IOC Report
SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
initial sample
 malicious
C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\nsiE437.tmp\FiddlerSetup.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
modified
 malicious
C:\Users\user\AppData\Local\Temp\nsoE58F.tmp
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SetupHelper.log
CSV text
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Analytics.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Analytics.pdb
MSVC program database ver 7.00, 512*95 bytes
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\App.ico
MS Windows icon resource - 8 icons, 32x32, 8 bits/pixel, 16x16, 8 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Be.Windows.Forms.HexBox.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Countdown.wav
RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 22050 Hz
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\DotNetZip.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\EnableLoopback.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\EnableLoopback.pdb
MSVC program database ver 7.00, 512*115 bytes
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ExecAction.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe.config
XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.pdb
MSVC program database ver 7.00, 512*3623 bytes
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ForceCPU.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\GA.Analytics.Monitor.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\GA.Analytics.Monitor.pdb
MSVC program database ver 7.00, 512*187 bytes
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ImportExport\BasicFormats.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ImportExport\BasicFormats.pdb
MSVC program database ver 7.00, 512*367 bytes
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ImportExport\VSWebTestExport.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ImportExport\VSWebTestExport.pdb
MSVC program database ver 7.00, 512*203 bytes
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\QWhale.Common.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\QWhale.Editor.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\QWhale.Syntax.Schemes.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\QWhale.Syntax.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\Standard.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Inspectors\SyntaxView.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\LoadScript.wav
RIFF (little-endian) data, WAVE audio, Microsoft PCM, 8 bit, mono 8000 Hz
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\LoadScriptError.wav
RIFF (little-endian) data, WAVE audio, Microsoft PCM, 8 bit, mono 8000 Hz
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\NOTICES.txt
Unicode text, UTF-8 text, with very long lines (2966), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Newtonsoft.Json.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Plugins\NetworkConnections\Telerik.NetworkConnections.Windows.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\200_FiddlerGif.dat
data
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\200_SimpleHTML.dat
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\200_TransPixel.dat
data
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\204_NoContent.dat
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\302_Redirect.dat
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\303_RedirectWithGet.dat
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\304_NotModified.dat
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\307_RedirectWithMethod.dat
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\401_AuthBasic.dat
ASCII text, with very long lines (520), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\401_AuthDigest.dat
ASCII text, with very long lines (520), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\403_AuthDeny.dat
ASCII text, with very long lines (520), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\404_Plain.dat
ASCII text, with very long lines (520), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\407_ProxyAuthBasic.dat
ASCII text, with very long lines (520), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ResponseTemplates\502_Unreachable.dat
ASCII text, with very long lines (520), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Screenshot.wav
RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\Analytics.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\Analytics.pdb
MSVC program database ver 7.00, 512*95 bytes
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\FSE2.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\FSE2.exe.config
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\GA.Analytics.Monitor.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\GA.Analytics.Monitor.pdb
MSVC program database ver 7.00, 512*187 bytes
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Common.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Editor.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Syntax.Parsers.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Syntax.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Addon.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Addon.pdb
MSVC program database ver 7.00, 512*143 bytes
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Connection.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Protocol.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\FiddlerOrchestra.Utilities.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\QWhale.Common.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\QWhale.Editor.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\QWhale.Syntax.Parsers.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\QWhale.Syntax.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\RulesTab2.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\SampleRules.cs
C++ source, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\SampleRules.js
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\SimpleFilter.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\SimpleFilter.pdb
MSVC program database ver 7.00, 512*311 bytes
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\Timeline.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\Timeline.pdb
MSVC program database ver 7.00, 512*79 bytes
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Scripts\netstandard.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Telerik.NetworkConnections.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Tools\Brotli.exe
PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Tools\JXR2PNG.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Tools\JXR2PNG.exe.config
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Tools\PngDistill.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Tools\PngDistill.pdb
MSVC program database ver 7.00, 512*51 bytes
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Tools\Zopfli.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\Tools\dwebp.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\TrustCert.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\TrustCert.pdb
MSVC program database ver 7.00, 512*35 bytes
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\credits.txt
ISO-8859 text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\license.txt
ISO-8859 text, with very long lines (1954), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\makecert.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\saz.ico
MS Windows icon resource - 3 icons, 48x48, 24 bits/pixel, 32x32, 24 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Fiddler\uninst.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
modified
C:\Users\user\AppData\Local\Temp\nsx8D7.tmp\System.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fiddler Classic.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Wed Mar 27 11:58:00 2024, mtime=Tue Apr 23 22:29:15 2024, atime=Wed Mar 27 11:58:00 2024, length=3666248, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fiddler ScriptEditor.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Wed Mar 27 11:57:06 2024, mtime=Tue Apr 23 22:29:17 2024, atime=Wed Mar 27 11:57:06 2024, length=51200, window=hide
dropped
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
modified
C:\Windows\assembly\NativeImages_v4.0.30319_64\EnableLoopback\59a1f5e7ac4b0e905803332438ede0a4\EnableLoopback.ni.exe (copy)
PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\EnableLoopback\59a1f5e7ac4b0e905803332438ede0a4\EnableLoopback.ni.exe.aux (copy)
Matlab v4 mat-file (little endian) H, rows 848, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\EnableLoopback\59a1f5e7ac4b0e905803332438ede0a4\EnableLoopback.ni.exe.aux.tmp
Matlab v4 mat-file (little endian) H, rows 848, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B3325a29b#\3f8d7f63514ceeaa11244b3e16a3ea5c\Microsoft.Build.Framework.ni.dll (copy)
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B3325a29b#\3f8d7f63514ceeaa11244b3e16a3ea5c\Microsoft.Build.Framework.ni.dll.aux (copy)
Matlab v4 mat-file (little endian) `, rows 580, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B3325a29b#\3f8d7f63514ceeaa11244b3e16a3ea5c\Microsoft.Build.Framework.ni.dll.aux.tmp
Matlab v4 mat-file (little endian) `, rows 580, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B83e9cb53#\7192d8df2c3d8228b392f5912e16ebc2\Microsoft.Build.Utilities.v4.0.ni.dll (copy)
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B83e9cb53#\7192d8df2c3d8228b392f5912e16ebc2\Microsoft.Build.Utilities.v4.0.ni.dll.aux (copy)
Matlab v4 mat-file (little endian) d, rows 880, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.B83e9cb53#\7192d8df2c3d8228b392f5912e16ebc2\Microsoft.Build.Utilities.v4.0.ni.dll.aux.tmp
Matlab v4 mat-file (little endian) d, rows 880, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\8e9f4b8ba90f0dd7ead0f6d3724d12f0\Microsoft.JScript.ni.dll (copy)
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\8e9f4b8ba90f0dd7ead0f6d3724d12f0\Microsoft.JScript.ni.dll.aux (copy)
Matlab v4 mat-file (little endian) X, rows 572, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\8e9f4b8ba90f0dd7ead0f6d3724d12f0\Microsoft.JScript.ni.dll.aux.tmp
Matlab v4 mat-file (little endian) X, rows 572, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\SMDiagnostics\1936f2ecbcf18cda53f04b49073cf801\SMDiagnostics.ni.dll (copy)
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\SMDiagnostics\1936f2ecbcf18cda53f04b49073cf801\SMDiagnostics.ni.dll.aux (copy)
Matlab v4 mat-file (little endian) T, rows 916, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\SMDiagnostics\1936f2ecbcf18cda53f04b49073cf801\SMDiagnostics.ni.dll.aux.tmp
Matlab v4 mat-file (little endian) T, rows 916, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Comp46f2b404#\70bed732cba41d298e54cc0a935a935b\System.ComponentModel.DataAnnotations.ni.dll (copy)
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Comp46f2b404#\70bed732cba41d298e54cc0a935a935b\System.ComponentModel.DataAnnotations.ni.dll.aux (copy)
Matlab v4 mat-file (little endian) l, rows 720, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Comp46f2b404#\70bed732cba41d298e54cc0a935a935b\System.ComponentModel.DataAnnotations.ni.dll.aux.tmp
Matlab v4 mat-file (little endian) l, rows 720, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\78d6922d3a02a93359e189f060d76f47\System.Data.SqlXml.ni.dll (copy)
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\78d6922d3a02a93359e189f060d76f47\System.Data.SqlXml.ni.dll.aux (copy)
Matlab v4 mat-file (little endian) X, rows 700, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\78d6922d3a02a93359e189f060d76f47\System.Data.SqlXml.ni.dll.aux.tmp
Matlab v4 mat-file (little endian) X, rows 700, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data86569bbf#\058b5c6d514044e05b07d4b113045f72\System.Data.OracleClient.ni.dll (copy)
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data86569bbf#\058b5c6d514044e05b07d4b113045f72\System.Data.OracleClient.ni.dll.aux (copy)
Matlab v4 mat-file (little endian) \, rows 1328, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data86569bbf#\058b5c6d514044e05b07d4b113045f72\System.Data.OracleClient.ni.dll.aux.tmp
Matlab v4 mat-file (little endian) \, rows 1328, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\4fa111e50d95d3e08c2d856a5394af3b\System.Deployment.ni.dll (copy)
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\4fa111e50d95d3e08c2d856a5394af3b\System.Deployment.ni.dll.aux (copy)
Matlab v4 mat-file (little endian) X, rows 1356, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\4fa111e50d95d3e08c2d856a5394af3b\System.Deployment.ni.dll.aux.tmp
Matlab v4 mat-file (little endian) X, rows 1356, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Design\e6264fe3334740cf9e7da3afc7d524cc\System.Design.ni.dll (copy)
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Design\e6264fe3334740cf9e7da3afc7d524cc\System.Design.ni.dll.aux (copy)
Matlab v4 mat-file (little endian) T, rows 2388, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Design\e6264fe3334740cf9e7da3afc7d524cc\System.Design.ni.dll.aux.tmp
Matlab v4 mat-file (little endian) T, rows 2388, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Dire5d62f0a2#\a2886f8a05c8adae3050b95af3970e92\System.DirectoryServices.Protocols.ni.dll (copy)
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Dire5d62f0a2#\a2886f8a05c8adae3050b95af3970e92\System.DirectoryServices.Protocols.ni.dll.aux (copy)
Matlab v4 mat-file (little endian) h, rows 760, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Dire5d62f0a2#\a2886f8a05c8adae3050b95af3970e92\System.DirectoryServices.Protocols.ni.dll.aux.tmp
Matlab v4 mat-file (little endian) h, rows 760, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Draw0a54d252#\1add9b3a6e41e9922f7c95ebd442ed4e\System.Drawing.Design.ni.dll (copy)
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Draw0a54d252#\1add9b3a6e41e9922f7c95ebd442ed4e\System.Drawing.Design.ni.dll.aux (copy)
Matlab v4 mat-file (little endian) \, rows 1080, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Draw0a54d252#\1add9b3a6e41e9922f7c95ebd442ed4e\System.Drawing.Design.ni.dll.aux.tmp
Matlab v4 mat-file (little endian) \, rows 1080, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\cbb85b2c3ecfe129570a8c187041de31\System.EnterpriseServices.Wrapper.dll (copy)
PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\cbb85b2c3ecfe129570a8c187041de31\System.EnterpriseServices.ni.dll (copy)
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\cbb85b2c3ecfe129570a8c187041de31\System.EnterpriseServices.ni.dll.aux (copy)
Matlab v4 mat-file (little endian) `, rows 1092, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\cbb85b2c3ecfe129570a8c187041de31\System.EnterpriseServices.ni.dll.aux.tmp
Matlab v4 mat-file (little endian) `, rows 1092, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\ce1e4670373608336100bea63bbc8990\System.Numerics.ni.dll (copy)
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\ce1e4670373608336100bea63bbc8990\System.Numerics.ni.dll.aux (copy)
Matlab v4 mat-file (little endian) T, rows 292, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\ce1e4670373608336100bea63bbc8990\System.Numerics.ni.dll.aux.tmp
Matlab v4 mat-file (little endian) T, rows 292, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt19c51595#\b5d4608754b2d1d4f1d2d3c00cbcdfe0\System.Runtime.Caching.ni.dll (copy)
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt19c51595#\b5d4608754b2d1d4f1d2d3c00cbcdfe0\System.Runtime.Caching.ni.dll.aux (copy)
Matlab v4 mat-file (little endian) \, rows 744, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt19c51595#\b5d4608754b2d1d4f1d2d3c00cbcdfe0\System.Runtime.Caching.ni.dll.aux.tmp
Matlab v4 mat-file (little endian) \, rows 744, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\f975db3abcedde8df2408b15e2c6dd09\System.Runtime.Serialization.Formatters.Soap.ni.dll (copy)
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\f975db3abcedde8df2408b15e2c6dd09\System.Runtime.Serialization.Formatters.Soap.ni.dll.aux (copy)
Matlab v4 mat-file (little endian) p, rows 636, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\f975db3abcedde8df2408b15e2c6dd09\System.Runtime.Serialization.Formatters.Soap.ni.dll.aux.tmp
Matlab v4 mat-file (little endian) p, rows 636, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\bde2021ecdaa53585a395f095971633c\System.Security.ni.dll (copy)
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\bde2021ecdaa53585a395f095971633c\System.Security.ni.dll.aux (copy)
Matlab v4 mat-file (little endian) T, rows 904, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\bde2021ecdaa53585a395f095971633c\System.Security.ni.dll.aux.tmp
Matlab v4 mat-file (little endian) T, rows 904, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Servd1dec626#\aa6a3ae1d00b1eb221bba5375e6387b1\System.ServiceModel.Internals.ni.dll (copy)
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Servd1dec626#\aa6a3ae1d00b1eb221bba5375e6387b1\System.ServiceModel.Internals.ni.dll.aux (copy)
Matlab v4 mat-file (little endian) d, rows 584, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Servd1dec626#\aa6a3ae1d00b1eb221bba5375e6387b1\System.ServiceModel.Internals.ni.dll.aux.tmp
Matlab v4 mat-file (little endian) d, rows 584, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\9c63130543c9d395491387159924bf83\System.Web.RegularExpressions.ni.dll (copy)
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\9c63130543c9d395491387159924bf83\System.Web.RegularExpressions.ni.dll.aux (copy)
Matlab v4 mat-file (little endian) d, rows 424, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\9c63130543c9d395491387159924bf83\System.Web.RegularExpressions.ni.dll.aux.tmp
Matlab v4 mat-file (little endian) d, rows 424, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.8dc504e4#\51cf3243e3f9124c32bc8614b4bcda4e\System.Web.ApplicationServices.ni.dll (copy)
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.8dc504e4#\51cf3243e3f9124c32bc8614b4bcda4e\System.Web.ApplicationServices.ni.dll.aux (copy)
Matlab v4 mat-file (little endian) d, rows 592, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.8dc504e4#\51cf3243e3f9124c32bc8614b4bcda4e\System.Web.ApplicationServices.ni.dll.aux.tmp
Matlab v4 mat-file (little endian) d, rows 592, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\0bc179a6f5376dabed45d64773e7a963\System.Web.ni.dll (copy)
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\0bc179a6f5376dabed45d64773e7a963\System.Web.ni.dll.aux (copy)
Matlab v4 mat-file (little endian) P, rows 3964, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\0bc179a6f5376dabed45d64773e7a963\System.Web.ni.dll.aux.tmp
Matlab v4 mat-file (little endian) P, rows 3964, columns 11, imaginary
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1090-0\System.Data.OracleClient.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\11ac-0\EnableLoopback.exe
PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1260-0\System.Design.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1280-0\System.Web.RegularExpressions.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1408-0\System.Drawing.Design.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1454-0\System.Numerics.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\172c-0\System.Runtime.Serialization.Formatters.Soap.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1958-0\System.ComponentModel.DataAnnotations.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1c30-0\System.Data.SqlXml.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1c44-0\System.Deployment.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1c68-0\System.Deployment.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1cd8-0\System.Data.SqlXml.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1cec-0\System.Security.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1e44-0\System.Security.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1edc-0\Microsoft.Build.Framework.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1f24-0\System.Runtime.Serialization.Formatters.Soap.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\240-0\SMDiagnostics.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\604-0\System.Web.ApplicationServices.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\744-0\Microsoft.JScript.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\780-0\System.Runtime.Caching.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\a58-0\System.DirectoryServices.Protocols.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\b18-0\System.Web.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\b64-0\System.ServiceModel.Internals.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\bb0-0\System.EnterpriseServices.Wrapper.dll
PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\bb0-0\System.EnterpriseServices.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\c0c-0\Microsoft.Build.Utilities.v4.0.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
Chrome Cache Entry: 272
Unicode text, UTF-8 text, with very long lines (46429), with no line terminators
downloaded
Chrome Cache Entry: 273
JSON data
downloaded
Chrome Cache Entry: 274
JSON data
dropped
Chrome Cache Entry: 275
ASCII text, with very long lines (2859), with no line terminators
downloaded
Chrome Cache Entry: 276
ASCII text, with very long lines (57671), with no line terminators
downloaded
Chrome Cache Entry: 277
Unicode text, UTF-8 text, with very long lines (47091), with NEL line terminators
downloaded
Chrome Cache Entry: 278
Web Open Font Format (Version 2), TrueType, length 12164, version 1.0
downloaded
Chrome Cache Entry: 279
MS Windows icon resource - 4 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 16x16, 32 bits/pixel
dropped
Chrome Cache Entry: 280
Unicode text, UTF-8 text, with very long lines (49273)
downloaded
Chrome Cache Entry: 281
JSON data
downloaded
Chrome Cache Entry: 282
ASCII text, with very long lines (65447)
downloaded
Chrome Cache Entry: 283
ASCII text, with no line terminators
dropped
Chrome Cache Entry: 284
ASCII text
downloaded
Chrome Cache Entry: 285
HTML document, ASCII text, with very long lines (4596), with no line terminators
downloaded
Chrome Cache Entry: 286
JSON data
downloaded
Chrome Cache Entry: 287
ASCII text, with very long lines (10922)
downloaded
Chrome Cache Entry: 288
ASCII text, with very long lines (988), with no line terminators
downloaded
Chrome Cache Entry: 289
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 290
ASCII text, with very long lines (2932), with no line terminators
downloaded
Chrome Cache Entry: 291
GIF image data, version 89a, 1 x 1
dropped
Chrome Cache Entry: 292
HTML document, ASCII text, with very long lines (1141), with CRLF line terminators
dropped
Chrome Cache Entry: 293
Unicode text, UTF-8 text, with very long lines (62292), with CRLF line terminators
downloaded
Chrome Cache Entry: 294
PNG image data, 65 x 65, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 295
HTML document, ASCII text, with very long lines (4634), with no line terminators
downloaded
Chrome Cache Entry: 296
ASCII text, with very long lines (64347)
downloaded
Chrome Cache Entry: 297
Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
downloaded
Chrome Cache Entry: 298
HTML document, ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 299
HTML document, ASCII text
dropped
Chrome Cache Entry: 300
ASCII text, with very long lines (21778), with no line terminators
downloaded
Chrome Cache Entry: 301
ASCII text, with very long lines (4189)
downloaded
Chrome Cache Entry: 302
ASCII text, with CRLF line terminators
downloaded
Chrome Cache Entry: 303
PNG image data, 65 x 65, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 304
ASCII text, with very long lines (65451)
downloaded
Chrome Cache Entry: 305
Web Open Font Format (Version 2), TrueType, length 34640, version 1.131
downloaded
Chrome Cache Entry: 306
JSON data
dropped
Chrome Cache Entry: 307
ASCII text, with very long lines (58324)
downloaded
Chrome Cache Entry: 308
JSON data
downloaded
Chrome Cache Entry: 309
ASCII text, with very long lines (507)
downloaded
Chrome Cache Entry: 310
ASCII text, with very long lines (7787)
downloaded
Chrome Cache Entry: 311
ASCII text, with very long lines (638)
downloaded
Chrome Cache Entry: 312
Web Open Font Format (Version 2), TrueType, length 34032, version 1.131
downloaded
Chrome Cache Entry: 313
ASCII text, with very long lines (65376)
downloaded
Chrome Cache Entry: 314
JSON data
dropped
Chrome Cache Entry: 315
ASCII text, with very long lines (19993)
downloaded
Chrome Cache Entry: 316
ASCII text, with very long lines (5140)
downloaded
Chrome Cache Entry: 317
ASCII text, with very long lines (6216)
downloaded
Chrome Cache Entry: 318
Web Open Font Format (Version 2), TrueType, length 32412, version 1.131
downloaded
Chrome Cache Entry: 319
Web Open Font Format (Version 2), TrueType, length 35758, version 1.131
downloaded
Chrome Cache Entry: 320
JSON data
downloaded
Chrome Cache Entry: 321
ASCII text, with very long lines (1504), with no line terminators
downloaded
Chrome Cache Entry: 322
Unicode text, UTF-8 text, with very long lines (35526), with NEL line terminators
downloaded
Chrome Cache Entry: 323
ASCII text, with very long lines (31952)
downloaded
Chrome Cache Entry: 324
JSON data
downloaded
Chrome Cache Entry: 325
ASCII text, with very long lines (21778), with no line terminators
dropped
Chrome Cache Entry: 326
ASCII text, with very long lines (7166)
downloaded
Chrome Cache Entry: 327
GIF image data, version 89a, 1 x 1
downloaded
Chrome Cache Entry: 328
JSON data
dropped
Chrome Cache Entry: 329
JSON data
dropped
Chrome Cache Entry: 330
JSON data
downloaded
Chrome Cache Entry: 331
HTML document, ASCII text, with very long lines (19477), with CRLF, LF line terminators
downloaded
Chrome Cache Entry: 332
ASCII text, with very long lines (24605)
downloaded
Chrome Cache Entry: 333
ASCII text, with very long lines (65450)
downloaded
Chrome Cache Entry: 334
Unicode text, UTF-8 (with BOM) text, with very long lines (2614), with no line terminators
downloaded
Chrome Cache Entry: 335
ASCII text, with very long lines (32607), with no line terminators
downloaded
Chrome Cache Entry: 336
ASCII text, with very long lines (667), with no line terminators
downloaded
Chrome Cache Entry: 337
JSON data
dropped
Chrome Cache Entry: 338
JSON data
downloaded
Chrome Cache Entry: 339
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 340
ASCII text, with very long lines (2343)
downloaded
Chrome Cache Entry: 341
MS Windows icon resource - 4 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 16x16, 32 bits/pixel
downloaded
Chrome Cache Entry: 342
ASCII text, with very long lines (5258)
downloaded
Chrome Cache Entry: 343
Unicode text, UTF-8 (with BOM) text, with very long lines (7348), with no line terminators
downloaded
Chrome Cache Entry: 344
HTML document, ASCII text, with very long lines (321), with CRLF line terminators
downloaded
Chrome Cache Entry: 345
Unicode text, UTF-8 (with BOM) text, with very long lines (4188), with no line terminators
downloaded
Chrome Cache Entry: 346
ASCII text, with very long lines (13479)
downloaded
Chrome Cache Entry: 347
JSON data
downloaded
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped
There are 253 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\AppData\Local\Temp\nsiE437.tmp\FiddlerSetup.exe
"C:\Users\user~1\AppData\Local\Temp\nsiE437.tmp\FiddlerSetup.exe" /D=
 malicious
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="FiddlerProxy"
 malicious
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="FiddlerProxy" program="C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe" action=allow profile=any dir=in edge=deferuser protocol=tcp description="Permit inbound connections to Fiddler"
malicious
C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe
"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\user\AppData\Local\Programs\Fiddler\Fiddler.exe"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\user\AppData\Local\Programs\Fiddler\EnableLoopback.exe"
C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper
"C:\Users\user\AppData\Local\Programs\Fiddler\SetupHelper" /a "C:\Users\user\AppData\Local\Programs\Fiddler"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 0 -NGENProcess 1bc -Pipe 1c8 -Comment "NGen Worker Process"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://fiddler2.com/r/?Fiddler2FirstRun
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2660 --field-trial-handle=2244,i,18061082204408847072,8654867018620333004,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 0 -NGENProcess 260 -Pipe 268 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 0 -NGENProcess 270 -Pipe 278 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 0 -NGENProcess 280 -Pipe 288 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 0 -NGENProcess 290 -Pipe 298 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 0 -NGENProcess 2dc -Pipe 264 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 0 -NGENProcess 2fc -Pipe 290 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 0 -NGENProcess 26c -Pipe 2c8 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 0 -NGENProcess 294 -Pipe 304 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 0 -NGENProcess 2f0 -Pipe 2ec -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 0 -NGENProcess 2f0 -Pipe 2f4 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 0 -NGENProcess 2f4 -Pipe 264 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 0 -NGENProcess 2dc -Pipe 304 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 0 -NGENProcess 330 -Pipe 328 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 0 -NGENProcess 320 -Pipe 30c -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 0 -NGENProcess 18c -Pipe 330 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 0 -NGENProcess 280 -Pipe 270 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 0 -NGENProcess 324 -Pipe 2f4 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 0 -NGENProcess 2a4 -Pipe 328 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 0 -NGENProcess 338 -Pipe 18c -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 0 -NGENProcess 320 -Pipe 334 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 0 -NGENProcess 34c -Pipe 31c -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 0 -NGENProcess 354 -Pipe 328 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 0 -NGENProcess 340 -Pipe 360 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 0 -NGENProcess 38c -Pipe 398 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 0 -NGENProcess 370 -Pipe 36c -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 0 -NGENProcess 3a8 -Pipe 3b0 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 0 -NGENProcess 3cc -Pipe 394 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 0 -NGENProcess 3ac -Pipe 384 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 0 -NGENProcess 3dc -Pipe 3e8 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 0 -NGENProcess 3b4 -Pipe 280 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 0 -NGENProcess 3a4 -Pipe 370 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 0 -NGENProcess 3d0 -Pipe 3c4 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 0 -NGENProcess 3e4 -Pipe 3e0 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 0 -NGENProcess 3ec -Pipe 3c0 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 0 -NGENProcess 3a8 -Pipe 3c8 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 0 -NGENProcess 3e4 -Pipe 3ec -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 0 -NGENProcess 3bc -Pipe 3b8 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 0 -NGENProcess 3d8 -Pipe 3a0 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 0 -NGENProcess 3ac -Pipe 3d4 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 0 -NGENProcess 3d8 -Pipe 3b8 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 0 -NGENProcess 3d0 -Pipe 388 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 0 -NGENProcess 3d8 -Pipe 3e4 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 0 -NGENProcess 298 -Pipe 2a0 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 0 -NGENProcess 268 -Pipe 2bc -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 0 -NGENProcess 2a8 -Pipe 2b0 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 0 -NGENProcess 264 -Pipe 26c -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 0 -NGENProcess 300 -Pipe 334 -Comment "NGen Worker Process"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 0 -NGENProcess 2b8 -Pipe 2c0 -Comment "NGen Worker Process"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 55 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://www.telerik.com/RestApi/personalizations/render?pageNodeId=5ceb4be1-05bd-4c69-892a-2c2bbd37538b&pageDataId=1f960fad-aef2-4475-8978-52fb7a29dbc9&pageNodeKey=5CEB4BE1-05BD-4C69-892A-2C2BBD37538B/b31ca85c-a1c5-4a9d-8b5d-e7b0736a8b16/SitefinitySiteMap&url=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&controls=09f9bb4f-5990-40af-b361-7849c73c9604_1,0cd3f511-e7d9-4e23-8773-26005ae09893_1,25637a62-a321-49a0-8b7e-5962dc977e95_1,6b5ac4dc-8fd0-4043-bd0a-e9ffd31e3bc8_1&correlationId=lvd0q0oezinv502q4f
50.56.19.112
https://s1325.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=1325&ref=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&ref2=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&tzo=-60&ms=36&optin=disabled
192.29.11.142
https://fiddler2.com/r/?credits
unknown
http://www.fiddler2.com/sandbox/FormAndCookie.asp
unknown
https://www.telerik.com/webapi/Announcements/GetPromo?url=https://www.telerik.com/download/fiddler/first-run
50.56.19.112
http://fiddler2.com/r/?id=bitness)
unknown
http://fiddler2.com/surveys/SurveysBaseUri
unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/DetailsView.jsT
unknown
http://fiddler2.com/r/?Fiddler2FirstRun_
unknown
https://ampcid.google.com/v1/publisher:getClientId
unknown
http://fiddler.wikidot.com/prefs
unknown
about:blank
http://fiddler2.com/r/?Fiddler2FirstRunR
unknown
https://www.telerik.com/RestApi/personalizations/render?pageNodeId=5ceb4be1-05bd-4c69-892a-2c2bbd37538b&pageDataId=1f960fad-aef2-4475-8978-52fb7a29dbc9&pageNodeKey=5CEB4BE1-05BD-4C69-892A-2C2BBD37538B/b31ca85c-a1c5-4a9d-8b5d-e7b0736a8b16/SitefinitySiteMap&url=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&controls=09f9bb4f-5990-40af-b361-7849c73c9604_1,0cd3f511-e7d9-4e23-8773-26005ae09893_1,25637a62-a321-49a0-8b7e-5962dc977e95_1,6b5ac4dc-8fd0-4043-bd0a-e9ffd31e3bc8_1&correlationId=lvd0qj2kn097okrw3nn
50.56.19.112
http://fiddler2.com/r/?Fiddler2FirstRunP
unknown
http://www.opensource.org/licenses/mit-license.php
unknown
http://groups.google.com/group/http-archive-specification/
unknown
https://www.telerik.com/blogs/fiddlercore-for-net-standard-and-fiddler-orchestra-the-future-of-fiddl
unknown
http://commons.apache.org/proper/commons-compress/
unknown
http://nsis.sourceforge.net/Main_Page
unknown
https://stats.g.doubleclick.net/j/collect
unknown
http://fiddler2.com/r/?Fiddler2FirstRunz
unknown
http://fiddler2.com/r/?quickexec
unknown
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-9JSNBCSF54&cid=925834404.1713914987&gtm=45je44m0v9167661709z8536291za200&aip=1&dma=0&gcs=G111&gcd=13v3v3v3v5&npa=0
142.251.2.156
http://fiddler2.com/r/?Fiddler2FirstRunl
unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/GridView.jsT
unknown
https://www.nuget.org/packages/DotNetZip/
unknown
https://d6vtbcy3ong79.cloudfront.net/telerik-navigation/3.5.25/js/index.min.mjs
13.226.251.88
http://www.telerik.com/fiddler
unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/WebForms.js
unknown
https://www.progress.com/legal/privacy-policy).
unknown
http://www.entrust.net/rpa03
unknown
http://www.google.com/bot.html)
unknown
http://exslt.org/common
unknown
https://s1325.t.eloqua.com/visitor/v200/svrGP?pps=70&siteid=1325
192.29.11.142
https://s1325.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=1325&ref=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&ref2=elqNone&tzo=-60&ms=762&optin=disabled&elqCookie=1
192.29.11.142
http://www.telerik.com/download/fiddler/first-run
50.56.19.112
https://github.com/google/zopfli/commit/720b20e8db19ea90b38edce82aca52815edf8c1a
unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/WebParts.jsT
unknown
http://www.fiddlerbook.com/fiddler/help/http/headers.asp?query=
unknown
https://rum-collector-2.pingdom.net/img/beacon.gif?id=54328dddabe53db9497b23c6&sAW=1280&sAH=984&bIW=1034&bIH=870&pD=24&dPR=1&or=landscape-primary&nT=1&rC=0&nS=0&cS=13&cE=434&dLE=13&dLS=13&fS=4&hS=14&rE=-1&rS=-1&reS=434&resS=1091&resE=1520&uEE=1137&uES=1137&dL=1156&dI=1751&dCLES=1751&dCLEE=1754&dC=8300&lES=8308&lEE=8310&s=nt&title=First%20run&path=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&ref=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&sId=zaewourn&sST=1713915006&sIS=1&rV=0&v=1.4.1
34.245.244.146
http://ajax.aspnetcdn.com/ajax/4.6/1/Focus.jsT
unknown
http://www.symauth.com/cps0(
unknown
https://www.google.com/pagead/landing?gcs=G111&gcd=13t3t3t3t5&rnd=1853818599.1713914998&url=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&dma=0&npa=0&gtm=45je44m0v9167661709z8536291za200&auid=571138784.1713914988
142.250.141.106
https://q.quora.com/_/ad/f3942e2f1f7d449b81784d171e274880/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run
52.200.154.95
http://127.0.0.1:
unknown
http://sourceforge.net/projects/hexbox/
unknown
http://www.symauth.com/rpa00
unknown
https://cdn.cookielaw.org/consent/3dfce4f2-dab6-4128-9f33-df7e0597da82/8b69118b-3606-49f3-8c41-2718141b484d/en.json
104.19.178.52
https://script.hotjar.com/modules.588629dd3c10b20ab52d.js
13.226.225.31
https://cl.qualaroo.com/ki.js/24100/4Nr.js
143.244.50.82
http://www.URLtoDownloadFrom.net
unknown
https://www.google.com/pagead/1p-conversion/975652292/?label=p4zxCNq_8IkYEMSLndED&guid=ON&script=0&ct_cookie_present=false&random=410509906&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJjBsQIiAQFAAQ&pscrd=CLnc9JHh-P76OCITCIaknPO-2YUDFcT8_QUdYDUDfjICCAMyAggEMgIIBzICCAgyAggJMgIICjICCAIyAggLOhhodHRwczovL3d3dy50ZWxlcmlrLmNvbS8&is_vtc=1&cid=CAQSKQB7FLtqm_2Y7mhgr_4TT706Z25qzJIIuEtEWsQVeg8mFAIyjSrn8yEj&random=4068442111
142.250.141.106
https://d6vtbcy3ong79.cloudfront.net/fonts/2.2.7/metric/Metric-Semibold.woff2
13.226.251.88
http://www.contoso.com/
unknown
http://www.someserver.com/upload.aspx
unknown
http://fiddler2.com/r/?SYNTAXVIEWINSTALL
unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/WebUIValidation.jsT
unknown
http://crl.entrust.net/2048ca.crl0
unknown
http://fiddler2.com/r/?Fiddler2FirstRunert
unknown
http://html4/loose.dtd
unknown
https://connect.facebook.net/signals/config/1444093252502226?v=2.9.154&r=stable&domain=www.telerik.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105
31.13.70.7
http://fiddler2.com/r/?id=bitness
unknown
http://fiddler2.com/r/?FiddlerLog
unknown
https://www.telerik.com/WebResource.axd?d=wnB2OjhYopty-dCFa4b2kKCIWGgLoaj0QQ4I7F_PiSysmtqnVBUtsGpmlAymZDgXEXdRjhe5BdfNkuyybLSHMhRnbzI9oh6WXC-y-EwOrJPY0qCvfWaOo0ltV4TVm8apzRlzF5O244Y4u7-m5V8Vv2yC1Tun7PurVRoOxfv28sPwY-isOJNAi7MSqc1tycGYAkqZXHU_zlVNorSTBDv4W4jemDM1&t=638477158040000000
50.56.19.112
http://fiddler2.com/fiddlercore
unknown
https://github.com/ymnk/jzlib
unknown
https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1444093252502226&ev=CHEQ&dl=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&rl=&if=false&ts=1713914994454&sw=1280&sh=1024&v=2.9.154&r=stable&ec=0&o=4126&fbp=fb.1.1713914994453.110516813&ler=empty&cdl=API_unavailable&it=1713914993541&coo=false&rqm=FGET
31.13.70.36
http://curl.haxx.se/
unknown
https://www.clarity.ms/tag/uet/
unknown
http://fiddler2.com/r/?Fiddler2FirstRunfbw
unknown
https://unpkg.com/web-vitals/dist/web-vitals.iife.js
104.17.246.203
http://.css
unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/Menu.jsT
unknown
http://www.qwhale.net/products/editor.htm
unknown
https://cdn.cookielaw.org/vendorlist/googleData.json
unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/MenuStandards.jsT
unknown
http://fiddler2.com/
unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0
unknown
https://servicestack.net
unknown
http://www.fatcow.com/free-icons
unknown
http://blogs.msdn.com/ieinternals/archive/2009/07/20/Using-post_2D00_check-and-pre_2D00_check-cache-
unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/TreeView.jsT
unknown
https://cdn.cookielaw.org/vendorlist/iab2Data.json
unknown
http://fiddler2.com/r/?FiddlerSandboxSOFTWARE
unknown
http://www.bouncycastle.org)
unknown
https://dtzbdy9anri2p.cloudfront.net/cache/b6ce06a57a51347c21d7af30873baa8620408fd6/telerik/css/style.css
52.85.205.195
http://crl.entrust.net/ts1ca.crl0
unknown
https://obseu.ytwohlcq.telerik.com/tracker/tc_imp.gif?e=37dfbd8ee84e00126bedce34ef478a9d9225c24f567d43d6da1908be6245cad7bd70a976750ef80ed89373bfe70e9c20c1e53e8d5d168b6a2f17071a10acf9f29f674d8b83d8022b3648fa2c2157826adf61950c655021c604030a35555997b7624f77be26bb25cb43e2923ef44c6eaa132c7a14c450ea54e285929c68f37950aa2084ba5f7ff35b7b1a2d18c8c9077af562b7818fbd1910fa0a9fc95df820da75c45b956279f02b01f2040e0228d2595fe69fe0a100ba2f965f980cf64d766dbad1276140023df819958d45a95f60e8e4e47116253bc6f57662d4dd09012b4576190bb98e32606d64f5ac183bd5b4f02d97fe58740f30b9e4f0d58a7dacd9db0ee35fc95f6f6bc9ecc8b6f03dc5d8e23d97320fd9ad9d784a40ff6939ac820876b08de97e8a03fa42ae965d8013d9c56d9c7c71d6da2dc77ad795afedcbbabf4c68af74a8e8a5744e60e3943dcceb13e75a1058830906d092cecccaec9426873ac792f5c638e87b3b6cd7366b8493925f2adca82bf853b5c11fd837ae3d1a0b63fd76f14ddc87f62cf6c72fc45cbfd9929b77895d437ded590413260974d1ba71a51d99819231b0d273fa9e2bca89e0b27c82bfaa596b6b84e75347ddfa0d5104f2e2e524bb6cc3a81fabfd6cf722b22d87008c06ddba58924672a6f7c974232d3e526c520b46eeb8d332c008a5075c5f3bafe53c83c14d52bac18ba8b67ecbefe1f485fcabf14f513dfc4685bf586a8a4b6209cb710b231faa22fa285dbbbfd3699861c9248caa2fc4b90990720b25250162129dc0e1da3a7354990a59879185a9baa152059eb0bd6197cf7379d0ce133c69fa91c55721b72483439c06fe3c9d16c7d515f8ba5ffe89dc97c11370e5f23a7d8371a78eb9aa129564330841d0151536f6fb3686b711cccdc2ae1edf9b95704b6e13ac37b904b454b5806a9f334728493d633f9633c7f56635c61dc7f3f569a8bb289e6861eb5425788de2c30b44ef76f48d19db0338084da25b57f3cbbf1ebd165ec7dd67a2d6dca8925ec81f157407f81c484e8ed24805a836e7e2d379de97bd72022ff32e79575aad4207bfc6b00a1b927e6387c2c553c3d5bacf5922a622fb5a3b44c64f3f6d958d510399dce0caf0f24ea328ac6ec9379ecc5195fff22a2bfdd90391cbfca0cef0cadf6b01dfa4375f9b23805bde4cebe52cacd3df8c32cbc6a7a4a41520cdbfb1ec499705d411432f&cri=JFpDhY30Gl&ts=1709&cb=1713914999226
3.248.162.96
http://.jpg
unknown
https://dntcl.qualaroo.com/frame.html
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-111455-1&cid=925834404.1713914987&jid=1541579741&gjid=934141005&_gid=1225407003.1713914987&_u=aGBAiEABBAAAAGAFKC~&z=2074653487
142.251.2.156
about:srcdoc
https://github.com/google/zopfli0
unknown
https://script.hotjar.com/browser-perf.8417c6bba72228fa2e29.js
13.226.225.31
https://www.telerik.com/favicon.ico?v=rebv1
50.56.19.112
http://getfiddler.com/
unknown
https://d6vtbcy3ong79.cloudfront.net/telerik-navigation/3.5.25/css/index.min.css
13.226.251.88
http://aia.entrust.net/ts1-chain256.cer01
unknown
https://googleads.g.doubleclick.net
unknown
There are 90 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
telerik.com
50.56.19.112
d6vtbcy3ong79.cloudfront.net
13.226.251.88
sni1gl.wpc.gammacdn.net
152.195.19.97
p01f.t.eloqua.com
192.29.11.142
euob.ytwohlcq.telerik.com
18.154.206.13
platform.twitter.map.fastly.net
146.75.92.157
stats.g.doubleclick.net
142.251.2.156
scontent.xx.fbcdn.net
31.13.70.7
privacyportal.onetrust.com
104.18.32.137
rum-static.pingdom.net
104.22.54.104
t.co
104.244.42.69
script.hotjar.com
13.226.225.31
cdnjs.cloudflare.com
104.17.25.14
www.google.com
142.250.141.99
q.quora.com
52.200.154.95
static-cdn.hotjar.com
18.65.25.57
star-mini.c10r.facebook.com
31.13.70.36
s.twitter.com
104.244.42.131
bcltest2.b-cdn.net
143.244.50.82
obseu.ytwohlcq.telerik.com
3.248.162.96
d585tldpucybw.cloudfront.net
108.139.9.18
d2no1x7oj2rkdb.cloudfront.net
18.65.25.14
prod-dem-collector-elb-611025824.eu-west-1.elb.amazonaws.com
34.245.244.146
googleads.g.doubleclick.net
142.251.2.155
qualdnt.b-cdn.net
143.244.50.213
part-0041.t-0009.t-msedge.net
13.107.213.69
td.doubleclick.net
74.125.137.156
analytics.google.com
142.251.2.139
dtzbdy9anri2p.cloudfront.net
52.85.205.195
fiddler2.com
50.56.19.116
unpkg.com
104.17.246.203
cdn.cookielaw.org
104.19.178.52
geolocation.onetrust.com
104.18.32.137
geo.qualaroo.com
3.211.190.76
api.insight.sitefinity.com
52.252.156.53
static.ads-twitter.com
unknown
a.quora.com
unknown
s1325.t.eloqua.com
unknown
www.telerik.com
unknown
static.hotjar.com
unknown
cl.qualaroo.com
unknown
c.clarity.ms
unknown
www.facebook.com
unknown
www.clarity.ms
unknown
img.en25.com
unknown
www.linkedin.com
unknown
www.clickcease.com
unknown
rum-collector-2.pingdom.net
unknown
d.clarity.ms
unknown
connect.facebook.net
unknown
px.ads.linkedin.com
unknown
analytics.twitter.com
unknown
dntcl.qualaroo.com
unknown
snap.licdn.com
unknown
cdn.insight.sitefinity.com
unknown
There are 45 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
192.29.11.142
p01f.t.eloqua.com
United States
3.211.190.76
geo.qualaroo.com
United States
18.65.25.57
static-cdn.hotjar.com
United States
52.252.156.53
api.insight.sitefinity.com
United States
18.65.25.14
d2no1x7oj2rkdb.cloudfront.net
United States
192.168.2.7
unknown
unknown
74.125.137.156
td.doubleclick.net
United States
34.240.56.220
unknown
United States
50.56.19.116
fiddler2.com
United States
104.18.32.137
privacyportal.onetrust.com
United States
108.139.9.18
d585tldpucybw.cloudfront.net
United States
142.250.141.106
unknown
United States
142.250.141.104
unknown
United States
50.56.19.112
telerik.com
United States
13.226.251.88
d6vtbcy3ong79.cloudfront.net
United States
142.251.2.156
stats.g.doubleclick.net
United States
142.251.2.155
googleads.g.doubleclick.net
United States
31.13.70.36
star-mini.c10r.facebook.com
Ireland
52.200.154.95
q.quora.com
United States
52.85.205.195
dtzbdy9anri2p.cloudfront.net
United States
104.244.42.131
s.twitter.com
United States
172.64.155.119
unknown
United States
18.154.206.13
euob.ytwohlcq.telerik.com
United States
239.255.255.250
unknown
Reserved
143.244.50.82
bcltest2.b-cdn.net
United States
104.17.25.14
cdnjs.cloudflare.com
United States
104.19.177.52
unknown
United States
142.250.141.99
www.google.com
United States
152.195.19.97
sni1gl.wpc.gammacdn.net
United States
13.107.213.69
part-0041.t-0009.t-msedge.net
United States
3.248.162.96
obseu.ytwohlcq.telerik.com
United States
104.17.246.203
unpkg.com
United States
104.19.178.52
cdn.cookielaw.org
United States
104.244.42.69
t.co
United States
143.244.50.213
qualdnt.b-cdn.net
United States
13.226.225.31
script.hotjar.com
United States
31.13.70.7
scontent.xx.fbcdn.net
Ireland
146.75.92.157
platform.twitter.map.fastly.net
Sweden
34.245.244.146
prod-dem-collector-elb-611025824.eu-west-1.elb.amazonaws.com
United States
104.22.54.104
rum-static.pingdom.net
United States
There are 30 hidden IPs, click here to show them.

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fiddler2\InstallerSettings
InstallPath
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fiddler2\InstallerSettings
PluginPath
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fiddler2\InstallerSettings
ScriptPath
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fiddler2\InstallerSettings
InstalledVersion
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
Fiddler.exe
HKEY_CURRENT_USER_Classes\.saz
NULL
HKEY_CURRENT_USER_Classes\Fiddler.ArchiveZip
NULL
HKEY_CURRENT_USER_Classes\Fiddler.ArchiveZip
PerceivedType
HKEY_CURRENT_USER_Classes\Fiddler.ArchiveZip
Content Type
HKEY_CURRENT_USER_Classes\Fiddler.ArchiveZip\DefaultIcon
NULL
HKEY_CURRENT_USER_Classes\Fiddler.ArchiveZip\Shell\Open\command
NULL
HKEY_CURRENT_USER_Classes\Fiddler.ArchiveZip\Shell\Open &in Viewer\command
NULL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fiddler2
UpdatePending
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fiddler2\UI
frmViewer_WState
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fiddler2
JSEditor
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fiddler2\MenuExt\&Sandbox
Command
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fiddler2\MenuExt\&Sandbox
Parameters
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fiddler2\ImagesMenuExt\PNG&Distill
Command
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fiddler2\ImagesMenuExt\PNG&Distill
Parameters
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fiddler2\ImagesMenuExt\PNG&Distill
Types
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fiddler2\MenuExt\Win&8 Loopback Exemptions
Command
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fiddler2\MenuExt\&View IE Cache
Command
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyHttp1.1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
EnableHttp1_1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fiddler2
EstimatedSize
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fiddler2
DisplayName
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fiddler2
Comments
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fiddler2
Publisher
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fiddler2
InstallLocation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fiddler2
DisplayVersion
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fiddler2
UninstallString
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fiddler2
DisplayIcon
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fiddler2
HelpLink
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fiddler2
URLUpdateInfo
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fiddler2
URLInfoAbout
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fiddler2
NoModify
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fiddler2
NoRepair
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Fiddler2
DetectedBrowser
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
Fiddler.exe
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer
GlobalAssocChangedCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
Scenario
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe
Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
RuntimeVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/Fiddler.exe\0
Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/EnableLoopback.exe\0
Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/EnableLoopback.exe\0
Scenario
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/EnableLoopback.exe
Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/EnableLoopback.exe\0
RuntimeVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/EnableLoopback.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/EnableLoopback.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/EnableLoopback.exe\0
Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/EnableLoopback.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/EnableLoopback.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/EnableLoopback.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/EnableLoopback.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/EnableLoopback.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/EnableLoopback.exe\0
ImageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/EnableLoopback.exe\0
Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Users/user/AppData/Local/Programs/Fiddler/EnableLoopback.exe
Status
HKEY_CURRENT_USER\Environment
PATH
There are 75 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2808A8F5000
heap
page read and write
72FEAFF000
stack
page read and write
450000
heap
page read and write
1A780933000
heap
page read and write
2D48000
heap
page read and write
2808AA21000
heap
page read and write
63C000
heap
page read and write
5F5000
heap
page read and write
400000
unkown
page readonly
4F0000
heap
page read and write
2808A900000
heap
page read and write
57F1000
heap
page read and write
2840000
trusted library allocation
page read and write
5DC000
heap
page read and write
BD0000
trusted library allocation
page read and write
570000
heap
page read and write
3050000
heap
page read and write
55BF000
stack
page read and write
2808AA73000
heap
page read and write
1A780958000
heap
page read and write
3A61000
trusted library allocation
page read and write
BE3000
trusted library allocation
page execute and read and write
F5E000
stack
page read and write
3040000
heap
page read and write
35E0000
trusted library allocation
page read and write
2808A9D1000
heap
page read and write
1A7808FE000
heap
page read and write
1A780B60000
heap
page read and write
2808C904000
heap
page read and write
28AE000
stack
page read and write
349E000
stack
page read and write
1070000
trusted library allocation
page read and write
21BE000
stack
page read and write
6F0000
heap
page read and write
66A000
heap
page read and write
2808C8D9000
heap
page read and write
2280000
heap
page read and write
D00000
heap
page read and write
4E0000
heap
page read and write
56E1000
heap
page read and write
4A9E000
stack
page read and write
5F8000
heap
page read and write
1A782361000
heap
page read and write
2950000
heap
page read and write
267F000
stack
page read and write
C0B000
heap
page read and write
5330000
trusted library allocation
page read and write
434000
unkown
page read and write
42A000
unkown
page read and write
1A780936000
heap
page read and write
19A000
stack
page read and write
72FEBFC000
stack
page read and write
1A7809C0000
heap
page read and write
1A782310000
heap
page read and write
2808C2C5000
heap
page read and write
2A5F000
stack
page read and write
408000
unkown
page readonly
40A000
unkown
page write copy
2808AA9E000
heap
page read and write
B00000
heap
page read and write
2850000
trusted library allocation
page execute and read and write
2808AA00000
heap
page read and write
772000
unkown
page readonly
1A78099E000
heap
page read and write
2808AA09000
heap
page read and write
2D70000
heap
page read and write
2808C854000
heap
page read and write
43B000
unkown
page readonly
1A78091C000
heap
page read and write
40A000
unkown
page read and write
27C1000
heap
page read and write
2808A9D8000
heap
page read and write
2718000
heap
page read and write
BE4000
trusted library allocation
page read and write
72FECFC000
stack
page read and write
2808A9A0000
heap
page read and write
650000
heap
page read and write
1A7808D1000
heap
page read and write
510000
heap
page read and write
2808AA55000
heap
page read and write
BC0000
heap
page read and write
B8E31FC000
stack
page read and write
433000
unkown
page read and write
64A000
heap
page read and write
400000
unkown
page readonly
277F000
stack
page read and write
450000
heap
page read and write
408000
unkown
page readonly
1A780909000
heap
page read and write
BF0000
trusted library allocation
page read and write
6B0000
heap
page read and write
2ADB000
heap
page read and write
1A780B65000
heap
page read and write
C2B000
heap
page read and write
1A7809F0000
heap
page read and write
427000
unkown
page read and write
260E000
stack
page read and write
427000
unkown
page read and write
1A78096C000
heap
page read and write
578000
heap
page read and write
1A7808A9000
heap
page read and write
43E000
unkown
page readonly
4B9E000
stack
page read and write
72FE9FE000
stack
page read and write
408000
unkown
page readonly
73C60000
unkown
page readonly
B80000
heap
page read and write
401000
unkown
page execute read
1080000
heap
page read and write
72FEDFF000
stack
page read and write
215E000
stack
page read and write
2808AA63000
heap
page read and write
225F000
stack
page read and write
30E0000
trusted library allocation
page read and write
4E5000
heap
page read and write
2808A7E0000
heap
page read and write
2808A920000
heap
page read and write
BF4000
trusted library allocation
page read and write
2808C90E000
heap
page read and write
B8E36FC000
stack
page read and write
2808C2C0000
heap
page read and write
72FE8F9000
stack
page read and write
439000
unkown
page read and write
B8E2FFF000
stack
page read and write
4E7000
heap
page read and write
540000
heap
page read and write
4F00000
trusted library allocation
page read and write
D05000
heap
page read and write
4E0000
heap
page read and write
2808C914000
heap
page read and write
B8E37FC000
stack
page read and write
56F0000
heap
page read and write
400000
unkown
page readonly
65C000
heap
page read and write
1A780922000
heap
page read and write
5F8000
heap
page read and write
96000
stack
page read and write
1A7808A0000
heap
page read and write
F1F000
stack
page read and write
401000
unkown
page execute read
2808C8A4000
heap
page read and write
6B8000
heap
page read and write
2808A8C0000
heap
page read and write
1A78094D000
heap
page read and write
C00000
heap
page read and write
1A7807C0000
heap
page read and write
2808C861000
heap
page read and write
2808A9B5000
heap
page read and write
401000
unkown
page execute read
C34000
heap
page read and write
2808C91A000
heap
page read and write
105F000
stack
page read and write
A3C000
stack
page read and write
64E000
stack
page read and write
2A61000
trusted library allocation
page read and write
359F000
stack
page read and write
1A78090B000
heap
page read and write
2782000
heap
page read and write
42B000
unkown
page read and write
270C000
stack
page read and write
1A780949000
heap
page read and write
56E0000
heap
page read and write
2808A9DC000
heap
page read and write
B8E2DFE000
stack
page read and write
2860000
heap
page execute and read and write
1077000
trusted library allocation
page execute and read and write
2808C8CF000
heap
page read and write
107B000
trusted library allocation
page execute and read and write
73C66000
unkown
page readonly
424000
unkown
page read and write
1A782371000
heap
page read and write
1A7808AF000
heap
page read and write
2808A8F0000
heap
page read and write
40A000
unkown
page write copy
680000
heap
page read and write
65F000
heap
page read and write
2808AA42000
heap
page read and write
43E000
unkown
page readonly
5D8000
heap
page read and write
19A000
stack
page read and write
57F0000
heap
page read and write
2808AA7B000
heap
page read and write
B38000
stack
page read and write
2808C850000
heap
page read and write
516000
heap
page read and write
C0E000
heap
page read and write
408000
unkown
page readonly
2808A9A9000
heap
page read and write
1A782500000
heap
page read and write
1A782505000
heap
page read and write
27DA000
heap
page read and write
61A000
heap
page read and write
B8E2CF2000
stack
page read and write
40A000
unkown
page read and write
770000
unkown
page readonly
2230000
heap
page read and write
2808C89B000
heap
page read and write
401000
unkown
page execute read
2808AA5A000
heap
page read and write
73C64000
unkown
page readonly
43B000
unkown
page readonly
B8E2EFF000
stack
page read and write
B05000
heap
page read and write
1A7809A0000
heap
page read and write
C40000
heap
page read and write
56F0000
heap
page read and write
4EE0000
heap
page read and write
106A000
trusted library allocation
page execute and read and write
29A6000
heap
page read and write
B8E30FC000
stack
page read and write
9B000
stack
page read and write
1A7808C7000
heap
page read and write
2808AA0E000
heap
page read and write
27D1000
heap
page read and write
1A7808E0000
heap
page read and write
5FE000
heap
page read and write
425000
unkown
page read and write
2284000
heap
page read and write
E1E000
stack
page read and write
55E0000
heap
page read and write
1060000
trusted library allocation
page read and write
601000
heap
page read and write
2808AA37000
heap
page read and write
B09000
heap
page read and write
2808C865000
heap
page read and write
1A78099B000
heap
page read and write
73C61000
unkown
page execute read
2808C8F0000
heap
page read and write
B70000
heap
page read and write
54BE000
stack
page read and write
72FF2FC000
stack
page read and write
2808AA4B000
heap
page read and write
2808AA58000
heap
page read and write
400000
unkown
page readonly
616000
heap
page read and write
There are 225 hidden memdumps, click here to show them.

DOM / HTML

URL
Malicious
https://td.doubleclick.net/td/ga/rul?tid=G-9JSNBCSF54&gacid=925834404.1713914987&gtm=45je44m0v9167661709z8536291za200&dma=0&gcs=G111&gcd=13v3v3v3v5&npa=0&pscdl=noapi&aip=1&fledge=1&z=1283479480
about:srcdoc
about:srcdoc
about:blank
https://www.telerik.com/download/fiddler/first-run
https://www.telerik.com/download/fiddler/first-run
https://www.telerik.com/download/fiddler/first-run
https://www.telerik.com/download/fiddler/first-run
https://td.doubleclick.net/td/rul/975652292?random=1713914991222&cv=11&fst=1713914991222&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45je44m0v9167661709za200&gcs=G111&gcd=13v3v3v3v5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&label=p4zxCNq_8IkYEMSLndED&hn=www.googleadservices.com&frm=0&tiba=First%20run&gtm_ee=1&npa=0&pscdl=noapi&auid=571138784.1713914988&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.134%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.134&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&data=event%3Dconversion&ct_cookie_present=0
https://td.doubleclick.net/td/rul/975652292?random=1713914999207&cv=11&fst=1713914999207&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45je44m0v9167661709za200&gcs=G111&gcd=13v3v3v3v5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&ref=https%3A%2F%2Fwww.telerik.com%2Fdownload%2Ffiddler%2Ffirst-run&label=p4zxCNq_8IkYEMSLndED&hn=www.googleadservices.com&frm=0&tiba=First%20run&gtm_ee=1&npa=0&pscdl=noapi&auid=571138784.1713914988&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.134%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.134&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&data=event%3Dconversion&ct_cookie_present=0
https://dntcl.qualaroo.com/frame.html
There are 1 hidden doms, click here to show them.