59:40 UTC	13111	IN	Data Raw: 33 33 32 66 0d 0a 77 69 6e 64 6f 77 2e 68 6a 53 69 74 65 53 65 74 74 69 6e 67 73 20 3d 20 77 69 6e 64 6f 77 2e 68 6a 53 69 74 65 53 65 74 74 69 6e 67 73 20 7c 7c 20 7b 22 73 69 74 65 5f 69 64 22 3a 36 36 39 30 35 2c 22 72 65 63 5f 76 61 6c 75 65 22 3a 30 2e 30 2c 22 73 74 61 74 65 5f 63 68 61 6e 67 65 5f 6c 69 73 74 65 6e 5f 6d 6f 64 65 22 3a 22 6d 61 6e 75 61 6c 22 2c 22 72 65 63 6f 72 64 22 3a 74 72 75 65 2c 22 63 6f 6e 74 69 6e 75 6f 75 73 5f 63 61 70 74 75 72 65 5f 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 72 65 63 6f 72 64 69 6e 67 5f 63 61 70 74 75 72 65 5f 6b 65 79 73 74 72 6f 6b 65 73 22 3a 66 61 6c 73 65 2c 22 73 65 73 73 69 6f 6e 5f 63 61 70 74 75 72 65 5f 63 6f 6e 73 6f 6c 65 5f 63 6f 6e 73 65 6e 74 22 3a 66 61 6c 73 65 2c 22 61 6e 6f 6e 79 Data Ascii: 332fwindow.hjSiteSettings = window.hjSiteSettings \|\| {"site_id":66905,"rec_value":0.0,"state_change_listen_mode":"manual","record":true,"continuous_capture_enabled":true,"recording_capture_keystrokes":false,"session_capture_console_consent":false,"anony
2024-11-15 14:59:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	49878	18.66.122.7	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:40 UTC	1209	OUT	GET /sxp/i/940047942047f9f048d2c1e1f6b78492.js HTTP/1.1 Host: euob.ytwohlcq.telerik.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sf-data-intell-subject=1731682772047-fcdb670f-3afa-4045-a714-511c43447023; sf-ins-ssid=1731682772048-24ff44aa-f054-426c-9634-59f4c41cf3cf; OptanonConsent=isGpcEnabled=0&datestamp=Fri+Nov+15+2024+09%3A59%3A32+GMT-0500+(Eastern+Standard+Time)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=5dfe2b59-6049-4581-b125-b53263b879ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&groups=1%3A1%2C2%3A1%2C3%3A1%2C4%3A1; gauuid=d2144829-e324-4fbe-8dab-96fd3d3ecb59; _gcl_au=1.1.816168706.1731682775; _cq_duid=1.1731682777.ns9ymyf7k6usbTXX; _cq_suid=1.1731682777.eziSzDGYZbIOehGF; _ga_9JSNBCSF54=GS1.1.1731682777.1.0.1731682777.60.0.0; _ga=GA1.1.146950673.1731682778; _uetsid=3c075310a36211ef9214e39993a332b6; _uetvid=3c0795e0a36211ef90d903624085c4d8
2024-11-15 14:59:40 UTC	503	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Content-Length: 110668 Connection: close Server: Caddy Date: Fri, 15 Nov 2024 14:59:37 GMT Cache-Control: max-age=43200 Expires: Sat, 16 Nov 2024 01:11:31 GMT ETag: "1b04c-jTMVm5l3tKuSTTnih8nZ1aNoBcc" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 0121ceb2efadb6db52d122a8b6b52f90.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P2 X-Amz-Cf-Id: ufr_ZakRZim-cvq9djdkgbSiRAGIWu9o1_viI_N5JlXpuRtTLzL43Q== Age: 6489
2024-11-15 14:59:40 UTC	16384	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 72 28 65 29 7b 69 66 28 6e 5b 65 5d 29 72 65 74 75 72 6e 20 6e 5b 65 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 69 3d 6e 5b 65 5d 3d 7b 69 3a 65 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 74 5b 65 5d 2e 63 61 6c 6c 28 69 2e 65 78 70 6f 72 74 73 2c 69 2c 69 2e 65 78 70 6f 72 74 73 2c 72 29 2c 69 2e 6c 3d 21 30 2c 69 2e 65 78 70 6f 72 74 73 7d 72 2e 6d 3d 74 2c 72 2e 63 3d 6e 2c 72 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 65 29 7b 72 2e 6f 28 74 2c 6e 29 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 6e 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 65 7d 29 7d 2c 72 2e 72 3d 66 75 6e Data Ascii: !function(t){var n={};function r(e){if(n[e])return n[e].exports;var i=n[e]={i:e,l:!1,exports:{}};return t[e].call(i.exports,i,i.exports,r),i.l=!0,i.exports}r.m=t,r.c=n,r.d=function(t,n,e){r.o(t,n)\|\|Object.defineProperty(t,n,{enumerable:!0,get:e})},r.r=fun
2024-11-15 14:59:40 UTC	16384	IN	Data Raw: 78 2e 24 74 28 22 5f 75 65 74 76 69 64 22 29 7c 7c 22 2d 22 7d 63 61 74 63 68 28 74 29 7b 7d 72 65 74 75 72 6e 22 2d 22 7d 2c 4b 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 74 3d 61 2e 63 6f 6f 6b 69 65 2e 6d 61 74 63 68 28 2f 5f 67 61 63 5f 55 41 5c 2d 5c 64 2b 5c 2d 5c 64 2b 5c 3d 28 2e 2a 3f 29 5c 3b 2f 29 5b 31 5d 3b 69 66 28 33 3d 3d 3d 74 2e 73 70 6c 69 74 28 22 2e 22 29 2e 6c 65 6e 67 74 68 29 7b 76 61 72 20 6e 3d 74 2e 73 70 6c 69 74 28 22 2e 22 29 5b 31 5d 3b 69 66 28 6d 2e 47 28 6e 29 29 72 65 74 75 72 6e 20 6d 2e 56 28 28 78 2e 48 74 28 29 2d 31 65 33 2a 6d 2e 56 28 6e 29 29 2f 31 65 33 29 7d 7d 63 61 74 63 68 28 74 29 7b 7d 72 65 74 75 72 6e 22 2d 22 7d 2c 5a 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 69 66 28 69 2e Data Ascii: x.$t("_uetvid")\|\|"-"}catch(t){}return"-"},Kn:function(){try{var t=a.cookie.match(/_gac_UA\-\d+\-\d+\=(.?)\;/)[1];if(3===t.split(".").length){var n=t.split(".")[1];if(m.G(n))return m.V((x.Ht()-1e3m.V(n))/1e3)}}catch(t){}return"-"},Zn:function(){try{if(i.
2024-11-15 14:59:40 UTC	16384	IN	Data Raw: 64 22 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6e 29 2c 64 2e 64 6f 6d 45 6c 65 6d 65 6e 74 73 2e 70 75 73 68 28 6e 29 7d 3b 6a 3f 79 2e 58 6e 28 22 63 74 22 2c 4f 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 74 72 79 7b 69 66 28 6e 29 4f 3d 28 4f 2b 3d 22 26 78 65 72 3d 22 2b 43 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 6e 29 29 29 2e 72 65 70 6c 61 63 65 28 2f 26 61 62 5c 3d 2e 2a 3f 28 26 7c 24 29 2f 2c 22 26 61 62 3d 6a 78 2e 34 2e 32 3b 24 31 22 29 2c 52 28 4f 29 2c 67 5b 4a 5d 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 2c 65 2c 69 2c 61 2c 6f 2c 63 29 7b 56 28 74 2c 6e 2c 72 2c 65 2c 69 2c 61 2c 6f 2c 63 29 7d 3b 65 6c 73 65 20 69 66 28 74 29 7b 76 61 72 20 72 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 74 29 2c 65 3d 72 2e 63 7c 7c 22 22 Data Ascii: d")[0].appendChild(n),d.domElements.push(n)};j?y.Xn("ct",O,function(t,n){try{if(n)O=(O+="&xer="+C(JSON.stringify(n))).replace(/&ab\=.*?(&\|$)/,"&ab=jx.4.2;$1"),R(O),g[J]=function(t,n,r,e,i,a,o,c){V(t,n,r,e,i,a,o,c)};else if(t){var r=JSON.parse(t),e=r.c\|\|""
2024-11-15 14:59:40 UTC	16384	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 21 74 7c 7c 30 3d 3d 3d 74 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 21 31 3b 66 6f 72 28 76 61 72 20 6e 3d 74 5b 30 5d 2c 72 3d 74 5b 30 5d 2c 65 3d 31 3b 65 3c 74 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 74 5b 65 5d 3c 6e 26 26 28 6e 3d 74 5b 65 5d 29 2c 74 5b 65 5d 3e 72 26 26 28 72 3d 74 5b 65 5d 29 3b 72 65 74 75 72 6e 20 72 2d 6e 7d 28 65 29 3c 3d 36 29 72 65 74 75 72 6e 20 5f 74 28 38 32 2c 74 5b 72 5d 29 2c 21 30 7d 7d 2c 72 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 21 63 2e 71 72 28 29 7d 2c 65 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 21 75 5b 6f 2e 58 28 22 4e 4e 61 66 58 7f 78 65 42 72 63 78 61 65 62 22 2c 31 37 29 5d 7d 2c 69 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 Data Ascii: function(t){if(!t\|\|0===t.length)return!1;for(var n=t[0],r=t[0],e=1;e<t.length;e++)t[e]<n&&(n=t[e]),t[e]>r&&(r=t[e]);return r-n}(e)<=6)return _t(82,t[r]),!0}},rr=function(){return!!c.qr()},er=function(){return!!u[o.X("NNafXxeBrcxaeb",17)]},ir=function(){v
2024-11-15 14:59:40 UTC	16384	IN	Data Raw: 72 67 65 74 3b 6e 2e 70 75 73 68 28 65 2e 74 61 67 4e 61 6d 65 29 2c 6e 2e 70 75 73 68 28 72 2e 78 29 2c 6e 2e 70 75 73 68 28 72 2e 79 29 2c 6e 2e 70 75 73 68 28 65 2e 69 64 29 2c 6e 2e 70 75 73 68 28 65 2e 63 6c 61 73 73 4e 61 6d 65 29 7d 72 65 74 75 72 6e 20 6e 2e 6a 6f 69 6e 28 22 2c 22 29 7d 72 65 74 75 72 6e 22 30 22 7d 7d 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 75 2e 49 6e 74 6c 2e 44 61 74 65 54 69 6d 65 46 6f 72 6d 61 74 28 29 2e 72 65 73 6f 6c 76 65 64 4f 70 74 69 6f 6e 73 28 29 3b 72 65 74 75 72 6e 5b 74 2e 74 69 6d 65 5a 6f 6e 65 2c 74 2e 6c 6f 63 61 6c 65 2c 74 2e 6e 75 6d 62 65 72 69 6e 67 53 79 73 74 65 6d 2c 74 2e 63 61 6c 65 6e 64 61 72 5d 2e 6a 6f 69 6e 28 22 2c 22 29 7d 3b 6e 65 2e 49 65 3d 21 30 3b 76 61 72 20 72 Data Ascii: rget;n.push(e.tagName),n.push(r.x),n.push(r.y),n.push(e.id),n.push(e.className)}return n.join(",")}return"0"}},ne=function(){var t=u.Intl.DateTimeFormat().resolvedOptions();return[t.timeZone,t.locale,t.numberingSystem,t.calendar].join(",")};ne.Ie=!0;var r
2024-11-15 14:59:40 UTC	16384	IN	Data Raw: 69 3d 22 22 3b 75 2e 70 74 28 74 2c 66 75 6e 63 74 69 6f 6e 28 6e 2c 72 29 7b 69 2b 3d 65 28 6e 29 2b 28 72 2b 31 3c 74 2e 6c 65 6e 67 74 68 3f 22 7c 22 3a 22 22 29 7d 29 2c 69 26 26 28 6e 5b 72 5d 3d 69 29 7d 3b 6e 2e 63 70 3d 74 3b 76 61 72 20 63 3d 69 28 29 3b 69 66 28 6e 2e 67 74 6d 3d 63 3f 75 2e 74 74 28 75 6e 65 73 63 61 70 65 28 64 28 75 2e 52 28 63 29 29 29 29 3a 22 2d 22 2c 6e 2e 67 61 63 3d 66 2e 5a 6e 28 29 2c 61 28 79 2e 6e 69 2c 22 6d 6d 22 29 2c 61 28 79 2e 63 69 2c 22 73 63 22 29 2c 61 28 79 2e 65 69 2c 22 6d 64 22 29 2c 61 28 79 2e 69 69 2c 22 6d 75 22 29 2c 61 28 79 2e 6f 69 2c 22 63 6c 22 29 2c 6f 28 79 2e 75 69 2c 22 74 62 22 29 2c 6f 28 79 2e 73 69 2c 22 67 69 22 29 2c 6f 28 79 2e 4b 65 2c 22 73 75 73 22 29 2c 79 2e 5a 65 2e 58 65 29 Data Ascii: i="";u.pt(t,function(n,r){i+=e(n)+(r+1<t.length?"\|":"")}),i&&(n[r]=i)};n.cp=t;var c=i();if(n.gtm=c?u.tt(unescape(d(u.R(c)))):"-",n.gac=f.Zn(),a(y.ni,"mm"),a(y.ci,"sc"),a(y.ei,"md"),a(y.ii,"mu"),a(y.oi,"cl"),o(y.ui,"tb"),o(y.si,"gi"),o(y.Ke,"sus"),y.Ze.Xe)
2024-11-15 14:59:40 UTC	10747	IN	Data Raw: 4d 69 3a 22 5f 73 61 74 65 6c 6c 69 74 65 22 2c 54 69 3a 22 5f 63 71 5f 70 5f 74 67 22 2c 71 69 3a 22 5f 63 71 5f 70 5f 74 74 22 2c 42 69 3a 22 43 48 45 51 20 74 68 72 65 61 74 20 67 72 6f 75 70 20 6f 72 20 74 79 70 65 20 63 68 61 6e 67 65 64 22 2c 55 69 3a 22 63 68 65 71 5f 72 65 73 70 6f 6e 73 65 22 2c 50 69 3a 22 65 56 61 72 22 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 63 26 26 28 74 68 69 73 2e 6b 69 3d 6f 2e 46 74 28 74 2e 63 29 29 2c 74 2e 67 26 26 28 74 68 69 73 2e 78 69 3d 6f 2e 46 74 28 74 2e 67 29 29 2c 74 2e 74 61 65 26 26 28 74 68 69 73 2e 41 69 3d 74 2e 74 61 65 29 2c 74 2e 74 74 65 26 26 28 74 68 69 73 2e 4f 69 3d 74 68 69 73 2e 50 69 2b 74 2e 74 74 65 29 2c 74 2e 74 67 65 26 26 28 74 68 69 73 2e 6a 69 3d 74 68 69 73 2e 50 Data Ascii: Mi:"_satellite",Ti:"_cq_p_tg",qi:"_cq_p_tt",Bi:"CHEQ threat group or type changed",Ui:"cheq_response",Pi:"eVar",init:function(t){t.c&&(this.ki=o.Ft(t.c)),t.g&&(this.xi=o.Ft(t.g)),t.tae&&(this.Ai=t.tae),t.tte&&(this.Oi=this.Pi+t.tte),t.tge&&(this.ji=this.P
2024-11-15 14:59:40 UTC	1617	IN	Data Raw: 29 7d 29 2c 65 3d 72 2e 64 6f 6d 61 69 6e 4c 6f 6f 6b 75 70 45 6e 64 26 26 72 2e 64 6f 6d 61 69 6e 4c 6f 6f 6b 75 70 53 74 61 72 74 3f 6f 2e 56 28 72 2e 64 6f 6d 61 69 6e 4c 6f 6f 6b 75 70 45 6e 64 2d 72 2e 64 6f 6d 61 69 6e 4c 6f 6f 6b 75 70 53 74 61 72 74 29 3a 22 2d 22 3b 74 28 5b 72 2e 6e 65 78 74 48 6f 70 50 72 6f 74 6f 63 6f 6c 2c 72 2e 72 65 6e 64 65 72 42 6c 6f 63 6b 69 6e 67 53 74 61 74 75 73 2c 6f 2e 56 28 72 2e 64 75 72 61 74 69 6f 6e 29 2c 6f 2e 56 28 72 2e 64 65 63 6f 64 65 64 42 6f 64 79 53 69 7a 65 29 2c 6f 2e 56 28 72 2e 73 65 63 75 72 65 43 6f 6e 6e 65 63 74 69 6f 6e 53 74 61 72 74 29 2c 6f 2e 56 28 72 2e 72 65 71 75 65 73 74 53 74 61 72 74 29 2c 6f 2e 56 28 72 2e 63 6f 6e 6e 65 63 74 53 74 61 72 74 29 2c 6f 2e 56 28 72 2e 63 6f 6e 6e 65 Data Ascii: )}),e=r.domainLookupEnd&&r.domainLookupStart?o.V(r.domainLookupEnd-r.domainLookupStart):"-";t([r.nextHopProtocol,r.renderBlockingStatus,o.V(r.duration),o.V(r.decodedBodySize),o.V(r.secureConnectionStart),o.V(r.requestStart),o.V(r.connectStart),o.V(r.conne

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	49874	146.75.120.157	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:40 UTC	352	OUT	GET /uwt.js HTTP/1.1 Host: static.ads-twitter.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:40 UTC	543	IN	HTTP/1.1 200 OK Connection: close Content-Length: 58876 Last-Modified: Tue, 29 Oct 2024 01:22:31 GMT ETag: "4328e910de583ad53b3a7a76455af005" x-amz-server-side-encryption: AES256 Cache-Control: no-cache Content-Type: application/javascript; charset=utf-8 Accept-Ranges: bytes Date: Fri, 15 Nov 2024 14:59:40 GMT X-Served-By: cache-iad-kiad7000145-IAD, cache-fra-etou8220046-FRA X-Cache: HIT, HIT Vary: Accept-Encoding,Host P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" x-tw-cdn: FT
2024-11-15 14:59:40 UTC	1378	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 7b 36 31 37 33 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3b 74 2e 65 78 70 6f 72 74 73 3d 28 72 3d 72 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 3b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 26 26 28 72 3d 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 29 2c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2e 63 72 79 70 74 6f 26 26 28 72 3d 73 65 6c 66 2e 63 72 79 70 74 6f 29 2c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 26 26 28 72 3d Data Ascii: !function(){var t={6173:function(t,e,n){var r;t.exports=(r=r\|\|function(t,e){var r;if("undefined"!=typeof window&&window.crypto&&(r=window.crypto),"undefined"!=typeof self&&self.crypto&&(r=self.crypto),"undefined"!=typeof globalThis&&globalThis.crypto&&(r=
2024-11-15 14:59:40 UTC	1378	IN	Data Raw: 74 68 69 73 2e 77 6f 72 64 73 3d 74 7c 7c 5b 5d 2c 74 68 69 73 2e 73 69 67 42 79 74 65 73 3d 6e 75 6c 6c 21 3d 65 3f 65 3a 34 2a 74 2e 6c 65 6e 67 74 68 7d 2c 74 6f 53 74 72 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 28 74 7c 7c 66 29 2e 73 74 72 69 6e 67 69 66 79 28 74 68 69 73 29 7d 2c 63 6f 6e 63 61 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 77 6f 72 64 73 2c 6e 3d 74 2e 77 6f 72 64 73 2c 72 3d 74 68 69 73 2e 73 69 67 42 79 74 65 73 2c 69 3d 74 2e 73 69 67 42 79 74 65 73 3b 69 66 28 74 68 69 73 2e 63 6c 61 6d 70 28 29 2c 72 25 34 29 66 6f 72 28 76 61 72 20 6f 3d 30 3b 6f 3c 69 3b 6f 2b 2b 29 7b 76 61 72 20 61 3d 6e 5b 6f 3e 3e 3e 32 5d 3e 3e 3e 32 34 2d 6f 25 34 2a 38 26 32 35 35 3b 65 5b 72 2b 6f Data Ascii: this.words=t\|\|[],this.sigBytes=null!=e?e:4t.length},toString:function(t){return(t\|\|f).stringify(this)},concat:function(t){var e=this.words,n=t.words,r=this.sigBytes,i=t.sigBytes;if(this.clamp(),r%4)for(var o=0;o<i;o++){var a=n[o>>>2]>>>24-o%48&255;e[r+o
2024-11-15 14:59:40 UTC	1378	IN	Data Raw: 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 64 2e 70 61 72 73 65 28 75 6e 65 73 63 61 70 65 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 74 29 29 29 7d 7d 2c 70 3d 63 2e 42 75 66 66 65 72 65 64 42 6c 6f 63 6b 41 6c 67 6f 72 69 74 68 6d 3d 75 2e 65 78 74 65 6e 64 28 7b 72 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 64 61 74 61 3d 6e 65 77 20 73 2e 69 6e 69 74 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 3d 30 7d 2c 5f 61 70 70 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 28 74 3d 68 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 Data Ascii: ion(t){return d.parse(unescape(encodeURIComponent(t)))}},p=c.BufferedBlockAlgorithm=u.extend({reset:function(){this._data=new s.init,this._nDataBytes=0},_append:function(t){"string"==typeof t&&(t=h.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigByt
2024-11-15 14:59:40 UTC	1378	IN	Data Raw: 72 28 76 61 72 20 72 3d 32 2c 69 3d 30 3b 69 3c 36 34 3b 29 65 28 72 29 26 26 28 69 3c 38 26 26 28 63 5b 69 5d 3d 6e 28 74 2e 70 6f 77 28 72 2c 2e 35 29 29 29 2c 75 5b 69 5d 3d 6e 28 74 2e 70 6f 77 28 72 2c 31 2f 33 29 29 2c 69 2b 2b 29 2c 72 2b 2b 7d 28 29 3b 76 61 72 20 73 3d 5b 5d 2c 6c 3d 61 2e 53 48 41 32 35 36 3d 6f 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 69 2e 69 6e 69 74 28 63 2e 73 6c 69 63 65 28 30 29 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 6e 3d 74 68 69 73 2e 5f 68 61 73 68 2e 77 6f 72 64 73 2c 72 3d 6e 5b 30 5d 2c 69 3d 6e 5b 31 5d 2c 6f 3d 6e 5b 32 5d 2c 61 3d 6e 5b 33 Data Ascii: r(var r=2,i=0;i<64;)e(r)&&(i<8&&(c[i]=n(t.pow(r,.5))),u[i]=n(t.pow(r,1/3)),i++),r++}();var s=[],l=a.SHA256=o.extend({_doReset:function(){this._hash=new i.init(c.slice(0))},_doProcessBlock:function(t,e){for(var n=this._hash.words,r=n[0],i=n[1],o=n[2],a=n[3
2024-11-15 14:59:40 UTC	1378	IN	Data Raw: 72 20 69 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 74 68 69 73 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 21 74 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 6e 28 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 74 79 70 65 6f 66 20 74 2b 22 20 22 2b 74 2b 22 20 69 73 20 6e 6f 74 20 69 74 65 72 61 62 6c 65 28 63 61 6e 6e 6f 74 20 72 65 61 64 20 70 72 6f 70 65 72 74 79 20 53 79 6d 62 6f 6c 28 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 29 29 22 29 29 3b 76 61 72 20 72 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 74 29 3b 69 66 28 30 3d 3d 3d 72 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 65 28 5b 5d 29 3b 76 61 72 20 69 3d 72 2e 6c 65 6e 67 74 Data Ascii: r i=function(t){return new this((function(e,n){if(!t\|\|void 0===t.length)return n(new TypeError(typeof t+" "+t+" is not iterable(cannot read property Symbol(Symbol.iterator))"));var r=Array.prototype.slice.call(t);if(0===r.length)return e([]);var i=r.lengt
2024-11-15 14:59:40 UTC	1378	IN	Data Raw: 76 6f 69 64 20 64 28 74 29 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6e 29 72 65 74 75 72 6e 20 76 6f 69 64 20 70 28 28 72 3d 6e 2c 69 3d 65 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 2e 61 70 70 6c 79 28 69 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2c 74 29 7d 74 2e 5f 73 74 61 74 65 3d 31 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 64 28 74 29 7d 63 61 74 63 68 28 65 29 7b 66 28 74 2c 65 29 7d 76 61 72 20 72 2c 69 7d 66 75 6e 63 74 69 6f 6e 20 66 28 74 2c 65 29 7b 74 2e 5f 73 74 61 74 65 3d 32 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 64 28 74 29 7d 66 75 6e 63 74 69 6f 6e 20 64 28 74 29 7b 32 3d 3d 3d 74 2e 5f 73 74 61 74 65 26 26 30 3d 3d 3d 74 2e 5f 64 65 66 65 72 72 65 64 73 2e 6c 65 6e 67 74 68 26 26 75 2e 5f 69 6d 6d 65 64 69 61 74 65 46 6e Data Ascii: void d(t);if("function"==typeof n)return void p((r=n,i=e,function(){r.apply(i,arguments)}),t)}t._state=1,t._value=e,d(t)}catch(e){f(t,e)}var r,i}function f(t,e){t._state=2,t._value=e,d(t)}function d(t){2===t._state&&0===t._deferreds.length&&u._immediateFn
2024-11-15 14:59:40 UTC	1378	IN	Data Raw: 74 75 72 6e 20 6e 65 77 20 75 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 6e 28 74 29 7d 29 29 7d 2c 75 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 75 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 21 61 28 74 29 29 72 65 74 75 72 6e 20 6e 28 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 50 72 6f 6d 69 73 65 2e 72 61 63 65 20 61 63 63 65 70 74 73 20 61 6e 20 61 72 72 61 79 22 29 29 3b 66 6f 72 28 76 61 72 20 72 3d 30 2c 69 3d 74 2e 6c 65 6e 67 74 68 3b 72 3c 69 3b 72 2b 2b 29 75 2e 72 65 73 6f 6c 76 65 28 74 5b 72 5d 29 2e 74 68 65 6e 28 65 2c 6e 29 7d 29 29 7d 2c 75 2e 5f 69 6d 6d 65 64 69 61 74 65 46 6e 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 73 65 74 49 6d 6d 65 64 69 61 74 65 Data Ascii: turn new u((function(e,n){n(t)}))},u.race=function(t){return new u((function(e,n){if(!a(t))return n(new TypeError("Promise.race accepts an array"));for(var r=0,i=t.length;r<i;r++)u.resolve(t[r]).then(e,n)}))},u._immediateFn="function"==typeof setImmediate
2024-11-15 14:59:40 UTC	1378	IN	Data Raw: 68 72 6f 77 22 3d 3d 3d 69 29 74 68 72 6f 77 20 6f 3b 72 65 74 75 72 6e 20 43 28 29 7d 66 6f 72 28 6e 2e 6d 65 74 68 6f 64 3d 69 2c 6e 2e 61 72 67 3d 6f 3b 3b 29 7b 76 61 72 20 61 3d 6e 2e 64 65 6c 65 67 61 74 65 3b 69 66 28 61 29 7b 76 61 72 20 63 3d 67 28 61 2c 6e 29 3b 69 66 28 63 29 7b 69 66 28 63 3d 3d 3d 6c 29 63 6f 6e 74 69 6e 75 65 3b 72 65 74 75 72 6e 20 63 7d 7d 69 66 28 22 6e 65 78 74 22 3d 3d 3d 6e 2e 6d 65 74 68 6f 64 29 6e 2e 73 65 6e 74 3d 6e 2e 5f 73 65 6e 74 3d 6e 2e 61 72 67 3b 65 6c 73 65 20 69 66 28 22 74 68 72 6f 77 22 3d 3d 3d 6e 2e 6d 65 74 68 6f 64 29 7b 69 66 28 22 73 75 73 70 65 6e 64 65 64 53 74 61 72 74 22 3d 3d 3d 72 29 74 68 72 6f 77 20 72 3d 22 63 6f 6d 70 6c 65 74 65 64 22 2c 6e 2e 61 72 67 3b 6e 2e 64 69 73 70 61 74 63 68 Data Ascii: hrow"===i)throw o;return C()}for(n.method=i,n.arg=o;;){var a=n.delegate;if(a){var c=g(a,n);if(c){if(c===l)continue;return c}}if("next"===n.method)n.sent=n._sent=n.arg;else if("throw"===n.method){if("suspendedStart"===r)throw r="completed",n.arg;n.dispatch
2024-11-15 14:59:40 UTC	1378	IN	Data Raw: 29 7d 28 69 2c 6f 2c 72 2c 61 29 7d 29 29 7d 72 65 74 75 72 6e 20 72 3d 72 3f 72 2e 74 68 65 6e 28 61 2c 61 29 3a 61 28 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 67 28 74 2c 65 29 7b 76 61 72 20 6e 3d 74 2e 69 74 65 72 61 74 6f 72 5b 65 2e 6d 65 74 68 6f 64 5d 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 6e 29 7b 69 66 28 65 2e 64 65 6c 65 67 61 74 65 3d 6e 75 6c 6c 2c 22 74 68 72 6f 77 22 3d 3d 3d 65 2e 6d 65 74 68 6f 64 29 7b 69 66 28 74 2e 69 74 65 72 61 74 6f 72 2e 72 65 74 75 72 6e 26 26 28 65 2e 6d 65 74 68 6f 64 3d 22 72 65 74 75 72 6e 22 2c 65 2e 61 72 67 3d 76 6f 69 64 20 30 2c 67 28 74 2c 65 29 2c 22 74 68 72 6f 77 22 3d 3d 3d 65 2e 6d 65 74 68 6f 64 29 29 72 65 74 75 72 6e 20 6c 3b 65 2e 6d 65 74 68 6f 64 3d 22 74 68 72 6f 77 22 2c 65 2e 61 72 67 3d 6e 65 Data Ascii: )}(i,o,r,a)}))}return r=r?r.then(a,a):a()}}function g(t,e){var n=t.iterator[e.method];if(void 0===n){if(e.delegate=null,"throw"===e.method){if(t.iterator.return&&(e.method="return",e.arg=void 0,g(t,e),"throw"===e.method))return l;e.method="throw",e.arg=ne
2024-11-15 14:59:40 UTC	1378	IN	Data Raw: 61 74 6f 72 46 75 6e 63 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 72 65 74 75 72 6e 21 21 65 26 26 28 65 3d 3d 3d 64 7c 7c 22 47 65 6e 65 72 61 74 6f 72 46 75 6e 63 74 69 6f 6e 22 3d 3d 3d 28 65 2e 64 69 73 70 6c 61 79 4e 61 6d 65 7c 7c 65 2e 6e 61 6d 65 29 29 7d 2c 74 2e 6d 61 72 6b 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3f 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 74 2c 68 29 3a 28 74 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 68 2c 63 28 74 2c 61 2c 22 47 65 6e 65 72 61 74 6f 72 46 75 6e 63 74 69 6f 6e 22 29 29 2c 74 2e 70 Data Ascii: atorFunction=function(t){var e="function"==typeof t&&t.constructor;return!!e&&(e===d\|\|"GeneratorFunction"===(e.displayName\|\|e.name))},t.mark=function(t){return Object.setPrototypeOf?Object.setPrototypeOf(t,h):(t.__proto__=h,c(t,a,"GeneratorFunction")),t.p

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:40 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:40 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:40 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 998ee9d3-c01e-0046-120b-362db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145940Z-1866b5c5fbbfhwqqhC1DFW513800000000xg0000000070u7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:40 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:40 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:40 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:40 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 885b02a2-801e-0035-1509-37752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145940Z-1866b5c5fbbvz6qbhC1DFWsyms00000000pg00000000aw8h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:40 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:40 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:40 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: b4070537-501e-0047-6baf-36ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145940Z-16547b76f7fmbrhqhC1DFWkds80000000n7000000000pxdd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:40 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:40 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:40 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 4dbbda22-e01e-0033-5212-374695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145940Z-164f84587bfffmgqhC1DFWk5ts00000001gg00000000r1bg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:40 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	49889	150.171.28.10	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:40 UTC	355	OUT	GET /p/action/5614127.js HTTP/1.1 Host: bat.bing.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:40 UTC	570	IN	HTTP/1.1 200 OK Cache-Control: private,max-age=1800 Content-Length: 363 Content-Type: application/javascript; charset=utf-8 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: C0DC98E6C1A24012AFC91F0214694CDF Ref B: DFW30EDGE1813 Ref C: 2024-11-15T14:59:40Z Date: Fri, 15 Nov 2024 14:59:40 GMT Connection: close
2024-11-15 14:59:40 UTC	363	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 2c 63 2c 6b 2c 61 2c 62 2c 74 2c 65 29 20 7b 0a 20 20 20 20 76 61 72 20 63 73 20 3d 20 64 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 3b 0a 20 20 20 20 69 66 20 28 63 73 29 20 7b 0a 20 20 20 20 20 20 20 20 76 61 72 20 75 6f 20 3d 20 63 73 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 27 64 61 74 61 2d 75 65 74 6f 27 29 3b 0a 20 20 20 20 20 20 20 20 69 66 20 28 75 6f 20 26 26 20 77 5b 75 6f 5d 20 26 26 20 74 79 70 65 6f 66 20 77 5b 75 6f 5d 2e 73 65 74 55 73 65 72 53 69 67 6e 61 6c 73 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 5b 75 6f 5d 2e 73 65 74 55 73 65 72 53 69 67 6e 61 6c 73 28 7b 27 65 61 27 3a 20 63 2c 20 27 6b 63 27 3a 20 6b 2c 20 27 61 74 27 3a 20 61 2c 20 27 Data Ascii: (function(w,d,c,k,a,b,t,e) { var cs = d.currentScript; if (cs) { var uo = cs.getAttribute('data-ueto'); if (uo && w[uo] && typeof w[uo].setUserSignals === 'function') { w[uo].setUserSignals({'ea': c, 'kc': k, 'at': a, '

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	49890	18.245.46.123	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:41 UTC	357	OUT	GET /monitor/stat.js HTTP/1.1 Host: www.clickcease.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:41 UTC	930	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 145222 Connection: close Last-Modified: Tue, 12 Sep 2023 09:05:15 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: Cf02rYNryv9UIBzoGOQeQJTZ2QU2vf2Y Accept-Ranges: bytes Server: AmazonS3 Date: Fri, 15 Nov 2024 14:59:41 GMT ETag: "e112b8bf96f23bc2970347a3c98e37fc" X-Cache: Hit from cloudfront Via: 1.1 6b15a9d1514a5645abfd43cbf330ce48.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P9 X-Amz-Cf-Id: sYfJZaOcRKBQEHsUSkEw2MYmJMag2M6tva8DAQtwmv2DV7IX2QqaVg== Age: 2 X-Frame-Options: SAMEORIGIN Referrer-Policy: no-referrer-when-downgrade Content-Security-Policy: frame-ancestors 'self' https://clickceasebiz.com https://*.clickceasebiz.com; upgrade-insecure-requests; X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: microphone 'none'; camera 'none'; Vary: Origin
2024-11-15 14:59:41 UTC	15454	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 6b 28 29 7b 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 3b 76 61 72 20 63 2c 61 3d 7b 7d 2c 65 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6c 3d 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 75 3d 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 65 5b 74 5d 3d 6e 2e 76 61 6c 75 65 7d 2c 74 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3f 53 79 6d 62 6f 6c 3a 7b 7d 2c 72 3d 74 2e 69 74 65 72 61 74 6f 72 7c 7c 22 40 40 69 74 65 72 61 74 6f 72 22 2c 6e 3d 74 2e 61 73 79 6e 63 49 74 65 72 61 74 6f 72 7c 7c 22 40 40 61 73 79 Data Ascii: !function(){"use strict";function k(){k=function(){return a};var c,a={},e=Object.prototype,l=e.hasOwnProperty,u=Object.defineProperty\|\|function(e,t,n){e[t]=n.value},t="function"==typeof Symbol?Symbol:{},r=t.iterator\|\|"@@iterator",n=t.asyncIterator\|\|"@@asy
2024-11-15 14:59:41 UTC	16384	IN	Data Raw: 2e 72 65 67 65 6e 65 72 61 74 6f 72 52 75 6e 74 69 6d 65 26 26 30 3c 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 4e 61 6d 65 73 28 74 29 2e 69 6e 64 65 78 4f 66 28 22 72 65 67 65 6e 65 72 61 74 6f 72 52 75 6e 74 69 6d 65 22 29 2c 64 3d 65 26 26 74 2e 72 65 67 65 6e 65 72 61 74 6f 72 52 75 6e 74 69 6d 65 3b 69 66 28 74 2e 72 65 67 65 6e 65 72 61 74 6f 72 52 75 6e 74 69 6d 65 3d 76 6f 69 64 20 30 2c 65 29 74 2e 72 65 67 65 6e 65 72 61 74 6f 72 52 75 6e 74 69 6d 65 3d 64 3b 65 6c 73 65 20 74 72 79 7b 64 65 6c 65 74 65 20 74 2e 72 65 67 65 6e 65 72 61 74 6f 72 52 75 6e 74 69 6d 65 7d 63 61 74 63 68 28 65 29 7b 74 2e 72 65 67 65 6e 65 72 61 74 6f 72 52 75 6e 74 69 6d 65 3d 76 6f 69 64 20 30 7d 76 61 72 20 66 3d 22 75 6e 64 65 66 69 6e 65 Data Ascii: .regeneratorRuntime&&0<=Object.getOwnPropertyNames(t).indexOf("regeneratorRuntime"),d=e&&t.regeneratorRuntime;if(t.regeneratorRuntime=void 0,e)t.regeneratorRuntime=d;else try{delete t.regeneratorRuntime}catch(e){t.regeneratorRuntime=void 0}var f="undefine
2024-11-15 14:59:41 UTC	16384	IN	Data Raw: 22 23 22 21 3d 3d 72 5b 30 5d 7c 7c 22 62 61 63 6b 67 72 6f 75 6e 64 22 3d 3d 3d 6e 26 26 72 26 26 28 22 74 61 62 6c 65 22 3d 3d 3d 74 7c 7c 22 74 64 22 3d 3d 3d 74 7c 7c 22 74 68 22 3d 3d 3d 74 29 29 72 65 74 75 72 6e 20 67 28 65 2c 72 29 3b 69 66 28 22 73 72 63 73 65 74 22 3d 3d 3d 6e 26 26 72 29 7b 76 61 72 20 6f 3d 65 2c 69 3d 72 3b 69 66 28 22 22 3d 3d 3d 69 2e 74 72 69 6d 28 29 29 72 65 74 75 72 6e 20 69 3b 76 61 72 20 61 3d 30 3b 66 75 6e 63 74 69 6f 6e 20 73 28 65 29 7b 76 61 72 20 65 3d 65 2e 65 78 65 63 28 69 2e 73 75 62 73 74 72 69 6e 67 28 61 29 29 3b 72 65 74 75 72 6e 20 65 3f 28 65 3d 65 5b 30 5d 2c 61 2b 3d 65 2e 6c 65 6e 67 74 68 2c 65 29 3a 22 22 7d 66 6f 72 28 76 61 72 20 63 3d 5b 5d 3b 73 28 79 29 2c 21 28 61 3e 3d 69 2e 6c 65 6e 67 74 Data Ascii: "#"!==r[0]\|\|"background"===n&&r&&("table"===t\|\|"td"===t\|\|"th"===t))return g(e,r);if("srcset"===n&&r){var o=e,i=r;if(""===i.trim())return i;var a=0;function s(e){var e=e.exec(i.substring(a));return e?(e=e[0],a+=e.length,e):""}for(var c=[];s(y),!(a>=i.lengt
2024-11-15 14:59:41 UTC	16384	IN	Data Raw: 7b 76 61 72 20 72 3d 22 74 65 78 74 61 72 65 61 22 3d 3d 3d 66 26 26 22 76 61 6c 75 65 22 3d 3d 3d 65 2c 6f 3d 22 73 74 79 6c 65 22 3d 3d 3d 66 26 26 22 5f 63 73 73 54 65 78 74 22 3d 3d 3d 65 3b 69 66 28 6f 26 26 75 26 26 28 6e 3d 6b 28 6e 2c 64 29 29 2c 72 7c 7c 6f 29 7b 66 6f 72 28 76 61 72 20 72 3d 6c 2e 63 72 65 61 74 65 54 65 78 74 4e 6f 64 65 28 6e 29 2c 69 3d 30 2c 61 3d 41 72 72 61 79 2e 66 72 6f 6d 28 70 2e 63 68 69 6c 64 4e 6f 64 65 73 29 3b 69 3c 61 2e 6c 65 6e 67 74 68 3b 69 2b 2b 29 7b 76 61 72 20 73 3d 61 5b 69 5d 3b 73 2e 6e 6f 64 65 54 79 70 65 3d 3d 3d 70 2e 54 45 58 54 5f 4e 4f 44 45 26 26 70 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 73 29 7d 72 65 74 75 72 6e 20 70 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 72 29 7d 74 72 79 7b 69 66 28 63 2e Data Ascii: {var r="textarea"===f&&"value"===e,o="style"===f&&"_cssText"===e;if(o&&u&&(n=k(n,d)),r\|\|o){for(var r=l.createTextNode(n),i=0,a=Array.from(p.childNodes);i<a.length;i++){var s=a[i];s.nodeType===p.TEXT_NODE&&p.removeChild(s)}return p.appendChild(r)}try{if(c.
2024-11-15 14:59:41 UTC	16384	IN	Data Raw: 6e 65 77 20 53 65 74 2c 62 2e 64 72 6f 70 70 65 64 53 65 74 3d 6e 65 77 20 53 65 74 2c 62 2e 6d 6f 76 65 64 4d 61 70 3d 7b 7d 2c 62 2e 6d 75 74 61 74 69 6f 6e 43 62 28 67 29 29 7d 7d 2c 74 68 69 73 2e 70 72 6f 63 65 73 73 4d 75 74 61 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 72 29 7b 76 61 72 20 74 2c 65 2c 6e 2c 6f 3b 69 66 28 21 24 28 72 2e 74 61 72 67 65 74 29 29 73 77 69 74 63 68 28 72 2e 74 79 70 65 29 7b 63 61 73 65 22 63 68 61 72 61 63 74 65 72 44 61 74 61 22 3a 76 61 72 20 69 3d 72 2e 74 61 72 67 65 74 2e 74 65 78 74 43 6f 6e 74 65 6e 74 3b 4e 65 28 72 2e 74 61 72 67 65 74 2c 62 2e 62 6c 6f 63 6b 43 6c 61 73 73 29 7c 7c 69 3d 3d 3d 72 2e 6f 6c 64 56 61 6c 75 65 7c 7c 62 2e 74 65 78 74 73 2e 70 75 73 68 28 7b 76 61 6c 75 65 3a 58 28 72 2e 74 61 72 Data Ascii: new Set,b.droppedSet=new Set,b.movedMap={},b.mutationCb(g))}},this.processMutation=function(r){var t,e,n,o;if(!$(r.target))switch(r.type){case"characterData":var i=r.target.textContent;Ne(r.target,b.blockClass)\|\|i===r.oldValue\|\|b.texts.push({value:X(r.tar
2024-11-15 14:59:41 UTC	16384	IN	Data Raw: 65 2c 22 67 65 74 43 6f 6e 74 65 78 74 22 2c 66 75 6e 63 74 69 6f 6e 28 72 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6e 3d 31 3b 6e 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 74 5b 6e 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 3b 72 65 74 75 72 6e 20 4e 65 28 74 68 69 73 2c 6f 29 7c 7c 22 5f 5f 63 6f 6e 74 65 78 74 22 69 6e 20 74 68 69 73 7c 7c 28 74 68 69 73 2e 5f 5f 63 6f 6e 74 65 78 74 3d 65 29 2c 72 2e 61 70 70 6c 79 28 74 68 69 73 2c 43 65 28 5b 65 5d 2c 74 29 29 7d 7d 29 3b 74 2e 70 75 73 68 28 6e 29 7d 63 61 74 63 68 28 65 29 7b 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 22 66 61 69 6c 65 64 20 74 6f 20 70 61 74 63 68 20 48 54 4d 4c 43 61 6e 76 61 73 45 6c 65 6d Data Ascii: e,"getContext",function(r){return function(e){for(var t=[],n=1;n<arguments.length;n++)t[n-1]=arguments[n];return Ne(this,o)\|\|"__context"in this\|\|(this.__context=e),r.apply(this,Ce([e],t))}});t.push(n)}catch(e){console.error("failed to patch HTMLCanvasElem
2024-11-15 14:59:41 UTC	16384	IN	Data Raw: 72 6f 74 6f 74 79 70 65 2e 69 73 41 63 74 69 76 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 74 68 69 73 2e 72 61 66 7d 2c 63 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6e 64 41 63 74 69 6f 6e 49 6e 64 65 78 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 30 2c 6e 3d 74 68 69 73 2e 61 63 74 69 6f 6e 73 2e 6c 65 6e 67 74 68 2d 31 3b 74 3c 3d 6e 3b 29 7b 76 61 72 20 72 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 28 74 2b 6e 29 2f 32 29 3b 69 66 28 74 68 69 73 2e 61 63 74 69 6f 6e 73 5b 72 5d 2e 64 65 6c 61 79 3c 65 2e 64 65 6c 61 79 29 74 3d 72 2b 31 3b 65 6c 73 65 7b 69 66 28 21 28 74 68 69 73 2e 61 63 74 69 6f 6e 73 5b 72 5d 2e 64 65 6c 61 79 3e 65 2e 64 65 6c 61 79 29 29 72 65 74 75 72 6e 20 72 2b 31 3b 6e 3d Data Ascii: rototype.isActive=function(){return null!==this.raf},c.prototype.findActionIndex=function(e){for(var t=0,n=this.actions.length-1;t<=n;){var r=Math.floor((t+n)/2);if(this.actions[r].delay<e.delay)t=r+1;else{if(!(this.actions[r].delay>e.delay))return r+1;n=
2024-11-15 14:59:41 UTC	16384	IN	Data Raw: 69 74 28 45 65 2e 52 65 70 6c 61 79 65 72 45 76 65 6e 74 73 2e 45 76 65 6e 74 43 61 73 74 2c 61 29 7d 7d 2c 64 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 62 75 69 6c 64 46 75 6c 6c 53 6e 61 70 73 68 6f 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 74 68 69 73 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 21 31 29 2c 21 74 68 69 73 2e 69 66 72 61 6d 65 2e 63 6f 6e 74 65 6e 74 44 6f 63 75 6d 65 6e 74 29 72 65 74 75 72 6e 20 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 4c 6f 6f 6b 73 20 6c 69 6b 65 20 79 6f 75 72 20 72 65 70 6c 61 79 65 72 20 68 61 73 20 62 65 65 6e 20 64 65 73 74 72 6f 79 65 64 2e 22 29 3b 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 68 69 73 2e 6c 65 67 61 63 79 5f 6d 69 73 73 69 6e 67 4e 6f 64 65 52 65 74 72 79 4d 61 70 Data Ascii: it(Ee.ReplayerEvents.EventCast,a)}},d.prototype.rebuildFullSnapshot=function(e,t){var n=this;if(void 0===t&&(t=!1),!this.iframe.contentDocument)return console.warn("Looks like your replayer has been destroyed.");Object.keys(this.legacy_missingNodeRetryMap
2024-11-15 14:59:41 UTC	15080	IN	Data Raw: 72 2e 70 72 65 76 69 6f 75 73 49 64 2c 72 3d 72 2e 6e 65 78 74 49 64 2c 61 3d 61 26 26 65 5b 61 5d 2c 72 3d 72 26 26 65 5b 72 5d 3b 61 26 26 28 6f 3d 61 2e 6e 6f 64 65 2c 69 3d 61 2e 6d 75 74 61 74 69 6f 6e 2c 74 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 6f 2c 6e 29 2c 64 65 6c 65 74 65 20 65 5b 69 2e 6e 6f 64 65 2e 69 64 5d 2c 64 65 6c 65 74 65 20 74 68 69 73 2e 6c 65 67 61 63 79 5f 6d 69 73 73 69 6e 67 4e 6f 64 65 52 65 74 72 79 4d 61 70 5b 69 2e 6e 6f 64 65 2e 69 64 5d 2c 69 2e 70 72 65 76 69 6f 75 73 49 64 7c 7c 69 2e 6e 65 78 74 49 64 29 26 26 74 68 69 73 2e 6c 65 67 61 63 79 5f 72 65 73 6f 6c 76 65 4d 69 73 73 69 6e 67 4e 6f 64 65 28 65 2c 74 2c 6f 2c 69 29 2c 72 26 26 28 6f 3d 72 2e 6e 6f 64 65 2c 69 3d 72 2e 6d 75 74 61 74 69 6f 6e 2c 74 2e 69 6e Data Ascii: r.previousId,r=r.nextId,a=a&&e[a],r=r&&e[r];a&&(o=a.node,i=a.mutation,t.insertBefore(o,n),delete e[i.node.id],delete this.legacy_missingNodeRetryMap[i.node.id],i.previousId\|\|i.nextId)&&this.legacy_resolveMissingNode(e,t,o,i),r&&(o=r.node,i=r.mutation,t.in

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49896	162.159.140.229	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:41 UTC	1052	OUT	GET /i/adsct?bci=3&dv=America%2FNew_York%26en-US%2Cen%26Google%20Inc.%26Win32%26255%261280%261024%264%2624%261280%26984%260%26na&eci=2&event_id=d3c56a3e-5e46-458b-9cfc-58e4034af68a&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=b44ecccc-6ffc-4513-83c8-8720371a64fe&tw_document_href=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nurcc&type=javascript&version=2.3.31 HTTP/1.1 Host: t.co Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:41 UTC	882	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:41 GMT Content-Type: image/gif;charset=utf-8 Content-Length: 43 Connection: close perf: 7402827104 Set-Cookie: muc_ads=794b6615-e75e-4d2d-8535-6ac71126796e; Max-Age=63072000; Expires=Sun, 15 Nov 2026 14:59:41 GMT; Path=/; Domain=t.co; Secure; SameSite=None Cache-Control: no-cache, no-store, max-age=0 x-transaction-id: c63616b9747cacdb strict-transport-security: max-age=0 x-response-time: 88 x-connection-hash: cddc18834633e7349e7a59dbc9ea124fb94e09b724d980284188bdb4006119bb CF-Cache-Status: DYNAMIC Set-Cookie: __cf_bm=KPen1Zd9VNIs1TF9i2h9MUU7HgsfGzPHuQZZaVGYPSQ-1731682781-1.0.1.1-tOm_i.k0EhfB7HUqS4omPvNh95hXDRb.pmcwU6Epkiiv388LhIHfa29vevY1f8p9D6ixm2BrKpYV43OimYNb2A; path=/; expires=Fri, 15-Nov-24 15:29:41 GMT; domain=.t.co; HttpOnly; Secure; SameSite=None Server: cloudflare tsa_b CF-RAY: 8e301b465ef92cd7-DFW
2024-11-15 14:59:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	49892	169.150.236.105	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:41 UTC	532	OUT	GET /ki.js/24100/4Nr.js HTTP/1.1 Host: cl.qualaroo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:41 UTC	1142	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:41 GMT Content-Type: application/ecmascript Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Server: BunnyCDN-IL1-1207 CDN-PullZone: 92714 CDN-Uid: 50c043fb-dcd1-4574-9faf-b60384f66f78 CDN-RequestCountryCode: US Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match Access-Control-Expose-Headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match Cache-Control: max-age=3600 ETag: W/"38463fd52ab92a61a864ab2c81611cc7" Last-Modified: Fri, 08 Nov 2024 08:00:02 GMT x-amz-id-2: 2/i1r3e6uXfoscalW1UdGc/0FGxdCcyKF69sUb/IR3epyXC7MaeBT47ETLa8+pBFHq9/8Qy1uMA= x-amz-request-id: X5GN7EXT7SQQP2VR x-amz-server-side-encryption: AES256 CDN-ProxyVer: 1.06 CDN-RequestPullSuccess: True CDN-RequestPullCode: 200 CDN-CachedAt: 11/15/2024 08:58:07 CDN-EdgeStorageId: 894 CDN-Status: 200 CDN-RequestTime: 0 CDN-RequestId: 43cecac3b8f188c3886667f1e07fc89e CDN-Cache: REVALIDATED
2024-11-15 14:59:41 UTC	16384	IN	Data Raw: 39 37 61 39 0d 0a 2f 2f 20 51 75 61 6c 61 72 6f 6f 20 66 6f 72 20 74 65 6c 65 72 69 6b 2e 63 6f 6d 0a 2f 2f 20 28 43 29 20 32 30 32 34 20 51 75 61 6c 61 72 6f 6f 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 2f 2f 20 71 75 61 6c 61 72 6f 6f 2e 63 6f 6d 0a 0a 2f 2f 24 20 73 69 74 65 3a 20 31 39 35 34 37 2c 20 67 65 6e 65 72 61 74 65 64 3a 20 32 30 32 34 2d 31 31 2d 30 38 20 30 38 3a 30 30 3a 30 31 20 55 54 43 0a 2f 2f 24 20 63 6c 69 65 6e 74 3a 20 32 2e 30 2e 37 30 0a 0a 69 66 28 74 79 70 65 6f 66 20 4b 49 20 3d 3d 20 27 75 6e 64 65 66 69 6e 65 64 27 29 7b 4b 49 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 43 28 5f 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 5f 7d 76 61 72 Data Ascii: 97a9// Qualaroo for telerik.com// (C) 2024 Qualaroo. All rights reserved.// qualaroo.com//$ site: 19547, generated: 2024-11-08 08:00:01 UTC//$ client: 2.0.70if(typeof KI == 'undefined'){KI=function(){"use strict";function C(_){return typeof _}var
2024-11-15 14:59:41 UTC	16384	IN	Data Raw: 65 3d 22 74 65 78 74 22 20 76 61 6c 75 65 3d 22 25 21 25 75 66 25 21 25 22 25 21 25 73 78 25 21 25 2f 3e 27 2c 73 33 3a 27 3c 64 69 76 20 69 64 3d 22 71 75 61 6c 5f 61 6e 73 77 65 72 22 20 6e 6f 64 65 69 64 3d 25 21 25 76 61 6c 25 21 25 20 63 6c 61 73 73 3d 22 71 75 61 6c 5f 6f 6c 5f 61 6e 73 5f 77 65 6c 63 6f 6d 65 22 3e 3c 2f 64 69 76 3e 27 2c 62 37 3a 27 3c 64 69 76 20 69 64 3d 22 71 75 61 6c 5f 6f 6c 5f 62 69 6e 61 72 79 22 20 63 6c 61 73 73 3d 22 71 75 61 6c 5f 6f 6c 5f 62 69 6e 61 72 79 22 20 20 6e 6f 64 65 69 64 3d 25 21 25 76 61 6c 25 21 25 3e 25 21 25 69 35 25 21 25 3c 2f 64 69 76 3e 27 2c 62 6b 3a 27 3c 64 69 76 20 69 64 3d 22 71 75 61 6c 5f 6f 6c 5f 73 74 61 72 22 20 20 63 6c 61 73 73 3d 22 71 75 61 6c 5f 6f 6c 5f 73 74 61 72 22 3e 20 20 20 20 Data Ascii: e="text" value="%!%uf%!%"%!%sx%!%/>',s3:'<div id="qual_answer" nodeid=%!%val%!% class="qual_ol_ans_welcome"></div>',b7:'<div id="qual_ol_binary" class="qual_ol_binary" nodeid=%!%val%!%>%!%i5%!%</div>',bk:'<div id="qual_ol_star" class="qual_ol_star">
2024-11-15 14:59:41 UTC	16384	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 72 65 74 75 72 6e 20 5f 7d 2c 52 5f 3d 7b 75 6e 64 65 66 69 6e 65 64 3a 22 67 6e 22 2c 62 6f 6f 6c 65 61 6e 3a 22 6e 78 22 2c 6e 75 6d 62 65 72 3a 22 79 38 22 2c 73 74 72 69 6e 67 3a 22 66 6d 22 2c 66 75 6e 63 74 69 6f 6e 3a 22 62 61 22 2c 55 6e 64 65 66 69 6e 65 64 3a 22 67 6e 22 2c 4e 75 6c 6c 3a 22 6d 70 22 2c 42 6f 6f 6c 65 61 6e 3a 22 6e 78 22 2c 4e 75 6d 62 65 72 3a 22 79 38 22 2c 53 74 72 69 6e 67 3a 22 66 6d 22 2c 46 75 6e 63 74 69 6f 6e 3a 22 62 61 22 2c 41 72 72 61 79 3a 22 64 67 22 2c 53 74 79 6c 65 53 68 65 65 74 4c 69 73 74 3a 22 64 67 22 7d 2c 64 5f 3d 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 65 2c 69 3b 72 65 74 75 72 6e 20 5f 3d 3d 3d 63 69 3f 22 6d 70 22 3a 5f 3d 3d 3d 24 65 3f 22 67 6e 22 3a 28 Data Ascii: function(_){return _},R_={undefined:"gn",boolean:"nx",number:"y8",string:"fm",function:"ba",Undefined:"gn",Null:"mp",Boolean:"nx",Number:"y8",String:"fm",Function:"ba",Array:"dg",StyleSheetList:"dg"},d_=function(_){var e,i;return _===ci?"mp":_===$e?"gn":(
2024-11-15 14:59:41 UTC	16384	IN	Data Raw: 72 20 6e 6f 74 20 6f 6e 20 77 68 69 74 65 6c 69 73 74 22 2c 70 29 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 79 6b 22 3a 6d 26 26 28 5f 5f 3d 21 30 2c 63 5f 2e 70 64 28 22 70 7a 22 2c 22 41 42 4f 52 54 20 2d 20 72 65 66 65 72 72 65 72 20 6f 6e 20 62 6c 61 63 6b 6c 69 73 74 22 2c 70 29 29 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 5f 5f 3d 21 30 2c 63 5f 2e 70 64 28 22 63 71 22 2c 22 41 42 4f 52 54 20 2d 20 72 65 66 65 72 72 65 72 20 70 6f 6c 69 63 79 20 75 6e 6b 6e 6f 77 6e 22 2c 64 29 7d 69 66 28 5f 5f 29 72 65 74 75 72 6e 20 5a 28 29 7d 69 66 28 63 5f 2e 70 64 28 22 70 7a 22 2c 22 50 41 53 53 20 2d 20 72 65 66 65 72 72 65 72 20 63 68 65 63 6b 22 29 2c 22 79 36 22 3d 3d 3d 28 77 3d 48 2e 70 68 6b 29 26 26 59 3d 3d 3d 24 65 29 72 65 74 75 72 6e 20 5a 28 29 Data Ascii: r not on whitelist",p));break;case"yk":m&&(__=!0,c_.pd("pz","ABORT - referrer on blacklist",p));break;default:__=!0,c_.pd("cq","ABORT - referrer policy unknown",d)}if(__)return Z()}if(c_.pd("pz","PASS - referrer check"),"y6"===(w=H.phk)&&Y===$e)return Z()
2024-11-15 14:59:41 UTC	16384	IN	Data Raw: 30 7d 29 7d 72 65 74 75 72 6e 21 30 7d 2c 77 3d 66 75 6e 63 74 69 6f 6e 28 5f 2c 65 2c 69 2c 74 2c 73 2c 6f 2c 6e 2c 72 29 7b 76 61 72 20 61 2c 6c 3d 57 65 5b 4a 69 2e 70 75 72 5d 2c 64 3d 7b 7d 3b 69 66 28 21 28 43 28 6c 29 3d 3d 3d 4a 69 2e 67 78 29 29 72 65 74 75 72 6e 21 31 3b 66 6f 72 28 61 20 69 6e 20 65 29 65 5b 4a 69 2e 70 70 5d 28 61 29 26 26 28 64 5b 61 5d 3d 65 5b 61 5d 29 3b 72 65 74 75 72 6e 20 64 5b 6d 5d 3d 76 2c 64 5b 75 5d 3d 74 2c 6e 26 26 28 64 2e 71 75 65 73 74 69 6f 6e 5f 69 64 3d 6e 29 2c 72 26 26 28 64 2e 61 6e 73 77 65 72 5f 69 64 3d 72 29 2c 6c 28 4a 69 2e 70 64 33 2c 68 5b 5f 5d 2c 64 29 2c 21 30 7d 2c 79 3d 66 75 6e 63 74 69 6f 6e 28 5f 2c 65 2c 69 2c 74 2c 73 2c 6f 2c 6e 2c 72 29 7b 76 61 72 20 61 2c 6c 3d 57 65 5b 4a 69 2e 70 Data Ascii: 0})}return!0},w=function(_,e,i,t,s,o,n,r){var a,l=We[Ji.pur],d={};if(!(C(l)===Ji.gx))return!1;for(a in e)e[Ji.pp](a)&&(d[a]=e[a]);return d[m]=v,d[u]=t,n&&(d.question_id=n),r&&(d.answer_id=r),l(Ji.pd3,h[_],d),!0},y=function(_,e,i,t,s,o,n,r){var a,l=We[Ji.p
2024-11-15 14:59:41 UTC	16384	IN	Data Raw: 3d 74 3b 74 2d 2d 29 69 66 28 5f 3d 69 2e 73 6c 69 63 65 28 74 29 2e 6a 6f 69 6e 28 22 2e 22 29 2c 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 65 2b 22 3b 64 6f 6d 61 69 6e 3d 2e 22 2b 5f 2b 22 3b 22 2c 2d 31 3c 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 2e 69 6e 64 65 78 4f 66 28 65 29 29 72 65 74 75 72 6e 20 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 65 2e 73 70 6c 69 74 28 22 3d 22 29 5b 30 5d 2b 22 3d 3b 64 6f 6d 61 69 6e 3d 2e 22 2b 5f 2b 22 3b 65 78 70 69 72 65 73 3d 54 68 75 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 4d 54 3b 22 2c 5f 7d 28 29 29 2b 22 3b 20 22 29 2c 69 3d 69 2b 22 3d 22 2b 4e 69 28 5f 29 2b 22 3b 20 22 2c 47 65 5b 4a 69 2e 77 36 5d 3d 69 2b 3d 6f 2b 6e 2b 22 70 61 74 68 3d 2f 3b 20 22 2c 5f Data Ascii: =t;t--)if(_=i.slice(t).join("."),document.cookie=e+";domain=."+_+";",-1<document.cookie.indexOf(e))return document.cookie=e.split("=")[0]+"=;domain=."+_+";expires=Thu, 01 Jan 1970 00:00:01 GMT;",_}())+"; "),i=i+"="+Ni(_)+"; ",Ge[Ji.w6]=i+=o+n+"path=/; ",_
2024-11-15 14:59:41 UTC	16384	IN	Data Raw: 2e 71 75 61 6c 5f 78 5f 63 6c 6f 73 65 22 3a 7b 70 62 3a 51 69 2e 70 30 2c 70 66 3a 51 69 2e 70 30 7d 2c 22 64 69 76 23 71 75 61 6c 5f 6f 6c 20 64 69 76 2e 71 75 61 6c 5f 6f 6c 5f 62 6f 78 2e 71 75 61 6c 5f 63 6c 6f 73 65 64 22 3a 7b 64 31 3a 22 75 6e 73 65 74 20 21 69 6d 70 6f 72 74 61 6e 74 22 7d 2c 22 64 69 76 23 71 75 61 6c 5f 6f 6c 20 2e 71 75 61 6c 5f 78 5f 63 6c 6f 73 65 2e 71 75 61 6c 5f 63 6c 6f 73 65 64 20 2e 71 75 61 6c 5f 78 5f 63 6c 61 62 65 6c 2e 71 75 61 6c 5f 68 61 73 5f 6c 61 62 65 6c 22 3a 7b 64 78 3a 22 31 65 6d 22 7d 2c 22 64 69 76 23 71 75 61 6c 5f 6f 6c 20 64 69 76 2e 71 75 61 6c 5f 6f 6c 5f 62 6f 78 2e 71 75 61 6c 5f 63 6c 6f 73 65 22 3a 7b 64 31 3a 22 75 6e 73 65 74 20 21 69 6d 70 6f 72 74 61 6e 74 22 7d 2c 22 64 69 76 23 71 75 61 Data Ascii: .qual_x_close":{pb:Qi.p0,pf:Qi.p0},"div#qual_ol div.qual_ol_box.qual_closed":{d1:"unset !important"},"div#qual_ol .qual_x_close.qual_closed .qual_x_clabel.qual_has_label":{dx:"1em"},"div#qual_ol div.qual_ol_box.qual_close":{d1:"unset !important"},"div#qua
2024-11-15 14:59:41 UTC	16384	IN	Data Raw: 67 20 70 61 74 68 2c 2e 71 75 61 6c 5f 6f 6c 5f 6d 6f 72 65 5f 61 62 6f 76 65 2e 71 75 61 6c 5f 78 5f 73 65 6c 65 63 74 20 73 76 67 2c 20 2e 71 75 61 6c 5f 6f 6c 5f 6d 6f 72 65 5f 61 62 6f 76 65 2e 71 75 61 6c 5f 78 5f 73 65 6c 65 63 74 20 73 76 67 20 70 61 74 68 22 3a 7b 6b 77 3a 22 6f 6d 22 7d 2c 22 64 69 76 23 71 75 61 6c 5f 6f 6c 20 74 65 78 74 61 72 65 61 2e 71 75 61 6c 5f 6f 6c 5f 61 6e 73 5f 74 65 78 74 2c 20 64 69 76 23 71 75 61 6c 5f 6f 6c 20 69 6e 70 75 74 2e 71 75 61 6c 5f 6f 6c 5f 61 6e 73 5f 74 65 78 74 5f 73 69 6e 67 6c 65 2c 64 69 76 23 71 75 61 6c 5f 6f 6c 20 2e 71 75 61 6c 5f 6f 6c 5f 61 6e 73 5f 6c 6f 6e 67 5f 65 78 70 6c 61 69 6e 20 74 65 78 74 61 72 65 61 2c 64 69 76 23 71 75 61 6c 5f 6f 6c 20 2e 71 75 61 6c 5f 6f 6c 5f 61 6e 73 5f 73 Data Ascii: g path,.qual_ol_more_above.qual_x_select svg, .qual_ol_more_above.qual_x_select svg path":{kw:"om"},"div#qual_ol textarea.qual_ol_ans_text, div#qual_ol input.qual_ol_ans_text_single,div#qual_ol .qual_ol_ans_long_explain textarea,div#qual_ol .qual_ol_ans_s
2024-11-15 14:59:41 UTC	16384	IN	Data Raw: 7d 7d 29 7d 22 70 32 22 21 3d 3d 64 2e 64 35 26 26 28 5f 3d 76 28 65 29 29 2c 22 79 79 22 3d 3d 3d 63 3f 28 6d 26 26 69 5b 4a 69 2e 70 36 5d 28 6d 29 2c 5f 26 26 28 69 5b 4a 69 2e 70 36 5d 28 24 69 2e 70 36 6b 29 2c 69 5b 4a 69 2e 70 36 5d 28 5f 29 29 29 3a 28 5f 7c 7c 6d 29 26 26 69 5b 4a 69 2e 70 36 5d 28 48 28 7b 70 79 3a 24 69 2e 70 7a 35 2c 70 37 3a 7b 70 77 32 3a 6d 2c 77 6c 3a 5f 7d 7d 29 29 2c 69 5b 4a 69 2e 70 36 5d 28 48 28 7b 70 79 3a 24 69 2e 70 6f 72 2c 70 37 3a 7b 62 34 3a 61 7d 7d 29 29 2c 75 26 26 75 28 69 29 7d 2c 71 5f 3d 66 75 6e 63 74 69 6f 6e 28 5f 2c 65 29 7b 5f 3d 67 5f 2e 66 64 28 5f 29 3b 65 3f 28 6a 73 2e 79 72 28 29 2c 57 65 2e 6f 70 65 6e 28 5f 2c 22 5f 62 6c 61 6e 6b 22 29 29 3a 28 6a 73 2e 79 72 28 29 2c 66 5f 2e 70 75 78 28 Data Ascii: }})}"p2"!==d.d5&&(_=v(e)),"yy"===c?(m&&i[Ji.p6](m),_&&(i[Ji.p6]($i.p6k),i[Ji.p6](_))):(_\|\|m)&&i[Ji.p6](H({py:$i.pz5,p7:{pw2:m,wl:_}})),i[Ji.p6](H({py:$i.por,p7:{b4:a}})),u&&u(i)},q_=function(_,e){_=g_.fd(_);e?(js.yr(),We.open(_,"_blank")):(js.yr(),f_.pux(
2024-11-15 14:59:41 UTC	16384	IN	Data Raw: 61 6c 5f 66 69 6c 6c 65 64 5f 6f 75 74 5f 73 74 61 72 22 29 2c 4a 3d 30 3b 4a 3c 51 2e 6c 65 6e 67 74 68 3b 4a 2b 2b 29 5a 28 51 5b 4a 5d 2c 22 71 75 61 6c 5f 78 5f 73 65 6c 65 63 74 5f 73 74 61 72 22 29 2c 51 5b 4a 5d 5b 4a 69 2e 6f 77 5d 3d 22 e2 98 86 22 3b 49 73 28 4c 2c 22 71 75 61 6c 5f 78 5f 73 65 6c 65 63 74 22 29 2c 5f 74 2e 6c 79 3d 21 30 2c 4f 3d 42 73 28 4c 29 2c 5f 74 2e 6a 31 3d 4f 3b 66 6f 72 28 4a 3d 30 3b 4a 3c 3d 4f 3b 4a 2b 2b 29 51 5b 4a 5d 5b 4a 69 2e 6f 77 5d 3d 22 e2 98 85 22 2c 49 73 28 51 5b 4a 5d 2c 22 71 75 61 6c 5f 78 5f 73 65 6c 65 63 74 5f 73 74 61 72 22 29 3b 72 65 74 75 72 6e 20 5f 74 2e 70 38 3d 4c 2c 5f 74 2e 70 31 3d 5b 42 73 28 4c 29 5d 2c 5f 74 2e 63 75 3d 72 69 28 24 2c 24 69 2e 66 68 29 2c 21 30 7d 69 66 28 22 62 37 Data Ascii: al_filled_out_star"),J=0;J<Q.length;J++)Z(Q[J],"qual_x_select_star"),Q[J][Ji.ow]="";Is(L,"qual_x_select"),_t.ly=!0,O=Bs(L),_t.j1=O;for(J=0;J<=O;J++)Q[J][Ji.ow]="",Is(Q[J],"qual_x_select_star");return _t.p8=L,_t.p1=[Bs(L)],_t.cu=ri($,$i.fh),!0}if("b7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	49895	162.159.140.229	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:41 UTC	1052	OUT	GET /i/adsct?bci=3&dv=America%2FNew_York%26en-US%2Cen%26Google%20Inc.%26Win32%26255%261280%261024%264%2624%261280%26984%260%26na&eci=2&event_id=cff2a29a-f564-408a-9834-ff7d0dacc979&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=b44ecccc-6ffc-4513-83c8-8720371a64fe&tw_document_href=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzcii&type=javascript&version=2.3.31 HTTP/1.1 Host: t.co Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:41 UTC	882	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:41 GMT Content-Type: image/gif;charset=utf-8 Content-Length: 43 Connection: close perf: 7402827104 Set-Cookie: muc_ads=d1b1472d-84f3-4677-a0bd-6fb1f6351caa; Max-Age=63072000; Expires=Sun, 15 Nov 2026 14:59:41 GMT; Path=/; Domain=t.co; Secure; SameSite=None Cache-Control: no-cache, no-store, max-age=0 x-transaction-id: 4730f9d31671f645 strict-transport-security: max-age=0 x-response-time: 78 x-connection-hash: fc8fc57a7e5dfd8350a0c0874d1e84488e6e366f3017407a0c97259477505942 CF-Cache-Status: DYNAMIC Set-Cookie: __cf_bm=NLZRWL_QCrni2DAGSU_B2h__xRddOeetT4hvy2GsmzA-1731682781-1.0.1.1-Rg0EEGbJfS5DmGZkJNSjuvXpwnpCFG9ZQbJ9LATjeBZ7TFVn2sUQsz8iHaDY1AB1Ixz1BEmtTMGqCuD8j0OnKQ; path=/; expires=Fri, 15-Nov-24 15:29:41 GMT; domain=.t.co; HttpOnly; Secure; SameSite=None Server: cloudflare tsa_b CF-RAY: 8e301b4659d86b23-DFW
2024-11-15 14:59:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	49897	104.244.42.195	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:41 UTC	1069	OUT	GET /i/adsct?bci=3&dv=America%2FNew_York%26en-US%2Cen%26Google%20Inc.%26Win32%26255%261280%261024%264%2624%261280%26984%260%26na&eci=2&event_id=d3c56a3e-5e46-458b-9cfc-58e4034af68a&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=b44ecccc-6ffc-4513-83c8-8720371a64fe&tw_document_href=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nurcc&type=javascript&version=2.3.31 HTTP/1.1 Host: analytics.twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:41 UTC	571	IN	HTTP/1.1 200 OK date: Fri, 15 Nov 2024 14:59:40 GMT perf: 7402827104 server: tsa_b set-cookie: personalization_id="v1_IPT/hSvea/525bSdJk/qmA=="; Max-Age=63072000; Expires=Sun, 15 Nov 2026 14:59:41 GMT; Path=/; Domain=.twitter.com; Secure; SameSite=None content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: a254f59e048fae1c strict-transport-security: max-age=631138519 x-response-time: 8 x-connection-hash: b4b4c4ef08b76fa89305e116a4c3fb76f8b6634f1fb3911e3b7c0acd688defb0 connection: close
2024-11-15 14:59:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	49891	157.240.253.1	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:41 UTC	536	OUT	GET /en_US/fbevents.js HTTP/1.1 Host: connect.facebook.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:41 UTC	1452	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: application/x-javascript; charset=utf-8 timing-allow-origin: * reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-security-policy: default-src 'self' data: blob: ;script-src 'nonce-cnMr1yDO' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; document-policy: force-load-at-top
2024-11-15 14:59:41 UTC	1671	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewpor
2024-11-15 14:59:41 UTC	1	IN	Data Raw: 2f Data Ascii: /
2024-11-15 14:59:41 UTC	14680	IN	Data Raw: 2a 2a 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 37 2d 70 72 65 73 65 6e 74 2c 20 46 61 63 65 62 6f 6f 6b 2c 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 2a 0a 2a 20 59 6f 75 20 61 72 65 20 68 65 72 65 62 79 20 67 72 61 6e 74 65 64 20 61 20 6e 6f 6e 2d 65 78 63 6c 75 73 69 76 65 2c 20 77 6f 72 6c 64 77 69 64 65 2c 20 72 6f 79 61 6c 74 79 2d 66 72 65 65 20 6c 69 63 65 6e 73 65 20 74 6f 20 75 73 65 2c 0a 2a 20 63 6f 70 79 2c 20 6d 6f 64 69 66 79 2c 20 61 6e 64 20 64 69 73 74 72 69 62 75 74 65 20 74 68 69 73 20 73 6f 66 74 77 61 72 65 20 69 6e 20 73 6f 75 72 63 65 20 63 6f 64 65 20 6f 72 20 62 69 6e 61 72 79 20 66 6f 72 6d 20 66 6f 72 20 75 73 65 0a 2a 20 69 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 77 69 74 Data Ascii: * Copyright (c) 2017-present, Facebook, Inc. All rights reserved. You are hereby granted a non-exclusive, worldwide, royalty-free license to use,* copy, modify, and distribute this software in source code or binary form for use* in connection wit
2024-11-15 14:59:41 UTC	16384	IN	Data Raw: 7c 64 3d 3d 3d 22 47 54 4d 22 7c 7c 64 3d 3d 3d 22 4a 53 4f 4e 5f 4c 44 22 7c 7c 64 3d 3d 3d 22 4d 45 54 41 5f 54 41 47 22 7c 7c 64 3d 3d 3d 22 4f 50 45 4e 5f 47 52 41 50 48 22 7c 7c 64 3d 3d 3d 22 52 44 46 41 22 7c 7c 64 3d 3d 3d 22 53 43 48 45 4d 41 5f 44 4f 54 5f 4f 52 47 22 7c 7c 64 3d 3d 3d 22 55 52 49 22 3f 64 3a 6e 75 6c 6c 3b 72 65 74 75 72 6e 20 62 21 3d 6e 75 6c 6c 26 26 63 21 3d 6e 75 6c 6c 26 26 61 21 3d 6e 75 6c 6c 26 26 64 21 3d 6e 75 6c 6c 3f 7b 64 6f 6d 61 69 6e 5f 75 72 69 3a 62 2c 65 76 65 6e 74 5f 74 79 70 65 3a 63 2c 65 78 74 72 61 63 74 6f 72 5f 74 79 70 65 3a 64 2c 69 64 3a 61 7d 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 67 28 61 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 7c 7c 28 74 79 70 65 6f 66 20 61 3d 3d 3d 22 75 6e 64 65 66 69 6e Data Ascii: \|d==="GTM"\|\|d==="JSON_LD"\|\|d==="META_TAG"\|\|d==="OPEN_GRAPH"\|\|d==="RDFA"\|\|d==="SCHEMA_DOT_ORG"\|\|d==="URI"?d:null;return b!=null&&c!=null&&a!=null&&d!=null?{domain_uri:b,event_type:c,extractor_type:d,id:a}:null}function g(a){if(a==null\|\|(typeof a==="undefin
2024-11-15 14:59:41 UTC	16384	IN	Data Raw: 75 72 6e 20 6a 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 0a 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 45 78 70 65 72 69 6d 65 6e 74 73 54 79 70 65 64 65 66 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 67 2c 68 2c 69 2c 6a 29 7b 76 61 72 20 6b 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 6b 2e 65 78 70 6f 72 74 73 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 54 79 70 65 64 22 29 2c 62 3d 61 2e 54 79 70 65 64 3b 61 2e 63 6f 65 72 63 65 3b 61 2e 65 6e 66 6f Data Ascii: urn j.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEventsExperimentsTypedef",function(){return function(g,h,i,j){var k={exports:{}};k.exports;(function(){"use strict";var a=f.getFbeventsModules("SignalsFBEventsTyped"),b=a.Typed;a.coerce;a.enfo
2024-11-15 14:59:41 UTC	16384	IN	Data Raw: 72 20 61 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 42 61 73 65 45 76 65 6e 74 22 29 2c 62 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 50 69 78 65 6c 54 79 70 65 64 65 66 22 29 2c 63 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 54 79 70 65 64 22 29 2c 64 3d 63 2e 54 79 70 65 64 2c 65 3d 63 2e 63 6f 65 72 63 65 3b 66 75 6e 63 74 69 6f 6e 20 67 28 61 2c 63 2c 66 2c 67 2c 68 29 7b 61 3d 65 28 61 2c 62 29 3b 63 3d 65 28 63 2c 64 2e 73 74 72 69 6e 67 28 29 29 3b 76 61 72 20 6a 3d 7b 7d 3b 66 21 3d 6e 75 6c 6c 26 26 28 74 79 70 65 6f 66 20 66 3d 3d 3d 22 Data Ascii: r a=f.getFbeventsModules("SignalsFBEventsBaseEvent"),b=f.getFbeventsModules("SignalsFBEventsPixelTypedef"),c=f.getFbeventsModules("SignalsFBEventsTyped"),d=c.Typed,e=c.coerce;function g(a,c,f,g,h){a=e(a,b);c=e(c,d.string());var j={};f!=null&&(typeof f==="
2024-11-15 14:59:41 UTC	1703	IN	Data Raw: 61 72 20 62 3d 67 5b 6b 28 61 29 5d 3b 62 3d 62 26 26 62 2e 67 65 74 50 72 6f 74 6f 63 6f 6c 2e 63 61 6c 6c 26 26 62 2e 67 65 74 50 72 6f 74 6f 63 6f 6c 28 29 3d 3d 3d 64 3f 62 3a 6e 75 6c 6c 3b 62 21 3d 3d 6e 75 6c 6c 26 26 28 6a 5b 61 5b 30 5d 5d 3d 6a 5b 61 5b 30 5d 5d 7c 7c 7b 7d 2c 6a 5b 61 5b 30 5d 5d 5b 61 5b 31 5d 5d 3d 62 29 3b 72 65 74 75 72 6e 20 62 21 3d 3d 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 61 29 7b 76 61 72 20 62 3d 5b 5d 3b 61 3d 6a 5b 61 2e 69 64 5d 7c 7c 7b 7d 3b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 63 29 26 26 62 2e 70 75 73 68 28 61 5b 63 5d 29 3b 72 65 74 75 72 6e 20 62 7d 66 75 6e 63 74 69 6f 6e 20 Data Ascii: ar b=g[k(a)];b=b&&b.getProtocol.call&&b.getProtocol()===d?b:null;b!==null&&(j[a[0]]=j[a[0]]\|\|{},j[a[0]][a[1]]=b);return b!==null}function n(a){var b=[];a=j[a.id]\|\|{};for(var c in a)Object.prototype.hasOwnProperty.call(a,c)&&b.push(a[c]);return b}function
2024-11-15 14:59:41 UTC	14681	IN	Data Raw: 61 29 7b 61 3d 62 28 61 2c 63 29 3b 61 21 3d 6e 75 6c 6c 26 26 28 74 68 69 73 2e 6d 6f 64 75 6c 65 45 6e 63 6f 64 69 6e 67 73 3d 61 29 7d 7d 2c 7b 6b 65 79 3a 22 61 64 64 45 6e 63 6f 64 69 6e 67 73 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 63 3d 74 68 69 73 3b 69 66 28 67 2e 66 62 71 3d 3d 6e 75 6c 6c 7c 7c 67 2e 66 62 71 2e 5f 5f 66 62 65 76 65 6e 74 73 52 65 73 6f 6c 76 65 64 4d 6f 64 75 6c 65 73 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 3b 69 66 28 74 68 69 73 2e 6d 6f 64 75 6c 65 45 6e 63 6f 64 69 6e 67 73 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 3b 76 61 72 20 66 3d 62 28 67 2e 66 62 71 2e 5f 5f 66 62 65 76 65 6e 74 73 52 65 73 6f 6c 76 65 64 4d 6f 64 75 6c 65 73 2c 64 2e 6f 62 6a 65 63 74 28 29 29 3b 69 66 28 66 3d 3d 6e 75 Data Ascii: a){a=b(a,c);a!=null&&(this.moduleEncodings=a)}},{key:"addEncodings",value:function(a){var c=this;if(g.fbq==null\|\|g.fbq.__fbeventsResolvedModules==null)return;if(this.moduleEncodings==null)return;var f=b(g.fbq.__fbeventsResolvedModules,d.object());if(f==nu
2024-11-15 14:59:41 UTC	16384	IN	Data Raw: 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 4c 6f 67 67 69 6e 67 22 29 2c 63 3d 62 2e 6c 6f 67 45 72 72 6f 72 3b 62 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 55 74 69 6c 73 22 29 3b 76 61 72 20 64 3d 62 2e 6d 61 70 2c 65 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 50 61 72 61 6d 4c 69 73 74 22 29 2c 68 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 73 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 53 65 6e 64 42 65 61 63 6f 6e 22 29 2c 69 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 73 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 53 65 6e 64 47 45 54 22 29 2c 6a Data Ascii: entsModules("SignalsFBEventsLogging"),c=b.logError;b=f.getFbeventsModules("SignalsFBEventsUtils");var d=b.map,e=f.getFbeventsModules("SignalsParamList"),h=f.getFbeventsModules("signalsFBEventsSendBeacon"),i=f.getFbeventsModules("signalsFBEventsSendGET"),j
2024-11-15 14:59:41 UTC	16384	IN	Data Raw: 72 22 29 74 68 72 6f 77 20 6e 65 77 20 67 28 29 3b 72 65 74 75 72 6e 20 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 72 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 28 74 79 70 65 6f 66 20 61 3d 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 22 75 6e 64 65 66 69 6e 65 64 22 3a 69 28 61 29 29 21 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 7c 7c 61 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 67 28 29 3b 72 65 74 75 72 6e 20 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 73 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 28 74 79 70 65 6f 66 20 61 3d 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 22 75 6e 64 65 66 69 6e 65 64 22 3a 69 28 61 29 29 21 3d 3d 22 6f 62 6a 65 63 74 22 26 26 Data Ascii: r")throw new g();return a}}function r(){return function(a){if((typeof a==="undefined"?"undefined":i(a))!=="object"\|\|Array.isArray(a)\|\|a==null)throw new g();return a}}function s(){return function(a){if((typeof a==="undefined"?"undefined":i(a))!=="object"&&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	49893	54.217.99.7	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:41 UTC	792	OUT	GET /img/beacon.gif?id=54328dddabe53db9497b23c6&sAW=1280&sAH=984&bIW=1034&bIH=870&pD=24&dPR=1&or=landscape-primary&nT=0&rC=0&nS=0&cS=1740&cE=2590&dLE=1740&dLS=1732&fS=1719&hS=1740&rE=-1&rS=-1&reS=2607&resS=2883&resE=3006&uEE=-1&uES=-1&dL=2920&dI=6111&dCLES=12491&dCLEE=12493&dC=12525&lES=12525&lEE=12525&s=nt&title=First%20run&path=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&ref=&sId=6d4mnwic&sST=1731682778&sIS=1&rV=0&v=1.4.1 HTTP/1.1 Host: rum-collector-2.pingdom.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:41 UTC	208	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Cache-Control: no-cache, no-store, must-revalidate Date: Fri, 15 Nov 2024 14:59:41 GMT Expires: 0 Pragma: no-cache Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:41 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:41 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:41 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 56737357-c01e-0014-3efa-36a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145941Z-164f84587bfjxw6fhC1DFWq94400000001mg000000007n9e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:41 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:41 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:41 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:41 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: eef1fd5d-a01e-006f-4c9a-3613cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145941Z-164f84587bft9l9khC1DFW32rc00000001fg000000005krc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:41 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:41 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:41 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: aa86c2cb-a01e-0021-1ba3-34814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145941Z-1866b5c5fbbqjkpbhC1DFWt4h400000001ng00000000bsug x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	49902	104.244.42.195	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:41 UTC	1069	OUT	GET /i/adsct?bci=3&dv=America%2FNew_York%26en-US%2Cen%26Google%20Inc.%26Win32%26255%261280%261024%264%2624%261280%26984%260%26na&eci=2&event_id=cff2a29a-f564-408a-9834-ff7d0dacc979&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=b44ecccc-6ffc-4513-83c8-8720371a64fe&tw_document_href=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzcii&type=javascript&version=2.3.31 HTTP/1.1 Host: analytics.twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telerik.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 14:59:41 UTC	571	IN	HTTP/1.1 200 OK date: Fri, 15 Nov 2024 14:59:40 GMT perf: 7402827104 server: tsa_b set-cookie: personalization_id="v1_qWdBg7UfUb1N1Z/SS9IVHg=="; Max-Age=63072000; Expires=Sun, 15 Nov 2026 14:59:41 GMT; Path=/; Domain=.twitter.com; Secure; SameSite=None content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: 472932c673a154fa strict-transport-security: max-age=631138519 x-response-time: 6 x-connection-hash: b0d32866bb68a5265b9c4c200aa59b40198f6f0396e614c672c42bd9ee241df5 connection: close
2024-11-15 14:59:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 14:59:41 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 14:59:41 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 14:59:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 5c60c0f5-901e-0067-06a2-34b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T145941Z-1866b5c5fbb55pxzhC1DFW1aps00000001eg00000000ch62 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 14:59:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Target ID:	0
Start time:	09:58:57
Start date:	15/11/2024
Path:	C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe"
Imagebase:	0x400000
File size:	4'656'360 bytes
MD5 hash:	C1980B018489DF28BE8809EB32519001
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	09:58:57
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=
Imagebase:	0x400000
File size:	4'583'304 bytes
MD5 hash:	C2A0EB6F104EACEC3F39581451EE208F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	09:59:07
Start date:	15/11/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="FiddlerProxy"
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:59:07
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:59:07
Start date:	15/11/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="FiddlerProxy" program="C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe" action=allow profile=any dir=in edge=deferuser protocol=tcp description="Permit inbound connections to Fiddler"
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:59:07
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:59:07
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe"
Imagebase:	0x7ff6ec7d0000
File size:	174'552 bytes
MD5 hash:	B6C3FE33B436E5006514403824F17C66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:59:07
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:59:07
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\user\AppData\Local\Programs\Fiddler\EnableLoopback.exe"
Imagebase:	0x7ff6ec7d0000
File size:	174'552 bytes
MD5 hash:	B6C3FE33B436E5006514403824F17C66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:59:07
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper" /a "C:\Users\user\AppData\Local\Programs\Fiddler"
Imagebase:	0x4d0000
File size:	18'496 bytes
MD5 hash:	B1827FCA38A5D49FB706A4A7EEE4A778
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:59:07
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:59:07
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:59:08
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 0 -NGENProcess 1bc -Pipe 1c8 -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:59:08
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://fiddler2.com/r/?Fiddler2FirstRun
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	09:59:11
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2020,i,18335219383054077630,11953133906641342437,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	09:59:13
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 0 -NGENProcess 274 -Pipe 27c -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	09:59:13
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 0 -NGENProcess 1bc -Pipe 264 -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:59:13
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 0 -NGENProcess 288 -Pipe 290 -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	09:59:13
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 0 -NGENProcess 298 -Pipe 1dc -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	09:59:17
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 0 -NGENProcess 28c -Pipe 280 -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:59:17
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 0 -NGENProcess 2bc -Pipe 26c -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	09:59:18
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 330 -Pipe 320 -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	09:59:23
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 0 -NGENProcess 2dc -Pipe 33c -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	09:59:23
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 0 -NGENProcess 34c -Pipe 354 -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	09:59:24
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 0 -NGENProcess 328 -Pipe 2dc -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	09:59:25
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 0 -NGENProcess 36c -Pipe 34c -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	09:59:31
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 0 -NGENProcess 330 -Pipe 368 -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	09:59:40
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 0 -NGENProcess 36c -Pipe 18c -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	09:59:40
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 0 -NGENProcess 38c -Pipe 388 -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	09:59:40
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 0 -NGENProcess 3a4 -Pipe 3b0 -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	09:59:40
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 0 -NGENProcess 3a0 -Pipe 38c -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	09:59:41
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4208 --field-trial-handle=2020,i,18335219383054077630,11953133906641342437,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	09:59:41
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4092 --field-trial-handle=2020,i,18335219383054077630,11953133906641342437,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	09:59:41
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 0 -NGENProcess 3c8 -Pipe 3a4 -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	09:59:41
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 0 -NGENProcess 3b4 -Pipe 390 -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	09:59:41
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 0 -NGENProcess 394 -Pipe 18c -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	09:59:41
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 0 -NGENProcess 328 -Pipe 380 -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	09:59:41
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 0 -NGENProcess 1c8 -Pipe 1d4 -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	09:59:41
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 0 -NGENProcess 24c -Pipe 260 -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	09:59:41
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 0 -NGENProcess 270 -Pipe 278 -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	09:59:41
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 0 -NGENProcess 26c -Pipe 284 -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	09:59:41
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 0 -NGENProcess 28c -Pipe 294 -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	09:59:43
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 0 -NGENProcess 310 -Pipe 30c -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	09:59:44
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 0 -NGENProcess 31c -Pipe 324 -Comment "NGen Worker Process"
Imagebase:	0x7ff6a58b0000
File size:	151'984 bytes
MD5 hash:	412A3FB0C25743DA59375C1E298933EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.1%
Total number of Nodes:	1378
Total number of Limit Nodes:	26

Executed Functions

Function 0040351C Relevance: 81.0, APIs: 32, Strings: 14, Instructions: 464
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 0040353F
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040356A
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 0040357D
lstrlenA.KERNEL32(UXTHEME,UXTHEME,?,?,?,?,?,?,?,?), ref: 00403616
#17.COMCTL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403653
OleInitialize.OLE32(00000000), ref: 0040365A
SHGetFileInfoW.SHELL32(00420EC8,00000000,?,000002B4,00000000), ref: 00403679
GetCommandLineW.KERNEL32(00428A20,NSIS Error,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040368E
CharNextW.USER32(00000000,00434000,00000020,00434000,00000000,?,00000008,0000000A,0000000C), ref: 004036C7
GetTempPathW.KERNELBASE(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00008001,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004037FF
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403810
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040381C
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403830
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403838
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403849
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403851
DeleteFileW.KERNELBASE(1033,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403865
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00434000,00000000,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040393E

Part of subcall function 00406541: lstrcpynW.KERNEL32(?,?,00000400,0040368E,00428A20,NSIS Error,?,00000008,0000000A,0000000C), ref: 0040654E

wsprintfW.USER32 ref: 0040399B
GetFileAttributesW.KERNEL32(0042C800,C:\Users\user\AppData\Local\Temp\), ref: 004039CE
DeleteFileW.KERNEL32(0042C800), ref: 004039DA
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403A08

Part of subcall function 00406301: MoveFileExW.KERNEL32(?,?,00000005,00405DFF,?,00000000,000000F1,?,?,?,?,?), ref: 0040630B

CopyFileW.KERNEL32(C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe,0042C800,00000001,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403A1E

Part of subcall function 00405B24: CreateProcessW.KERNELBASE(00000000,0042C800,00000000,00000000,00000000,04000000,00000000,00000000,00425F10,?,?,?,0042C800,?), ref: 00405B4D
Part of subcall function 00405B24: CloseHandle.KERNEL32(?,?,?,0042C800,?), ref: 00405B5A

Part of subcall function 0040689E: FindFirstFileW.KERNELBASE(75923420,00425F58,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,00405F61,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,00000000,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C6D,?,75923420,C:\Users\user\AppData\Local\Temp\), ref: 004068A9
Part of subcall function 0040689E: FindClose.KERNEL32(00000000), ref: 004068B5

OleUninitialize.OLE32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403A6C
ExitProcess.KERNEL32 ref: 00403A89
CloseHandle.KERNEL32(00000000,0042D000,0042D000,?,0042C800,00000000), ref: 00403A90
GetCurrentProcess.KERNEL32(00000028,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403AAC
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?), ref: 00403AB3
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AC8
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00403AEB
ExitWindowsEx.USER32(00000002,80040002), ref: 00403B10
ExitProcess.KERNEL32 ref: 00403B33

Part of subcall function 00405AEF: CreateDirectoryW.KERNELBASE(?,00000000,0040350F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403806,?,00000008,0000000A,0000000C), ref: 00405AF5

Strings

C:\Users\user\Desktop, xrefs: 0040395C
Error launching installer, xrefs: 004038E7
~nsu%X.tmp, xrefs: 00403992
C:\Users\user\AppData\Local\Temp\, xrefs: 004037F4, 004037F9, 0040380F, 0040381B, 0040382A, 00403837, 00403843, 0040384B, 00403939, 004039BA, 004039E6, 00403A07, 00403A10
TMP, xrefs: 0040384C
C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe, xrefs: 00403A19
SeShutdownPrivilege, xrefs: 00403AC2
Low, xrefs: 00403832
NSIS Error, xrefs: 0040367F
UXTHEME, xrefs: 0040360A, 0040360F, 00403615
\Temp, xrefs: 00403816
1033, xrefs: 00403860
TEMP, xrefs: 00403844
C:\Users\user\AppData\Local\Temp\nskEDF3.tmp, xrefs: 00403911

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: File$Process$CloseDirectoryExit$CreateCurrentDeleteEnvironmentFindHandlePathTempTokenVariableVersionWindowslstrcatlstrlen$AdjustAttributesCharCommandCopyErrorFirstInfoInitializeLineLookupModeMoveNextOpenPrivilegePrivilegesUninitializeValuelstrcpynwsprintf
String ID: 1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nskEDF3.tmp$C:\Users\user\Desktop$C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu%X.tmp
API String ID: 1813718867-383870148
Opcode ID: daee1b245cf7e07369d61f24f389d4badec905710e97a29cd4a8bfd3b1e66271
Instruction ID: b6c3ecddbcec298392be70143bc2b9781a35be0696dc4cb4866b7eddd329dddd
Opcode Fuzzy Hash: daee1b245cf7e07369d61f24f389d4badec905710e97a29cd4a8bfd3b1e66271
Instruction Fuzzy Hash: A9F12370604311ABD720AF659D05B2B7EE8EF8570AF10483EF481B22D1DB7D9A45CB6E

Function 00405C4D Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,75923420,C:\Users\user\AppData\Local\Temp\,00434000), ref: 00405C76
lstrcatW.KERNEL32(00424F10,\*.*,00424F10,?,?,75923420,C:\Users\user\AppData\Local\Temp\,00434000), ref: 00405CBE
lstrcatW.KERNEL32(?,0040A014,?,00424F10,?,?,75923420,C:\Users\user\AppData\Local\Temp\,00434000), ref: 00405CE1
lstrlenW.KERNEL32(?,?,0040A014,?,00424F10,?,?,75923420,C:\Users\user\AppData\Local\Temp\,00434000), ref: 00405CE7
FindFirstFileW.KERNEL32(00424F10,?,?,?,0040A014,?,00424F10,?,?,75923420,C:\Users\user\AppData\Local\Temp\,00434000), ref: 00405CF7
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405D97
FindClose.KERNEL32(00000000), ref: 00405DA6

Strings

\*.*, xrefs: 00405CB8
C:\Users\user\AppData\Local\Temp\, xrefs: 00405C5A

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3547449828
Opcode ID: 0b85f367639a69f5b614f98777155fba44d4349fb39831c7af8fd38ecdabae30
Instruction ID: c1737a7785d2a2f908f5f44de07c4aee1227101a85bdbc8c56ed50a571596083
Opcode Fuzzy Hash: 0b85f367639a69f5b614f98777155fba44d4349fb39831c7af8fd38ecdabae30
Instruction Fuzzy Hash: 3241C430800A14BADB216B65CD4DABF7678DF41758F14813BF802B21D1D77C4AC19EAE

Function 0040689E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(75923420,00425F58,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,00405F61,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,00000000,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C6D,?,75923420,C:\Users\user\AppData\Local\Temp\), ref: 004068A9
FindClose.KERNEL32(00000000), ref: 004068B5

Strings

X_B, xrefs: 0040689F
C:\Users\user\AppData\Local\Temp\nskEDF3.tmp, xrefs: 0040689E

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp$X_B
API String ID: 2295610775-3946764874
Opcode ID: 368a1c0a689282c2aa5195ddf357efb180b92b440bed087baa82a07527058284
Instruction ID: f67f359cedd367be1f2f51a398ada2a6aadcf11014009cc1af4821528039bb17
Opcode Fuzzy Hash: 368a1c0a689282c2aa5195ddf357efb180b92b440bed087baa82a07527058284
Instruction Fuzzy Hash: 68D0123251A5205BC64067396E0C84B7B58AF153717268A36F5AAF21E0CB348C6A969C

Function 00406C5F Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c61fa70d481ae7decb37dc56cf27f7a4c6ea5b826eb98dd3ad332090416f9cd2
Instruction ID: db5d81fcbfa5be4a2d8af1487b95e9640f9c883cb1993a3fcb30b22963867ec5
Opcode Fuzzy Hash: c61fa70d481ae7decb37dc56cf27f7a4c6ea5b826eb98dd3ad332090416f9cd2
Instruction Fuzzy Hash: 87F17871D04229CBDF28CFA8C8946ADBBB0FF44305F25816ED456BB281D7786A86CF45

Function 00403C13 Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406935: GetModuleHandleA.KERNEL32(?,00000020,?,0040362C,0000000C,?,?,?,?,?,?,?,?), ref: 00406947
Part of subcall function 00406935: GetProcAddress.KERNEL32(00000000,?), ref: 00406962

lstrcatW.KERNEL32(1033,00422F08,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422F08,00000000,00000002,75923420,C:\Users\user\AppData\Local\Temp\,00000000,00434000,00008001), ref: 00403C94
lstrlenW.KERNEL32("C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=,?,?,?,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=,00000000,00434800,1033,00422F08,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422F08,00000000,00000002,75923420), ref: 00403D14
lstrcmpiW.KERNEL32(?,.exe,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=,?,?,?,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=,00000000,00434800,1033,00422F08,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422F08,00000000), ref: 00403D27
GetFileAttributesW.KERNEL32("C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=), ref: 00403D32
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00434800), ref: 00403D7B

Part of subcall function 00406488: wsprintfW.USER32 ref: 00406495

RegisterClassW.USER32(004289C0), ref: 00403DB8
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403DD0
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403E05
ShowWindow.USER32(00000005,00000000), ref: 00403E3B
GetClassInfoW.USER32(00000000,RichEdit20W,004289C0), ref: 00403E67
GetClassInfoW.USER32(00000000,RichEdit,004289C0), ref: 00403E74
RegisterClassW.USER32(004289C0), ref: 00403E7D
DialogBoxParamW.USER32(?,00000000,00403FC1,00000000), ref: 00403E9C

Strings

_Nb, xrefs: 00403D97, 00403DFF
.DEFAULT\Control Panel\International, xrefs: 00403C7F
RichEdit20W, xrefs: 00403E5F, 00403E65
RichEd32, xrefs: 00403E4F
1033, xrefs: 00403C33, 00403C8F
.exe, xrefs: 00403D21
Control Panel\Desktop\ResourceLocale, xrefs: 00403C47
C:\Users\user\AppData\Local\Temp\, xrefs: 00403C18
"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=, xrefs: 00403CDB, 00403CE4, 00403CF2, 00403D41, 00403D47
RichEdit, xrefs: 00403E6E
RichEd20, xrefs: 00403E41

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-2605405731
Opcode ID: 5037b0ac7b0afaf53c36cfd73c50730ff94dd9e4d82060fed1f88605cc91a9c7
Instruction ID: 5b9c441e0465166458f669e0e2db1e5d0b29f952519833dd96bf398df7fa21fd
Opcode Fuzzy Hash: 5037b0ac7b0afaf53c36cfd73c50730ff94dd9e4d82060fed1f88605cc91a9c7
Instruction Fuzzy Hash: E661D570600300BAD620AF66DD46F3B3A7CEB84B49F81453FF941B61E2CB795952CA6D

Function 004030A2 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004030B3
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe,00000400), ref: 004030CF

Part of subcall function 00406031: GetFileAttributesW.KERNELBASE(00000003,004030E2,C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe,80000000,00000003), ref: 00406035
Part of subcall function 00406031: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00406057

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe,C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe,80000000,00000003), ref: 0040311B
GlobalAlloc.KERNELBASE(00000040,?), ref: 00403251

Strings

C:\Users\user\Desktop, xrefs: 004030FD, 00403102, 00403108
soft, xrefs: 00403190
Error launching installer, xrefs: 004030F2
Inst, xrefs: 00403187
C:\Users\user\AppData\Local\Temp\, xrefs: 004030A9
C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe, xrefs: 004030B9, 004030C8, 004030DC, 004030FC
Null, xrefs: 00403199
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403278

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-1509561350
Opcode ID: f6f149303cde104692999693530b98443d3dd0b2c967e283c98aa5a581eac7be
Instruction ID: 0f45a59523ef10b9f6d61eaf83b2f91e1f12d324a613ce28672a4e7bf9d48b30
Opcode Fuzzy Hash: f6f149303cde104692999693530b98443d3dd0b2c967e283c98aa5a581eac7be
Instruction Fuzzy Hash: 7B51B071A01304AFDB209F65DD86B9E7FACAB08356F20417BF504B62D1CB789E818B5D

Function 00401794 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,?,?,00000031), ref: 004017D5
CompareFileTime.KERNEL32(-00000014,?,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=,00000000,00000000,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,?,?,00000031), ref: 004017FA

Part of subcall function 00406541: lstrcpynW.KERNEL32(?,?,00000400,0040368E,00428A20,NSIS Error,?,00000008,0000000A,0000000C), ref: 0040654E

Part of subcall function 004055C6: lstrlenW.KERNEL32(00421EE8,00000000,0069339A,00000000,?,?,?,?,?,?,?,?,?,00403412,00000000,?), ref: 004055FE
Part of subcall function 004055C6: lstrlenW.KERNEL32(00403412,00421EE8,00000000,0069339A,00000000,?,?,?,?,?,?,?,?,?,00403412,00000000), ref: 0040560E
Part of subcall function 004055C6: lstrcatW.KERNEL32(00421EE8,00403412,00403412,00421EE8,00000000,0069339A,00000000), ref: 00405621
Part of subcall function 004055C6: SetWindowTextW.USER32(00421EE8,00421EE8), ref: 00405633
Part of subcall function 004055C6: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405659
Part of subcall function 004055C6: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405673
Part of subcall function 004055C6: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405681

Strings

C:\Users\user\AppData\Local\Temp\nskEDF3.tmp, xrefs: 0040185A, 00401876
"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=, xrefs: 004017B2, 004017BB, 004017DA, 004017E6, 0040181C, 00401832, 00401850, 0040188C, 0040190D, 00401916, 00401920, 0040192B
$VersionToInstall, xrefs: 00401846, 00401864
C:\Users\user\AppData\Local\Temp\nskEDF3.tmp, xrefs: 004017C3

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: "C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=$$VersionToInstall$C:\Users\user\AppData\Local\Temp\nskEDF3.tmp$C:\Users\user\AppData\Local\Temp\nskEDF3.tmp
API String ID: 1941528284-2840846884
Opcode ID: b5c9de8d8c973790bb063ac1906df9c73b5cc822e409ceab015e7b2e817133de
Instruction ID: 43cdcdb3dd666cfde73f7e2270c9ebc879cf542ec353fd5a36f292582218c0dc
Opcode Fuzzy Hash: b5c9de8d8c973790bb063ac1906df9c73b5cc822e409ceab015e7b2e817133de
Instruction Fuzzy Hash: 0141B431910604BACB117BA9DD86DBE3AB5EF45329F21427FF412B10E1CB3C8A91966D

Function 004032D9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040333A
GetTickCount.KERNEL32 ref: 004033BB
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004033E8
wsprintfW.USER32 ref: 004033FB

Strings

... %d%%, xrefs: 004033F5

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: 05f4ba2d2f2a4a5dfa404d26d053dcd1f9bdf675e575ac8564198bce70fe1ccc
Instruction ID: 37f968fffa50e4a1d2003f203ee40286d056d648d4267fa9fd8a089c231f80ea
Opcode Fuzzy Hash: 05f4ba2d2f2a4a5dfa404d26d053dcd1f9bdf675e575ac8564198bce70fe1ccc
Instruction Fuzzy Hash: 39517E71900219EBCB11DF65D944BAF3FA8AF40766F14417BF804BB2C1D7789E408BA9

Function 004068C5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068DC
wsprintfW.USER32 ref: 00406917
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040692B

Strings

UXTHEME, xrefs: 004068CE
%s%S.dll, xrefs: 00406911

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME
API String ID: 2200240437-1106614640
Opcode ID: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction ID: 5a11031caceee5166790be9fdf4905626ac305c011281564bfcfed8699633c36
Opcode Fuzzy Hash: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction Fuzzy Hash: 4FF0FC31501219A6CF10BB68DD0DF9B375C9B00304F10847EA546F10E0EB78D768C798

Function 00406060 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040607E
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,0040351A,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403806), ref: 00406099

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406065
nsa, xrefs: 0040606D

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-44229769
Opcode ID: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction ID: 6ac4114a0c6328616d68196ae331b9967fc339ed7b26ce04d623ba2336a1d7a6
Opcode Fuzzy Hash: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction Fuzzy Hash: D4F09076B40204BBEB00CF69ED05F9FB7ACEB95750F11803AFA01F7180E6B099548768

Function 004015E6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405EBB: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,?,00405F2F,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C6D,?,75923420,C:\Users\user\AppData\Local\Temp\,00434000), ref: 00405EC9
Part of subcall function 00405EBB: CharNextW.USER32(00000000), ref: 00405ECE
Part of subcall function 00405EBB: CharNextW.USER32(00000000), ref: 00405EE6

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040163F

Part of subcall function 00405A95: CreateDirectoryW.KERNELBASE(0042C800,?), ref: 00405AD7

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,?,00000000,000000F0), ref: 00401672

Strings

C:\Users\user\AppData\Local\Temp\nskEDF3.tmp, xrefs: 00401665

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp
API String ID: 1892508949-1036905562
Opcode ID: a64431a77bffabb549fafc7082d3351f8412fc4dcc05edca3b1d50bfae194cce
Instruction ID: 707209c2395922376f9f001c82b8f9212c950a3f0646f554414056ec45e3a30b
Opcode Fuzzy Hash: a64431a77bffabb549fafc7082d3351f8412fc4dcc05edca3b1d50bfae194cce
Instruction Fuzzy Hash: DC11B231504514EBDF206FA5CD415AF36B0EF14368B25493FE942B22F1D63E4A81DA9D

Function 00407094 Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff22e2e2fe9ce3de78e7ddd3335664d820a6fec416f6b591a6c72a947d9530d
Instruction ID: 57bf2fd90c69a3a2134d3ca1d9604f9a54cf20ddad3feead76618616929b2f58
Opcode Fuzzy Hash: 2ff22e2e2fe9ce3de78e7ddd3335664d820a6fec416f6b591a6c72a947d9530d
Instruction Fuzzy Hash: 17A15471E04229CBDF28CFA8C8546ADBBB1FF44305F10846ED816BB281D7786A86DF45

Function 00407295 Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bdb7e84a84856003d11171116f50dfbd9bb9a779b2e7a3e4899fdc47cedc848
Instruction ID: 6b1c66eb9f97b1ade68f1d395623a9ed29f1776dbc94043a645b3c6b65beda35
Opcode Fuzzy Hash: 0bdb7e84a84856003d11171116f50dfbd9bb9a779b2e7a3e4899fdc47cedc848
Instruction Fuzzy Hash: C5912270E04228CBDF28CF98C854BADBBB1FF44305F14816AD856BB281D778A986DF45

Function 00406FAB Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be7a598e94a0405de8a772e3f69c54869daecda94b4303a07673bf76e2652f1c
Instruction ID: ce41943af36f178b06a8ef9aeec7331a28cc36c4f565c07526a7a1ecbc0683f6
Opcode Fuzzy Hash: be7a598e94a0405de8a772e3f69c54869daecda94b4303a07673bf76e2652f1c
Instruction Fuzzy Hash: 8C813571E04228CFDF24CFA8C844BADBBB1FB45305F24816AD456BB281D778A986DF45

Function 00406AB0 Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32d59b201beac9d8f322f7ad5055b4a277c8e7969ed8db35c8d1fbf5724c7b18
Instruction ID: 8f4657df29e0a6c4f41eae1c6e560b42ebe12933d6c33c39fa024371cffe791d
Opcode Fuzzy Hash: 32d59b201beac9d8f322f7ad5055b4a277c8e7969ed8db35c8d1fbf5724c7b18
Instruction Fuzzy Hash: F4815771E04228DBDF24CFA8C8447ADBBB1FF44315F10816AD856BB281D7786986DF45

Function 00406EFE Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ad3ccd1842de9fa96a72a1c56b2a37abd66cddd4bfb2a4aa43cc43f3deb674d
Instruction ID: 467485e0bb60f7ca81b57cb4e762169b1f98b62e9d0b722d18e83a7fcf81438f
Opcode Fuzzy Hash: 5ad3ccd1842de9fa96a72a1c56b2a37abd66cddd4bfb2a4aa43cc43f3deb674d
Instruction Fuzzy Hash: 04711375E04228CBDF24CFA8C844BADBBF1FB48305F15806AD856B7281D778A986DF45

Function 0040701C Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702cc36666a341df00ed023e166d9505421316bb70e071c2ca241f15019959e6
Instruction ID: 8594309fab6a939f8579025671b20e25c27ad2f20b93bd04310bc8f9388019e2
Opcode Fuzzy Hash: 702cc36666a341df00ed023e166d9505421316bb70e071c2ca241f15019959e6
Instruction Fuzzy Hash: A6713471E04228CBDF28CF98C844BADBBB1FF45305F14806AD816BB281D778A986DF45

Function 00406F68 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97fac772243d771687d70cd7bd51d4e603ca3fb4096038018fdbee07d45d8760
Instruction ID: 804367245b599a5d262e6525417658d62bb0317a144133a249ff79fbb491f744
Opcode Fuzzy Hash: 97fac772243d771687d70cd7bd51d4e603ca3fb4096038018fdbee07d45d8760
Instruction Fuzzy Hash: 04712571E04228CBDF28CF98C854BADBBB1FF44305F15806AD856B7281C778A986DF45

Function 00401BC0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(006A0220), ref: 00401C30
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401C42

Strings

"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=, xrefs: 00401BE7, 00401BED, 00401C07

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Global$AllocFree
String ID: "C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=
API String ID: 3394109436-2788633850
Opcode ID: 912042247f91428da489115643b6de71280009c4a347fbe359cf9eb4d516dc52
Instruction ID: b885d26f68b874ad9ff9a305e80acb85bda866dca5011e4f065ba1a91b1516cf
Opcode Fuzzy Hash: 912042247f91428da489115643b6de71280009c4a347fbe359cf9eb4d516dc52
Instruction Fuzzy Hash: 09218473904610ABD730ABA4DE85A6E72A4AB04328715053FF952B32D4C6BCE8919B5D

Function 0040254F Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 00402580
RegCloseKey.ADVAPI32(?,?,?,$VersionToInstall,00000000,00000011,00000002), ref: 00402622

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: f9b5b70eb5f8eb92ec57ded847e112811e229396ee3b7d9d1295a2e9ebcd785a
Instruction ID: d59507dec88f13297dcb42e268b6e0170753ff524d958fced3891ef78adf3038
Opcode Fuzzy Hash: f9b5b70eb5f8eb92ec57ded847e112811e229396ee3b7d9d1295a2e9ebcd785a
Instruction Fuzzy Hash: 8F118C71904216EADF15DFA0CA589AEB7B4FF04348F20443FE806B62D0D3B84A45DB9D

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(0040A2D8,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 24120cd7971efbcf380a3cfcf85aef56aa5faf56da28ec4d1ccb8bb0957475b6
Instruction ID: 2b867b2a322a557ec20ecaa395e060e0be7e2a6973b32d365fcb6e947ad1390c
Opcode Fuzzy Hash: 24120cd7971efbcf380a3cfcf85aef56aa5faf56da28ec4d1ccb8bb0957475b6
Instruction Fuzzy Hash: 9E01F4327242209BE7195B389D05B6B3798E710314F10863FF855F66F1DA78CC429B4C

Function 00405A95 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(0042C800,?), ref: 00405AD7
GetLastError.KERNEL32 ref: 00405AE5

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 93d1f65b513afb97053b6d969de6af344d99c991354c8e43ed6bd2c6eb9068ab
Instruction ID: d90010de02f5ef9460f17531ca4347861228eabf88ca3652e96e8ae86f83f0cd
Opcode Fuzzy Hash: 93d1f65b513afb97053b6d969de6af344d99c991354c8e43ed6bd2c6eb9068ab
Instruction Fuzzy Hash: 5FF017B1D0060EDBDF00CFA4D6487EFBBB4AF04309F00812AD941B6281D7B882488FE9

Function 00405B24 Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,0042C800,00000000,00000000,00000000,04000000,00000000,00000000,00425F10,?,?,?,0042C800,?), ref: 00405B4D
CloseHandle.KERNEL32(?,?,?,0042C800,?), ref: 00405B5A

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: ab728716b39bc4ae5022fc4c28ab15e9e5542c8e0cf41f1555c5a84b4fa30c9d
Instruction ID: 3e6b85693243cf5959e47e0a5ce0ecee53803ede082a99688cf67a66356fc275
Opcode Fuzzy Hash: ab728716b39bc4ae5022fc4c28ab15e9e5542c8e0cf41f1555c5a84b4fa30c9d
Instruction Fuzzy Hash: 3AE0BFB4A10219BFFB10AB64ED05F7B77BCF704604F418825BD10F2551D774A9148A7C

Function 00406935 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,0040362C,0000000C,?,?,?,?,?,?,?,?), ref: 00406947
GetProcAddress.KERNEL32(00000000,?), ref: 00406962

Part of subcall function 004068C5: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068DC
Part of subcall function 004068C5: wsprintfW.USER32 ref: 00406917
Part of subcall function 004068C5: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040692B

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
Instruction ID: 5f896a6f513cb693e05c26686958cbb9026995673407ad46a654cc37c4de4e39
Opcode Fuzzy Hash: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
Instruction Fuzzy Hash: BCE0CD73604310EBD61067755D0493773E89F85B50302483EF947F2140D734DC32A7AA

Function 00406031 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004030E2,C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe,80000000,00000003), ref: 00406035
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00406057

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction ID: 9d50a09f5748d4f60ef03139cc16a9656d1073ae209d3065c053d14625e31d4c
Opcode Fuzzy Hash: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction Fuzzy Hash: 87D09E31654301AFEF098F20DE16F2EBAA2EB84B00F11552CB682941E0DA715819DB15

Function 0040600C Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405C11,?,?,00000000,00405DE7,?,?,?,?), ref: 00406011
SetFileAttributesW.KERNEL32(?,00000000), ref: 00406025

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
Instruction ID: fbd6844141adfc982ff7d741096df028d7bbee698e850df9006aa2ae5f51d9dd
Opcode Fuzzy Hash: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
Instruction Fuzzy Hash: 24D0C972504221AFC2103728EE0889BBF55DB542717028A35F8A9A22B0CB304C668694

Function 00405AEF Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,0040350F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403806,?,00000008,0000000A,0000000C), ref: 00405AF5
GetLastError.KERNEL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405B03

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction ID: c3646108da72950d5b730f2af08982bf7448ccd78712563759f5c9f930c8cbe9
Opcode Fuzzy Hash: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction Fuzzy Hash: 11C04C70244906DAD6509B219F0C71779A0EB50781F195839A586E50A0DA34B455D92D

Function 004060E3 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,0040349F,00000000,00414EC0,?,00414EC0,?,000000FF,00000004,00000000), ref: 004060F7

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction ID: b9d802e93a63440494d75fc60edee4ff4d41d1542efeb3ab79d4fb436c6ecda5
Opcode Fuzzy Hash: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction Fuzzy Hash: 91E08C3220422AABEF109E909C04EEB3B6CEB003A0F014432FD26E6050D271E9319BA4

Function 004060B4 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034D1,00000000,00000000,00403328,000000FF,00000004,00000000,00000000,00000000), ref: 004060C8

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction ID: 0a9ed9335d9fcbf33a9b7557f86da276afb46ac39f2db62fb679b5cfb923300a
Opcode Fuzzy Hash: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction Fuzzy Hash: C1E0BF32250269ABDF109E559C00AAB775CEB05251F014436B955E7150D671E92197A4

Function 004063AE Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00421EE8,00000000,00000000,?,?,00000000,?,0040643C,?,00421EE8,?,?,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=,?,00000000), ref: 004063D2

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
Instruction ID: 160c38975f312424f4866d14917befa5dd24af40cdf73f4d33e28196d90f96f9
Opcode Fuzzy Hash: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
Instruction Fuzzy Hash: 44D0123204020EBBDF115E90ED01FAB3B1DAB08350F014426FE06E40A0D775D534A754

Function 004034D4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403267,?), ref: 004034E2

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction ID: 1f5c7ae16c2334422adcad36111bde95194575cbdac9b1f52e29a9f6e91cc98e
Opcode Fuzzy Hash: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction Fuzzy Hash: 34B01271240300BFDA214F00DF09F057B21ABA0700F10C034B388380F086711035EB0D

Function 00401FC9 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004055C6: lstrlenW.KERNEL32(00421EE8,00000000,0069339A,00000000,?,?,?,?,?,?,?,?,?,00403412,00000000,?), ref: 004055FE
Part of subcall function 004055C6: lstrlenW.KERNEL32(00403412,00421EE8,00000000,0069339A,00000000,?,?,?,?,?,?,?,?,?,00403412,00000000), ref: 0040560E
Part of subcall function 004055C6: lstrcatW.KERNEL32(00421EE8,00403412,00403412,00421EE8,00000000,0069339A,00000000), ref: 00405621
Part of subcall function 004055C6: SetWindowTextW.USER32(00421EE8,00421EE8), ref: 00405633
Part of subcall function 004055C6: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405659
Part of subcall function 004055C6: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405673
Part of subcall function 004055C6: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405681

Part of subcall function 00405B24: CreateProcessW.KERNELBASE(00000000,0042C800,00000000,00000000,00000000,04000000,00000000,00000000,00425F10,?,?,?,0042C800,?), ref: 00405B4D
Part of subcall function 00405B24: CloseHandle.KERNEL32(?,?,?,0042C800,?), ref: 00405B5A

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00402010

Part of subcall function 004069E0: WaitForSingleObject.KERNEL32(?,00000064), ref: 004069F1
Part of subcall function 004069E0: GetExitCodeProcess.KERNEL32(?,?), ref: 00406A13

Part of subcall function 00406488: wsprintfW.USER32 ref: 00406495

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 4af19e8990f14249d37718fe1ee1663bb12bcb7082944af9f650a7a100cf57c9
Instruction ID: 2b527fce213089fa12a92f7baeb69a5519dacc7bd52e038cdd259e112745fe09
Opcode Fuzzy Hash: 4af19e8990f14249d37718fe1ee1663bb12bcb7082944af9f650a7a100cf57c9
Instruction Fuzzy Hash: D0F09632904611ABDF30BBA59A895DF76B49F0035CF21413FE202B25D5C6BD4E41E76E

Non-executed Functions

Function 00405705 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405763
GetDlgItem.USER32(?,000003EE), ref: 00405772
GetClientRect.USER32(?,?), ref: 004057AF
GetSystemMetrics.USER32(00000002), ref: 004057B6
SendMessageW.USER32(?,00001061,00000000,?), ref: 004057D7
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004057E8
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004057FB
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405809
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040581C
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040583E
ShowWindow.USER32(?,00000008), ref: 00405852
GetDlgItem.USER32(?,000003EC), ref: 00405873
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405883
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040589C
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004058A8
GetDlgItem.USER32(?,000003F8), ref: 00405781

Part of subcall function 004044F5: SendMessageW.USER32(00000028,?,00000001,00404320), ref: 00404503

GetDlgItem.USER32(?,000003EC), ref: 004058C5
CreateThread.KERNEL32(00000000,00000000,Function_00005699,00000000), ref: 004058D3
CloseHandle.KERNEL32(00000000), ref: 004058DA
ShowWindow.USER32(00000000), ref: 004058FE
ShowWindow.USER32(?,00000008), ref: 00405903
ShowWindow.USER32(00000008), ref: 0040594D
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405981
CreatePopupMenu.USER32 ref: 00405992
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004059A6
GetWindowRect.USER32(?,?), ref: 004059C6
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004059DF
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A17
OpenClipboard.USER32(00000000), ref: 00405A27
EmptyClipboard.USER32 ref: 00405A2D
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A39
GlobalLock.KERNEL32(00000000), ref: 00405A43
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A57
GlobalUnlock.KERNEL32(00000000), ref: 00405A77
SetClipboardData.USER32(0000000D,00000000), ref: 00405A82
CloseClipboard.USER32 ref: 00405A88

Strings

{, xrefs: 0040596B

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 3824989ea0536e5c3d89d87b24ed579d9185aa06a8fa494c1d573172a0034d7b
Instruction ID: 1ec4b4c3d0988b91a44b02e8c0f1a80d5eff4bd371306251f5288e66bb296ab7
Opcode Fuzzy Hash: 3824989ea0536e5c3d89d87b24ed579d9185aa06a8fa494c1d573172a0034d7b
Instruction Fuzzy Hash: 4FB139B1900608FFDB11AFA0DD89AAE7B79FB04354F40813AFA41B61A0CB744E51DF68

Function 004049B1 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404A00
SetWindowTextW.USER32(00000000,?), ref: 00404A2A
SHBrowseForFolderW.SHELL32(?), ref: 00404ADB
CoTaskMemFree.OLE32(00000000), ref: 00404AE6
lstrcmpiW.KERNEL32("C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=,00422F08,00000000,?,?), ref: 00404B18
lstrcatW.KERNEL32(?,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=), ref: 00404B24
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B36

Part of subcall function 00405B85: GetDlgItemTextW.USER32(?,?,00000400,00404B6D), ref: 00405B98

Part of subcall function 004067EF: CharNextW.USER32(?,*?|<>/":,00000000,00434000,75923420,C:\Users\user\AppData\Local\Temp\,00000000,004034F7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403806,?,00000008,0000000A,0000000C), ref: 00406852
Part of subcall function 004067EF: CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406861
Part of subcall function 004067EF: CharNextW.USER32(?,00434000,75923420,C:\Users\user\AppData\Local\Temp\,00000000,004034F7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403806,?,00000008,0000000A,0000000C), ref: 00406866
Part of subcall function 004067EF: CharPrevW.USER32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000,004034F7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403806,?,00000008,0000000A,0000000C), ref: 00406879

GetDiskFreeSpaceW.KERNEL32(00420ED8,?,?,0000040F,?,00420ED8,00420ED8,?,00000001,00420ED8,?,?,000003FB,?), ref: 00404BF9
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404C14

Part of subcall function 00404D6D: lstrlenW.KERNEL32(00422F08,00422F08,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E0E
Part of subcall function 00404D6D: wsprintfW.USER32 ref: 00404E17
Part of subcall function 00404D6D: SetDlgItemTextW.USER32(?,00422F08), ref: 00404E2A

Strings

"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=, xrefs: 00404B12, 00404B17, 00404B22
A, xrefs: 00404AD4

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=$A
API String ID: 2624150263-1835090364
Opcode ID: 935987cb4f9461c6069e20587a72eda96bebf85d42a230f0735d58c75f334840
Instruction ID: bc895223e5afc39127eca44d4d62e4eac8fcc33aadfc8ea3f63fda85b43113f0
Opcode Fuzzy Hash: 935987cb4f9461c6069e20587a72eda96bebf85d42a230f0735d58c75f334840
Instruction Fuzzy Hash: 15A190B1A01208ABDB11DFA6DD45AAFB7B8EF84304F11403BF611B62D1D77C9A418B6D

Function 004021CF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084DC,?,00000001,004084CC,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040224E

Strings

C:\Users\user\AppData\Local\Temp\nskEDF3.tmp, xrefs: 0040228E

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp
API String ID: 542301482-1036905562
Opcode ID: 8882f6c087a9c260bd645c81a88a1ab3c106a841e164c85b8e9d93fe7746e708
Instruction ID: 7c9e104ca8be0d6b13ead4f97a80eb64338f0e545dbf3bddd9310e0b0504cb73
Opcode Fuzzy Hash: 8882f6c087a9c260bd645c81a88a1ab3c106a841e164c85b8e9d93fe7746e708
Instruction Fuzzy Hash: 54410575A00209AFCB00DFE4CA89AAD7BB5FF48318B20457EF505EB2D1DB799981CB54

Function 00402930 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040293F

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 37f2b48b27080797d787e445f9566862dc494f0e442a3a5c817077e9e4d44de1
Instruction ID: 9ac6bcba1e22606d8a3f98507846f809c14ae5b1cd4137618ecf9cbbc0e374ac
Opcode Fuzzy Hash: 37f2b48b27080797d787e445f9566862dc494f0e442a3a5c817077e9e4d44de1
Instruction Fuzzy Hash: D6F08C71A04115AFD710EBA4DA499AEB378EF14328F6001BBE116F31E5D7B88E419B29

Function 00404F2D Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404F45
GetDlgItem.USER32(?,00000408), ref: 00404F50
GlobalAlloc.KERNEL32(00000040,?), ref: 00404F9A
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404FB1
SetWindowLongW.USER32(?,000000FC,0040553A), ref: 00404FCA
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404FDE
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404FF0
SendMessageW.USER32(?,00001109,00000002), ref: 00405006
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405012
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00405024
DeleteObject.GDI32(00000000), ref: 00405027
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405052
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 0040505E
SendMessageW.USER32(?,00001132,00000000,?), ref: 004050F9
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00405129

Part of subcall function 004044F5: SendMessageW.USER32(00000028,?,00000001,00404320), ref: 00404503

SendMessageW.USER32(?,00001132,00000000,?), ref: 0040513D
GetWindowLongW.USER32(?,000000F0), ref: 0040516B
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00405179
ShowWindow.USER32(?,00000005), ref: 00405189
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405284
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004052E9
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004052FE
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405322
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405342
ImageList_Destroy.COMCTL32(?), ref: 00405357
GlobalFree.KERNEL32(?), ref: 00405367
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004053E0
SendMessageW.USER32(?,00001102,?,?), ref: 00405489
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405498
InvalidateRect.USER32(?,00000000,00000001), ref: 004054C3
ShowWindow.USER32(?,00000000), ref: 00405511
GetDlgItem.USER32(?,000003FE), ref: 0040551C
ShowWindow.USER32(00000000), ref: 00405523

Strings

M, xrefs: 004050E1
N, xrefs: 004051C2
, xrefs: 004054FB

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: a09e9907cf1d85342395cb53904611de706c132920ab67d22d4dedafd93240b8
Instruction ID: 4e4e2263315175f506fe38719dbb0ef9e1096acd748b53dfdf66ec3fe5014b92
Opcode Fuzzy Hash: a09e9907cf1d85342395cb53904611de706c132920ab67d22d4dedafd93240b8
Instruction Fuzzy Hash: BA029C70A00608AFDB20DF64DD45AAF7BB5FB44314F10817AE610BA2E1D7B98A42DF18

Function 00403FC1 Relevance: 51.4, APIs: 34, Instructions: 357windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403FFD
ShowWindow.USER32(?), ref: 0040401D
GetWindowLongW.USER32(?,000000F0), ref: 0040402F
ShowWindow.USER32(?,00000004), ref: 00404048
DestroyWindow.USER32 ref: 0040405C
SetWindowLongW.USER32(?,00000000,00000000), ref: 00404075
GetDlgItem.USER32(?,?), ref: 00404094
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004040A8
IsWindowEnabled.USER32(00000000), ref: 004040AF
GetDlgItem.USER32(?,00000001), ref: 0040415A
GetDlgItem.USER32(?,00000002), ref: 00404164
SetClassLongW.USER32(?,000000F2,?), ref: 0040417E
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004041CF
GetDlgItem.USER32(?,00000003), ref: 00404275
ShowWindow.USER32(00000000,?), ref: 00404296
EnableWindow.USER32(?,?), ref: 004042A8
EnableWindow.USER32(?,?), ref: 004042C3
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042D9
EnableMenuItem.USER32(00000000), ref: 004042E0
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004042F8
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040430B
lstrlenW.KERNEL32(00422F08,?,00422F08,00000000), ref: 00404335
SetWindowTextW.USER32(?,00422F08), ref: 00404349
ShowWindow.USER32(?,0000000A), ref: 0040447D

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 1860320154-0
Opcode ID: 4b3fe02cb5795506d30df4e66f46237e59566fdbff82c58b44480cf0eb866077
Instruction ID: f4824fcfb4375dbde2e3aa314f90dcffafac0cdac9d9fdfce080a9e5a5e1030c
Opcode Fuzzy Hash: 4b3fe02cb5795506d30df4e66f46237e59566fdbff82c58b44480cf0eb866077
Instruction Fuzzy Hash: E7C1CEB1600200BBCB216F61EE49E2B3A68FB95719F41053EF751B11F0CB795882DB2E

Function 0040467F Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040471D
GetDlgItem.USER32(?,000003E8), ref: 00404731
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040474E
GetSysColor.USER32(?), ref: 0040475F
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040476D
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040477B
lstrlenW.KERNEL32(?), ref: 00404780
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040478D
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004047A2
GetDlgItem.USER32(?,0000040A), ref: 004047FB
SendMessageW.USER32(00000000), ref: 00404802
GetDlgItem.USER32(?,000003E8), ref: 0040482D
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404870
LoadCursorW.USER32(00000000,00007F02), ref: 0040487E
SetCursor.USER32(00000000), ref: 00404881
LoadCursorW.USER32(00000000,00007F00), ref: 0040489A
SetCursor.USER32(00000000), ref: 0040489D
SendMessageW.USER32(00000111,00000001,00000000), ref: 004048CC
SendMessageW.USER32(00000010,00000000,00000000), ref: 004048DE

Strings

"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=, xrefs: 0040485C
N, xrefs: 0040481B

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=$N
API String ID: 3103080414-4259208237
Opcode ID: 4011bf91f23cdad070dcf702cd0082b1ea04741390be1e297b86103e4649bf75
Instruction ID: 9930e5d90db5dccbb26e86255d6156f8bb9eb7c4e216bd2cc4efdce7ef6c99e8
Opcode Fuzzy Hash: 4011bf91f23cdad070dcf702cd0082b1ea04741390be1e297b86103e4649bf75
Instruction Fuzzy Hash: 8E6180B1A00209BFDB10AF64DD85A6A7B69FB84354F00843AF605B62D0D7B8AD51DF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00428A20,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: fcc37e75e13d0dca8524aaa06a8ee829d240d30c68f9aadea354bd02ab1c226a
Instruction ID: d1034cbb9d528375343357a353c0022e70e8214492c202610c441178c5bfc5cd
Opcode Fuzzy Hash: fcc37e75e13d0dca8524aaa06a8ee829d240d30c68f9aadea354bd02ab1c226a
Instruction Fuzzy Hash: FC417B71800249AFCB058FA5DE459AFBBB9FF45314F00802EF592AA1A0CB74DA55DFA4

Function 00406187 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406322,?,?), ref: 004061C2
GetShortPathNameW.KERNEL32(?,004265A8,00000400), ref: 004061CB

Part of subcall function 00405F96: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040627B,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA6
Part of subcall function 00405F96: lstrlenA.KERNEL32(00000000,?,00000000,0040627B,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD8

GetShortPathNameW.KERNEL32(?,00426DA8,00000400), ref: 004061E8
wsprintfA.USER32 ref: 00406206
GetFileSize.KERNEL32(00000000,00000000,00426DA8,C0000000,00000004,00426DA8,?,?,?,?,?), ref: 00406241
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406250
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406288
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,004261A8,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004062DE
GlobalFree.KERNEL32(00000000), ref: 004062EF
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004062F6

Part of subcall function 00406031: GetFileAttributesW.KERNELBASE(00000003,004030E2,C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe,80000000,00000003), ref: 00406035
Part of subcall function 00406031: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00406057

Strings

[Rename], xrefs: 00406270, 00406282
%ls=%ls, xrefs: 004061FC

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 3cd7194a84b85a053e31ee19696a447fece43685b985ba60a20dd83e8f5070ac
Instruction ID: 01145b8f81eafc368a5e669bb7cc9688017d9d0d23ed4dcd6a8783cd941829b9
Opcode Fuzzy Hash: 3cd7194a84b85a053e31ee19696a447fece43685b985ba60a20dd83e8f5070ac
Instruction Fuzzy Hash: DF31353060072ABBD6207B659D49F2B3A5CDF41754F12007EF902F62D2EA3D9C2586BD

Function 0040657E Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 204stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32("C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=,00000400), ref: 004066A0
GetWindowsDirectoryW.KERNEL32("C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=,00000400,00000000,00421EE8,?,?,00000000,00000000,0069339A,00000000), ref: 004066B6
SHGetPathFromIDListW.SHELL32(00000000,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=), ref: 00406714
CoTaskMemFree.OLE32(00000000,?,00000000,00000007), ref: 0040671D
lstrcatW.KERNEL32("C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=,\Microsoft\Internet Explorer\Quick Launch,00000000,00421EE8,?,?,00000000,00000000,0069339A,00000000), ref: 00406748
lstrlenW.KERNEL32("C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=,00000000,00421EE8,?,?,00000000,00000000,0069339A,00000000), ref: 004067A2

Strings

"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=, xrefs: 004065AB, 00406665, 0040666C, 00406670, 00406689, 0040668A, 0040669F, 004066B5, 004066E6, 00406712, 00406747, 0040674D, 0040676A, 0040677D, 0040679B, 004067A1, 004067AA, 004067DF
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406742
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406671

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Directory$FreeFromListPathSystemTaskWindowslstrcatlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4024019347-3487496330
Opcode ID: 14c9f03641932d7153c154bb414b77852189b75d1473d82c894b9adbe9647435
Instruction ID: 9d84e59ac7151f7caf92dcd2fae633819e279481621c74ff0a59597acd22528a
Opcode Fuzzy Hash: 14c9f03641932d7153c154bb414b77852189b75d1473d82c894b9adbe9647435
Instruction Fuzzy Hash: 46612471A047119BD7209F28DC80B7A77E4AF58328F65053FF686B32D0DA3C89A5875E

Function 00404527 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404544
GetSysColor.USER32(00000000), ref: 00404582
SetTextColor.GDI32(?,00000000), ref: 0040458E
SetBkMode.GDI32(?,?), ref: 0040459A
GetSysColor.USER32(?), ref: 004045AD
SetBkColor.GDI32(?,?), ref: 004045BD
DeleteObject.GDI32(?), ref: 004045D7
CreateBrushIndirect.GDI32(?), ref: 004045E1

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction ID: d41769c693a3b03867a7fa47e0dc02698e8003aaa16d7874add0ef0652afaaee
Opcode Fuzzy Hash: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction Fuzzy Hash: 5A2195B1500704BFCB349F39DD08A477BF8AF41714B00892EEA96A22E0DB38DA44CB54

Function 00402711 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040277D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004027B8
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027DB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027F1

Part of subcall function 00406112: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00406128

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040289D

Strings

9, xrefs: 00402760

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 91519286727b7715e667a28de049f7dc24ed8e1d9bfc14afdf41a8c3697f6d43
Instruction ID: 7b917313dc97d271e667d5624dbaf811d8953be2b726cd25112f37da0e7500b1
Opcode Fuzzy Hash: 91519286727b7715e667a28de049f7dc24ed8e1d9bfc14afdf41a8c3697f6d43
Instruction Fuzzy Hash: 35511E75D04119AADF20EFD4CA84AAEB779FF44304F14817BE501B62D0D7B89D828B58

Function 004055C6 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00421EE8,00000000,0069339A,00000000,?,?,?,?,?,?,?,?,?,00403412,00000000,?), ref: 004055FE
lstrlenW.KERNEL32(00403412,00421EE8,00000000,0069339A,00000000,?,?,?,?,?,?,?,?,?,00403412,00000000), ref: 0040560E
lstrcatW.KERNEL32(00421EE8,00403412,00403412,00421EE8,00000000,0069339A,00000000), ref: 00405621
SetWindowTextW.USER32(00421EE8,00421EE8), ref: 00405633
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405659
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405673
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405681

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: a9fafcf7327b9621bb894f8e2d9ac48d1397335c234e36f420f2517ccdad5277
Instruction ID: 832834c51e0bf9a0f82df7ca1b5cea98aaac4e2da268f37eaeed00ca70cd3c8d
Opcode Fuzzy Hash: a9fafcf7327b9621bb894f8e2d9ac48d1397335c234e36f420f2517ccdad5277
Instruction Fuzzy Hash: BA21A175900558BACB119FA5DD84DCFBF79EF45350F50843AF904B22A0C77A4A41CF58

Function 004067EF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00434000,75923420,C:\Users\user\AppData\Local\Temp\,00000000,004034F7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403806,?,00000008,0000000A,0000000C), ref: 00406852
CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406861
CharNextW.USER32(?,00434000,75923420,C:\Users\user\AppData\Local\Temp\,00000000,004034F7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403806,?,00000008,0000000A,0000000C), ref: 00406866
CharPrevW.USER32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000,004034F7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403806,?,00000008,0000000A,0000000C), ref: 00406879

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004067F0
*?|<>/":, xrefs: 00406841

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1201062745
Opcode ID: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction ID: 55fd55a6259970f18c414665dfb8d2eb8684f68ced2253b2c35ece4a8e009edc
Opcode Fuzzy Hash: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction Fuzzy Hash: 0E11E61780221295DB303B15CC40ABB62E8EF54750F16C43FE999732C0E77C4C9286BD

Function 00404E7B Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404E96
GetMessagePos.USER32 ref: 00404E9E
ScreenToClient.USER32(?,?), ref: 00404EB8
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404ECA
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404EF0

Strings

f, xrefs: 00404ECC

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction ID: 6d9709cdd774db07ceaeaaa3ef1e8ea5a4c7015a7cc254b2929396571b15d8ef
Opcode Fuzzy Hash: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction Fuzzy Hash: 7E015E71900218BADB00DB94DD85BFEBBBCAF95B11F10412BBB51B61D0C7B49A418BA4

Function 00402FB8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FD6
MulDiv.KERNEL32(0046EC99,00000064,?), ref: 00403001
wsprintfW.USER32 ref: 00403011
SetWindowTextW.USER32(?,?), ref: 00403021
SetDlgItemTextW.USER32(?,00000406,?), ref: 00403033

Strings

verifying installer: %d%%, xrefs: 0040300B

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 7c72eb226873640f15370cd8631d515f33e7e0e766319f11269e715f4bf9c46b
Instruction ID: 92b1fa929db6ad6423e495ae3c8b7d5051599f53ef0535b5d141126ce54988b0
Opcode Fuzzy Hash: 7c72eb226873640f15370cd8631d515f33e7e0e766319f11269e715f4bf9c46b
Instruction Fuzzy Hash: 41014F70640208BBEF209F60DD49FEE3B69BB04345F008039FA02A51D0DBB99A559F58

Function 00402975 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029D6
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029F2
GlobalFree.KERNEL32(?), ref: 00402A2B
GlobalFree.KERNEL32(00000000), ref: 00402A3E
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A5A
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A6D

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: c2b671b088f8a2c6a2cc46e86308de55ebb46a294384aac1552312227abe31fd
Instruction ID: 30dd54c89a4cddf194586c2a2fc5346a944fd6f702074eaf72055d986495362b
Opcode Fuzzy Hash: c2b671b088f8a2c6a2cc46e86308de55ebb46a294384aac1552312227abe31fd
Instruction Fuzzy Hash: 0C31B171D00128BBCF21AFA5DE49D9E7E79AF44324F20423AF415762E1CB798D418FA8

Function 00402ECE Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402F22
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F6E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F77
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F8E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F99

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 6bbd6cd9bb694ee1e5b18e2fc67d121d416227cee6099befa8b5f279801200a9
Instruction ID: d442e96e729bea3163a88d870f4d25619929b9fa7009ff0cba57fd90435ded5e
Opcode Fuzzy Hash: 6bbd6cd9bb694ee1e5b18e2fc67d121d416227cee6099befa8b5f279801200a9
Instruction Fuzzy Hash: 8B212A7150010ABFDF129F94CE89EEF7A7DEB54388F110076B909B21A0D7B58E54AA68

Function 00401DA6 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401DBF
GetClientRect.USER32(?,?), ref: 00401E0A
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E3A
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E4E
DeleteObject.GDI32(00000000), ref: 00401E5E

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 24d559174ba8d1ea0ff588d178efc5a8b4b5bc163578ff463a4868f6c49c4eb4
Instruction ID: eb17948d85696e98a42b5b2e026cdebc0bad80675354e43e8e08d2e827efe14e
Opcode Fuzzy Hash: 24d559174ba8d1ea0ff588d178efc5a8b4b5bc163578ff463a4868f6c49c4eb4
Instruction Fuzzy Hash: 94213B72D00119AFCB05DF98DE45AEEBBB5EB08300F14003AF945F62A0D7349D81DB98

Function 00401E73 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E76
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E90
MulDiv.KERNEL32(00000000,00000000), ref: 00401E98
ReleaseDC.USER32(?,00000000), ref: 00401EA9
CreateFontIndirectW.GDI32(0040CDC8), ref: 00401EF8

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: ef63408107684041e4866229634915ac86451c59f948bd83cb9cb27aef798f6a
Instruction ID: 1d77b42acd886a27ae9f5cf53f8bcf428a8cf24ec4295262a5ba191a384267e2
Opcode Fuzzy Hash: ef63408107684041e4866229634915ac86451c59f948bd83cb9cb27aef798f6a
Instruction Fuzzy Hash: 9E01B171950250EFEB005BB4AE8AADD3FB0AF59300F10497AF142BA1E2CAB804049B2C

Function 00401C68 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CD8
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CF0

Strings

!, xrefs: 00401CA4

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e5ebd0c2485f00d6c9f151be0d8d18ef0011f408847e131bf1e0c601e94fb195
Instruction ID: 7915d77c0e8d2f35ba529c4d8f0c1bf85837a2641dbb4ead1ffb962ccc12b17a
Opcode Fuzzy Hash: e5ebd0c2485f00d6c9f151be0d8d18ef0011f408847e131bf1e0c601e94fb195
Instruction Fuzzy Hash: CC218071D1421AAEEB05AFA4D94AAFE7BB0EF44304F10453FF505B61D0D7B88941DB98

Function 00404D6D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422F08,00422F08,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E0E
wsprintfW.USER32 ref: 00404E17
SetDlgItemTextW.USER32(?,00422F08), ref: 00404E2A

Strings

%u.%u%s%s, xrefs: 00404DF8

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 808c56ceb77bc8fa6bb0a4fcfba6dc4e55d7e9e185af3d36fc5e6f51395c7837
Instruction ID: 531ff4d773969165704d770d32cd75e70745a6e311be36c98e560407ed735fca
Opcode Fuzzy Hash: 808c56ceb77bc8fa6bb0a4fcfba6dc4e55d7e9e185af3d36fc5e6f51395c7837
Instruction Fuzzy Hash: 1711EB73A0422837DB0056ADAC46E9E3698DF85374F250237FA66F21D5D978CC2142D8

Function 004024AF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32($VersionToInstall,00000023,00000011,00000002), ref: 004024FA
RegSetValueExW.ADVAPI32(?,?,?,?,$VersionToInstall,00000000,00000011,00000002), ref: 0040253A
RegCloseKey.ADVAPI32(?,?,?,$VersionToInstall,00000000,00000011,00000002), ref: 00402622

Strings

$VersionToInstall, xrefs: 004024EB, 004024F9, 00402510, 00402524, 0040252F

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: $VersionToInstall
API String ID: 2655323295-2426216592
Opcode ID: 87919b92e034b9ff7b6fa324b8696dad4ae44ab562a7e5dbadc68fddbe6150aa
Instruction ID: 8b3a83999d63c16b18a9973427bcf430ab7992b94c8fe07ed2dd95b358db5eaa
Opcode Fuzzy Hash: 87919b92e034b9ff7b6fa324b8696dad4ae44ab562a7e5dbadc68fddbe6150aa
Instruction Fuzzy Hash: 1611B431D00114BEDB00AFA5DE59AAEB6B4EF44318F20443FF400B61D1C7B88E409668

Function 00405F18 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406541: lstrcpynW.KERNEL32(?,?,00000400,0040368E,00428A20,NSIS Error,?,00000008,0000000A,0000000C), ref: 0040654E

Part of subcall function 00405EBB: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,?,00405F2F,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C6D,?,75923420,C:\Users\user\AppData\Local\Temp\,00434000), ref: 00405EC9
Part of subcall function 00405EBB: CharNextW.USER32(00000000), ref: 00405ECE
Part of subcall function 00405EBB: CharNextW.USER32(00000000), ref: 00405EE6

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,00000000,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C6D,?,75923420,C:\Users\user\AppData\Local\Temp\,00434000), ref: 00405F71
GetFileAttributesW.KERNEL32(C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,00000000,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C6D,?,75923420,C:\Users\user\AppData\Local\Temp\), ref: 00405F81

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F18
C:\Users\user\AppData\Local\Temp\nskEDF3.tmp, xrefs: 00405F1E, 00405F23, 00405F29, 00405F6A, 00405F70, 00405F78, 00405F80

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nskEDF3.tmp
API String ID: 3248276644-715395352
Opcode ID: db39f955a116f1e539d990513461dc7a207fa728de065fffbfa736c70f2b9a34
Instruction ID: 8289fae0aeb6f8c8bb33a18b648b52325edb3dacd4d1dfbf908f72671121fed4
Opcode Fuzzy Hash: db39f955a116f1e539d990513461dc7a207fa728de065fffbfa736c70f2b9a34
Instruction Fuzzy Hash: 5EF0F435115E6326E722373A5C49AAF1A04CEC6324B59053BF8A5B22C1DF3C8D5389BE

Function 00405EBB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,?,00405F2F,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C6D,?,75923420,C:\Users\user\AppData\Local\Temp\,00434000), ref: 00405EC9
CharNextW.USER32(00000000), ref: 00405ECE
CharNextW.USER32(00000000), ref: 00405EE6

Strings

C:\Users\user\AppData\Local\Temp\nskEDF3.tmp, xrefs: 00405EBC

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp
API String ID: 3213498283-1036905562
Opcode ID: a019630038ff328a8ec37a6ad8a5e0fa1ea3fa9b42c133706ff5938ffc5cdd25
Instruction ID: c2ae64a9e281e0169ab0b3f813724322829f62ec5c7d6721859fffd7401bb401
Opcode Fuzzy Hash: a019630038ff328a8ec37a6ad8a5e0fa1ea3fa9b42c133706ff5938ffc5cdd25
Instruction Fuzzy Hash: 3AF0F631920A1296DB31B7548C58E7752BCEB94350B00843BD281B32C1D7FC49C18EED

Function 00405E10 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403509,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403806,?,00000008,0000000A,0000000C), ref: 00405E16
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403509,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403806,?,00000008,0000000A,0000000C), ref: 00405E20
lstrcatW.KERNEL32(?,0040A014,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405E32

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405E10

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction ID: 6241345b1480893618f3385b5901a002ffa6f457481071e3b6de6f74fd74f6f8
Opcode Fuzzy Hash: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction Fuzzy Hash: 00D05E71101634AAC2117B48AC08CDF62AC9E46344341402AF141B20A5C7785A5186ED

Function 00402663 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nskEDF3.tmp), ref: 004026BA

Strings

C:\Users\user\AppData\Local\Temp\nskEDF3.tmp, xrefs: 0040267E, 004026A3, 004026B5, 00402701
$VersionToInstall, xrefs: 004026A8

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: lstrlen
String ID: $VersionToInstall$C:\Users\user\AppData\Local\Temp\nskEDF3.tmp
API String ID: 1659193697-2621705783
Opcode ID: 83c0ebf7cc7438f6cd2f583d50e1920e8b6e4258a652de50ece2f8b0493f471e
Instruction ID: a3276bd60f4d5d6bb2aa79b2f1cf5674750ecc9aad51c5d7eefbc562b3e224a1
Opcode Fuzzy Hash: 83c0ebf7cc7438f6cd2f583d50e1920e8b6e4258a652de50ece2f8b0493f471e
Instruction Fuzzy Hash: 7B112B71A10211BBCB00BBB19E469AE3B61AF50348F20443FF402B61C1DAFD8851631E

Function 0040303E Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,0040321C,00000001), ref: 00403051
GetTickCount.KERNEL32 ref: 0040306F
CreateDialogParamW.USER32(0000006F,00000000,00402FB8,00000000), ref: 0040308C
ShowWindow.USER32(00000000,00000005), ref: 0040309A

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 33eae82cd865283ad0f9b1d758b5427aa2cdbcf5f418f2cf2359be72f6e08548
Instruction ID: 1fe6cbc8f6a725ad0ac4e372fd1d3cf1f1d396d39c9c490f6de0fad46aa3fa9f
Opcode Fuzzy Hash: 33eae82cd865283ad0f9b1d758b5427aa2cdbcf5f418f2cf2359be72f6e08548
Instruction Fuzzy Hash: 1CF05431602621ABC6316F54FD08A9B7BA9FB44B13F41087AF045B11A9CB7948828B9C

Function 0040553A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405569
CallWindowProcW.USER32(?,?,?,?), ref: 004055BA

Part of subcall function 0040450C: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040451E

Strings

, xrefs: 0040554A

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 8a6e7ab2b2ebc920f12c2d5b2b2096f2e9954bb0ec9a095f665350d4b71d8349
Instruction ID: e9ac82e17096a71ceb81da4f6da7be56a9305aae285fff99253fdd5fe3b389a1
Opcode Fuzzy Hash: 8a6e7ab2b2ebc920f12c2d5b2b2096f2e9954bb0ec9a095f665350d4b71d8349
Instruction Fuzzy Hash: 6B017171200609BFDF315F11DD84AAB3A66FB84754F100037FA00B51E5C7BA8D52AE69

Function 0040640F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,00421EE8,?,00000800,00000000,?,00421EE8,?,?,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=,?,00000000,00406680,80000002), ref: 00406455
RegCloseKey.ADVAPI32(?), ref: 00406460

Strings

"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=, xrefs: 00406416

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CloseQueryValue
String ID: "C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" /D=
API String ID: 3356406503-2788633850
Opcode ID: d1d1cf9fba81775932f415e0b00659446f948772619985b3c02fdc538e95a10d
Instruction ID: ab0cc6cc405738cc07c99bf25685dc2411b0540f073fb059e05756a610da7e73
Opcode Fuzzy Hash: d1d1cf9fba81775932f415e0b00659446f948772619985b3c02fdc538e95a10d
Instruction Fuzzy Hash: 4F015E72510209AADF218F51CC05EDB3BA8EB54354F01403AFD5992150D738D968DB94

Function 00403B7E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,75923420,00000000,C:\Users\user\AppData\Local\Temp\,00403B56,00403A6C,?,?,00000008,0000000A,0000000C), ref: 00403B98
GlobalFree.KERNEL32(?), ref: 00403B9F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403B7E

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-823278215
Opcode ID: 628ac1cb43285a1a84ac4c7f875ed8910a03c7a164280e3efa8a6a131abbe062
Instruction ID: 6342289a3e1e3ca18c24491f6708bfd4349b13536718f8c5743bc800c8661b5d
Opcode Fuzzy Hash: 628ac1cb43285a1a84ac4c7f875ed8910a03c7a164280e3efa8a6a131abbe062
Instruction Fuzzy Hash: FBE08C329015205BC6211F19ED04B1A77B86F45B27F06402AE8807B26287B82C838FD8

Function 00405E5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,0040310E,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe,C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe,80000000,00000003), ref: 00405E62
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,0040310E,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe,C:\Users\user\Desktop\FiddlerSetup.5.0.20245.10105-latest.exe,80000000,00000003), ref: 00405E72

Strings

C:\Users\user\Desktop, xrefs: 00405E5C

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1246513382
Opcode ID: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
Instruction ID: b9e9e75b8ba1df67f9f167ecd7c14c3df7ff164ad8267efb590a8552da577330
Opcode Fuzzy Hash: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
Instruction Fuzzy Hash: 81D0A7B3400930DAC3127718EC04D9F77ACEF1634074A443AE580B7165D7785D8186EC

Function 00405F96 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040627B,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA6
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FBE
CharNextA.USER32(00000000,?,00000000,0040627B,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FCF
lstrlenA.KERNEL32(00000000,?,00000000,0040627B,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD8

Memory Dump Source

Source File: 00000000.00000002.3310569082.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3310500766.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310623503.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310656846.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3310851504.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FiddlerSetup.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction ID: c3aaa261a9e4bb9915bd58c77e7651ea6c0a11e303954dac61c17192ece284d7
Opcode Fuzzy Hash: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction Fuzzy Hash: F7F06231105459EFDB029BA5DD00D9EBBA8EF15254B2540BAE840F7250D678DE019B69

Analysis Process: FiddlerSetup.exePID: 2972, Parent PID: 6948COMMON

Execution Graph

Execution Coverage:	23.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2%
Total number of Nodes:	1612
Total number of Limit Nodes:	44

Executed Functions

Function 00403665 Relevance: 88.0, APIs: 32, Strings: 18, Instructions: 464
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32 ref: 00403688
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?), ref: 004036B3
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 004036C6
lstrlenA.KERNEL32(UXTHEME,UXTHEME,?,?,?,?,?,?,?,?), ref: 0040375F
#17.COMCTL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040379C
OleInitialize.OLE32(00000000), ref: 004037A3
SHGetFileInfoW.SHELL32(00420F08,00000000,?,000002B4,00000000), ref: 004037C2
GetCommandLineW.KERNEL32(00428A60,NSIS Error,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004037D7
CharNextW.USER32(00000000,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" ,00000020,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" ,00000000,?,00000008,0000000A,0000000C), ref: 00403810
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00008001,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403948
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403959
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403965
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403979
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403981
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403992
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040399A
DeleteFileW.KERNEL32(1033,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004039AE
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" ,00000000,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403A87

Part of subcall function 004066A2: lstrcpynW.KERNEL32(?,?,00000400,004037D7,00428A60,NSIS Error,?,00000008,0000000A,0000000C), ref: 004066AF

wsprintfW.USER32 ref: 00403AE4
GetFileAttributesW.KERNEL32(0042C800,C:\Users\user\AppData\Local\Temp\), ref: 00403B17
DeleteFileW.KERNEL32(0042C800), ref: 00403B23
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403B51

Part of subcall function 00406462: MoveFileExW.KERNEL32(?,?,00000005,00405F60,?,00000000,000000F1,?,?,?,?,?), ref: 0040646C

CopyFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe,0042C800,00000001,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403B67

Part of subcall function 00405C85: CreateProcessW.KERNEL32(00000000,0042C800,00000000,00000000,00000000,04000000,00000000,00000000,00425F50,?,?,?,0042C800,?), ref: 00405CAE
Part of subcall function 00405C85: CloseHandle.KERNEL32(?,?,?,0042C800,?), ref: 00405CBB

Part of subcall function 004069FF: FindFirstFileW.KERNEL32(75923420,00425F98,C:\,004060C2,C:\,C:\,00000000,C:\,C:\,75923420,?,75922EE0,00405DCE,?,75923420,75922EE0), ref: 00406A0A
Part of subcall function 004069FF: FindClose.KERNEL32(00000000), ref: 00406A16

OleUninitialize.OLE32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403BB5
ExitProcess.KERNEL32 ref: 00403BD2
CloseHandle.KERNEL32(00000000,0042D000,0042D000,?,0042C800,00000000), ref: 00403BD9
GetCurrentProcess.KERNEL32(00000028,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403BF5
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?), ref: 00403BFC
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403C11
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00403C34
ExitWindowsEx.USER32(00000002,80040002), ref: 00403C59
ExitProcess.KERNEL32 ref: 00403C7C

Part of subcall function 00405C50: CreateDirectoryW.KERNEL32(?,00000000,00403658,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040394F,?,00000008,0000000A,0000000C), ref: 00405C56

Strings

C:\Users\user\AppData\Local\Programs\Fiddler, xrefs: 0040392D, 00403A4F, 00403A9C, 00403AAA
SeShutdownPrivilege, xrefs: 00403C0B
C:\Users\user\AppData\Local\Temp\nskEDF3.tmp, xrefs: 00403AA5
UXTHEME, xrefs: 00403753, 00403758, 0040375E
~nsu%X.tmp, xrefs: 00403ADB
TEMP, xrefs: 0040398D
Error launching installer, xrefs: 00403A30
"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" , xrefs: 004037DD, 004037E3, 004037F8, 004039D6
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040367C
1033, xrefs: 004039A9
0x000048A3, xrefs: 00403A92
TMP, xrefs: 00403995
C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe, xrefs: 00403B62
\Temp, xrefs: 0040395F
C:\Users\user\AppData\Local\Programs\Fiddler, xrefs: 00403A5A
Low, xrefs: 0040397B
NSIS Error, xrefs: 004037C8
C:\Users\user\AppData\Local\Temp\, xrefs: 0040393D, 00403942, 00403958, 00403964, 00403973, 00403980, 0040398C, 00403994, 00403A82, 00403B03, 00403B2F, 00403B50, 00403B59

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: File$Process$CloseDirectoryExit$CreateCurrentDeleteEnvironmentFindHandlePathTempTokenVariableVersionWindowslstrcatlstrlen$AdjustAttributesCharCommandCopyErrorFirstInfoInitializeLineLookupModeMoveNextOpenPrivilegePrivilegesUninitializeValuelstrcpynwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" $0x000048A3$1033$C:\Users\user\AppData\Local\Programs\Fiddler$C:\Users\user\AppData\Local\Programs\Fiddler$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nskEDF3.tmp$C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu%X.tmp
API String ID: 1813718867-1694594105
Opcode ID: 73eb161cc7daad2c628f7086665b9d74cb3225a20acc52f4111f8de2049d8e56
Instruction ID: 48c25345ab5c6186891d52a8fabce3a967a0262862fdddf466c19d710b4311b7
Opcode Fuzzy Hash: 73eb161cc7daad2c628f7086665b9d74cb3225a20acc52f4111f8de2049d8e56
Instruction Fuzzy Hash: EDF1E571604301AAD720AF659D05B2B7EE8EB8570AF10483EF581B22D1DB7CDA45CB6E

Function 6E0E1BFF Relevance: 20.1, APIs: 13, Instructions: 597stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6E0E12BB: GlobalAlloc.KERNEL32(00000040,?,6E0E12DB,?,6E0E137F,00000019,6E0E11CA,-000000A0), ref: 6E0E12C5

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 6E0E1D2D
lstrcpyW.KERNEL32(00000008,?), ref: 6E0E1D75
lstrcpyW.KERNEL32(00000808,?), ref: 6E0E1D7F
GlobalFree.KERNEL32(00000000), ref: 6E0E1D92
GlobalFree.KERNEL32(?), ref: 6E0E1E74
GlobalFree.KERNEL32(?), ref: 6E0E1E79
GlobalFree.KERNEL32(?), ref: 6E0E1E7E
GlobalFree.KERNEL32(00000000), ref: 6E0E2068
lstrcpyW.KERNEL32(?,?), ref: 6E0E2222
GetModuleHandleW.KERNEL32(00000008), ref: 6E0E22A1
LoadLibraryW.KERNEL32(00000008), ref: 6E0E22B2
GetProcAddress.KERNEL32(?,?), ref: 6E0E230C
lstrlenW.KERNEL32(00000808), ref: 6E0E2326

Memory Dump Source

Source File: 00000001.00000002.3313723502.000000006E0E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E0E0000, based on PE: true

Associated: 00000001.00000002.3313696406.000000006E0E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.3313755020.000000006E0E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.3313780368.000000006E0E6000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e0e0000_FiddlerSetup.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: e4f9d84f8ac81bb55b5dd3f79dd1d678bee224a7d2dce6e21b44022007ef6838
Instruction ID: 9ed7d9ab8125fd53c919ecf98e6c4c80c59374a990f82f1f48d557d4bc30303d
Opcode Fuzzy Hash: e4f9d84f8ac81bb55b5dd3f79dd1d678bee224a7d2dce6e21b44022007ef6838
Instruction Fuzzy Hash: BC229771D1820ADEDB548FE988807EEB7F4FB09359F50453ED1A5E3A80D7709A89CB90

Function 00405DAE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(?,?,75923420,75922EE0,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" ), ref: 00405DD7
lstrcatW.KERNEL32(C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fiddler 4.lnk,\*.*,C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fiddler 4.lnk,?,?,75923420,75922EE0,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" ), ref: 00405E1F
lstrcatW.KERNEL32(?,0040A014,?,C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fiddler 4.lnk,?,?,75923420,75922EE0,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" ), ref: 00405E42
lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fiddler 4.lnk,?,?,75923420,75922EE0,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" ), ref: 00405E48
FindFirstFileW.KERNEL32(C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fiddler 4.lnk,?,?,?,0040A014,?,C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fiddler 4.lnk,?,?,75923420,75922EE0,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" ), ref: 00405E58
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405EF8
FindClose.KERNEL32(00000000), ref: 00405F07

Strings

\*.*, xrefs: 00405E19
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fiddler 4.lnk, xrefs: 00405E07, 00405E0D, 00405E1E, 00405E57
"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" , xrefs: 00405DB7

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" $C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fiddler 4.lnk$\*.*
API String ID: 2035342205-368145931
Opcode ID: 1052980a6287c0031938da12d564b2d54368d5a4b13eada63b906b45cc1336bf
Instruction ID: 08bfc2840413863968cf962241dff1eb28b75ffaef7a08e493f25e9a85e6eaf1
Opcode Fuzzy Hash: 1052980a6287c0031938da12d564b2d54368d5a4b13eada63b906b45cc1336bf
Instruction Fuzzy Hash: E341F130800A06A6CB21AB61CD89BBF7278EF45754F14413FF485B11C1DB7C4A82DEAE

Function 00406DC0 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9c4c7fe21643fbeaf7e138ee869f294de0f5e1fd31501e9972d14a61e44697c
Instruction ID: 2c84522690a72e7b125efbdd79dcce5a6d58b8fc95eff680b6a5e34cc787ad25
Opcode Fuzzy Hash: f9c4c7fe21643fbeaf7e138ee869f294de0f5e1fd31501e9972d14a61e44697c
Instruction Fuzzy Hash: 5EF17670D04229CBDF28CFA8C8946ADBBB1FF44305F24856ED456BB281D7786A86CF45

Function 004069FF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(75923420,00425F98,C:\,004060C2,C:\,C:\,00000000,C:\,C:\,75923420,?,75922EE0,00405DCE,?,75923420,75922EE0), ref: 00406A0A
FindClose.KERNEL32(00000000), ref: 00406A16

Strings

C:\, xrefs: 004069FF

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: 5aa02b152b1bdaa4a45d264aeb005cec44e37fe5ecd5a9a233d7a39d055da6f3
Instruction ID: 20279147522b4af1e9b85c80e58242a12c3cc79f3f19e9bc8d226ca4cfbd33e3
Opcode Fuzzy Hash: 5aa02b152b1bdaa4a45d264aeb005cec44e37fe5ecd5a9a233d7a39d055da6f3
Instruction Fuzzy Hash: 9FD012317595205BC640673C6E0C89B7E589F1A3317128A36F06BF21E4D7348C628A9C

Function 6E0E2B98 Relevance: 1.6, APIs: 1, Instructions: 143processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000000), ref: 6E0E2C57

Memory Dump Source

Source File: 00000001.00000002.3313723502.000000006E0E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E0E0000, based on PE: true

Associated: 00000001.00000002.3313696406.000000006E0E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.3313755020.000000006E0E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.3313780368.000000006E0E6000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e0e0000_FiddlerSetup.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: 7f9f6fa63a027ba8c5442f54833e1b4df2c6b99a791474d02658dc4ab8b2ee15
Instruction ID: 0a8a6a157ed139d002da5d943b2a7d32c42e0e7fa4ac2076a476e5321c2b95c3
Opcode Fuzzy Hash: 7f9f6fa63a027ba8c5442f54833e1b4df2c6b99a791474d02658dc4ab8b2ee15
Instruction Fuzzy Hash: 19417A76904606DFDB20DFE4D985BAD37BCEB45758F208C3AFA04D7A10E73894908B91

Function 00402930 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040293F

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 5f40b9c168098cd7c08605d36f5ba7f449bc57889a4c1abe0db35f31e7ccfb05
Instruction ID: 5eb670257f645768a78f75f5229fdd379fa6a203c359b676d04f77a704ba2a21
Opcode Fuzzy Hash: 5f40b9c168098cd7c08605d36f5ba7f449bc57889a4c1abe0db35f31e7ccfb05
Instruction Fuzzy Hash: 9DF08271A04105AADB00EBA5D9499AEB378EF14314F60017BE111F31E5D7B88E51DB29

Function 00405866 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004058C4
GetDlgItem.USER32(?,000003EE), ref: 004058D3
GetClientRect.USER32(?,?), ref: 00405910
GetSystemMetrics.USER32(00000002), ref: 00405917
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405938
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405949
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040595C
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040596A
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040597D
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040599F
ShowWindow.USER32(?,00000008), ref: 004059B3
GetDlgItem.USER32(?,000003EC), ref: 004059D4
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004059E4
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004059FD
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405A09
GetDlgItem.USER32(?,000003F8), ref: 004058E2

Part of subcall function 00404656: SendMessageW.USER32(00000028,?,00000001,00404481), ref: 00404664

GetDlgItem.USER32(?,000003EC), ref: 00405A26
CreateThread.KERNEL32(00000000,00000000,Function_000057FA,00000000), ref: 00405A34
CloseHandle.KERNEL32(00000000), ref: 00405A3B
ShowWindow.USER32(00000000), ref: 00405A5F
ShowWindow.USER32(?,00000008), ref: 00405A64
ShowWindow.USER32(00000008), ref: 00405AAE
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405AE2
CreatePopupMenu.USER32 ref: 00405AF3
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405B07
GetWindowRect.USER32(?,?), ref: 00405B27
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405B40
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B78
OpenClipboard.USER32(00000000), ref: 00405B88
EmptyClipboard.USER32 ref: 00405B8E
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405B9A
GlobalLock.KERNEL32(00000000), ref: 00405BA4
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405BB8
GlobalUnlock.KERNEL32(00000000), ref: 00405BD8
SetClipboardData.USER32(0000000D,00000000), ref: 00405BE3
CloseClipboard.USER32 ref: 00405BE9

Strings

{, xrefs: 00405ACC
H/B, xrefs: 00405B54

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: H/B${
API String ID: 590372296-332483393
Opcode ID: 4256ca649c188c4a78c3bce7c2399f716ebe601cbcb2d09ab3e8d43f166fbc89
Instruction ID: 26959a90f0a266772171a70e0d2c3eddd0d3dcd8a9821819e75e01dae6d4cf8f
Opcode Fuzzy Hash: 4256ca649c188c4a78c3bce7c2399f716ebe601cbcb2d09ab3e8d43f166fbc89
Instruction Fuzzy Hash: 1EB158B0900608FFEB11AF60DD859AE7B79FB08354F00413AFA45BA1A0CB785E51DF68

Function 00404122 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 0040415E
ShowWindow.USER32(?), ref: 0040417E
GetWindowLongW.USER32(?,000000F0), ref: 00404190
ShowWindow.USER32(?,00000004), ref: 004041A9
DestroyWindow.USER32 ref: 004041BD
SetWindowLongW.USER32(?,00000000,00000000), ref: 004041D6
GetDlgItem.USER32(?,?), ref: 004041F5
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00404209
IsWindowEnabled.USER32(00000000), ref: 00404210
GetDlgItem.USER32(?,00000001), ref: 004042BB
GetDlgItem.USER32(?,00000002), ref: 004042C5
SetClassLongW.USER32(?,000000F2,?), ref: 004042DF
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00404330
GetDlgItem.USER32(?,00000003), ref: 004043D6
ShowWindow.USER32(00000000,?), ref: 004043F7
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404409
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404424
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040443A
EnableMenuItem.USER32(00000000), ref: 00404441
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404459
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040446C
lstrlenW.KERNEL32(00422F48,?,00422F48,00000000), ref: 00404496
SetWindowTextW.USER32(?,00422F48), ref: 004044AA
ShowWindow.USER32(?,0000000A), ref: 004045DE

Strings

H/B, xrefs: 00404486

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Window$Item$MessageSendShow$Long$CallbackDispatcherMenuUser$ClassDestroyEnableEnabledSystemTextlstrlen
String ID: H/B
API String ID: 3964124867-184950203
Opcode ID: 1d334063ac87d117f163498afb3e0779bdc14ef4bf1212a9a53b176d670ff06c
Instruction ID: 9a8659dd655c0040c26f3da6c71aaed3cdb3e7512c47e66a19b3526095f1ef41
Opcode Fuzzy Hash: 1d334063ac87d117f163498afb3e0779bdc14ef4bf1212a9a53b176d670ff06c
Instruction Fuzzy Hash: 0FC1CEB1600604BBDB216F61EE85E2B7A68FB85345F41093EF741B25F0CB799842DB2D

Function 00403D74 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406A96: GetModuleHandleA.KERNEL32(?,00000020,?,00403775,0000000C,?,?,?,?,?,?,?,?), ref: 00406AA8
Part of subcall function 00406A96: GetProcAddress.KERNEL32(00000000,?), ref: 00406AC3

lstrcatW.KERNEL32(1033,00422F48,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422F48,00000000,00000002,75923420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" ,00008001), ref: 00403DF5
lstrlenW.KERNEL32(: Completed,?,?,?,: Completed,00000000,C:\Users\user\AppData\Local\Programs\Fiddler,1033,00422F48,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422F48,00000000,00000002,75923420), ref: 00403E75
lstrcmpiW.KERNEL32(?,.exe,: Completed,?,?,?,: Completed,00000000,C:\Users\user\AppData\Local\Programs\Fiddler,1033,00422F48,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422F48,00000000), ref: 00403E88
GetFileAttributesW.KERNEL32(: Completed), ref: 00403E93
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Programs\Fiddler), ref: 00403EDC

Part of subcall function 004065E9: wsprintfW.USER32 ref: 004065F6

RegisterClassW.USER32(00428A00), ref: 00403F19
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403F31
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403F66
ShowWindow.USER32(00000005,00000000), ref: 00403F9C
GetClassInfoW.USER32(00000000,RichEdit20W,00428A00), ref: 00403FC8
GetClassInfoW.USER32(00000000,RichEdit,00428A00), ref: 00403FD5
RegisterClassW.USER32(00428A00), ref: 00403FDE
DialogBoxParamW.USER32(?,00000000,00404122,00000000), ref: 00403FFD

Strings

C:\Users\user\AppData\Local\Programs\Fiddler, xrefs: 00403E04, 00403E0C, 00403EAF, 00403EB5, 00403EC5
H/B, xrefs: 00403DA0
.DEFAULT\Control Panel\International, xrefs: 00403DE0
RichEdit20W, xrefs: 00403FC0, 00403FC6
"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" , xrefs: 00403D77
RichEd32, xrefs: 00403FB0
RichEd20, xrefs: 00403FA2
1033, xrefs: 00403D94, 00403DF0
_Nb, xrefs: 00403EF8, 00403F60
Control Panel\Desktop\ResourceLocale, xrefs: 00403DA8
: Completed, xrefs: 00403E3C, 00403E45, 00403E53, 00403EA2, 00403EA8
RichEdit, xrefs: 00403FCF
C:\Users\user\AppData\Local\Temp\, xrefs: 00403D79
.exe, xrefs: 00403E82

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" $.DEFAULT\Control Panel\International$.exe$1033$: Completed$C:\Users\user\AppData\Local\Programs\Fiddler$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$H/B$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-2475164972
Opcode ID: 751fa15274863fdb5cd35a7a9b6f64ca31fb44c440073016e23fc4eae778d6db
Instruction ID: c4c704bd5297fd73affe36db923882850e9d0fe41f98d1713f1e709c6875f219
Opcode Fuzzy Hash: 751fa15274863fdb5cd35a7a9b6f64ca31fb44c440073016e23fc4eae778d6db
Instruction Fuzzy Hash: E061C670240701BAD620AB66AD46F2B3A7CEB85745F41453FF941B22E2DF7D5D02CA2D

Function 004047E0 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040487E
GetDlgItem.USER32(?,000003E8), ref: 00404892
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004048AF
GetSysColor.USER32(?), ref: 004048C0
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004048CE
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004048DC
lstrlenW.KERNEL32(?), ref: 004048E1
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004048EE
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404903
GetDlgItem.USER32(?,0000040A), ref: 0040495C
SendMessageW.USER32(00000000), ref: 00404963
GetDlgItem.USER32(?,000003E8), ref: 0040498E
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004049D1
LoadCursorW.USER32(00000000,00007F02), ref: 004049DF
SetCursor.USER32(00000000), ref: 004049E2
LoadCursorW.USER32(00000000,00007F00), ref: 004049FB
SetCursor.USER32(00000000), ref: 004049FE
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404A2D
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404A3F

Strings

: Completed, xrefs: 004049BD
WG@, xrefs: 004049EA
N, xrefs: 0040497C

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: : Completed$N$WG@
API String ID: 3103080414-1783646508
Opcode ID: 0408aea07e4224223b1525a80d6e9a5543208d2b5c1b62ae9aa87092746790f3
Instruction ID: 54d9d544d8a339ed1f673c4731e81340660bcd02aea44dc88bd758a97d32eb83
Opcode Fuzzy Hash: 0408aea07e4224223b1525a80d6e9a5543208d2b5c1b62ae9aa87092746790f3
Instruction Fuzzy Hash: 2B61A0B1A40209BFDB10AF64CD85AAA7B69FB84314F00843AF605B72D0C779AD51CF98

Function 00404B12 Relevance: 31.8, APIs: 12, Strings: 6, Instructions: 275
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404B61
SetWindowTextW.USER32(00000000,?), ref: 00404B8B
SHAutoComplete.SHLWAPI(00000000,00000001,00000009,00000000,?,00000014,?,?,00000001,?), ref: 00404BC5
SHBrowseForFolderW.SHELL32(?), ref: 00404C3C
CoTaskMemFree.OLE32(00000000), ref: 00404C47
lstrcmpiW.KERNEL32(: Completed,00422F48,00000000,?,?), ref: 00404C79
lstrcatW.KERNEL32(?,: Completed), ref: 00404C85
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404C97

Part of subcall function 00405CE6: GetDlgItemTextW.USER32(?,?,00000400,00404CCE), ref: 00405CF9

Part of subcall function 00406950: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" ,75923420,C:\Users\user\AppData\Local\Temp\,00000000,00403640,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040394F,?,00000008,0000000A,0000000C), ref: 004069B3
Part of subcall function 00406950: CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004069C2
Part of subcall function 00406950: CharNextW.USER32(?,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" ,75923420,C:\Users\user\AppData\Local\Temp\,00000000,00403640,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040394F,?,00000008,0000000A,0000000C), ref: 004069C7
Part of subcall function 00406950: CharPrevW.USER32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000,00403640,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040394F,?,00000008,0000000A,0000000C), ref: 004069DA

GetDiskFreeSpaceExW.KERNEL32(C:\Users\user\AppData\Local\,?,?,?,00000001,C:\Users\user\AppData\Local\,?,?,000003FB,?), ref: 00404D0E
GetDiskFreeSpaceW.KERNEL32(C:\Users\user\AppData\Local\,?,?,0000040F,?,C:\Users\user\AppData\Local\,C:\Users\user\AppData\Local\,?,00000001,C:\Users\user\AppData\Local\,?,?,000003FB,?), ref: 00404D5A
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404D75

Part of subcall function 00404ECE: lstrlenW.KERNEL32(00422F48,00422F48,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F6F
Part of subcall function 00404ECE: wsprintfW.USER32 ref: 00404F78
Part of subcall function 00404ECE: SetDlgItemTextW.USER32(?,00422F48), ref: 00404F8B

Strings

0x000048A3, xrefs: 00404B2B
C:\Users\user\AppData\Local\Programs\Fiddler, xrefs: 00404C62
H/B, xrefs: 00404C0F
: Completed, xrefs: 00404C73, 00404C78, 00404C83
A, xrefs: 00404C35
C:\Users\user\AppData\Local\, xrefs: 00404CDF, 00404CE5, 00404D0D, 00404D1C, 00404D34, 00404D3A, 00404D59

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CharItemText$FreeNext$DiskSpace$AutoBrowseCompleteFolderPrevTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: 0x000048A3$: Completed$A$C:\Users\user\AppData\Local\$C:\Users\user\AppData\Local\Programs\Fiddler$H/B
API String ID: 4039761011-2232405354
Opcode ID: ccfd36b4e03117f1e72b5cb6ebe337c45c549a3101787cd9149ccaea4d98369e
Instruction ID: d1d33be9ed2b3c34a6912e34267e60509d8c64d33f654f2361a06684bbdb7283
Opcode Fuzzy Hash: ccfd36b4e03117f1e72b5cb6ebe337c45c549a3101787cd9149ccaea4d98369e
Instruction Fuzzy Hash: FBA191B1900209ABDB11AFA5CD41AEFB7B8FF84754F11843BF601B62D1DB7C89418B69

Function 004030F5 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403109
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe,00000400), ref: 00403125

Part of subcall function 00406192: GetFileAttributesW.KERNEL32(00000003,00403138,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe,80000000,00000003), ref: 00406196
Part of subcall function 00406192: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 004061B8

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe,80000000,00000003), ref: 0040316E
GlobalAlloc.KERNEL32(00000040,00008001), ref: 004032B0

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403347
C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe, xrefs: 0040310F, 0040311E, 00403132, 0040314F
C:\Users\user\AppData\Local\Temp\nskEDF3.tmp, xrefs: 00403150, 00403155, 0040315B
C:\Users\user\AppData\Local\Temp\, xrefs: 004030FF, 004032C8
Null, xrefs: 004031EC
Inst, xrefs: 004031DA
Error launching installer, xrefs: 00403145
"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" , xrefs: 004030FE
soft, xrefs: 004031E3
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004032F9

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" $C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nskEDF3.tmp$C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-1301382622
Opcode ID: e25ddccf2931d554cf8ae4c0c3bfc4e86d8fe1291d5fc5cd744d09a7651939d3
Instruction ID: 4d59aa34fe8aef517225e0e03f455ac639a07fb2fd098cfe03fbce1fe051b31e
Opcode Fuzzy Hash: e25ddccf2931d554cf8ae4c0c3bfc4e86d8fe1291d5fc5cd744d09a7651939d3
Instruction Fuzzy Hash: 4671D071A00204ABDB20DFA4DD86BAE3EACAB04715F20457FE915B72C1CB789F418B5C

Function 004066DF Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 204
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(: Completed,00000400), ref: 00406801
GetWindowsDirectoryW.KERNEL32(: Completed,00000400,00000000,00421F28,?,?,00000000,00000000,00000000,00000000), ref: 00406817
SHGetPathFromIDListW.SHELL32(00000000,: Completed), ref: 00406875
CoTaskMemFree.OLE32(00000000,?,00000000,00000007), ref: 0040687E
lstrcatW.KERNEL32(: Completed,\Microsoft\Internet Explorer\Quick Launch,00000000,00421F28,?,?,00000000,00000000,00000000,00000000), ref: 004068A9
lstrlenW.KERNEL32(: Completed,00000000,00421F28,?,?,00000000,00000000,00000000,00000000), ref: 00406903

Strings

0x000048A3, xrefs: 004068D8
: Completed, xrefs: 0040670C, 004067C6, 004067CD, 004067D1, 004067EA, 004067EB, 00406800, 00406816, 00406847, 00406873, 004068A8, 004068AE, 004068CB, 004068DE, 004068FC, 00406902, 0040690B, 00406940
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004068A3
Software\Microsoft\Windows\CurrentVersion, xrefs: 004067D2

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Directory$FreeFromListPathSystemTaskWindowslstrcatlstrlen
String ID: 0x000048A3$: Completed$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4024019347-3647101648
Opcode ID: b59e22a8bd15446390fa157bdf264ea230bac4db41f2cb9535611f30a8a1d2e5
Instruction ID: c05bc8db6a500faa8ceae89892d654845b9b7d80f8daaf315b7a9d2c48b59061
Opcode Fuzzy Hash: b59e22a8bd15446390fa157bdf264ea230bac4db41f2cb9535611f30a8a1d2e5
Instruction Fuzzy Hash: CE6147B2A053019BEB20AF24DC84B6B77D8AF54314F26453FF587B26D0DA3C8961875E

Function 00401794 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Programs\Fiddler,?,?,00000031), ref: 004017D5
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Programs\Fiddler,?,?,00000031), ref: 004017FA

Part of subcall function 004066A2: lstrcpynW.KERNEL32(?,?,00000400,004037D7,00428A60,NSIS Error,?,00000008,0000000A,0000000C), ref: 004066AF

Part of subcall function 00405727: lstrlenW.KERNEL32(00421F28,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000,?), ref: 0040575F
Part of subcall function 00405727: lstrlenW.KERNEL32(004030CD,00421F28,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000), ref: 0040576F
Part of subcall function 00405727: lstrcatW.KERNEL32(00421F28,004030CD,004030CD,00421F28,00000000,00000000,00000000), ref: 00405782
Part of subcall function 00405727: SetWindowTextW.USER32(00421F28,00421F28), ref: 00405794
Part of subcall function 00405727: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004057BA
Part of subcall function 00405727: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004057D4
Part of subcall function 00405727: SendMessageW.USER32(?,00001013,?,00000000), ref: 004057E2

Strings

C:\Users\user\AppData\Local\Temp\nsu12C2.tmp\System.dll, xrefs: 0040185A, 00401876
False, xrefs: 00401846, 00401864
C:\Users\user\AppData\Local\Programs\Fiddler, xrefs: 004017C3
Call, xrefs: 004017B2, 004017BB, 004017C8, 004017DA, 004017E6, 0040181C, 00401832, 00401850, 0040188C, 0040190D, 00401916, 00401920, 0040192B

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Programs\Fiddler$C:\Users\user\AppData\Local\Temp\nsu12C2.tmp\System.dll$Call$False
API String ID: 1941528284-1474224350
Opcode ID: dbe0c772773e81646de52cb28a2c9ac51c991085b1ba9fdce9be4af8878c7550
Instruction ID: adf8bb8e975ebc770d7c27afbe064fe35cfd0cbf1071ecc95f96a86e7a4b9e55
Opcode Fuzzy Hash: dbe0c772773e81646de52cb28a2c9ac51c991085b1ba9fdce9be4af8878c7550
Instruction Fuzzy Hash: 8A41C671900105BACF117BA5CD85DAE3A79EF45368F21823FF422B10E1D73D8E91AA2D

Function 00405727 Relevance: 10.6, APIs: 7, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00421F28,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000,?), ref: 0040575F
lstrlenW.KERNEL32(004030CD,00421F28,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000), ref: 0040576F
lstrcatW.KERNEL32(00421F28,004030CD,004030CD,00421F28,00000000,00000000,00000000), ref: 00405782
SetWindowTextW.USER32(00421F28,00421F28), ref: 00405794
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004057BA
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004057D4
SendMessageW.USER32(?,00001013,?,00000000), ref: 004057E2

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 478899543bd82950d8a4d30903f75c7e93d106f960787587e0f6081d0d83e678
Instruction ID: 5626e068ca8b5f19a977ecdc4b6aac72793d852c885f634865ceb3a8b40a731b
Opcode Fuzzy Hash: 478899543bd82950d8a4d30903f75c7e93d106f960787587e0f6081d0d83e678
Instruction Fuzzy Hash: 6F218E71900558FACB119F65DD849CFBFB9EF45350F10803AF904B62A0C7794A819F68

Function 00404ECE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00422F48,00422F48,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F6F
wsprintfW.USER32 ref: 00404F78
SetDlgItemTextW.USER32(?,00422F48), ref: 00404F8B

Strings

H/B, xrefs: 00404F61
%u.%u%s%s, xrefs: 00404F59

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$H/B
API String ID: 3540041739-2222257793
Opcode ID: 701484786e9e788ccce1f8e608fe17be4446b7c9895a13b6126df495f4584910
Instruction ID: d50fdcff321319429c488fc01686433ffa638a32cb0890ada2b0e386a1fa8516
Opcode Fuzzy Hash: 701484786e9e788ccce1f8e608fe17be4446b7c9895a13b6126df495f4584910
Instruction Fuzzy Hash: 8B11A873A0412837DB00656D9D45E9E369C9B85374F154637FA26F31D1E979CC2182E8

Function 00406A26 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406A3D
wsprintfW.USER32 ref: 00406A78
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406A8C

Strings

UXTHEME, xrefs: 00406A2F
%s%S.dll, xrefs: 00406A72

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME
API String ID: 2200240437-1106614640
Opcode ID: bea2c3dfad6db3553b24c87bd1a60070de232aee380c5cee9c100d0800ee2260
Instruction ID: 2c328a31db22aac531adf2f34800fe5ee0562984a44f040f64af452ff7173633
Opcode Fuzzy Hash: bea2c3dfad6db3553b24c87bd1a60070de232aee380c5cee9c100d0800ee2260
Instruction Fuzzy Hash: 36F0FC3060011967CF14BB64DD0EF9B375C9B01704F10847AA546F10D0EB789668CF98

Function 00406C11 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ck%d, xrefs: 00406C1B

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID:
String ID: ck%d
API String ID: 0-4000962198
Opcode ID: 4f111ab4920ac525fdea371edc0372209efebd88f4f49b64d61f26737748280a
Instruction ID: a75c210e76fb72c91da92bd055febaaadf45c37f1dc492509737fdaa257f63d6
Opcode Fuzzy Hash: 4f111ab4920ac525fdea371edc0372209efebd88f4f49b64d61f26737748280a
Instruction Fuzzy Hash: 2D817731D04228DBDF24CFA8C844BADBBB1FF44315F20856AD856BB281C7796A86DF45

Function 6E0E1817 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6E0E1BFF: GlobalFree.KERNEL32(?), ref: 6E0E1E74
Part of subcall function 6E0E1BFF: GlobalFree.KERNEL32(?), ref: 6E0E1E79
Part of subcall function 6E0E1BFF: GlobalFree.KERNEL32(?), ref: 6E0E1E7E

GlobalFree.KERNEL32(00000000), ref: 6E0E18C5
FreeLibrary.KERNEL32(?), ref: 6E0E194B
GlobalFree.KERNEL32(00000000), ref: 6E0E1970

Part of subcall function 6E0E243E: GlobalAlloc.KERNEL32(00000040,?), ref: 6E0E246F

Part of subcall function 6E0E2810: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,6E0E1896,00000000), ref: 6E0E28E0

Part of subcall function 6E0E1666: wsprintfW.USER32 ref: 6E0E1694

Strings

, xrefs: 6E0E1951

Memory Dump Source

Source File: 00000001.00000002.3313723502.000000006E0E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E0E0000, based on PE: true

Associated: 00000001.00000002.3313696406.000000006E0E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.3313755020.000000006E0E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.3313780368.000000006E0E6000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e0e0000_FiddlerSetup.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: b7e2262d7056d8cd6e53ba069d56e14831308cde1a4a285482767b08bf9d64bf
Instruction ID: 09beb1bf27517eed9aceb877c80aba3d2009b43fc4d87c19ccb3cf365c7c99f0
Opcode Fuzzy Hash: b7e2262d7056d8cd6e53ba069d56e14831308cde1a4a285482767b08bf9d64bf
Instruction Fuzzy Hash: 7841A371500207AFDF509FF4D984BD937ECAF05398F044876E9299B886DBB4958CC7A0

Function 0040349E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004034B2

Part of subcall function 0040361D: SetFilePointer.KERNEL32(00000000,00000000,00000000,0040331B,?), ref: 0040362B

SetFilePointer.KERNEL32(00000000,00000000,?,00000000,004033C8,00000004,00000000,00000000,?,?,00403342,000000FF,00000000,00000000,00008001,?), ref: 004034E5
SetFilePointer.KERNEL32(00E757A2,00000000,00000000,ck%d,00004000,?,00000000,004033C8,00000004,00000000,00000000,?,?,00403342,000000FF,00000000), ref: 004035E0

Strings

ck%d, xrefs: 00403512, 00403518

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: FilePointer$CountTick
String ID: ck%d
API String ID: 1092082344-4000962198
Opcode ID: 1344b17e1481b80582bdb0ed23b8c3804af25e72a501c03e477dd398e9b7707c
Instruction ID: f81ac03ea206090be76b65a385b2ac7d4b581aa0cbae2b80a2d2021fe8c89915
Opcode Fuzzy Hash: 1344b17e1481b80582bdb0ed23b8c3804af25e72a501c03e477dd398e9b7707c
Instruction Fuzzy Hash: 7E319CB2600201EFC7209F29EE859263FA9F740356B55023BF901B22F1CBB59E41DB9C

Function 004024AF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(False,00000023,00000011,00000002), ref: 004024FA
RegSetValueExW.KERNEL32(?,?,?,?,False,00000000,00000011,00000002), ref: 0040253A
RegCloseKey.KERNEL32(?,?,?,False,00000000,00000011,00000002), ref: 00402622

Strings

False, xrefs: 004024EB, 004024F9, 00402510, 00402524, 0040252F

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: False
API String ID: 2655323295-3926673204
Opcode ID: 0de24fb2535ea2e0bea56a18bf8e5dc89f408b524e964dc68ce8a364c8b1f1e1
Instruction ID: bf0ef5d62df918b2bfabe39acf8ac680016d82ecec6d2e1c9a4cf4f2d71e963b
Opcode Fuzzy Hash: 0de24fb2535ea2e0bea56a18bf8e5dc89f408b524e964dc68ce8a364c8b1f1e1
Instruction Fuzzy Hash: 2911A231D00115BEEB10AFA58E4AAAEB6B4EB44318F21443FF404B71D1C7B88E419668

Function 004061C1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004061DF
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00000000,00403663,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040394F), ref: 004061FA

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004061C6
nsa, xrefs: 004061CE

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-44229769
Opcode ID: ca4f867381b256d976a036b4ee2479ffffcb38332db50c9e5a73bf50e74bc53e
Instruction ID: f348173cd445ce0cff63ab1922c44f7ab34be52ec2d52f6d3f60174017d9ed76
Opcode Fuzzy Hash: ca4f867381b256d976a036b4ee2479ffffcb38332db50c9e5a73bf50e74bc53e
Instruction Fuzzy Hash: 3BF06D76701204BBEB109B59DD05E9AB7A8EBA1710F11803EEA01A6240E6B099648764

Function 00403396 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00008001,00000000,00000000,00000000,00000000,?,?,00403342,000000FF,00000000,00000000,00008001,?), ref: 004033BB

Strings

ck%d, xrefs: 00403410, 00403427, 0040343D

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: FilePointer
String ID: ck%d
API String ID: 973152223-4000962198
Opcode ID: 3d500f412808721b8c87be071932eede801725a1d128c96ac4c777ed30e32dcd
Instruction ID: 0f6a82c9814b8130565900c4f77509fb73920235a48305220d01948b4924e2c4
Opcode Fuzzy Hash: 3d500f412808721b8c87be071932eede801725a1d128c96ac4c777ed30e32dcd
Instruction Fuzzy Hash: 31317170640219BBDB22DF59ED48A9E3FA8EB00359F10443BF904FA1D1D3788E519BA9

Function 004015E6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 0040601C: CharNextW.USER32(?,?,C:\,?,00406090,C:\,C:\,75923420,?,75922EE0,00405DCE,?,75923420,75922EE0,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" ), ref: 0040602A
Part of subcall function 0040601C: CharNextW.USER32(00000000), ref: 0040602F
Part of subcall function 0040601C: CharNextW.USER32(00000000), ref: 00406047

GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 0040163F

Part of subcall function 00405BF6: CreateDirectoryW.KERNEL32(0042C800,?), ref: 00405C38

SetCurrentDirectoryW.KERNEL32(?,C:\Users\user\AppData\Local\Programs\Fiddler,?,00000000,000000F0), ref: 00401672

Strings

C:\Users\user\AppData\Local\Programs\Fiddler, xrefs: 00401665

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Programs\Fiddler
API String ID: 1892508949-451659537
Opcode ID: 2c9a68df1b521519dfe3a33f0f7d961bf53756525e0079ccbcfc168fc289cea5
Instruction ID: af3d40abcb4b92d5c03464ca519eb5fb88e5f0cb8c812bf2788953b75bb9e179
Opcode Fuzzy Hash: 2c9a68df1b521519dfe3a33f0f7d961bf53756525e0079ccbcfc168fc289cea5
Instruction Fuzzy Hash: B911B231504514EBDF20AFA5CD4169F36A0EF14368B29493FE942B22F1D63E8981DA5D

Function 00406079 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004066A2: lstrcpynW.KERNEL32(?,?,00000400,004037D7,00428A60,NSIS Error,?,00000008,0000000A,0000000C), ref: 004066AF

Part of subcall function 0040601C: CharNextW.USER32(?,?,C:\,?,00406090,C:\,C:\,75923420,?,75922EE0,00405DCE,?,75923420,75922EE0,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" ), ref: 0040602A
Part of subcall function 0040601C: CharNextW.USER32(00000000), ref: 0040602F
Part of subcall function 0040601C: CharNextW.USER32(00000000), ref: 00406047

lstrlenW.KERNEL32(C:\,00000000,C:\,C:\,75923420,?,75922EE0,00405DCE,?,75923420,75922EE0,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" ), ref: 004060D2
GetFileAttributesW.KERNEL32(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,75923420,?,75922EE0,00405DCE,?,75923420,75922EE0), ref: 004060E2

Strings

C:\, xrefs: 0040607F, 00406084, 0040608A, 004060CB, 004060D1, 004060D9, 004060E1

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 8ac32a27a18f4c2dd493eafaed9bce6c13b36ca5a95e32c2f60d88480e43d1b4
Instruction ID: 57cdea5284265d05e194d97f438d60f20e9a33b3e1b8f85ab2b18f32e1c9dba5
Opcode Fuzzy Hash: 8ac32a27a18f4c2dd493eafaed9bce6c13b36ca5a95e32c2f60d88480e43d1b4
Instruction Fuzzy Hash: F6F04425184A6259E622B73A0C05AAF25098F82324B4B463FF803B22C1DF3D8963917E

Function 00406570 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,00421F28,?,00000800,00000000,?,00421F28,?,?,: Completed,?,00000000,004067E1,80000002), ref: 004065B6
RegCloseKey.ADVAPI32(?), ref: 004065C1

Strings

: Completed, xrefs: 00406577

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CloseQueryValue
String ID: : Completed
API String ID: 3356406503-2954849223
Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction ID: 4169300ffd031f607b120f1368fde5344542a6b636238975c7224480bb0190f2
Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction Fuzzy Hash: 93017C72500209BBDF218F55DC09EDB3BA8EB54364F01803AFD1AA2190E778D964DBA4

Function 004071F5 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8001648312b76757b4dc2f3646509216fc345bf83ee85411accbee75f523ad1d
Instruction ID: 24c32228aea39238aae05165091b6f794a4b9b1c66cd55bc1afee76a19a4bada
Opcode Fuzzy Hash: 8001648312b76757b4dc2f3646509216fc345bf83ee85411accbee75f523ad1d
Instruction Fuzzy Hash: 10A14471E04228DBDF28CFA8C8446ADBBB1FF44305F14856ED856BB281C7786A86DF45

Function 004073F6 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2384488d3f0122d52eec19d06177794e899fdfc3e1a025a719282f78321e7206
Instruction ID: b8cb9ce97df986fef79018f719ec18ee870a51f75f9c549f23c9243a2682c43e
Opcode Fuzzy Hash: 2384488d3f0122d52eec19d06177794e899fdfc3e1a025a719282f78321e7206
Instruction Fuzzy Hash: 48912370D04228CBDF28CF98C8947ADBBB1FF44305F14856AD856BB291C778A986DF45

Function 0040710C Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27b0d047e0c308e0b5114cd8a4e3873cb63df72f9853a9642e586e78b8cecf79
Instruction ID: 4da454054b0c3dd02772a9c96e50ae6a11cdbe5b18e0bc5540401a1e7d1606fc
Opcode Fuzzy Hash: 27b0d047e0c308e0b5114cd8a4e3873cb63df72f9853a9642e586e78b8cecf79
Instruction Fuzzy Hash: E4813471D04228DBDF24CFA8C8847ADBBB1FF45305F24816AD456BB281C778AA86DF45

Function 0040705F Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb6308170f34cf48dfcb4d8f9c09bb4bb9b1200d68288f83770d90fe7aa59a96
Instruction ID: 2ce83fc52b21f36f835e1fdafd5cf74e6ced0850754c4da96a209bb8fab2d9ce
Opcode Fuzzy Hash: eb6308170f34cf48dfcb4d8f9c09bb4bb9b1200d68288f83770d90fe7aa59a96
Instruction Fuzzy Hash: 11712471D04228DBDF28CFA8C8847ADBBB1FF48305F15806AD856B7281C778A986DF55

Function 0040717D Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35efb6cfb69a5e3ac5770c17f23e35896c35ba4500d931508133f68803cc17e7
Instruction ID: eaca5e257ecba6057ed761995cb39389c4d8ec983a179070fe5d03b82c062b57
Opcode Fuzzy Hash: 35efb6cfb69a5e3ac5770c17f23e35896c35ba4500d931508133f68803cc17e7
Instruction Fuzzy Hash: BF713671E04218DBDF28CFA8C884BADBBB1FF44305F14806AD856BB281C7786986DF55

Function 004070C9 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a7222321010e346b35687484556753c48e929d86f13e87db132154ce9d598b8
Instruction ID: 26522df2f7fda751442351ae768cbf4c3b612a3e7fb567ef5040218afec9c9a0
Opcode Fuzzy Hash: 3a7222321010e346b35687484556753c48e929d86f13e87db132154ce9d598b8
Instruction Fuzzy Hash: CB713771D04228DBEF28CF98C8447ADBBB1FF44305F15806AD856B7281C778A946DF45

Function 004020FD Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 00402128

Part of subcall function 00405727: lstrlenW.KERNEL32(00421F28,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000,?), ref: 0040575F
Part of subcall function 00405727: lstrlenW.KERNEL32(004030CD,00421F28,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000), ref: 0040576F
Part of subcall function 00405727: lstrcatW.KERNEL32(00421F28,004030CD,004030CD,00421F28,00000000,00000000,00000000), ref: 00405782
Part of subcall function 00405727: SetWindowTextW.USER32(00421F28,00421F28), ref: 00405794
Part of subcall function 00405727: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004057BA
Part of subcall function 00405727: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004057D4
Part of subcall function 00405727: SendMessageW.USER32(?,00001013,?,00000000), ref: 004057E2

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402139
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004021B6

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: b6973e3890687e9b22bcb8eeb46457d9035beda251d7ed3188fef093bcba0e75
Instruction ID: 77040aa306750b8c28c9decefed3201328e3be048babc7be2d350fd99aa9233c
Opcode Fuzzy Hash: b6973e3890687e9b22bcb8eeb46457d9035beda251d7ed3188fef093bcba0e75
Instruction Fuzzy Hash: A3219F31904204EADF10AFA5CF89A9E7A71BF44359F30413BE105B91E5CBBD8982DA2D

Function 00401BC0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401C30
GlobalAlloc.KERNEL32(00000040,00000804), ref: 00401C42

Strings

Call, xrefs: 00401BE7, 00401BED, 00401C07

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: 3750bf9dfa814a3c0f6efd612861c63dc40cfe6380e236ca5b9144ec9c5a3e46
Instruction ID: ce9828fb533201d430d1dfc272b0b5c9437a35d96f5815e0f5c69034b7ba0116
Opcode Fuzzy Hash: 3750bf9dfa814a3c0f6efd612861c63dc40cfe6380e236ca5b9144ec9c5a3e46
Instruction Fuzzy Hash: 0021F372944150EBDB20BBA4DE85A5E33A8AB04714718093FF552F32D0C6BC9C918B9D

Function 0040204F Relevance: 4.6, APIs: 3, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406A96: GetModuleHandleA.KERNEL32(?,00000020,?,00403775,0000000C,?,?,?,?,?,?,?,?), ref: 00406AA8
Part of subcall function 00406A96: GetProcAddress.KERNEL32(00000000,?), ref: 00406AC3

GetFileVersionInfoSizeW.KERNELBASE(0000000B,00000000,?,000000EE), ref: 00402065
GlobalAlloc.KERNEL32(00000040,00000000), ref: 00402084
GetFileVersionInfoW.KERNELBASE(?,?,00000000,?,0000000D,0000000C), ref: 004020B1

Part of subcall function 004065E9: wsprintfW.USER32 ref: 004065F6

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: FileInfoVersion$AddressAllocGlobalHandleModuleProcSizewsprintf
String ID:
API String ID: 2654256344-0
Opcode ID: 07812cedf9ef6ff5752f09a7ef8dacfbefdf77ad1719ce8d4fbf696c8ce9ac10
Instruction ID: 091db0ea7ea1b964f219afddefb3a375ce28aab9314d1797bc42d4ec1cd84b70
Opcode Fuzzy Hash: 07812cedf9ef6ff5752f09a7ef8dacfbefdf77ad1719ce8d4fbf696c8ce9ac10
Instruction Fuzzy Hash: 89212971A00208ABDF10EFE5D985AAEBBB4EF04344F21402AF605F62E0D7759D51DB64

Function 004025C3 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025F6
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 00402609
RegCloseKey.KERNEL32(?,?,?,False,00000000,00000011,00000002), ref: 00402622

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: ea10670c8674ea56920c7c8a5d7e61c9f2d77da932cf661bffc88eb9ba6ffbcf
Instruction ID: fde7ee3b690bf0a9f1400c3c006cad269c6ae989cb90eb9f0638982b81c2946e
Opcode Fuzzy Hash: ea10670c8674ea56920c7c8a5d7e61c9f2d77da932cf661bffc88eb9ba6ffbcf
Instruction Fuzzy Hash: B0017C71A04615ABEB149F94DE58BAFB668EF80348F10443EF101B61D0D7B85E41976D

Function 00406B41 Relevance: 4.5, APIs: 3, Instructions: 27synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000064), ref: 00406B52
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00406B67
GetExitCodeProcess.KERNEL32(?,?), ref: 00406B74

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: ObjectSingleWait$CodeExitProcess
String ID:
API String ID: 2567322000-0
Opcode ID: 8ff07581d1a9b179a96ae9e6ed15c74e4a8339333c72220da53f642c9193dd0c
Instruction ID: 0a43b9f96fb2b6b0c204ab13ec475b47687dff995c0faea4a1be46f6685e1a01
Opcode Fuzzy Hash: 8ff07581d1a9b179a96ae9e6ed15c74e4a8339333c72220da53f642c9193dd0c
Instruction Fuzzy Hash: AFE09271600218BBDB00AB54CD01EDE7B6ADB45700F104036B601B6190D6B5AE62DA98

Function 004021CF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084DC,?,00000001,004084CC,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040224E

Strings

C:\Users\user\AppData\Local\Programs\Fiddler, xrefs: 0040228E

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Programs\Fiddler
API String ID: 542301482-451659537
Opcode ID: cfcf055d97698e4c570f06ff821b23c4d0c69ef19f965f4a5f4b3cd5951c4e76
Instruction ID: 6ff6f317fb38c44f87062c5feee8d19efe767a13196ba6052caed3a8697b1732
Opcode Fuzzy Hash: cfcf055d97698e4c570f06ff821b23c4d0c69ef19f965f4a5f4b3cd5951c4e76
Instruction Fuzzy Hash: 57410575A00209AFCB00DFE4CA89A9D7BB5FF48318B20457EF505EB2D1DB799981CB54

Function 00406215 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00008001,00000000,00000000,00000000,00000000,ck%d,0040CEF0,0040361A,00008001,00008001,0040351E,ck%d,00004000,?,00000000,004033C8), ref: 00406229

Strings

ck%d, xrefs: 00406218

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: FileRead
String ID: ck%d
API String ID: 2738559852-4000962198
Opcode ID: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction ID: fbac330590941eb325162a4ee9bfa4b3c7313c609e27a1dd4f64d068a4d06545
Opcode Fuzzy Hash: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction Fuzzy Hash: 8FE08632110129ABCF106E549C00EEB375CEF05350F014876F951E3040D730E83187A5

Function 0040254F Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 00402580
RegCloseKey.KERNEL32(?,?,?,False,00000000,00000011,00000002), ref: 00402622

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 86fad1e446aa8b08d0eaee014d74f44cc203c290d92848c6c8e309bf312e033b
Instruction ID: a1e8d7c51e2174fe69d0a38a45018fa5c8ecdbf0c3d6cccc33ed9d3604573096
Opcode Fuzzy Hash: 86fad1e446aa8b08d0eaee014d74f44cc203c290d92848c6c8e309bf312e033b
Instruction Fuzzy Hash: 5A119E71A0421AEADF15DFA0DA589AEB7B4FF04348F20443FE402B62D0D3B88A45DB5D

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(0040A230,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 44422ec4cc38e602ea7d4d2f5f5b5ed5cf3abc39ac7d2c30bec0a520d1a14902
Instruction ID: 4cdfa14fa51073ec67c7732ce5b449902c092ffb61bdcee16cd85da0f6320b18
Opcode Fuzzy Hash: 44422ec4cc38e602ea7d4d2f5f5b5ed5cf3abc39ac7d2c30bec0a520d1a14902
Instruction Fuzzy Hash: 0F01F4327212209BE7295B389D05B6B3698E710354F10863FF855F6AF1DA78CC429B4C

Function 00402459 Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040247B
RegCloseKey.ADVAPI32(00000000), ref: 00402484

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: 7259ca6d1f05d7483d87d2f391694756323bc0c45ff6c46f1d59c05c3536b230
Instruction ID: e2e4e8893df5a4528a6e21454bcdecfabc6281ca852765cce5f9bf4b5ee6cd51
Opcode Fuzzy Hash: 7259ca6d1f05d7483d87d2f391694756323bc0c45ff6c46f1d59c05c3536b230
Instruction Fuzzy Hash: 63F09632A04521ABDB10BBA9DB8EAEE72A5AB44354F11443FF542B71C1CAFC4D02977D

Function 004057FA Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0040580A

Part of subcall function 0040466D: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040467F

CoUninitialize.COMBASE(00000404,00000000), ref: 00405856

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: 6b48ba6f2f212ba91ce3a94f30354a0bb9d691122d035e2291a9dc674f3f10d0
Instruction ID: c9b136bfd6425174320eda825e29e98f29050d968d981144e95e0ff8d77ed717
Opcode Fuzzy Hash: 6b48ba6f2f212ba91ce3a94f30354a0bb9d691122d035e2291a9dc674f3f10d0
Instruction Fuzzy Hash: 11F0B473A006008AEB516755AD01B5777A4FBD4309F05843AEE84722F0DB794C12CF5D

Function 00405BF6 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(0042C800,?), ref: 00405C38
GetLastError.KERNEL32 ref: 00405C46

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: cc352e270a5c7d66bac2c8a7d463e84c1d5eb2dce2c10117675193e318c6cc25
Instruction ID: 25e10c4fac4d698a59efea960107f93253b8ac9e3b964bd1d6400c706bcc644c
Opcode Fuzzy Hash: cc352e270a5c7d66bac2c8a7d463e84c1d5eb2dce2c10117675193e318c6cc25
Instruction Fuzzy Hash: E6F0F4B0C04209DAEB00CFA4D9497EFBBB4BB04319F00802AD541B6281D7B882488FA9

Function 00405C85 Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,0042C800,00000000,00000000,00000000,04000000,00000000,00000000,00425F50,?,?,?,0042C800,?), ref: 00405CAE
CloseHandle.KERNEL32(?,?,?,0042C800,?), ref: 00405CBB

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: dc4e0aa2a6e4d88c421582106c1d46ba955b2ae98b0244f92ff0ec2e2b298c3d
Instruction ID: 3c730061575d40878ccbcf559f5dc137d48881e2855f55d79af12727e8fe0db1
Opcode Fuzzy Hash: dc4e0aa2a6e4d88c421582106c1d46ba955b2ae98b0244f92ff0ec2e2b298c3d
Instruction Fuzzy Hash: 0BE0BFB4600219BFFB109B64EE49F7B7B7CE700644F418425BD14F2591D77498149A7C

Function 00406A96 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403775,0000000C,?,?,?,?,?,?,?,?), ref: 00406AA8
GetProcAddress.KERNEL32(00000000,?), ref: 00406AC3

Part of subcall function 00406A26: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406A3D
Part of subcall function 00406A26: wsprintfW.USER32 ref: 00406A78
Part of subcall function 00406A26: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406A8C

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 09a5520475afffee645b4664441d986c1138b09cf986c3d6b2a713b3520f987f
Instruction ID: 6883b19bcb958afdb132cd43d0a9aeb12fc85c99e1cf53eaa24744f9dd55f8c1
Opcode Fuzzy Hash: 09a5520475afffee645b4664441d986c1138b09cf986c3d6b2a713b3520f987f
Instruction Fuzzy Hash: CDE08636714611ABD210BA745E48C6777A89F86610306C83EF542F2141D734DC33AA79

Function 00406192 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000003,00403138,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe,80000000,00000003), ref: 00406196
CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 004061B8

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: d28f21770be58fa8ab322e44db2ef64be76ab1399ecbb41bfd548adfe90c5e60
Instruction ID: be52236ca1bfc2e7009fe271a1dfd41440a2a0d1ebc26b2cb4c8630358080456
Opcode Fuzzy Hash: d28f21770be58fa8ab322e44db2ef64be76ab1399ecbb41bfd548adfe90c5e60
Instruction Fuzzy Hash: 30D09E31254301EFFF098F20DE16F2EBAA2EB94B00F11952CB682941E0DA715819DB15

Function 0040616D Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,00405D72,?,?,00000000,00405F48,?,?,?,?), ref: 00406172
SetFileAttributesW.KERNEL32(?,00000000), ref: 00406186

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
Instruction ID: 83b49fe15d4d51a1c27b4b8da2ab4689423c6710ab607d501633f61f971848cf
Opcode Fuzzy Hash: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
Instruction Fuzzy Hash: 63D0C972504220BFC2102728AE0889BBB55DB552717028A35FCA9A22B0CB314C6A86A4

Function 00405C50 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,00000000,00403658,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040394F,?,00000008,0000000A,0000000C), ref: 00405C56
GetLastError.KERNEL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405C64

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 713f00ffaa2578e3ba1d99e04a2fab42aad7341dbc9e3b83e2e07bf738d273a4
Instruction ID: 868687b2a80a8d4cb6d5034857ca3092976d2c25b2f3b55ea206b3a8d14aaeda
Opcode Fuzzy Hash: 713f00ffaa2578e3ba1d99e04a2fab42aad7341dbc9e3b83e2e07bf738d273a4
Instruction Fuzzy Hash: C7C04C30608701DAEA105B31DE8CB177A50BB54741F198439A582F41B0DA348555D92D

Function 004028B6 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,?,00000000,?,?), ref: 004028D4

Part of subcall function 004065E9: wsprintfW.USER32 ref: 004065F6

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 71ec0585dfc1f5a4deb38e390d125e8dba0ecba5ee550c3c95508aededf6839d
Instruction ID: 25ca00dcee0cf0708ebb41b42c3bcfe7940f6ca7f4ca5ddd9dc2277bf7af936e
Opcode Fuzzy Hash: 71ec0585dfc1f5a4deb38e390d125e8dba0ecba5ee550c3c95508aededf6839d
Instruction Fuzzy Hash: 04E06D71A08104AAEB04ABA5AE49CAF7379AF90345B20443FF101B00D8C6794D119A2D

Function 00402903 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(00000000,?,?), ref: 00402917

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 4a658412309a22cd8c561ba8e9edf7253248352025784d29f3c0f8aefcd4dc67
Instruction ID: 652cfb359cd4de79752e2b21477efebd6c6d4182b0d23a8f837041602f946fc7
Opcode Fuzzy Hash: 4a658412309a22cd8c561ba8e9edf7253248352025784d29f3c0f8aefcd4dc67
Instruction Fuzzy Hash: D4E06D726041059BDB11DBE5DA5CAAFB3B8EF00348F20447BD102F21E1E7B98A55DB19

Function 0040653D Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E7C,00000000,?,?), ref: 00406566

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b17b4e85cc10dff7c00d1995fa2300a068af545831f113dbcef6cd8b4d780b07
Instruction ID: cfc89692b4771faa31f3440cbcbb3328f2b21d62788620711c29387ee39994bc
Opcode Fuzzy Hash: b17b4e85cc10dff7c00d1995fa2300a068af545831f113dbcef6cd8b4d780b07
Instruction Fuzzy Hash: 94E0BFB2010109BEEF095F50EC0AD7F371DE708210F11452EF946D5051E6B5A9309674

Function 00406244 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00008001,00000000,00000000,00000000,00000000,00411E1B,0040CEF0,0040359E,0040CEF0,00411E1B,ck%d,00004000,?,00000000,004033C8,00000004), ref: 00406258

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction ID: 50ccb5e768420c5b79bdfebb9096a84dabe54a6ff5c0a4120d9a71b85527c923
Opcode Fuzzy Hash: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction Fuzzy Hash: FDE08C3221821AABCF10BE608C00EEB3B6CEB017A0F02447AFD56E3050D231E83097A8

Function 6E0E2A7F Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(6E0E505C,00000004,00000040,6E0E504C), ref: 6E0E2A9D

Memory Dump Source

Source File: 00000001.00000002.3313723502.000000006E0E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E0E0000, based on PE: true

Associated: 00000001.00000002.3313696406.000000006E0E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.3313755020.000000006E0E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.3313780368.000000006E0E6000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e0e0000_FiddlerSetup.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2345f972898dd515885e216037ac7a68247c9a402a6a39610b00743e9863cae3
Instruction ID: edb1c49f2cccfaac415c4bfaf3195ccee34cb51d02d7706cb4df3aa78ecdbb0a
Opcode Fuzzy Hash: 2345f972898dd515885e216037ac7a68247c9a402a6a39610b00743e9863cae3
Instruction Fuzzy Hash: 9AF0AEB8904A80EECBA0CFE884447293BE0B70AB14B144D3AF29CDA680F3744444CF91

Function 0040650F Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(00000000,00421F28,00000000,00000000,?,?,00000000,?,0040659D,?,00421F28,?,?,: Completed,?,00000000), ref: 00406533

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
Instruction ID: f918e5a98cb24a054262289ed7dc727aaea68e18f53d3a7cb50250e03803467c
Opcode Fuzzy Hash: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
Instruction Fuzzy Hash: 49D0127200020DBBDF119E90AD01FAB3B1DEB08750F014826FE06A4090D775D530A759

Function 00404621 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetDlgItemTextW.USER32(?,?,00000000), ref: 0040463B

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 9f5f9317995870dd68fcf34551989b3f9c33a874f6e62bdf9e4bbf2fb329bfe5
Instruction ID: 40b0c8aab23b9b46c3ec191ca1ef6f3d1e6ea20de3ce9ad326d3c9787e78ebc3
Opcode Fuzzy Hash: 9f5f9317995870dd68fcf34551989b3f9c33a874f6e62bdf9e4bbf2fb329bfe5
Instruction Fuzzy Hash: 36C04C75548300BFE641A759CC42F1FB799EF94355F40C92EB15DA11D1C67588209A2A

Function 0040466D Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040467F

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bbff93e8e7b6fbbde5b3e6835961aabe87c2407351212feb15be82645ba7347e
Instruction ID: 38647ca3e6c342635367b16172ac7ab85b9be791cf4bd3c69a3aa105c12693b9
Opcode Fuzzy Hash: bbff93e8e7b6fbbde5b3e6835961aabe87c2407351212feb15be82645ba7347e
Instruction Fuzzy Hash: 2EC04C717402007BDA209B509E49F0777585790750F15493D7641E50E0DA75E450DA1C

Function 00404656 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00404481), ref: 00404664

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7b4bfb7d8a9e2d5081e5309f0fc6290f036d11fbecd93854b33ee848cd02fe6a
Instruction ID: d5eb2a856a333d3101ae379727e71f2b9456d74e3cdd14bb02a2274a242f0d94
Opcode Fuzzy Hash: 7b4bfb7d8a9e2d5081e5309f0fc6290f036d11fbecd93854b33ee848cd02fe6a
Instruction Fuzzy Hash: 7DB09235280640AADE215B00DE09F867B66A7A4701F008438B240640B0CAB204A1DB08

Function 0040361D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,0040331B,?), ref: 0040362B

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction ID: 1f5c7ae16c2334422adcad36111bde95194575cbdac9b1f52e29a9f6e91cc98e
Opcode Fuzzy Hash: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction Fuzzy Hash: 34B01271240300BFDA214F00DF09F057B21ABA0700F10C034B388380F086711035EB0D

Function 00405CC8 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00405CD7

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: accb29398adcd6f2598047f0fcddae8b07494e52d9cc9fcafc25c5f5f83f3143
Instruction ID: 080962bbef7e268e86b0d243ececfcd1ad47764945baea7f73af6130fa7b9bd6
Opcode Fuzzy Hash: accb29398adcd6f2598047f0fcddae8b07494e52d9cc9fcafc25c5f5f83f3143
Instruction Fuzzy Hash: A9C092F2100201EFE301CF80CB09F067BE8AF54306F028058E1899A060CB788800CB29

Function 00404643 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040441A), ref: 0040464D

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: a1d13c5b68b43feb2506ad2660f88dc7f5461ef8ac70b9f67d62976f64309ddb
Instruction ID: 1e4f5f38d13ad7c97f33cdc532a4b6885827051f8054e7174c13f2a159251e9b
Opcode Fuzzy Hash: a1d13c5b68b43feb2506ad2660f88dc7f5461ef8ac70b9f67d62976f64309ddb
Instruction Fuzzy Hash: 7FA00176544900ABCA16AB50EF0980ABB72BBA8701B5288B9A285610348BB25821FB19

Function 00401FC9 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00405727: lstrlenW.KERNEL32(00421F28,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000,?), ref: 0040575F
Part of subcall function 00405727: lstrlenW.KERNEL32(004030CD,00421F28,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000), ref: 0040576F
Part of subcall function 00405727: lstrcatW.KERNEL32(00421F28,004030CD,004030CD,00421F28,00000000,00000000,00000000), ref: 00405782
Part of subcall function 00405727: SetWindowTextW.USER32(00421F28,00421F28), ref: 00405794
Part of subcall function 00405727: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004057BA
Part of subcall function 00405727: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004057D4
Part of subcall function 00405727: SendMessageW.USER32(?,00001013,?,00000000), ref: 004057E2

Part of subcall function 00405C85: CreateProcessW.KERNEL32(00000000,0042C800,00000000,00000000,00000000,04000000,00000000,00000000,00425F50,?,?,?,0042C800,?), ref: 00405CAE
Part of subcall function 00405C85: CloseHandle.KERNEL32(?,?,?,0042C800,?), ref: 00405CBB

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00402010

Part of subcall function 00406B41: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406B52
Part of subcall function 00406B41: GetExitCodeProcess.KERNEL32(?,?), ref: 00406B74

Part of subcall function 004065E9: wsprintfW.USER32 ref: 004065F6

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: e69e05c3dc1c12fb4290c215016f24b525655286682406ff582cbfed98be6605
Instruction ID: 5ec8f1ba08e9840dea923bca67266c83376547b269141edce926560ea608d087
Opcode Fuzzy Hash: e69e05c3dc1c12fb4290c215016f24b525655286682406ff582cbfed98be6605
Instruction Fuzzy Hash: 7AF09C31904615DBEF20BB655AC95DE7665DF00318F11413FE202B21D5CABC4D41A75D

Function 6E0E12BB Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,6E0E12DB,?,6E0E137F,00000019,6E0E11CA,-000000A0), ref: 6E0E12C5

Memory Dump Source

Source File: 00000001.00000002.3313723502.000000006E0E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E0E0000, based on PE: true

Associated: 00000001.00000002.3313696406.000000006E0E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.3313755020.000000006E0E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.3313780368.000000006E0E6000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e0e0000_FiddlerSetup.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 3ea96dd1f7e96e6f7def9b5c52f690f26e5a19afbb34c176a924d8454641c119
Instruction ID: ac865b965b2085e2829c3445d381ecdcb15c66206dc9ba5eb47a02bb01bdf7ce
Opcode Fuzzy Hash: 3ea96dd1f7e96e6f7def9b5c52f690f26e5a19afbb34c176a924d8454641c119
Instruction Fuzzy Hash: ECB01270600400AFEE408B94DC0AF343254F701B00F040430B700C1040C1704C108524

Non-executed Functions

Function 0040508E Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004050A6
GetDlgItem.USER32(?,00000408), ref: 004050B1
GlobalAlloc.KERNEL32(00000040,?), ref: 004050FB
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00405112
SetWindowLongW.USER32(?,000000FC,0040569B), ref: 0040512B
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 0040513F
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00405151
SendMessageW.USER32(?,00001109,00000002), ref: 00405167
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405173
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00405185
DeleteObject.GDI32(00000000), ref: 00405188
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 004051B3
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 004051BF
SendMessageW.USER32(?,00001132,00000000,?), ref: 0040525A
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040528A

Part of subcall function 00404656: SendMessageW.USER32(00000028,?,00000001,00404481), ref: 00404664

SendMessageW.USER32(?,00001132,00000000,?), ref: 0040529E
GetWindowLongW.USER32(?,000000F0), ref: 004052CC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 004052DA
ShowWindow.USER32(?,00000005), ref: 004052EA
SendMessageW.USER32(?,00000419,00000000,?), ref: 004053E5
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040544A
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 0040545F
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405483
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004054A3
ImageList_Destroy.COMCTL32(?), ref: 004054B8
GlobalFree.KERNEL32(?), ref: 004054C8
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405541
SendMessageW.USER32(?,00001102,?,?), ref: 004055EA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004055F9
InvalidateRect.USER32(?,00000000,00000001), ref: 00405624
ShowWindow.USER32(?,00000000), ref: 00405672
GetDlgItem.USER32(?,000003FE), ref: 0040567D
ShowWindow.USER32(00000000), ref: 00405684

Strings

, xrefs: 0040565C
N, xrefs: 00405323
M, xrefs: 00405242

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 5556c4ccadcc43b485929ea75668a96a24f705d46e3e8325ca371777a04c903b
Instruction ID: 34ca0daebb1283ae0dea41fcbe79f03df20d3d5ccd25e7298a94edbde83860af
Opcode Fuzzy Hash: 5556c4ccadcc43b485929ea75668a96a24f705d46e3e8325ca371777a04c903b
Instruction Fuzzy Hash: F5028C70A00609AFDB20DF55CD45AAF7BB5FB84314F50857AF910BA2E1D7B98A42CF18

Function 004062E8 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406483,?,?), ref: 00406323
GetShortPathNameW.KERNEL32(?,004265E8,00000400), ref: 0040632C

Part of subcall function 004060F7: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063DC,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406107
Part of subcall function 004060F7: lstrlenA.KERNEL32(00000000,?,00000000,004063DC,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406139

GetShortPathNameW.KERNEL32(?,00426DE8,00000400), ref: 00406349
wsprintfA.USER32 ref: 00406367
GetFileSize.KERNEL32(00000000,00000000,00426DE8,C0000000,00000004,00426DE8,?,?,?,?,?), ref: 004063A2
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004063B1
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004063E9
SetFilePointer.KERNEL32(0040A5B0,00000000,00000000,00000000,00000000,004261E8,00000000,-0000000A,0040A5B0,00000000,[Rename],00000000,00000000,00000000), ref: 0040643F
GlobalFree.KERNEL32(00000000), ref: 00406450
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406457

Part of subcall function 00406192: GetFileAttributesW.KERNEL32(00000003,00403138,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe,80000000,00000003), ref: 00406196
Part of subcall function 00406192: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 004061B8

Strings

mB, xrefs: 0040633E
mB, xrefs: 00406345
[Rename], xrefs: 004063D1, 004063E3
%ls=%ls, xrefs: 0040635D
eB, xrefs: 00406311

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]$eB$mB$mB
API String ID: 2171350718-2529913679
Opcode ID: db523023045b127196975f0173c88122861a3a00dd6e7a8812d5311d7169504c
Instruction ID: 9150ff15d44dd6ac7e39c2a3973aa46bc34ee9e674c79fba1fcd409278ee571c
Opcode Fuzzy Hash: db523023045b127196975f0173c88122861a3a00dd6e7a8812d5311d7169504c
Instruction Fuzzy Hash: A0312370600325BBD2206F65AD49F6B3A5CDF41754F12403AFA02B62D3DA7CD82586BD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00428A60,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 9a1d1952d02a6587733a796de720c08d05f060e36ce2c67ddab1b612aed24319
Instruction ID: 3c33d73dbc2ffdf14e434cca4ae815e9cfbd561affca8d3971a90777bf4c3be5
Opcode Fuzzy Hash: 9a1d1952d02a6587733a796de720c08d05f060e36ce2c67ddab1b612aed24319
Instruction Fuzzy Hash: 34418B71800249AFCF058FA5DE459AFBBB9FF45314F00802EF592AA1A0CB34DA55DFA4

Function 00406950 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" ,75923420,C:\Users\user\AppData\Local\Temp\,00000000,00403640,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040394F,?,00000008,0000000A,0000000C), ref: 004069B3
CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004069C2
CharNextW.USER32(?,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" ,75923420,C:\Users\user\AppData\Local\Temp\,00000000,00403640,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040394F,?,00000008,0000000A,0000000C), ref: 004069C7
CharPrevW.USER32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000,00403640,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040394F,?,00000008,0000000A,0000000C), ref: 004069DA

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406951
"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" , xrefs: 00406994
*?|<>/":, xrefs: 004069A2

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2647613828
Opcode ID: 7c4491ab095b24fecdd0000f8ec6f0e383ca7ce11269c465865605e120ff5cd6
Instruction ID: ee050b90af12f7da754e5e1a7cefda923f304df8a209a79dab08f9ec4fc7f4f9
Opcode Fuzzy Hash: 7c4491ab095b24fecdd0000f8ec6f0e383ca7ce11269c465865605e120ff5cd6
Instruction Fuzzy Hash: 0311B695800612A5DB303B148D40AB7A2F8AF55794F52403FED9AB3AC1EB7C4C9286BD

Function 00404688 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004046A5
GetSysColor.USER32(00000000), ref: 004046E3
SetTextColor.GDI32(?,00000000), ref: 004046EF
SetBkMode.GDI32(?,?), ref: 004046FB
GetSysColor.USER32(?), ref: 0040470E
SetBkColor.GDI32(?,?), ref: 0040471E
DeleteObject.GDI32(?), ref: 00404738
CreateBrushIndirect.GDI32(?), ref: 00404742

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction ID: dc9e33635e48260261a40037ac820fc698cd45b4c1bae75aa0874807b7806060
Opcode Fuzzy Hash: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction Fuzzy Hash: B321A7715007049BCB309F38DA48B5B7BF4AF82714B00893DE9A6B72E0D778E904CB58

Function 00402711 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040277D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004027B8
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027DB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027F1

Part of subcall function 00406273: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00406289

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040289D

Strings

9, xrefs: 00402760

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: f4cc411d6a691ff0d779ee2962e3d04b2c777b5052aec2b7df3f44af6f7597f5
Instruction ID: 77fbecb4268093b3ffff8c623a80bd5bb6512b600f7762490a4bde5bc174ce64
Opcode Fuzzy Hash: f4cc411d6a691ff0d779ee2962e3d04b2c777b5052aec2b7df3f44af6f7597f5
Instruction Fuzzy Hash: 9A511D75D04219AADF20EFD4CA85AAEBB79FF44304F14817BE501B62D0D7B89D82CB58

Function 00403053 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 0040306E
GetTickCount.KERNEL32 ref: 0040308C
wsprintfW.USER32 ref: 004030BA

Part of subcall function 00405727: lstrlenW.KERNEL32(00421F28,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000,?), ref: 0040575F
Part of subcall function 00405727: lstrlenW.KERNEL32(004030CD,00421F28,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000), ref: 0040576F
Part of subcall function 00405727: lstrcatW.KERNEL32(00421F28,004030CD,004030CD,00421F28,00000000,00000000,00000000), ref: 00405782
Part of subcall function 00405727: SetWindowTextW.USER32(00421F28,00421F28), ref: 00405794
Part of subcall function 00405727: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004057BA
Part of subcall function 00405727: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004057D4
Part of subcall function 00405727: SendMessageW.USER32(?,00001013,?,00000000), ref: 004057E2

CreateDialogParamW.USER32(0000006F,00000000,00402FB8,00000000), ref: 004030DE
ShowWindow.USER32(00000000,00000005), ref: 004030EC

Part of subcall function 00403037: MulDiv.KERNEL32(00013AC3,00000064,000189EE), ref: 0040304C

Strings

... %d%%, xrefs: 004030B4

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 920e2fed2f7f6b90a89c4d732b65cf36064fa2cf8f5ba5adda892f284e8f97c6
Instruction ID: 97c902a025ac2946b461c4c6cbd0392064296d6115d029b2f7da86e316ad9030
Opcode Fuzzy Hash: 920e2fed2f7f6b90a89c4d732b65cf36064fa2cf8f5ba5adda892f284e8f97c6
Instruction Fuzzy Hash: 5901A530542320EBCB31AF60AE0AA6B7F6CAB00702F54443BF441B15D5CAB84641CB9E

Function 00404FDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404FF7
GetMessagePos.USER32 ref: 00404FFF
ScreenToClient.USER32(?,?), ref: 00405019
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040502B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00405051

Strings

f, xrefs: 0040502D

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction ID: 35c53ee3dfde216a4a17f9e8076a2c946c4c65f0c866826bb74e9a6ab3448864
Opcode Fuzzy Hash: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction Fuzzy Hash: F3015E31900218BADB00DBA4DD85BFFBBBCEF55711F10412BBA51B61D0D7B49A058BA4

Function 00402FB8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FD6
wsprintfW.USER32 ref: 0040300A
SetWindowTextW.USER32(?,?), ref: 0040301A
SetDlgItemTextW.USER32(?,00000406,?), ref: 0040302C

Strings

unpacking data: %d%%, xrefs: 00402FF8, 00403008
verifying installer: %d%%, xrefs: 00402FFF

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 66e00694bf9c2fcf5817c91216ca696d61ea9415c1ed8b1f40767934bfa15992
Instruction ID: bec97a1ff423586d6a5c987b60c5c02bd53578e49ae90ce5674df69195bed5dc
Opcode Fuzzy Hash: 66e00694bf9c2fcf5817c91216ca696d61ea9415c1ed8b1f40767934bfa15992
Instruction Fuzzy Hash: 98F0317054020CABEF209F60DD4ABEE3B6CEB04349F00803AF646B51D0DBB99A558F99

Function 6E0E2655 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 6E0E12BB: GlobalAlloc.KERNEL32(00000040,?,6E0E12DB,?,6E0E137F,00000019,6E0E11CA,-000000A0), ref: 6E0E12C5

GlobalFree.KERNEL32(?), ref: 6E0E2743
GlobalFree.KERNEL32(00000000), ref: 6E0E2778

Memory Dump Source

Source File: 00000001.00000002.3313723502.000000006E0E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E0E0000, based on PE: true

Associated: 00000001.00000002.3313696406.000000006E0E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.3313755020.000000006E0E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.3313780368.000000006E0E6000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e0e0000_FiddlerSetup.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 54f960a870ddf6fda21c2442df8b920570869a92c2c883b80da212a220b47100
Instruction ID: d4ddfc8ca7597109aea4470e1febf2e89883bb6f8125423e9702a059fc9292f1
Opcode Fuzzy Hash: 54f960a870ddf6fda21c2442df8b920570869a92c2c883b80da212a220b47100
Instruction Fuzzy Hash: 93319E71604503EFCB198FE5CC84E7E77FAFB867443544939F28183A60C731A8168B61

Function 00402975 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029D6
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029F2
GlobalFree.KERNEL32(?), ref: 00402A2B
GlobalFree.KERNEL32(00000000), ref: 00402A3E
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A5A
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A6D

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 99a72b25e835b2ea7940c93163da3ca2f710589d23dcac0e6d207047e8163098
Instruction ID: 349357d0e6511a5e46fd8e19636faeb724d9b15f10a4c99f70335ec2520be7da
Opcode Fuzzy Hash: 99a72b25e835b2ea7940c93163da3ca2f710589d23dcac0e6d207047e8163098
Instruction Fuzzy Hash: 2731B171D00124BBCF21AFA5DD89D9E7E79AF44364F14023AF415762E1CB794D418F68

Function 6E0E1979 Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 6E0E19DA
GlobalFree.KERNEL32(?), ref: 6E0E1B7A
GlobalFree.KERNEL32(?), ref: 6E0E1B7F

Memory Dump Source

Source File: 00000001.00000002.3313723502.000000006E0E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E0E0000, based on PE: true

Associated: 00000001.00000002.3313696406.000000006E0E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.3313755020.000000006E0E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.3313780368.000000006E0E6000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e0e0000_FiddlerSetup.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: f4666f9d2b99b5eedcc1a6e5dfe0a359c56ce9ac7662d51d9d128d2cf702bc37
Instruction ID: cecc62df6043321a463e11f53cf63f434701b491218fcd642196808e8d03a3ea
Opcode Fuzzy Hash: f4666f9d2b99b5eedcc1a6e5dfe0a359c56ce9ac7662d51d9d128d2cf702bc37
Instruction Fuzzy Hash: 3951D232D14119AE8B509FE9C8407EEBBFBEB46394F44857AD410B3E10E771AE8D8791

Function 6E0E2480 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 6E0E25C2

Part of subcall function 6E0E12CC: lstrcpynW.KERNEL32(00000000,?,6E0E137F,00000019,6E0E11CA,-000000A0), ref: 6E0E12DC

GlobalAlloc.KERNEL32(00000040), ref: 6E0E2548
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 6E0E2563

Memory Dump Source

Source File: 00000001.00000002.3313723502.000000006E0E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E0E0000, based on PE: true

Associated: 00000001.00000002.3313696406.000000006E0E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.3313755020.000000006E0E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.3313780368.000000006E0E6000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e0e0000_FiddlerSetup.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 8b85d44077f559a7585d27e65fd648bb84f0f063b14687599ca4f482a1911e7d
Instruction ID: 441f3ccc0c5e30b1d4c8ff85274a50bd2505df16b36769a4765f967d6217dc2c
Opcode Fuzzy Hash: 8b85d44077f559a7585d27e65fd648bb84f0f063b14687599ca4f482a1911e7d
Instruction Fuzzy Hash: DE41CDB2108706EFD714DFE9D950B6AB7F8FB85310F40893DE54687A81EB30A945CBA1

Function 00402ECE Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402F22
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F6E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F77
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F8E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F99

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: acaf4fc398a66893391ff6439948fdf9f5bbe1b70c5a8b97b274ab2e0b988985
Instruction ID: 5e325e4eb8c599eaadb2b1545cb8ec7488c9788084a271734582f96bfbf33a22
Opcode Fuzzy Hash: acaf4fc398a66893391ff6439948fdf9f5bbe1b70c5a8b97b274ab2e0b988985
Instruction Fuzzy Hash: FA213D7150010ABFEF129F90CE89EEF7B7DEB54388F110076B909B11E0D7759E54AA64

Function 00401DA6 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401DBF
GetClientRect.USER32(?,?), ref: 00401E0A
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E3A
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E4E
DeleteObject.GDI32(00000000), ref: 00401E5E

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: bd4e520b8cc5a1f7d7462dde4cdf2bafadf22cf4d53fc2066ec95edb4c3fdfff
Instruction ID: 9dfadece7afb1d036d9df0696a088785edc369755c046bee68b18a74b307b48a
Opcode Fuzzy Hash: bd4e520b8cc5a1f7d7462dde4cdf2bafadf22cf4d53fc2066ec95edb4c3fdfff
Instruction Fuzzy Hash: DC213B72900119AFCF05DF98DE45AEEBBB5EB08300F14003AF945F62A0D7349D81DB98

Function 00401E73 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E76
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E90
MulDiv.KERNEL32(00000000,00000000), ref: 00401E98
ReleaseDC.USER32(?,00000000), ref: 00401EA9
CreateFontIndirectW.GDI32(0040CDF8), ref: 00401EF8

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e7871214ef899597a5c21e8ed64a158595def24cf366e312614ef02057251c7c
Instruction ID: e238c2cdee3483520897b3d1e8694375d24364cfb31141c1d88cf39a281bb876
Opcode Fuzzy Hash: e7871214ef899597a5c21e8ed64a158595def24cf366e312614ef02057251c7c
Instruction Fuzzy Hash: 9D018871904250EFE7005BB4EE99BDD3FB4AF55301F20897AF142B61E2C6B904459BED

Function 6E0E16BD Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,6E0E22D8,?,00000808), ref: 6E0E16D5
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,6E0E22D8,?,00000808), ref: 6E0E16DC
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,6E0E22D8,?,00000808), ref: 6E0E16F0
GetProcAddress.KERNEL32(6E0E22D8,00000000), ref: 6E0E16F7
GlobalFree.KERNEL32(00000000), ref: 6E0E1700

Memory Dump Source

Source File: 00000001.00000002.3313723502.000000006E0E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E0E0000, based on PE: true

Associated: 00000001.00000002.3313696406.000000006E0E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.3313755020.000000006E0E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.3313780368.000000006E0E6000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e0e0000_FiddlerSetup.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 988b7a0c7260ddb39be96269f76c18cdeaccefb5ee7c1a9b53a9e0b3120091af
Instruction ID: 60088d66ad44a0f038fe19a1dee536442361b38c4c10cf7f017d81bd15a70df2
Opcode Fuzzy Hash: 988b7a0c7260ddb39be96269f76c18cdeaccefb5ee7c1a9b53a9e0b3120091af
Instruction Fuzzy Hash: 95F01C722065387BDA2016E79C4CDABBE9CEF8B6F5B110635F6289229086714D02D7F1

Function 00401C68 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CD8
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CF0

Strings

!, xrefs: 00401CA4

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 7ad168aabce29fd4aea1c4775643c0a159d1592a8197a50a1d283e8c160106aa
Instruction ID: 990765c93fade27e2bb35c4ad61bbd9c2d50a24465aba9d794b4eebee5297a47
Opcode Fuzzy Hash: 7ad168aabce29fd4aea1c4775643c0a159d1592a8197a50a1d283e8c160106aa
Instruction Fuzzy Hash: 30217E7191421AAEEB05AFA4D94AAFE7BB0EF44304F10453EF505B61D0D7B88941DB98

Function 0040601C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\,?,00406090,C:\,C:\,75923420,?,75922EE0,00405DCE,?,75923420,75922EE0,"C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe" ), ref: 0040602A
CharNextW.USER32(00000000), ref: 0040602F
CharNextW.USER32(00000000), ref: 00406047

Strings

C:\, xrefs: 0040601D

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: fbda1c126528e77f8eb1d19cbf263a4f79599cb979c26f3e0093e3aefe43dd94
Instruction ID: 37941c8e81507efb3cd3a011d4506580e18aa69eefbcae33377864b38d05d7c2
Opcode Fuzzy Hash: fbda1c126528e77f8eb1d19cbf263a4f79599cb979c26f3e0093e3aefe43dd94
Instruction Fuzzy Hash: 83F0F061D8061199DA31F6584C40E7766BCEB54360B06803BEA02B32C1D7BC88E182DA

Function 00405F71 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403652,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040394F,?,00000008,0000000A,0000000C), ref: 00405F77
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403652,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040394F,?,00000008,0000000A,0000000C), ref: 00405F81
lstrcatW.KERNEL32(?,0040A014,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405F93

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F71

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction ID: 335bc096d8d08ccdb4617666140afd44cda2f442d884a3fcf06d2b2a94fa9456
Opcode Fuzzy Hash: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction Fuzzy Hash: 42D0A731101A34EAC2117B448C04CDF629C9F46344341483BF101B31A1CB7D5DA287FD

Function 6E0E10E1 Relevance: 6.4, APIs: 5, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 6E0E1171
GlobalAlloc.KERNEL32(00000040,?), ref: 6E0E11E3
GlobalFree.KERNEL32 ref: 6E0E124A
GlobalFree.KERNEL32(?), ref: 6E0E129B
GlobalFree.KERNEL32(00000000), ref: 6E0E12B1

Memory Dump Source

Source File: 00000001.00000002.3313723502.000000006E0E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E0E0000, based on PE: true

Associated: 00000001.00000002.3313696406.000000006E0E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.3313755020.000000006E0E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.3313780368.000000006E0E6000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e0e0000_FiddlerSetup.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 0b5838f016e6ad92497ac5fba9d31701e37dfc5e3b680faa8593f3168060853b
Instruction ID: a9d1f2d2cf9ad3687f86d90cd870cd1320c7e3c482c2cc1b3035e7ef8445da47
Opcode Fuzzy Hash: 0b5838f016e6ad92497ac5fba9d31701e37dfc5e3b680faa8593f3168060853b
Instruction Fuzzy Hash: EA518CB9900602DFDB40DFE8C844B6A77E8FB1AB55B00497AF914DBA50E734EE18CB50

Function 00402663 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsu12C2.tmp\System.dll), ref: 004026BA

Strings

C:\Users\user\AppData\Local\Temp\nsu12C2.tmp\System.dll, xrefs: 0040267E, 004026A3, 004026B5, 00402701
False, xrefs: 004026A8

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: lstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsu12C2.tmp\System.dll$False
API String ID: 1659193697-1180392338
Opcode ID: fe63040d6f439a17d0e577c235a647e49714f4905ef3770450c3d22a2eadc764
Instruction ID: 3a980f7409dbeac528cd7030d6b505637954cb723df09773b9ac7431f40d283a
Opcode Fuzzy Hash: fe63040d6f439a17d0e577c235a647e49714f4905ef3770450c3d22a2eadc764
Instruction Fuzzy Hash: BD11EB72B00206A7CB00BBB18E4AA9E77659F50758F21443FF502B61D0DAFD8991635E

Function 00403C82 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000384,C:\Users\user\AppData\Local\Temp\,00403BB5,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403C94
CloseHandle.KERNEL32(00000378,C:\Users\user\AppData\Local\Temp\,00403BB5,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403CA8

Strings

C:\Users\user\AppData\Local\Temp\nsu12C2.tmp, xrefs: 00403CB8
C:\Users\user\AppData\Local\Temp\, xrefs: 00403C87

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsu12C2.tmp
API String ID: 2962429428-2225687171
Opcode ID: aee73ed6a062803200b229e34675cefdb9ab84dda1d90898f0442dcc956d8ee4
Instruction ID: 6bfdaf564fb6f4d857381f61ee43f4b3e7b9b57b480fcef53b70eb5bee5fd527
Opcode Fuzzy Hash: aee73ed6a062803200b229e34675cefdb9ab84dda1d90898f0442dcc956d8ee4
Instruction Fuzzy Hash: ADE0863150471896D5346F7CAF4D9853B185F413357258327F078F20F0C738D95A5AAD

Function 0040569B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004056CA
CallWindowProcW.USER32(?,?,?,?), ref: 0040571B

Part of subcall function 0040466D: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040467F

Strings

, xrefs: 004056AB

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 566dc257d6ecfccfd9b8870a3abbf6eef49955a94d49fdbfe0e36d929d226f84
Instruction ID: a38bd53333deb2965cf6bcfe27cab5e967b0379a0e7dc5bd4266cb97908be95f
Opcode Fuzzy Hash: 566dc257d6ecfccfd9b8870a3abbf6eef49955a94d49fdbfe0e36d929d226f84
Instruction Fuzzy Hash: A901B131200708EFDB204F90DEC0A9B3665FB84750F504036F605761D1D77A8C92AE2D

Function 00405FBD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,00403161,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe,80000000,00000003), ref: 00405FC3
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,00403161,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe,C:\Users\user\AppData\Local\Temp\nskEDF3.tmp\FiddlerSetup.exe,80000000,00000003), ref: 00405FD3

Strings

C:\Users\user\AppData\Local\Temp\nskEDF3.tmp, xrefs: 00405FBD

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp\nskEDF3.tmp
API String ID: 2709904686-1036905562
Opcode ID: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
Instruction ID: 38d9290afe44bb03d7cf08b54fe4d5b58535dca9612c3dc8604b8734ddeb262b
Opcode Fuzzy Hash: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
Instruction Fuzzy Hash: 3AD05EB2411921DAD3126704DD01D9F77ACEF12300746482AE440A7161D7785C8186AC

Function 004060F7 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063DC,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406107
lstrcmpiA.KERNEL32(00000000,00000000), ref: 0040611F
CharNextA.USER32(00000000,?,00000000,004063DC,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406130
lstrlenA.KERNEL32(00000000,?,00000000,004063DC,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406139

Memory Dump Source

Source File: 00000001.00000002.3310575741.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3310498306.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310625300.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000424000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3310670061.0000000000439000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3311021572.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FiddlerSetup.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 95544cd0fbc1c68b6442233ab1bb13ea59abf9e1bd9498eecabbd7b85e38d71d
Instruction ID: 5f3436636367d0d5bc92f6b0e419d408aad35ecbe6557c54d873c5627a92c34c
Opcode Fuzzy Hash: 95544cd0fbc1c68b6442233ab1bb13ea59abf9e1bd9498eecabbd7b85e38d71d
Instruction Fuzzy Hash: E4F0BB35604414FFC702DFA5DD00D9EBBA8EF46350B2640B9F841FB211D674DE129B99

Analysis Process: SetupHelperPID: 1436, Parent PID: 2972COMMON

Executed Functions

Function 025F0D20 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

$]q, xrefs: 025F0E11

Memory Dump Source

Source File: 0000000A.00000002.2154952573.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25f0000_SetupHelper.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 172cdc006a0c205bcd998fd2558956a63f6cbc6ba2368766b740094304c4fa9c
Instruction ID: 4263c0645a5fca0f3039ddd6089dfa1993698566e7067a5897959db2fa52db5e
Opcode Fuzzy Hash: 172cdc006a0c205bcd998fd2558956a63f6cbc6ba2368766b740094304c4fa9c
Instruction Fuzzy Hash: 6E31D431A002099FCB55EFB4D844BEEBBB4FF41310F14897AD915DB285EB745A09CB91

Function 025F046F Relevance: 1.0, Instructions: 964COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2154952573.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25f0000_SetupHelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1fd17ff3e86a95120f1e2d31896a504313bd271c930c3a13ad0baf007047e9f
Instruction ID: 9e98c27bf0a7f9075b0e528b7cc42a11c0b38d224f745951affafc61288fd252
Opcode Fuzzy Hash: d1fd17ff3e86a95120f1e2d31896a504313bd271c930c3a13ad0baf007047e9f
Instruction Fuzzy Hash: 3B31BC7080E3C29FC707EB38E8605897FB1EF0A200B1985D7D4848B1ABD6781919CB96

Function 025F0900 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2154952573.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25f0000_SetupHelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01be7f2bff4d21321bfb3998b449097ccc94fc913204d101006b0c1cbc010e06
Instruction ID: d8f3bdebdd2ccc3eb2bb1e0094cbe959dff1d08e38fe849ab9b1e6cc61c63bf2
Opcode Fuzzy Hash: 01be7f2bff4d21321bfb3998b449097ccc94fc913204d101006b0c1cbc010e06
Instruction Fuzzy Hash: 1D81D231B00305DFDB15DBB4D844AAABBB1FF89314B15C56AD51A8B3A6EB31D841CB44

Function 025F0C5F Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2154952573.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25f0000_SetupHelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc73acf302261acceddbe9767cb4662ac0aa1c99bb0eea4258e6d7b0c16a881
Instruction ID: f350d7f82bf6dd79843050cfd3e1edb5184d7ff64380952485b699f0879758fd
Opcode Fuzzy Hash: 8fc73acf302261acceddbe9767cb4662ac0aa1c99bb0eea4258e6d7b0c16a881
Instruction Fuzzy Hash: FE119E31308304DBDB90CB64E84476B7BA4FB41614F4849AAE94AC72DBEB34E945C769

Function 025F0B8F Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2154952573.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25f0000_SetupHelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a24f5cc4d32bb4f4e504dd2d2c81bcd00edac753b9db7b9368323a5d0641db9d
Instruction ID: d8fd5c61b710c367089a0902bd79227b03f6d011f35a7804e6f1ecc50cd45afa
Opcode Fuzzy Hash: a24f5cc4d32bb4f4e504dd2d2c81bcd00edac753b9db7b9368323a5d0641db9d
Instruction Fuzzy Hash: F6F09A31B08115AFCB50AAA998113EE7BB9EFC9B10F014466D50DEB380EA744E028BD2

Function 025F0848 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2154952573.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25f0000_SetupHelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00ee2256ce3e9c2bdb83f52419779b7706dc0b7f034887680c394d7bfa6f57fe
Instruction ID: 13643708446243d0cffda98f36d6dc88ca81454fd959497f001c4b3f5e641449
Opcode Fuzzy Hash: 00ee2256ce3e9c2bdb83f52419779b7706dc0b7f034887680c394d7bfa6f57fe
Instruction Fuzzy Hash: A001C078E003059FD709FF74E840A5DBBB2FB58744B20D965E80457269D7BC6A55CF80

Function 025F0D10 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2154952573.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25f0000_SetupHelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93150d60f885657bee4c477133a876c3d986ba093995d8fb23343f7b0aa7697e
Instruction ID: ec8c38928e56e67869478502d307c222ddf20ce201e7562036fe6b9b7dce4840
Opcode Fuzzy Hash: 93150d60f885657bee4c477133a876c3d986ba093995d8fb23343f7b0aa7697e
Instruction Fuzzy Hash: 2AF0E232A142189FCB219B75EC14BDABFB8EB42350B050AB6D904D7052DB70A50887B1

Function 025F0E78 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2154952573.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25f0000_SetupHelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 589c3f2d5b873dd71d6fc35829a5773692feb9370ebe1cae1ecedb9f36dfd29b
Instruction ID: e20d32e1665845d90957fd67c3e6e9c41ec55f815f356f0be3ea637835500b03
Opcode Fuzzy Hash: 589c3f2d5b873dd71d6fc35829a5773692feb9370ebe1cae1ecedb9f36dfd29b
Instruction Fuzzy Hash: B2F08C71E04214CFCB01EFA8D845AEE7BB0FF09300F0145AAD909AB296E2B04A05CBC2

Function 025F0E88 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2154952573.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25f0000_SetupHelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d583f6e2f4317cd6f9c2546a705309250b72aa0ead53c02e6b795f597a776dc
Instruction ID: d422c62d0a661ef2cf9c80ab673bfd0e86dba408be2e74cdb25c97a9d48be5fa
Opcode Fuzzy Hash: 0d583f6e2f4317cd6f9c2546a705309250b72aa0ead53c02e6b795f597a776dc
Instruction Fuzzy Hash: A5E04FB1E00219DFDB40FBA8D8017EAB7B4EB08200F004566D918D7245E6705A00CBD1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FiddlerSetup.5.0.20245.10105-latest.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Privilege Escalation

Phishing

Bitcoin Miner

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SetupHelper.log

C:\Users\user\AppData\Local\Programs\Fiddler\Analytics.dll

C:\Users\user\AppData\Local\Programs\Fiddler\Analytics.pdb

C:\Users\user\AppData\Local\Programs\Fiddler\App.ico

C:\Users\user\AppData\Local\Programs\Fiddler\Be.Windows.Forms.HexBox.dll

C:\Users\user\AppData\Local\Programs\Fiddler\Countdown.wav

C:\Users\user\AppData\Local\Programs\Fiddler\DotNetZip.dll

Windows Analysis Report
FiddlerSetup.5.0.20245.10105-latest.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre