Edit tour

Windows Analysis Report
random.exe

Overview

General Information

Sample name:	random.exe
Analysis ID:	1596842
MD5:	b986d1882535e8f044c3d091d324d2f9
SHA1:	af7fd2693f6f91c6655bde5621ad293daa53bcae
SHA256:	1d5f4f9082b27779f594b673840b56b01c5c925de8dac6b4a648543ddb9dd0b3
Tags:	CredentialFlusherexeuser-aachum
Infos:

Detection

Credential Flusher

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Credential Flusher

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Connects to many different domains

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

OS version to string mapping found (often used in BOTs)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

random.exe (PID: 6660 cmdline: "C:\Users\user\Desktop\random.exe" MD5: B986D1882535E8F044C3D091D324D2F9)

taskkill.exe (PID: 6688 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5756 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5844 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6712 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4320 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 5756 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 4020 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6404 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 4504 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2280 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2224 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c958a673-8d2a-4932-a065-728f92b5ad4e} 6404 "\\.\pipe\gecko-crash-server-pipe.6404" 1b575770310 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7672 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4112 -parentBuildID 20230927232528 -prefsHandle 3816 -prefMapHandle 3048 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cef76444-a689-447f-b1a3-9f982a55c08d} 6404 "\\.\pipe\gecko-crash-server-pipe.6404" 1b507bdf410 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7792 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3984 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 2784 -prefMapHandle 2768 -prefsLen 33185 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c18f3a26-7389-4e0f-8ffe-2a8c2ec164cb} 6404 "\\.\pipe\gecko-crash-server-pipe.6404" 1b50fda6910 utility MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: random.exe PID: 6660	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security

Code function: 0_2_0026EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_0026EAFF

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_0026ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0026ED6A

Source: C:\Users\user\Desktop\random.exe

0_2_0026EAFF

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_0025AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_0025AA57

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00289576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00289576

System Summary

Binary is likely a compiled AutoIt script file

Source: random.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: random.exe, 00000000.00000002.1774769294.00000000002B2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_5a0ab540-7
Source: random.exe, 00000000.00000002.1774769294.00000000002B2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_56af3f4b-c
Source: random.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_1630f60c-9
Source: random.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_ea5b66c1-4

Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 16_2_000001E5CC2721F2 NtQuerySystemInformation,		16_2_000001E5CC2721F2
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 16_2_000001E5CC279277 NtQuerySystemInformation,		16_2_000001E5CC279277

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_0025D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_0025D5EB

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00251201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00251201

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_0025E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0025E8F6

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_001FBF40	0_2_001FBF40
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00262046	0_2_00262046
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_001F8060	0_2_001F8060
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00258298	0_2_00258298
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0022E4FF	0_2_0022E4FF
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0022676B	0_2_0022676B
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00284873	0_2_00284873
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0021CAA0	0_2_0021CAA0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_001FCAF0	0_2_001FCAF0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0020CC39	0_2_0020CC39
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00226DD9	0_2_00226DD9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0020B119	0_2_0020B119
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_001F91C0	0_2_001F91C0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00211394	0_2_00211394
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00211706	0_2_00211706
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0021781B	0_2_0021781B
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_001F7920	0_2_001F7920
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0020997D	0_2_0020997D
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_002119B0	0_2_002119B0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00217A4A	0_2_00217A4A
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00211C77	0_2_00211C77
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00217CA7	0_2_00217CA7
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0027BE44	0_2_0027BE44
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00229EEE	0_2_00229EEE
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00211F32	0_2_00211F32
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 16_2_000001E5CC2721F2	16_2_000001E5CC2721F2
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 16_2_000001E5CC279277	16_2_000001E5CC279277
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 16_2_000001E5CC272232	16_2_000001E5CC272232
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 16_2_000001E5CC27291C	16_2_000001E5CC27291C

Source: C:\Users\user\Desktop\random.exe	Code function: String function: 00210A30 appears 46 times
Source: C:\Users\user\Desktop\random.exe	Code function: String function: 0020F9F2 appears 31 times

Source: random.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal80.troj.evad.winEXE@34/34@69/13

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_002637B5 GetLastError,FormatMessageW,

0_2_002637B5

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_002510BF AdjustTokenPrivileges,CloseHandle,		0_2_002510BF
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_002516C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_002516C3

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_002651CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_002651CD

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_0025D4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0025D4DC

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_0026648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0026648E

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_001F42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_001F42A2

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File created: C:\Users\user\AppData\Local\Mozilla\Firefox\SkeletonUILock-c388d246

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6760:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7048:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1440:120:WilError_03

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File created: C:\Users\user\AppData\Local\Temp\firefox

Jump to behavior

Source: random.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Program Files\Mozilla Firefox\firefox.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: firefox.exe, 0000000D.00000003.1929389276.000001B50FDCA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE timestamp BETWEEN date(:dateFrom) AND date(:dateTo);
Source: firefox.exe, 0000000D.00000003.1929389276.000001B50FDCA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE events (id INTEGER PRIMARY KEY, type INTEGER NOT NULL, count INTEGER NOT NULL, timestamp DATE );
Source: firefox.exe, 0000000D.00000003.1929389276.000001B50FDCA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INSERT INTO events (type, count, timestamp) VALUES (:type, 1, date(:date));
Source: firefox.exe, 0000000D.00000003.1929389276.000001B50FDCA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;
Source: firefox.exe, 0000000D.00000003.1929389276.000001B50FDCA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;Fy6
Source: firefox.exe, 0000000D.00000003.1929389276.000001B50FDCA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE events SET count = count + 1 WHERE id = :id;-
Source: firefox.exe, 0000000D.00000003.1929389276.000001B50FDCA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9'
Source: firefox.exe, 0000000D.00000003.1929389276.000001B50FDCA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9
Source: firefox.exe, 0000000D.00000003.1929389276.000001B50FDCA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE type = :type AND timestamp = date(:date);

Source: random.exe

ReversingLabs: Detection: 29%

Source: unknown	Process created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2280 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2224 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c958a673-8d2a-4932-a065-728f92b5ad4e} 6404 "\\.\pipe\gecko-crash-server-pipe.6404" 1b575770310 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4112 -parentBuildID 20230927232528 -prefsHandle 3816 -prefMapHandle 3048 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cef76444-a689-447f-b1a3-9f982a55c08d} 6404 "\\.\pipe\gecko-crash-server-pipe.6404" 1b507bdf410 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3984 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 2784 -prefMapHandle 2768 -prefsLen 33185 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c18f3a26-7389-4e0f-8ffe-2a8c2ec164cb} 6404 "\\.\pipe\gecko-crash-server-pipe.6404" 1b50fda6910 utility
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2280 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2224 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c958a673-8d2a-4932-a065-728f92b5ad4e} 6404 "\\.\pipe\gecko-crash-server-pipe.6404" 1b575770310 socket	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4112 -parentBuildID 20230927232528 -prefsHandle 3816 -prefMapHandle 3048 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cef76444-a689-447f-b1a3-9f982a55c08d} 6404 "\\.\pipe\gecko-crash-server-pipe.6404" 1b507bdf410 rdd	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3984 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 2784 -prefMapHandle 2768 -prefsLen 33185 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c18f3a26-7389-4e0f-8ffe-2a8c2ec164cb} 6404 "\\.\pipe\gecko-crash-server-pipe.6404" 1b50fda6910 utility	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: random.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: UxTheme.pdb source: firefox.exe, 0000000D.00000003.1937433712.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1959544276.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: rsaenh.pdb source: firefox.exe, 0000000D.00000003.1967845786.000001B50D97D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wininet.pdb source: firefox.exe, 0000000D.00000003.1967845786.000001B50D97D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: UMPDC.pdb source: firefox.exe, 0000000D.00000003.1956339249.000001B50D7AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1935887156.000001B50D7AE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winsta.pdb source: firefox.exe, 0000000D.00000003.1957373650.000001B5091A4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: rpcrt4.pdb source: firefox.exe, 0000000D.00000003.1937433712.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1959544276.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: WscApi.pdb source: firefox.exe, 0000000D.00000003.1936294192.000001B50D742000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1957158325.000001B50D742000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb source: firefox.exe, 0000000D.00000003.1937433712.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1959544276.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: xWindows.StateRepositoryPS.pdb source: firefox.exe, 0000000D.00000003.1957373650.000001B50915A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1957755236.000001B508E62000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: xOneCoreUAPCommonProxyStub.pdb source: firefox.exe, 0000000D.00000003.1968490925.000001B50D698000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb source: firefox.exe, 0000000D.00000003.1937433712.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1959544276.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nssckbi.pdb source: firefox.exe, 0000000D.00000003.1967933077.000001B50D971000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: userenv.pdbP4O source: firefox.exe, 0000000D.00000003.1957158325.000001B50D728000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1936294192.000001B50D728000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dcomp.pdb source: firefox.exe, 0000000D.00000003.1968013102.000001B50D6C1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winnsi.pdb source: firefox.exe, 0000000D.00000003.1957755236.000001B508E62000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: cryptsp.pdb source: firefox.exe, 0000000D.00000003.1967845786.000001B50D97D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: msimg32.pdb0 source: firefox.exe, 0000000D.00000003.1956339249.000001B50D7AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1935887156.000001B50D7AE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: sspicli.pdb source: firefox.exe, 0000000D.00000003.1967845786.000001B50D97D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shell32.pdb source: firefox.exe, 0000000D.00000003.1937433712.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1959544276.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntmarta.pdb@ source: firefox.exe, 0000000D.00000003.1937433712.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1959544276.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntmarta.pdb source: firefox.exe, 0000000D.00000003.1937433712.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1959544276.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: urlmon.pdb source: firefox.exe, 0000000D.00000003.1936294192.000001B50D742000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1957158325.000001B50D742000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnsapi.pdb source: firefox.exe, 0000000D.00000003.1968539197.000001B508E32000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: freebl3.pdbcanvas-device-reset source: firefox.exe, 0000000D.00000003.1956339249.000001B50D7AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1935887156.000001B50D7AE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: userenv.pdb source: firefox.exe, 0000000D.00000003.1957158325.000001B50D728000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1936294192.000001B50D728000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shlwapi.pdb source: firefox.exe, 0000000D.00000003.1937433712.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1959544276.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winhttp.pdb source: firefox.exe, 0000000D.00000003.1967845786.000001B50D97D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shlwapi.pdbbrowser/tabbrowser.ftl source: firefox.exe, 0000000D.00000003.1937433712.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1959544276.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mswsock.pdbps_quad_mask_FAST_PATH source: firefox.exe, 0000000D.00000003.1968581532.000001B508D98000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: msimg32.pdb source: firefox.exe, 0000000D.00000003.1956339249.000001B50D7AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1935887156.000001B50D7AE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: sspicli.pdbP4O source: firefox.exe, 0000000D.00000003.1967845786.000001B50D97D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntasn1.pdb source: firefox.exe, 0000000D.00000003.1967845786.000001B50D97D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb source: firefox.exe, 0000000D.00000003.1937433712.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1959544276.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: devobj.pdb source: firefox.exe, 0000000D.00000003.1957755236.000001B508E62000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: d3d11.pdb source: firefox.exe, 0000000D.00000003.1936294192.000001B50D742000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1957158325.000001B50D742000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dwmapi.pdb source: firefox.exe, 0000000D.00000003.1957373650.000001B5091A4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: srvcli.pdb source: firefox.exe, 0000000D.00000003.1936294192.000001B50D742000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1957158325.000001B50D742000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: imm32.pdb source: firefox.exe, 0000000D.00000003.1937433712.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1959544276.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: freebl3.pdb source: firefox.exe, 0000000D.00000003.1956339249.000001B50D7AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1935887156.000001B50D7AE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: gdi32.pdb source: firefox.exe, 0000000D.00000003.1937433712.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1959544276.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ws2_32.pdb source: firefox.exe, 0000000D.00000003.1959544276.000001B507CD8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1970424570.000001B507CD8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1937433712.000001B507CD8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: avrt.pdb source: firefox.exe, 0000000D.00000003.1967845786.000001B50D97D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: WLDP.pdb source: firefox.exe, 0000000D.00000003.1937433712.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1959544276.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mswsock.pdb source: firefox.exe, 0000000D.00000003.1968581532.000001B508D98000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: sechost.pdb source: firefox.exe, 0000000D.00000003.1937433712.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1959544276.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nsi.pdb source: firefox.exe, 0000000D.00000003.1957755236.000001B508E42000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1968539197.000001B508E32000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shell32.pdbP4O source: firefox.exe, 0000000D.00000003.1937433712.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.13.dr
Source:	Binary string: winmm.pdb source: firefox.exe, 0000000D.00000003.1963528343.000001B50834E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nssckbi.pdb@ source: firefox.exe, 0000000D.00000003.1956339249.000001B50D7AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1935887156.000001B50D7AE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winrnr.pdb source: firefox.exe, 0000000D.00000003.1957755236.000001B508E42000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: msctf.pdb source: firefox.exe, 0000000D.00000003.1957373650.000001B5091A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1957755236.000001B508E62000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ole32.pdb source: firefox.exe, 0000000D.00000003.1959544276.000001B507CD8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1937433712.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1970424570.000001B507CD8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1959544276.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1937433712.000001B507CD8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mscms.pdb source: firefox.exe, 0000000D.00000003.1957158325.000001B50D728000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1936294192.000001B50D728000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: user32.pdb source: firefox.exe, 0000000D.00000003.1937433712.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1959544276.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: twinapi.pdb source: firefox.exe, 0000000D.00000003.1957755236.000001B508E62000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.13.dr
Source:	Binary string: combase.pdb source: firefox.exe, 0000000D.00000003.1937433712.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1959544276.000001B507CA2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dxgi.pdb source: firefox.exe, 0000000D.00000003.1968013102.000001B50D6C1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: firefox.exe, 0000000D.00000003.1959544276.000001B507CD8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1970424570.000001B507CD8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1937433712.000001B507CD8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ncrypt.pdb source: firefox.exe, 0000000D.00000003.1967845786.000001B50D97D000.00000004.00000800.00020000.00000000.sdmp

Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_001F42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_001F42DE

Source: gmpopenh264.dll.tmp.13.dr

Static PE information: section name: .rodata

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00210A76 push ecx; ret

0_2_00210A89

Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp			Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)			Jump to dropped file

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0020F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_0020F98E
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00281C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00281C41

Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\random.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-95524

Source: C:\Program Files\Mozilla Firefox\firefox.exe

Code function: 16_2_000001E5CC2721F2 rdtsc

16_2_000001E5CC2721F2

Source: C:\Users\user\Desktop\random.exe

API coverage: 3.9 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0025DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0025DBBE
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_002668EE FindFirstFileW,FindClose,	0_2_002668EE
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0026698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_0026698F
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0025D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0025D076
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0025D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0025D3A9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00269642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00269642
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0026979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0026979D
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00269B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00269B2B
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00265C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00265C97

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_001F42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_001F42DE

Source: firefox.exe, 0000000F.00000002.2959231597.0000022AB7840000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWv8
Source: firefox.exe, 0000000F.00000002.2959231597.0000022AB7840000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll6:
Source: firefox.exe, 00000014.00000002.2957949214.000002DDD67F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW-
Source: firefox.exe, 0000000F.00000002.2951399418.0000022AB6F4A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2950015081.000001E5CBF3A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2958201246.000001E5CC863000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.2951231133.000002DDD646A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 0000000D.00000003.1748140918.000001B57E8C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.2957990489.0000022AB741E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: random.exe, 00000000.00000003.1774130092.00000000015B0000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1773995781.0000000001587000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1773037003.0000000001587000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1773219070.0000000001587000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1773496947.0000000001587000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1774496006.00000000015B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: firefox.exe, 00000010.00000002.2958201246.000001E5CC863000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllnk
Source: random.exe, 00000000.00000003.1774582592.0000000001796000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1761271298.0000000001796000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1777790923.0000000001796000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllcA
Source: firefox.exe, 0000000F.00000002.2959231597.0000022AB7840000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWV9
Source: random.exe, 00000000.00000003.1774582592.0000000001796000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1761271298.0000000001796000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1777790923.0000000001796000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.2951399418.0000022AB6F4A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2958201246.000001E5CC863000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: firefox.exe, 0000000F.00000002.2951399418.0000022AB6F4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWc

Source: C:\Users\user\Desktop\random.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

Code function: 16_2_000001E5CC2721F2 rdtsc

16_2_000001E5CC2721F2

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_0026EAA2 BlockInput,

0_2_0026EAA2

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00222622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00222622

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_001F42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_001F42DE

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00214CE8 mov eax, dword ptr fs:[00000030h]

0_2_00214CE8

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00250B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00250B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00222622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00222622
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0021083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0021083F
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_002109D5 SetUnhandledExceptionFilter,	0_2_002109D5
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00210C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00210C21

Source: C:\Users\user\Desktop\random.exe

0_2_00251201

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00232BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00232BA5

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_0025B226 SendInput,keybd_event,

0_2_0025B226

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_002722DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_002722DA

Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior

Source: C:\Users\user\Desktop\random.exe

0_2_00250B62

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00251663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00251663

Source: random.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: random.exe	Binary or memory string: Shell_TrayWnd
Source: firefox.exe, 0000000D.00000003.1941918616.000001B50F401000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hSoftware\Policies\Microsoft\Windows\PersonalizationNoChangingStartMenuBackgroundPersonalColors_BackgroundWilStaging_02RtlDisownModuleHeapAllocationRtlQueryFeatureConfigurationRtlRegisterFeatureConfigurationChangeNotificationRtlSubscribeWnfStateChangeNotificationRtlDllShutdownInProgressntdll.dllNtQueryWnfStateDataLocal\SM0:%d:%d:%hs_p0Local\SessionImmersiveColorPreferenceBEGINTHMthmfile\Sessions\%d\Windows\ThemeSectionMessageWindowendthemewndThemeApiConnectionRequest\ThemeApiPortwinsta0SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\PersonalizeAppsUseLightThemeSystemUsesLightThemedefaultshell\themes\uxtheme\render.cppCompositedWindow::WindowdeletedrcacheMDIClientSoftware\Microsoft\Windows\DWMColorPrevalenceSoftware\Microsoft\Windows\CurrentVersion\ImmersiveShellTabletModeMENUAccentColorSoftware\Microsoft\Windows\CurrentVersion\Explorer\AccentDefaultStartColorControl Panel\DesktopAutoColorizationAccentColorMenuStartColorMenuAutoColorSoftware\Microsoft\Windows\CurrentVersion\Themes\History\ColorsSoftware\Microsoft\Windows\CurrentVersion\Themes\HistoryAccentPaletteTab$Shell_TrayWndLocal\SessionImmersiveColorMutex

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00210698 cpuid

0_2_00210698

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_0024D21C GetLocalTime,

0_2_0024D21C

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_0024D27A GetUserNameW,

0_2_0024D27A

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_0022BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0022BB6F

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_001F42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_001F42DE

Stealing of Sensitive Information

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: random.exe PID: 6660, type: MEMORYSTR

Source: random.exe	Binary or memory string: WIN_81
Source: random.exe	Binary or memory string: WIN_XP
Source: random.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: random.exe	Binary or memory string: WIN_XPe
Source: random.exe	Binary or memory string: WIN_VISTA
Source: random.exe	Binary or memory string: WIN_7
Source: random.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: random.exe PID: 6660, type: MEMORYSTR

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00271204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00271204
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00271806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00271806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	2 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	1 DLL Side-Loading	NTDS	16 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 Extra Window Memory Injection	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Process Injection	1 Masquerading	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	2 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
random.exe	30%	ReversingLabs	Win32.Trojan.AutoitInject
random.exe	100%	Avira	TR/ATRAPS.Gen
random.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://login.li	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	96.7.128.186	true	false	high
star-mini.c10r.facebook.com	157.240.253.35	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
twitter.com	104.244.42.65	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
shavar.prod.mozaws.net	34.211.125.135	true	false	high
services.addons.mozilla.org	151.101.65.91	true	false	high
dyna.wikimedia.org	185.15.59.224	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
youtube.com	142.250.185.174	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
a19.dscg10.akamai.net	2.22.61.59	true	false	high
youtube-ui.l.google.com	142.250.185.238	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
reddit.map.fastly.net	151.101.193.140	true	false	high
ipv4only.arpa	192.0.0.171	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
normandy-cdn.services.mozilla.com	35.201.103.21	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
www.reddit.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
normandy.cdn.mozilla.net	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 00000014.00000002.2952868840.000002DDD66C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://datastudio.google.com/embed/reporting/	firefox.exe, 0000000D.00000003.1925558802.000001B509205000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1902137908.000001B506A62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1972987375.000001B50E343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1921507981.000001B505899000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1868265505.000001B50EAA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1931486671.000001B50E343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1951659576.000001B50E343000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.mozilla.com0	gmpopenh264.dll.tmp.13.dr	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	firefox.exe, 0000000D.00000003.1949701136.000001B57E7B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1800470918.000001B57FD5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.2954196743.0000022AB73CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2954495285.000001E5CC3E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.2958245293.000002DDD6903000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.13.dr	false		high
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	firefox.exe, 0000000D.00000003.1883033454.000001B50DC35000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000010.00000002.2954495285.000001E5CC386000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.2952868840.000002DDD668F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2019-09/schema.	firefox.exe, 0000000D.00000003.1807852510.000001B50655E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.leboncoin.fr/	firefox.exe, 0000000D.00000003.1953830726.000001B50DD60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1808967052.000001B50DD63000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 0000000D.00000003.1934611094.000001B50D9FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	firefox.exe, 0000000D.00000003.1807852510.000001B50657E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://shavar.services.mozilla.com	firefox.exe, 0000000D.00000003.1971993100.000001B50E35F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1931486671.000001B50E343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1951659576.000001B50E343000.00000004.00000800.00020000.00000000.sdmp	false		high
https://completion.amazon.com/search/complete?q=	firefox.exe, 0000000D.00000003.1752389908.000001B505400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1752726357.000001B50563C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1752571186.000001B50561F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1752871459.000001B50565A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1753066650.000001B505677000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000000D.00000003.1810376032.000001B5072F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1807852510.000001B506595000.00000004.00000800.00020000.00000000.sdmp	false		high
https://identity.mozilla.com/ids/ecosystem_telemetryU	firefox.exe, 0000000D.00000003.1929389276.000001B50FDCA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/breach-details/	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://github.com/w3c/csswg-drafts/issues/4650	firefox.exe, 0000000D.00000003.1936294192.000001B50D742000.00000004.00000800.00020000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 0000000D.00000003.1950959404.000001B50EC29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1930534105.000001B50EC29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1926753912.000001B57F02C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1747628998.000001B57F013000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000000D.00000003.1815198513.000001B5069CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1752389908.000001B505400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1752726357.000001B50563C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1808425422.000001B50645F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1752571186.000001B50561F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1752871459.000001B50565A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1753066650.000001B505677000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.msn.com	firefox.exe, 0000000D.00000003.1801296687.000001B508D37000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 0000000D.00000003.1752389908.000001B505400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1752726357.000001B50563C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1752571186.000001B50561F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1752871459.000001B50565A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1753066650.000001B505677000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/addon/	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
http://exslt.org/sets	firefox.exe, 0000000D.00000003.1749006417.000001B57E726000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://youtube.com/	firefox.exe, 0000000D.00000003.1968490925.000001B50D698000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1957158325.000001B50D728000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1936294192.000001B50D728000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2020-12/schema/=	firefox.exe, 0000000D.00000003.1807852510.000001B50655E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	firefox.exe, 0000000D.00000003.1949701136.000001B57E7B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1800470918.000001B57FD5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.2954196743.0000022AB73CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2954495285.000001E5CC3E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.2958245293.000002DDD6903000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.13.dr	false		high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 0000000D.00000003.1926753912.000001B57F02C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1747628998.000001B57F013000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://api.accounts.firefox.com/v1	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://login.li	firefox.exe, 0000000D.00000003.1812796070.000001B506964000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1890143554.000001B50694C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://exslt.org/common	firefox.exe, 0000000D.00000003.1749006417.000001B57E726000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/	firefox.exe, 0000000D.00000003.1806435286.000001B50DFB9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1955517175.000001B50D991000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://fpn.firefox.com	firefox.exe, 0000000D.00000003.1800470918.000001B57FD5E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc	firefox.exe, 0000000D.00000003.1950959404.000001B50EC2E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
http://exslt.org/dates-and-times	firefox.exe, 0000000D.00000003.1966861203.000001B57E761000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1949856491.000001B57E75C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1748914353.000001B57E762000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	firefox.exe, 0000000D.00000003.1949701136.000001B57E7B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1800470918.000001B57FD5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.2954196743.0000022AB73CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2954495285.000001E5CC3E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.2958245293.000002DDD6903000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.13.dr	false		high
https://www.youtube.com/	firefox.exe, 0000000D.00000003.1806435286.000001B50DFB9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1800470918.000001B57FD5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1955517175.000001B50D991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2954495285.000001E5CC30A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.2952868840.000002DDD660C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1283601	firefox.exe, 0000000D.00000003.1868123466.000001B506231000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1866197823.000001B50617D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://MD8.mozilla.org/1/m	firefox.exe, 0000000D.00000003.1926476126.000001B57FD48000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bbc.co.uk/	firefox.exe, 0000000D.00000003.1953830726.000001B50DD60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1808967052.000001B50DD63000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/firefox/addon/to-google-translate/	firefox.exe, 0000000D.00000003.1927766704.000001B5115EC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000014.00000002.2952868840.000002DDD66C4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1266220	firefox.exe, 0000000D.00000003.1868123466.000001B506231000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1866197823.000001B50617D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 0000000D.00000003.1917336508.000001B506889000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1944204917.000001B506887000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 0000000D.00000003.1927766704.000001B511590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://amazon.com	firefox.exe, 0000000D.00000003.1923301495.000001B57FD95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1800470918.000001B57FD95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1798825260.000001B57FD95000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000000D.00000003.1807852510.000001B506595000.00000004.00000800.00020000.00000000.sdmp	false		high
https://youtube.com/account?=	recovery.jsonlz4.tmp.13.dr	false		high
https://shavar.services.mozilla.com/	firefox.exe, 0000000D.00000003.1971014383.000001B510918000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	firefox.exe, 0000000D.00000003.1747628998.000001B57F013000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 0000000D.00000003.1934611094.000001B50D9FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2954495285.000001E5CC312000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.2952868840.000002DDD6613000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 0000000D.00000003.1953830726.000001B50DD60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1808967052.000001B50DD63000.00000004.00000800.00020000.00000000.sdmp	false		high
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 0000000D.00000003.1936294192.000001B50D742000.00000004.00000800.00020000.00000000.sdmp	false		high
http://a9.com/-/spec/opensearch/1.0/	firefox.exe, 0000000D.00000003.1969816595.000001B507DDD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/user/dashboard	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1170143	firefox.exe, 0000000D.00000003.1868123466.000001B506231000.00000004.00000800.00020000.00000000.sdmp	false		high
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.tsn.ca	firefox.exe, 0000000D.00000003.1812796070.000001B506964000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1890143554.000001B50694C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/about	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
http://mozilla.org/MPL/2.0/.	firefox.exe, 0000000D.00000003.1801296687.000001B508D42000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1830351136.000001B5061C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1817540654.000001B506AB9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1867255987.000001B506AB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1934294138.000001B50DA2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1944204917.000001B506882000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1912562051.000001B505AFA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1917442328.000001B506876000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1865065184.000001B5062C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1796816627.000001B50DCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1817540654.000001B506AB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1881959658.000001B50DCB1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1801296687.000001B508D60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1963435108.000001B508356000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1830351136.000001B5061CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1813334452.000001B506824000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1912562051.000001B505ADB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1797089741.000001B50DCB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1969499749.000001B508331000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1944204917.000001B506887000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1917336508.000001B506890000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.bellmedia.c	firefox.exe, 0000000D.00000003.1801296687.000001B508D37000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.openh264.org/	firefox.exe, 0000000D.00000003.1748140918.000001B57E8C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com	firefox.exe, 0000000D.00000003.1801296687.000001B508D37000.00000004.00000800.00020000.00000000.sdmp	false		high
https://coverage.mozilla.org	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	gmpopenh264.dll.tmp.13.dr	false		high
https://www.zhihu.com/	firefox.exe, 0000000D.00000003.1955771049.000001B50D7D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1935551099.000001B50D7B9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	firefox.exe, 0000000D.00000003.1809640666.000001B508158000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	firefox.exe, 0000000D.00000003.1809640666.000001B508158000.00000004.00000800.00020000.00000000.sdmp	false		high
http://a9.com/-/spec/opensearch/1.1/	firefox.exe, 0000000D.00000003.1969816595.000001B507DDD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 0000000D.00000003.1883033454.000001B50DC35000.00000004.00000800.00020000.00000000.sdmp	false		high
https://blocked.cdn.mozilla.net/	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://json-schema.org/draft/2019-09/schema	firefox.exe, 0000000D.00000003.1808967052.000001B50DD78000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1953830726.000001B50DD79000.00000004.00000800.00020000.00000000.sdmp	false		high
http://developer.mozilla.org/en/docs/DOM:element.addEventListener	firefox.exe, 0000000D.00000003.1950959404.000001B50EC2E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1926753912.000001B57F02C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1747628998.000001B57F013000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/?t=ffab&q=	firefox.exe, 0000000D.00000003.1808967052.000001B50DD63000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://outlook.live.com/default.aspx?rru=compose&to=%s	firefox.exe, 0000000D.00000003.1755537770.000001B502C25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1755779546.000001B502C33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1754674295.000001B502C33000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=793869	firefox.exe, 0000000D.00000003.1868123466.000001B506231000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mozilla.cloudflare-dns.com/dns-query	firefox.exe, 0000000F.00000002.2953232057.0000022AB7010000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2952127858.000001E5CC200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2957202462.000002DDD6700000.00000002.10000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	firefox.exe, 0000000D.00000003.1968677486.000001B508D8F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1801296687.000001B508D8B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1678448	firefox.exe, 0000000D.00000003.1868123466.000001B506231000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1866197823.000001B50617D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000000D.00000003.1755537770.000001B502C25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1755779546.000001B502C33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1754674295.000001B502C33000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.107.243.93	push.services.mozilla.com	United States	15169	GOOGLEUS	false
151.101.65.91	services.addons.mozilla.org	United States	54113	FASTLYUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
142.250.185.174	youtube.com	United States	15169	GOOGLEUS	false
34.211.125.135	shavar.prod.mozaws.net	United States	16509	AMAZON-02US	false
35.201.103.21	normandy-cdn.services.mozilla.com	United States	15169	GOOGLEUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1596842
Start date and time:	2025-01-22 15:32:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	random.exe
Detection:	MAL
Classification:	mal80.troj.evad.winEXE@34/34@69/13
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 97% Number of executed functions: 50 Number of non-executed functions: 291
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.238, 2.22.61.59, 142.250.184.206, 142.250.186.142, 216.58.212.170, 142.250.186.138, 2.19.106.160, 20.109.210.53, 13.107.253.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ciscobinary.openh264.org, ocsp.digicert.com, redirector.gvt1.com, slscr.update.microsoft.com, otelrules.azureedge.net, incoming.telemetry.mozilla.org, ctldl.windowsupdate.com, safebrowsing.googleapis.com, aus5.mozilla.org, location.services.mozilla.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:33:36	API Interceptor	1x Sleep call for process: firefox.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
34.117.188.166	random.exe	Get hash	malicious	Amadey, Babadeda, Credential Flusher, GCleaner, LummaC Stealer, PureLog Stealer, Stealc	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Amadey, Babadeda, Credential Flusher, Cryptbot, GCleaner, LummaC Stealer, Stealc	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	MAIN.zip	Get hash	malicious	Unknown	Browse
	MDE_File_Sample_c404ec52446527b77da6860ca493ea2007ac03d5 (3).zip	Get hash	malicious	Unknown	Browse
	mscoree.dll	Get hash	malicious	Unknown	Browse
	qOH6oNqqoi.ps1	Get hash	malicious	PureCrypter, Amadey	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
34.211.125.135	MAIN.zip	Get hash	malicious	Unknown	Browse
34.149.100.209	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	MAIN.zip	Get hash	malicious	Unknown	Browse
	MDE_File_Sample_c404ec52446527b77da6860ca493ea2007ac03d5 (3).zip	Get hash	malicious	Unknown	Browse
	mscoree.dll	Get hash	malicious	Unknown	Browse
	qOH6oNqqoi.ps1	Get hash	malicious	PureCrypter, Amadey	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	GbpfWtymAP.exe	Get hash	malicious	Credential Flusher	Browse
	GbpfWtymAP.exe	Get hash	malicious	Credential Flusher	Browse
151.101.65.91	random.exe	Get hash	malicious	Credential Flusher	Browse
	GbpfWtymAP.exe	Get hash	malicious	Credential Flusher	Browse
	NetFxRepairTools.msi	Get hash	malicious	Quasar	Browse
	ghostspider.7z	Get hash	malicious	Unknown	Browse
	https://walli.shanga.co/image/view/?id=1375	Get hash	malicious	Unknown	Browse
	LbgqLv7gT7.exe	Get hash	malicious	Credential Flusher	Browse
	fNlxQP0jBz.exe	Get hash	malicious	Credential Flusher	Browse
	P0HV8mjHS1.exe	Get hash	malicious	Credential Flusher	Browse
	mdPov8VTwi.exe	Get hash	malicious	Credential Flusher	Browse
	6eftz6UKDm.exe	Get hash	malicious	Credential Flusher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
example.org	random.exe	Get hash	malicious	Amadey, Babadeda, Credential Flusher, GCleaner, LummaC Stealer, PureLog Stealer, Stealc	Browse	23.215.0.133
	random.exe	Get hash	malicious	Credential Flusher	Browse	96.7.128.186
	random.exe	Get hash	malicious	Amadey, Babadeda, Credential Flusher, Cryptbot, GCleaner, LummaC Stealer, Stealc	Browse	23.215.0.132
	random.exe	Get hash	malicious	Credential Flusher	Browse	23.215.0.132
	MAIN.zip	Get hash	malicious	Unknown	Browse	96.7.128.192
	MDE_File_Sample_c404ec52446527b77da6860ca493ea2007ac03d5 (3).zip	Get hash	malicious	Unknown	Browse	96.7.128.186
	mscoree.dll	Get hash	malicious	Unknown	Browse	96.7.128.192
	qOH6oNqqoi.ps1	Get hash	malicious	PureCrypter, Amadey	Browse	96.7.128.186
	BingWallpaper.exe	Get hash	malicious	Unknown	Browse	96.7.128.192
	random.exe	Get hash	malicious	Credential Flusher	Browse	96.7.128.192
twitter.com	random.exe	Get hash	malicious	Amadey, Babadeda, Credential Flusher, GCleaner, LummaC Stealer, PureLog Stealer, Stealc	Browse	104.244.42.193
	random.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.1
	random.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.129
	MAIN.zip	Get hash	malicious	Unknown	Browse	104.244.42.65
	MDE_File_Sample_c404ec52446527b77da6860ca493ea2007ac03d5 (3).zip	Get hash	malicious	Unknown	Browse	104.244.42.1
shavar.prod.mozaws.net	random.exe	Get hash	malicious	Amadey, Babadeda, Credential Flusher, GCleaner, LummaC Stealer, PureLog Stealer, Stealc	Browse	34.211.101.148
	random.exe	Get hash	malicious	Credential Flusher	Browse	34.211.101.148
	random.exe	Get hash	malicious	Amadey, Babadeda, Credential Flusher, Cryptbot, GCleaner, LummaC Stealer, Stealc	Browse	34.211.101.148
	random.exe	Get hash	malicious	Credential Flusher	Browse	34.211.101.148
	MAIN.zip	Get hash	malicious	Unknown	Browse	34.211.125.135
	MDE_File_Sample_c404ec52446527b77da6860ca493ea2007ac03d5 (3).zip	Get hash	malicious	Unknown	Browse	44.233.129.8
	mscoree.dll	Get hash	malicious	Unknown	Browse	44.233.129.8
	qOH6oNqqoi.ps1	Get hash	malicious	PureCrypter, Amadey	Browse	34.211.125.135
	BingWallpaper.exe	Get hash	malicious	Unknown	Browse	34.211.101.148
	random.exe	Get hash	malicious	Credential Flusher	Browse	34.211.125.135
star-mini.c10r.facebook.com	random.exe	Get hash	malicious	Amadey, Babadeda, Credential Flusher, GCleaner, LummaC Stealer, PureLog Stealer, Stealc	Browse	157.240.0.35
	https://flugger.pl	Get hash	malicious	Unknown	Browse	157.240.0.35
	http://webflow.io	Get hash	malicious	Unknown	Browse	157.240.251.35
	https://dnl.hb-fein.de/	Get hash	malicious	Unknown	Browse	157.240.0.35
	https://thomasaltmnn.com/	Get hash	malicious	Unknown	Browse	157.240.253.35
	https://rakshit099-g.github.io/PROJECT_WORKS/	Get hash	malicious	HTMLPhisher	Browse	157.240.0.35
	https://link.space/@Deskservice	Get hash	malicious	Unknown	Browse	157.240.253.35
	https://www.zeffy.com/en-US/ticketing/9792a5cc-964b-451c-a97d-176fd6d24206	Get hash	malicious	HTMLPhisher	Browse	157.240.251.35
	https://www.zeffy.com/en-US/ticketing/9792a5cc-964b-451c-a97d-176fd6d24206	Get hash	malicious	HTMLPhisher	Browse	157.240.251.35
	random.exe	Get hash	malicious	Credential Flusher	Browse	157.240.253.35

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	random.exe	Get hash	malicious	Amadey, Babadeda, Credential Flusher, GCleaner, LummaC Stealer, PureLog Stealer, Stealc	Browse	34.117.188.166
	http://www.sterne-shop.de	Get hash	malicious	Unknown	Browse	34.117.77.79
	http://www.sterne-shop.de	Get hash	malicious	Unknown	Browse	34.117.77.79
	VQdUvAQ4xO.exe	Get hash	malicious	DCRat, PureLog Stealer, ReverseShell, zgRAT	Browse	34.117.59.81
	http://telegrauml.work/	Get hash	malicious	Telegram Phisher	Browse	34.117.59.81
	http://telegrems.fit/	Get hash	malicious	Telegram Phisher	Browse	34.117.59.81
	random.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	random.exe	Get hash	malicious	Amadey, Babadeda, Credential Flusher, Cryptbot, GCleaner, LummaC Stealer, Stealc	Browse	34.117.188.166
	random.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	MAIN.zip	Get hash	malicious	Unknown	Browse	34.117.188.166
FASTLYUS	random.exe	Get hash	malicious	Amadey, Babadeda, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	185.199.111.133
	https://tech-doctors.net/netf/NTXUPDATED	Get hash	malicious	Unknown	Browse	151.101.194.137
	random.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	https://rbslocadora.com.br/modules/aggregator/red.html	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://flugger.pl	Get hash	malicious	Unknown	Browse	151.101.64.84
	http://webflow.io	Get hash	malicious	Unknown	Browse	151.101.2.132
	https://app.dam.penzle.com/asset/c9b1ca84-2e6e-4091-8dd7-8eea9a901c0b--105887785658629571096-0797a88c-6d4b-41ed-9b50-9a993107fca0--34868474-c76c-4769-aa1a-4fb9218cd274	Get hash	malicious	Unknown	Browse	151.101.2.137
	random.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	https://steursinnovatingforthefuture.freshdesk.com/support/solutions/articles/203000017909-steurs-innovating-for-the-future	Get hash	malicious	Unknown	Browse	151.101.66.137
	ATT-897850.htm	Get hash	malicious	HtmlDropper	Browse	151.101.194.137
AMAZON-02US	attached PO.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	https://flugger.pl	Get hash	malicious	Unknown	Browse	13.35.58.9
	http://webflow.io	Get hash	malicious	Unknown	Browse	108.138.26.97
	https://mailzim-0fb4f9.webflow.io/	Get hash	malicious	Unknown	Browse	18.244.20.221
	http://www.sterne-shop.de	Get hash	malicious	Unknown	Browse	34.247.128.143
	http://www.sterne-shop.de	Get hash	malicious	Unknown	Browse	34.252.167.64
	https://www.mathemise.com/	Get hash	malicious	Unknown	Browse	3.78.6.236
	https://steursinnovatingforthefuture.freshdesk.com/support/solutions/articles/203000017909-steurs-innovating-for-the-future	Get hash	malicious	Unknown	Browse	3.5.138.151
	http://whatsappweb.net	Get hash	malicious	Unknown	Browse	18.158.3.25
	https://norpor.shop/riiw2-1.mp4	Get hash	malicious	Unknown	Browse	54.154.60.209
ATGS-MMD-ASUS	setups.exe	Get hash	malicious	Unknown	Browse	34.133.74.21
	http://webflow.io	Get hash	malicious	Unknown	Browse	34.128.128.0
	setups.exe	Get hash	malicious	Unknown	Browse	34.133.74.21
	http://www.sterne-shop.de	Get hash	malicious	Unknown	Browse	34.149.254.14
	arm7	Get hash	malicious	Unknown	Browse	57.180.175.94
	armv7l.elf	Get hash	malicious	Unknown	Browse	34.184.36.220
	jhdfer3s_jh3de.exe	Get hash	malicious	Unknown	Browse	34.160.111.145
	jhdfer3s_jh3de.exe	Get hash	malicious	Unknown	Browse	34.160.111.145
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	34.151.214.54
	87.121.79.19-mips-2025-01-22T04_20_52.elf	Get hash	malicious	Mirai, Moobot	Browse	32.115.128.83

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fb0aa01abe9d8e4037eb3473ca6e2dca	random.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	random.exe	Get hash	malicious	Amadey, Babadeda, Credential Flusher, Cryptbot, GCleaner, LummaC Stealer, Stealc	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	MAIN.zip	Get hash	malicious	Unknown	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	mscoree.dll	Get hash	malicious	Unknown	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	qOH6oNqqoi.ps1	Get hash	malicious	PureCrypter, Amadey	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	GbpfWtymAP.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	GbpfWtymAP.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	MAIN.zip	Get hash	malicious	Unknown	Browse
	MDE_File_Sample_c404ec52446527b77da6860ca493ea2007ac03d5 (3).zip	Get hash	malicious	Unknown	Browse
	mscoree.dll	Get hash	malicious	Unknown	Browse
	qOH6oNqqoi.ps1	Get hash	malicious	PureCrypter, Amadey	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	GbpfWtymAP.exe	Get hash	malicious	Credential Flusher	Browse
	GbpfWtymAP.exe	Get hash	malicious	Credential Flusher	Browse

Created / dropped Files

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_469d2ee9-b6b5-412f-b851-c214e004b99c.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7813
Entropy (8bit):	5.181465995377727
Encrypted:	false
SSDEEP:	192:1jMXjfotbhbVbTbfbRbObtbyEl7nErRJA6WnSrDtTUd/SkDrt:1YktNhnzFSJkrMBnSrDhUd//
MD5:	7B77D49B70FC0A99882602DA0E10AF60
SHA1:	66197E80D7D23FD198204484D1999BEC8749E58E
SHA-256:	6B597DB40AF2CF86694D51AA00CDD91254B0DE82A89FA6EC17E0A64757602902
SHA-512:	4C7935E946545E24C5C85DE2CAC1F1CCA3021CF7BF413B8E663FA4EB8C261767449200D5F9C1C54267A7B153A7E90486F643B83D5AA138C742DF82D830523CAE
Malicious:	false
Preview:	{"type":"uninstall","id":"469d2ee9-b6b5-412f-b851-c214e004b99c","creationDate":"2025-01-22T16:19:19.515Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"65e71c9e-6ac3-4903-9066-b134350de32c","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_469d2ee9-b6b5-412f-b851-c214e004b99c.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7813
Entropy (8bit):	5.181465995377727
Encrypted:	false
SSDEEP:	192:1jMXjfotbhbVbTbfbRbObtbyEl7nErRJA6WnSrDtTUd/SkDrt:1YktNhnzFSJkrMBnSrDhUd//
MD5:	7B77D49B70FC0A99882602DA0E10AF60
SHA1:	66197E80D7D23FD198204484D1999BEC8749E58E
SHA-256:	6B597DB40AF2CF86694D51AA00CDD91254B0DE82A89FA6EC17E0A64757602902
SHA-512:	4C7935E946545E24C5C85DE2CAC1F1CCA3021CF7BF413B8E663FA4EB8C261767449200D5F9C1C54267A7B153A7E90486F643B83D5AA138C742DF82D830523CAE
Malicious:	false
Preview:	{"type":"uninstall","id":"469d2ee9-b6b5-412f-b851-c214e004b99c","creationDate":"2025-01-22T16:19:19.515Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"65e71c9e-6ac3-4903-9066-b134350de32c","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\tmpaddon

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	453023
Entropy (8bit):	7.997718157581587
Encrypted:	true
SSDEEP:	12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5:	85430BAED3398695717B0263807CF97C
SHA1:	FFFBEE923CEA216F50FCE5D54219A188A5100F41
SHA-256:	A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
SHA-512:	06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
Malicious:	false
Preview:	PK.........bN...R..........gmpopenh264.dll..\|.E.0.=..I.....1....4f1q.`.........q.....'+....hm{.z..o_.{w........$..($A!...\|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....\|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`............ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\...........-i.K.I..4.a..6.....Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N..}..).3.N%.!..q........^I.m..~...6.#.~+.....A...I]r...x...<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..\|c.1.cUkM.&.Qn]..a]t.h...!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:\|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.925350903616756
Encrypted:	false
SSDEEP:	48:YnSwkmrOfJNmPUFpOdwNIOdoWLEWLtkDLuuukx5FBvipA6kbbXjQthvLuhakNnTn:8S+OfJQPUFpOdwNIOdYVjvYcXaNLMq8P
MD5:	D8225C19FC64B309756BB05D4EFFE4EF
SHA1:	B2CF9785D7AFD69A3AD38E419172E18DCBA46E6D
SHA-256:	3A21A6B7582FAF0080B34B804DAAC194FA66BBE3EB0000034C4816F7811A9B45
SHA-512:	4ED84BA2ACEA4945C21455E179F3B3A3E7A8E07604AA917E0F9A95A09FF057B2A7B699C6E67784D53F77769815E0F3852890D3B53DD9684CA037E8A96AC7D74E
Malicious:	false
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"c5d95379-f4ee-4629-a507-6f15a0e93cd4","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-03T11:50:29.548Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.925350903616756
Encrypted:	false
SSDEEP:	48:YnSwkmrOfJNmPUFpOdwNIOdoWLEWLtkDLuuukx5FBvipA6kbbXjQthvLuhakNnTn:8S+OfJQPUFpOdwNIOdYVjvYcXaNLMq8P
MD5:	D8225C19FC64B309756BB05D4EFFE4EF
SHA1:	B2CF9785D7AFD69A3AD38E419172E18DCBA46E6D
SHA-256:	3A21A6B7582FAF0080B34B804DAAC194FA66BBE3EB0000034C4816F7811A9B45
SHA-512:	4ED84BA2ACEA4945C21455E179F3B3A3E7A8E07604AA917E0F9A95A09FF057B2A7B699C6E67784D53F77769815E0F3852890D3B53DD9684CA037E8A96AC7D74E
Malicious:	false
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"c5d95379-f4ee-4629-a507-6f15a0e93cd4","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-03T11:50:29.548Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 23432 bytes
Category:	dropped
Size (bytes):	5312
Entropy (8bit):	6.615424734763731
Encrypted:	false
SSDEEP:	96:V2YbKsKNU2xWrp327tGmD4wBON6h6cHaJVJuZMd0JGkkrw2D:VTx2x2t0FDJ4NpwZMd0EJws
MD5:	1B9C8056D3619CE5A8C59B0C09873F17
SHA1:	1015C630E1937AA63F6AB31743782ECB5D78CCD8
SHA-256:	A6AE5DE0733FED050AB570AD9374FF4593D554F695B5AE4E2495871D171D34A3
SHA-512:	B1DC9CC675D5476C270A2D5B214D3DF2B3856576ED7EFE92D9A606C2D9D34E781018902AE75CE9C1E25007BB7F8D8F7B52997E6F05B845EF44BAF22F614FE899
Malicious:	false
Preview:	mozLz40..[....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 23432 bytes
Category:	dropped
Size (bytes):	5312
Entropy (8bit):	6.615424734763731
Encrypted:	false
SSDEEP:	96:V2YbKsKNU2xWrp327tGmD4wBON6h6cHaJVJuZMd0JGkkrw2D:VTx2x2t0FDJ4NpwZMd0EJws
MD5:	1B9C8056D3619CE5A8C59B0C09873F17
SHA1:	1015C630E1937AA63F6AB31743782ECB5D78CCD8
SHA-256:	A6AE5DE0733FED050AB570AD9374FF4593D554F695B5AE4E2495871D171D34A3
SHA-512:	B1DC9CC675D5476C270A2D5B214D3DF2B3856576ED7EFE92D9A606C2D9D34E781018902AE75CE9C1E25007BB7F8D8F7B52997E6F05B845EF44BAF22F614FE899
Malicious:	false
Preview:	mozLz40..[....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 5, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 5
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.04905391753567332
Encrypted:	false
SSDEEP:	24:DLivwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:D6wae+QtMImelekKDa5
MD5:	DD9D28E87ED57D16E65B14501B4E54D1
SHA1:	793839B47326441BE2D1336BA9A61C9B948C578D
SHA-256:	BB4E6C58C50BD6399ED70468C02B584595C29F010B66F864CD4D6B427FA365BC
SHA-512:	A2626F6A3CBADE62E38DA5987729D99830D0C6AA134D4A9E615026A5F18ACBB11A2C3C80917DAD76DA90ED5BAA9B0454D4A3C2DD04436735E78C974BA1D035B1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\store.json.mozlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\store.json.mozlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185924656884556
Encrypted:	false
SSDEEP:	768:wI43DvfWXf4E6C4p4EC4Y4QfEWvM4B4QS4z4444XQ4U:wUfdvk
MD5:	5656BA69BD2966108A461AAE35F60226
SHA1:	9C2E5AE52D82CEA43C4A5FFF205A7700CF54D61C
SHA-256:	587596712960B26EAC18CB354CCD633FFDB218E374A9D59EFEA843914D7AB299
SHA-512:	38F715AD9156558B5D57CA2E75FB0FFE0C5C6728BD94484B8F15E090120DDD02DCE42DBC9CC7143AD6552460A5F3A40E577FAF1D76D5D40B25CDBE636F250054
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{60024e8e-cfd0-41e5-965d-7128c7dcf0e8}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185924656884556
Encrypted:	false
SSDEEP:	768:wI43DvfWXf4E6C4p4EC4Y4QfEWvM4B4QS4z4444XQ4U:wUfdvk
MD5:	5656BA69BD2966108A461AAE35F60226
SHA1:	9C2E5AE52D82CEA43C4A5FFF205A7700CF54D61C
SHA-256:	587596712960B26EAC18CB354CCD633FFDB218E374A9D59EFEA843914D7AB299
SHA-512:	38F715AD9156558B5D57CA2E75FB0FFE0C5C6728BD94484B8F15E090120DDD02DCE42DBC9CC7143AD6552460A5F3A40E577FAF1D76D5D40B25CDBE636F250054
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{60024e8e-cfd0-41e5-965d-7128c7dcf0e8}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: MAIN.zip, Detection: malicious, Browse Filename: MDE_File_Sample_c404ec52446527b77da6860ca493ea2007ac03d5 (3).zip, Detection: malicious, Browse Filename: mscoree.dll, Detection: malicious, Browse Filename: qOH6oNqqoi.ps1, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: GbpfWtymAP.exe, Detection: malicious, Browse Filename: GbpfWtymAP.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.0732898472219601
Encrypted:	false
SSDEEP:	12:DBl/A0OWla0mwPxRymgObsCVR45wcYR4fmnsCVR4zkiJ:DLhesh7Owd4+ji
MD5:	8472BEBF43CABF9013AD4499CDED1F1F
SHA1:	D57BAF0CA47378BA4A60E3EADEDE3C2EC2AEF009
SHA-256:	0FAEBD2E39FD5022D8776E7BD46F79719FE36E77D3A2E9ADDFF0260F5B2507DC
SHA-512:	FE874DA80887EFF492E7A598F4A874EE377DA5830381756113E4434215445B034F30E5B6190D8616E40A0DF33AEEEB0FD065C82956FDA2DBA32321A401E12F75
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......~s..F~s........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.03535756160686293
Encrypted:	false
SSDEEP:	3:GtlstFCshJl45/O1lstFCshJl45/dJ89//alEl:GtWtAsZ4ZaWtAsZ4ZT89XuM
MD5:	FF5E4E6EBE530BA606A5652A98937B7B
SHA1:	60126B13C25EF9D8ED37EE1B18CEF051080964B9
SHA-256:	14F5E6F941DCEE432D91CE5072EA9F69FF5E8D5C2075AF8B71CFB350A3F0978F
SHA-512:	0E57F243C6274948A4F5FF39C39A509A250F1261D6263966A9E0CA42DB1D5C02D2AD59F7F11E176AD466E3C4661E4E845555AF1080D94999E7F2622080B1D306
Malicious:	false
Preview:	..-......................tz.i... ..xQY.]~x-[.:..-......................tz.i... ..xQY.]~x-[.:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	32824
Entropy (8bit):	0.03983200694987981
Encrypted:	false
SSDEEP:	3:Ol1gOtGTHofFe2lhRYelll8rEXsxdwhml8XW3R2:K1u4eQh3lll8dMhm93w
MD5:	E4A82DED450B46DE069A18A9144E2C22
SHA1:	CBF21847C46D36C9B0AE946E5337F9F0F2412B66
SHA-256:	6991366FBA5FE54F0F4C8C8CDD10ECA6DE49BCC1393C959575D80922673D493A
SHA-512:	14BFC306A78DAB34CA67C79F0DF49814A67FABC0073643E19310DCD9C4782A44F16729DEEB048529EB47B44F2BA0CDAC0CD0AB64CB5BB3A10119A8191C8D5EFE
Malicious:	false
Preview:	7....-.......... ..xQY...3.Q.P........ ..xQY.zt....i................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	modified
Size (bytes):	13254
Entropy (8bit):	5.495282059730854
Encrypted:	false
SSDEEP:	192:tLiWj0tbPxnaRtLYbBp6l6hj4qyaaXJ36K4XGPx9MN8F5RfGNBw8sItSl:teGqzyQscw+0
MD5:	E660C2F733E82FB5466693C35982F4CC
SHA1:	020D2BAA892C238F7E949570EF248846A30B06E4
SHA-256:	FDD28E5D1B2D58458C8B71670C582CC1F91C62219780B492B1C9DCA5805602EE
SHA-512:	BC0804AB15835128756FCCDA41E181E2D12C4DE3E3C14B4648F3C62F229348869C8EC935DAA252B43347A112DA9F89183523CA71985219E74F8342DD1E1D9FE2
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1737562728);..user_pref("app.update.lastUpdateTime.background-update-timer", 1737562728);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1737562728);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 173756

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	13254
Entropy (8bit):	5.495282059730854
Encrypted:	false
SSDEEP:	192:tLiWj0tbPxnaRtLYbBp6l6hj4qyaaXJ36K4XGPx9MN8F5RfGNBw8sItSl:teGqzyQscw+0
MD5:	E660C2F733E82FB5466693C35982F4CC
SHA1:	020D2BAA892C238F7E949570EF248846A30B06E4
SHA-256:	FDD28E5D1B2D58458C8B71670C582CC1F91C62219780B492B1C9DCA5805602EE
SHA-512:	BC0804AB15835128756FCCDA41E181E2D12C4DE3E3C14B4648F3C62F229348869C8EC935DAA252B43347A112DA9F89183523CA71985219E74F8342DD1E1D9FE2
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1737562728);..user_pref("app.update.lastUpdateTime.background-update-timer", 1737562728);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1737562728);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 173756

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 5, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.04062825861060003
Encrypted:	false
SSDEEP:	6:ltBl/l4/WN1h4BEJYqWvLue3FMOrMZ0l:DBl/WuntfJiFxMZO
MD5:	18F65713B07CB441E6A98655B726D098
SHA1:	2CEFA32BC26B25BE81C411B60C9925CB0F1F8F88
SHA-256:	B6C268E48546B113551A5AF9CA86BB6A462A512DE6C9289315E125CEB0FD8621
SHA-512:	A6871076C7D7ED53B630F9F144ED04303AD54A2E60B94ECA2AA96964D1AB375EEFDCA86CE0D3EB0E9DBB81470C6BD159877125A080C95EB17E54A52427F805FB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.baklz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1572
Entropy (8bit):	6.3335087151177145
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSL0LXnIgDR/pnxQwRlszT5sKt0b3eHVQj6T+amhujJlOsIomNVr0at:GUpOxFrrnR6E3eHT+4JlIqzt4
MD5:	338B6936C290D5D2920F972406F81092
SHA1:	DE6DF693495BA447DF6C52EA00C37C0BC5C46B02
SHA-256:	BAC8293448D178BD6DB88E4ACE4BBBB9156B9021E7C33910DF48B0144F3830D3
SHA-512:	6DD34622CE2437112E839554D774BD862A7C5052F18253A54356ECC927979DC329DB66FBA94728733B6F7D86785325FF3558D02EA5821B038179CAD4968D58C7
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{5f4e3d45-4b80-4724-9673-387f7e5a403c}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1737562749966,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...1a5ccf63-1000-409f-b5c1-afec7f75d4d9","zD..1...Wm..l........j..:....1":{..jUpdate...7,"startTim..`698025...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...A8bad2467092e6ddeb0dfa9e5ea54d86d26790ca7ba2ce88d10cb4604fe726755","path":"/","na..a"taarI\|.Recure...,`.Donly..fexpiry...09630,"originA..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1572
Entropy (8bit):	6.3335087151177145
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSL0LXnIgDR/pnxQwRlszT5sKt0b3eHVQj6T+amhujJlOsIomNVr0at:GUpOxFrrnR6E3eHT+4JlIqzt4
MD5:	338B6936C290D5D2920F972406F81092
SHA1:	DE6DF693495BA447DF6C52EA00C37C0BC5C46B02
SHA-256:	BAC8293448D178BD6DB88E4ACE4BBBB9156B9021E7C33910DF48B0144F3830D3
SHA-512:	6DD34622CE2437112E839554D774BD862A7C5052F18253A54356ECC927979DC329DB66FBA94728733B6F7D86785325FF3558D02EA5821B038179CAD4968D58C7
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{5f4e3d45-4b80-4724-9673-387f7e5a403c}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1737562749966,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...1a5ccf63-1000-409f-b5c1-afec7f75d4d9","zD..1...Wm..l........j..:....1":{..jUpdate...7,"startTim..`698025...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...A8bad2467092e6ddeb0dfa9e5ea54d86d26790ca7ba2ce88d10cb4604fe726755","path":"/","na..a"taarI\|.Recure...,`.Donly..fexpiry...09630,"originA..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1572
Entropy (8bit):	6.3335087151177145
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSL0LXnIgDR/pnxQwRlszT5sKt0b3eHVQj6T+amhujJlOsIomNVr0at:GUpOxFrrnR6E3eHT+4JlIqzt4
MD5:	338B6936C290D5D2920F972406F81092
SHA1:	DE6DF693495BA447DF6C52EA00C37C0BC5C46B02
SHA-256:	BAC8293448D178BD6DB88E4ACE4BBBB9156B9021E7C33910DF48B0144F3830D3
SHA-512:	6DD34622CE2437112E839554D774BD862A7C5052F18253A54356ECC927979DC329DB66FBA94728733B6F7D86785325FF3558D02EA5821B038179CAD4968D58C7
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{5f4e3d45-4b80-4724-9673-387f7e5a403c}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1737562749966,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...1a5ccf63-1000-409f-b5c1-afec7f75d4d9","zD..1...Wm..l........j..:....1":{..jUpdate...7,"startTim..`698025...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...A8bad2467092e6ddeb0dfa9e5ea54d86d26790ca7ba2ce88d10cb4604fe726755","path":"/","na..a"taarI\|.Recure...,`.Donly..fexpiry...09630,"originA..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.0836444556178684
Encrypted:	false
SSDEEP:	24:JBwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jnEUo9LXtR+JdkOnohYsl
MD5:	8B40B1534FF0F4B533AF767EB5639A05
SHA1:	63EDB539EA39AD09D701A36B535C4C087AE08CC9
SHA-256:	AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B
SHA-512:	54AF707698CED33C206B1B193DA414D630901762E88E37E99885A50D4D5F8DDC28367C9B401DFE251CF0552B4FA446EE28F78A97C9096AFB0F2898BFBB673B53
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	5.033328823706835
Encrypted:	false
SSDEEP:	48:YrSAYl6UQZpExB1+anOsW4Vh351VxWRzzc8eYMsku7f86SLAVL7if5FtsfAcbyJW:yclyTEr5QFRzzcMvbw6KkCrrc2Rn27
MD5:	AC8800383650773AAA4F3749D47E49A8
SHA1:	84843031941253E931B9F51B27B0605406B2A4F5
SHA-256:	C693E4FAC44295C23DD6D95C7C1826B584CAE50B4220BB81E1C08DF5FABCB799
SHA-512:	DC4BEC1B7247E2AF8498D4B4545C82DA754D508B93F4CBA3A3CA3BFD1E8778C1F98A1692D6C1B67B114FCF2EA8E59F2EAB88FF1B815708DDFF218A5518854D40
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2025-01-22T16:18:37.192Z","profileAgeCreated":1696333826043,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	5.033328823706835
Encrypted:	false
SSDEEP:	48:YrSAYl6UQZpExB1+anOsW4Vh351VxWRzzc8eYMsku7f86SLAVL7if5FtsfAcbyJW:yclyTEr5QFRzzcMvbw6KkCrrc2Rn27
MD5:	AC8800383650773AAA4F3749D47E49A8
SHA1:	84843031941253E931B9F51B27B0605406B2A4F5
SHA-256:	C693E4FAC44295C23DD6D95C7C1826B584CAE50B4220BB81E1C08DF5FABCB799
SHA-512:	DC4BEC1B7247E2AF8498D4B4545C82DA754D508B93F4CBA3A3CA3BFD1E8778C1F98A1692D6C1B67B114FCF2EA8E59F2EAB88FF1B815708DDFF218A5518854D40
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2025-01-22T16:18:37.192Z","profileAgeCreated":1696333826043,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.7024548645728474
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	random.exe
File size:	970'240 bytes
MD5:	b986d1882535e8f044c3d091d324d2f9
SHA1:	af7fd2693f6f91c6655bde5621ad293daa53bcae
SHA256:	1d5f4f9082b27779f594b673840b56b01c5c925de8dac6b4a648543ddb9dd0b3
SHA512:	31c10f9548db63209d445e900723692d936a7e7712203e7729bb9ac4c0525875e9fcf51f4c52d23021c8bdc7ae2835c6ccbe948763597b57f2cf6ac83593a104
SSDEEP:	24576:kqDEvCTbMWu7rQYlBQcBiT6rprG8a5n3F:kTvC/MTQYxsWR7a5n
TLSH:	6E259E0273D1C062FF9B92334B5AF6515BBC69260123E62F13A81D79BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6790F2FC [Wed Jan 22 13:30:36 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F9148812863h
jmp 00007F914881216Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F914881234Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F914881231Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F9148814F0Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F9148814F58h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F9148814F41h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x1625c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xeb000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x1625c	0x16400	2036d4db3aeaf69a54cab90462dfd2ca	False	0.6997454353932584	data	7.171792015546023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xeb000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd4718	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd4840	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4968	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c50	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d78	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5c20	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd64c8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd6a30	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8fd8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda080	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4e8	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xda538	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xda634	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdabc8	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb254	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb6e4	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbce0	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc33c	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc7a4	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc8fc	0xd3e0	data			1.0004793510324483
RT_GROUP_ICON	0xe9cdc	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xe9d54	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xe9d68	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xe9d7c	0x14	data	English	Great Britain	1.25
RT_VERSION	0xe9d90	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xe9e6c	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 22, 2025 15:33:27.666213036 CET	49737	443	192.168.2.4	35.190.72.216
Jan 22, 2025 15:33:27.666256905 CET	443	49737	35.190.72.216	192.168.2.4
Jan 22, 2025 15:33:27.676590919 CET	49737	443	192.168.2.4	35.190.72.216
Jan 22, 2025 15:33:27.684704065 CET	49737	443	192.168.2.4	35.190.72.216
Jan 22, 2025 15:33:27.684715986 CET	443	49737	35.190.72.216	192.168.2.4
Jan 22, 2025 15:33:28.157377005 CET	443	49737	35.190.72.216	192.168.2.4
Jan 22, 2025 15:33:28.157397032 CET	443	49737	35.190.72.216	192.168.2.4
Jan 22, 2025 15:33:28.157471895 CET	49737	443	192.168.2.4	35.190.72.216
Jan 22, 2025 15:33:28.168312073 CET	49737	443	192.168.2.4	35.190.72.216
Jan 22, 2025 15:33:28.168329000 CET	443	49737	35.190.72.216	192.168.2.4
Jan 22, 2025 15:33:28.168448925 CET	49737	443	192.168.2.4	35.190.72.216
Jan 22, 2025 15:33:28.168634892 CET	443	49737	35.190.72.216	192.168.2.4
Jan 22, 2025 15:33:28.178656101 CET	49737	443	192.168.2.4	35.190.72.216
Jan 22, 2025 15:33:29.426501989 CET	49739	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:29.426547050 CET	443	49739	142.250.185.174	192.168.2.4
Jan 22, 2025 15:33:29.428035975 CET	49739	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:29.429559946 CET	49739	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:29.429584026 CET	443	49739	142.250.185.174	192.168.2.4
Jan 22, 2025 15:33:29.894979954 CET	49740	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:29.895031929 CET	443	49740	142.250.185.174	192.168.2.4
Jan 22, 2025 15:33:29.912573099 CET	49740	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:29.914675951 CET	49740	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:29.914697886 CET	443	49740	142.250.185.174	192.168.2.4
Jan 22, 2025 15:33:29.928011894 CET	49741	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:29.932859898 CET	80	49741	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:29.952800989 CET	49741	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:29.956537962 CET	49741	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:29.961421967 CET	80	49741	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:30.097069025 CET	443	49739	142.250.185.174	192.168.2.4
Jan 22, 2025 15:33:30.097786903 CET	443	49739	142.250.185.174	192.168.2.4
Jan 22, 2025 15:33:30.107336998 CET	443	49739	142.250.185.174	192.168.2.4
Jan 22, 2025 15:33:30.115922928 CET	49739	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:30.123585939 CET	49739	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:30.123591900 CET	443	49739	142.250.185.174	192.168.2.4
Jan 22, 2025 15:33:30.123692989 CET	49739	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:30.123893976 CET	443	49739	142.250.185.174	192.168.2.4
Jan 22, 2025 15:33:30.124018908 CET	49739	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:30.360460997 CET	49743	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:30.360553026 CET	443	49743	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:30.364979982 CET	49743	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:30.366485119 CET	49743	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:30.366519928 CET	443	49743	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:30.382165909 CET	49744	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:30.382196903 CET	443	49744	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:30.382436991 CET	49744	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:30.383915901 CET	49744	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:30.383933067 CET	443	49744	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:30.417473078 CET	80	49741	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:30.422069073 CET	49745	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:30.422116041 CET	443	49745	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:30.423173904 CET	49745	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:30.423388958 CET	49745	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:30.423405886 CET	443	49745	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:30.458348036 CET	49741	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:30.546598911 CET	443	49740	142.250.185.174	192.168.2.4
Jan 22, 2025 15:33:30.546616077 CET	443	49740	142.250.185.174	192.168.2.4
Jan 22, 2025 15:33:30.547492027 CET	49740	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:30.547655106 CET	443	49740	142.250.185.174	192.168.2.4
Jan 22, 2025 15:33:30.547792912 CET	49740	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:30.852773905 CET	443	49743	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:30.852894068 CET	49743	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:30.869719028 CET	443	49744	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:30.869811058 CET	49744	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:30.884170055 CET	49740	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:30.884190083 CET	443	49740	142.250.185.174	192.168.2.4
Jan 22, 2025 15:33:30.884413958 CET	49740	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:30.884426117 CET	443	49740	142.250.185.174	192.168.2.4
Jan 22, 2025 15:33:30.884923935 CET	49746	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:30.884964943 CET	443	49746	142.250.185.174	192.168.2.4
Jan 22, 2025 15:33:30.885833979 CET	49740	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:30.885881901 CET	49746	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:30.887515068 CET	49746	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:30.887530088 CET	443	49746	142.250.185.174	192.168.2.4
Jan 22, 2025 15:33:30.888688087 CET	49743	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:30.888688087 CET	49743	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:30.888813972 CET	443	49743	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:30.888972998 CET	49747	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:30.889004946 CET	443	49747	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:30.889177084 CET	443	49743	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:30.890063047 CET	49743	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:30.890171051 CET	49747	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:30.892329931 CET	49747	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:30.892358065 CET	443	49747	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:30.893824100 CET	49744	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:30.893835068 CET	443	49744	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:30.893891096 CET	49744	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:30.894020081 CET	443	49744	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:30.894143105 CET	49744	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:30.912112951 CET	443	49745	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:30.918670893 CET	49745	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:30.921904087 CET	49745	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:30.921916962 CET	443	49745	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:30.922285080 CET	443	49745	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:30.927953005 CET	49745	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:30.928049088 CET	49745	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:30.928124905 CET	443	49745	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:30.928678036 CET	49745	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:30.933132887 CET	49748	443	192.168.2.4	34.160.144.191
Jan 22, 2025 15:33:30.933159113 CET	443	49748	34.160.144.191	192.168.2.4
Jan 22, 2025 15:33:30.933347940 CET	49748	443	192.168.2.4	34.160.144.191
Jan 22, 2025 15:33:30.933504105 CET	49748	443	192.168.2.4	34.160.144.191
Jan 22, 2025 15:33:30.933523893 CET	443	49748	34.160.144.191	192.168.2.4
Jan 22, 2025 15:33:30.969506025 CET	49749	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:30.974339008 CET	80	49749	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:30.975178957 CET	49749	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:30.975363970 CET	49749	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:30.977670908 CET	49741	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:30.980077982 CET	80	49749	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:30.982719898 CET	80	49741	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:30.982765913 CET	49741	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:31.044634104 CET	49750	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:31.044730902 CET	443	49750	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:31.046758890 CET	49750	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:31.048248053 CET	49750	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:31.048280954 CET	443	49750	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:31.052135944 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:31.056895971 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:31.057158947 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:31.057327986 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:31.062073946 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:31.386909008 CET	443	49747	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:31.387001038 CET	49747	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:31.398602962 CET	443	49748	34.160.144.191	192.168.2.4
Jan 22, 2025 15:33:31.398673058 CET	49748	443	192.168.2.4	34.160.144.191
Jan 22, 2025 15:33:31.431983948 CET	80	49749	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:31.482278109 CET	49748	443	192.168.2.4	34.160.144.191
Jan 22, 2025 15:33:31.482302904 CET	443	49748	34.160.144.191	192.168.2.4
Jan 22, 2025 15:33:31.482661963 CET	443	49748	34.160.144.191	192.168.2.4
Jan 22, 2025 15:33:31.482834101 CET	49749	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:31.485757113 CET	49747	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:31.485795021 CET	443	49747	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:31.485861063 CET	49747	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:31.486399889 CET	443	49747	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:31.486464024 CET	49747	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:31.488133907 CET	80	49749	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:31.488184929 CET	49749	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:31.521066904 CET	443	49746	142.250.185.174	192.168.2.4
Jan 22, 2025 15:33:31.521156073 CET	49746	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:31.522878885 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:31.523593903 CET	443	49746	142.250.185.174	192.168.2.4
Jan 22, 2025 15:33:31.523665905 CET	49746	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:31.528414011 CET	49748	443	192.168.2.4	34.160.144.191
Jan 22, 2025 15:33:31.537630081 CET	443	49750	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:31.537714958 CET	49750	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:31.579461098 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:31.695108891 CET	49748	443	192.168.2.4	34.160.144.191
Jan 22, 2025 15:33:31.695406914 CET	443	49748	34.160.144.191	192.168.2.4
Jan 22, 2025 15:33:31.697928905 CET	49748	443	192.168.2.4	34.160.144.191
Jan 22, 2025 15:33:31.700968981 CET	49748	443	192.168.2.4	34.160.144.191
Jan 22, 2025 15:33:31.700989008 CET	443	49748	34.160.144.191	192.168.2.4
Jan 22, 2025 15:33:31.702543974 CET	49753	443	192.168.2.4	34.160.144.191
Jan 22, 2025 15:33:31.702610016 CET	443	49753	34.160.144.191	192.168.2.4
Jan 22, 2025 15:33:31.702922106 CET	49753	443	192.168.2.4	34.160.144.191
Jan 22, 2025 15:33:31.703449011 CET	49753	443	192.168.2.4	34.160.144.191
Jan 22, 2025 15:33:31.703483105 CET	443	49753	34.160.144.191	192.168.2.4
Jan 22, 2025 15:33:31.705034971 CET	49750	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:31.705034971 CET	49750	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:31.705127001 CET	443	49750	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:31.705384016 CET	49754	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:31.705421925 CET	443	49750	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:31.705425024 CET	443	49754	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:31.705728054 CET	49746	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:31.705748081 CET	443	49746	142.250.185.174	192.168.2.4
Jan 22, 2025 15:33:31.705810070 CET	49746	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:31.706403971 CET	443	49746	142.250.185.174	192.168.2.4
Jan 22, 2025 15:33:31.706417084 CET	49750	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:31.706419945 CET	49754	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:31.707853079 CET	49754	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:31.707864046 CET	443	49754	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:31.710438013 CET	49746	443	192.168.2.4	142.250.185.174
Jan 22, 2025 15:33:31.727891922 CET	49755	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:31.732822895 CET	80	49755	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:31.735042095 CET	49755	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:31.735138893 CET	49755	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:31.739940882 CET	80	49755	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:31.780095100 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:31.785075903 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:31.879566908 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:31.929615974 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:32.145350933 CET	49755	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:32.150397062 CET	80	49755	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:32.161636114 CET	49755	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:32.181870937 CET	443	49753	34.160.144.191	192.168.2.4
Jan 22, 2025 15:33:32.181967020 CET	49753	443	192.168.2.4	34.160.144.191
Jan 22, 2025 15:33:32.184003115 CET	443	49754	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:32.185319901 CET	49753	443	192.168.2.4	34.160.144.191
Jan 22, 2025 15:33:32.185343981 CET	443	49753	34.160.144.191	192.168.2.4
Jan 22, 2025 15:33:32.185631990 CET	443	49753	34.160.144.191	192.168.2.4
Jan 22, 2025 15:33:32.190565109 CET	49754	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:32.195363998 CET	49753	443	192.168.2.4	34.160.144.191
Jan 22, 2025 15:33:32.195446014 CET	49753	443	192.168.2.4	34.160.144.191
Jan 22, 2025 15:33:32.195549965 CET	443	49753	34.160.144.191	192.168.2.4
Jan 22, 2025 15:33:32.195677042 CET	49753	443	192.168.2.4	34.160.144.191
Jan 22, 2025 15:33:32.196578026 CET	49754	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:32.196587086 CET	443	49754	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:32.196661949 CET	49754	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:32.196852922 CET	443	49754	34.117.188.166	192.168.2.4
Jan 22, 2025 15:33:32.197424889 CET	49754	443	192.168.2.4	34.117.188.166
Jan 22, 2025 15:33:32.428936005 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:32.429264069 CET	49756	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:32.433727026 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:32.434088945 CET	80	49756	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:32.435033083 CET	49756	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:32.435230970 CET	49756	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:32.439982891 CET	80	49756	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:32.526923895 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:32.578324080 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:32.799559116 CET	49756	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:32.804820061 CET	80	49756	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:32.804899931 CET	49756	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:32.868293047 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:32.873363018 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:32.873461008 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:32.873625994 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:32.878489971 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:33.320699930 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:33.365268946 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:36.980935097 CET	49761	443	192.168.2.4	34.211.125.135
Jan 22, 2025 15:33:36.980974913 CET	443	49761	34.211.125.135	192.168.2.4
Jan 22, 2025 15:33:36.981350899 CET	49761	443	192.168.2.4	34.211.125.135
Jan 22, 2025 15:33:36.982861996 CET	49761	443	192.168.2.4	34.211.125.135
Jan 22, 2025 15:33:36.982876062 CET	443	49761	34.211.125.135	192.168.2.4
Jan 22, 2025 15:33:37.757488012 CET	443	49761	34.211.125.135	192.168.2.4
Jan 22, 2025 15:33:37.757565022 CET	49761	443	192.168.2.4	34.211.125.135
Jan 22, 2025 15:33:37.761970997 CET	49761	443	192.168.2.4	34.211.125.135
Jan 22, 2025 15:33:37.761984110 CET	443	49761	34.211.125.135	192.168.2.4
Jan 22, 2025 15:33:37.762079954 CET	49761	443	192.168.2.4	34.211.125.135
Jan 22, 2025 15:33:37.762221098 CET	443	49761	34.211.125.135	192.168.2.4
Jan 22, 2025 15:33:37.762306929 CET	49761	443	192.168.2.4	34.211.125.135
Jan 22, 2025 15:33:41.244947910 CET	49765	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:41.244991064 CET	443	49765	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:41.246649981 CET	49766	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:41.246686935 CET	443	49766	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:41.251420975 CET	49765	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:41.251569033 CET	49765	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:41.251580000 CET	443	49765	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:41.252017975 CET	49766	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:41.253997087 CET	49766	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:41.254030943 CET	443	49766	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:41.411638021 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:41.414028883 CET	49767	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:33:41.414072990 CET	443	49767	34.107.243.93	192.168.2.4
Jan 22, 2025 15:33:41.414928913 CET	49767	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:33:41.416620016 CET	49767	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:33:41.416640043 CET	443	49767	34.107.243.93	192.168.2.4
Jan 22, 2025 15:33:41.416735888 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:41.509537935 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:41.521625996 CET	49768	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:41.521666050 CET	443	49768	34.149.100.209	192.168.2.4
Jan 22, 2025 15:33:41.521903992 CET	49768	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:41.523485899 CET	49768	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:41.523504019 CET	443	49768	34.149.100.209	192.168.2.4
Jan 22, 2025 15:33:41.528084993 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:41.533063889 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:41.553539991 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:41.629945993 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:41.686078072 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:41.722484112 CET	443	49765	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:41.722577095 CET	49765	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:41.725730896 CET	49765	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:41.725760937 CET	443	49765	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:41.726051092 CET	443	49765	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:41.729346991 CET	49765	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:41.729437113 CET	49765	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:41.729535103 CET	443	49765	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:41.729598999 CET	49765	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:41.732431889 CET	443	49766	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:41.732527971 CET	49766	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:41.737739086 CET	49766	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:41.737754107 CET	443	49766	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:41.737823963 CET	49766	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:41.737986088 CET	443	49766	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:41.739164114 CET	49766	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:41.876540899 CET	443	49767	34.107.243.93	192.168.2.4
Jan 22, 2025 15:33:41.876622915 CET	49767	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:33:41.882041931 CET	49767	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:33:41.882062912 CET	443	49767	34.107.243.93	192.168.2.4
Jan 22, 2025 15:33:41.882139921 CET	49767	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:33:41.882256985 CET	443	49767	34.107.243.93	192.168.2.4
Jan 22, 2025 15:33:41.882318020 CET	49767	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:33:41.991842031 CET	443	49768	34.149.100.209	192.168.2.4
Jan 22, 2025 15:33:41.997033119 CET	49768	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:42.001132965 CET	49768	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:42.001153946 CET	443	49768	34.149.100.209	192.168.2.4
Jan 22, 2025 15:33:42.001250029 CET	49768	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:42.001389980 CET	443	49768	34.149.100.209	192.168.2.4
Jan 22, 2025 15:33:42.001698017 CET	49769	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:42.001806974 CET	443	49769	34.149.100.209	192.168.2.4
Jan 22, 2025 15:33:42.002053022 CET	49768	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:42.002103090 CET	49769	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:42.003492117 CET	49769	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:42.003539085 CET	443	49769	34.149.100.209	192.168.2.4
Jan 22, 2025 15:33:42.385576010 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:42.390379906 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:42.407907963 CET	49770	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:42.407953024 CET	443	49770	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:42.416708946 CET	49770	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:42.418229103 CET	49770	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:42.418252945 CET	443	49770	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:42.468713999 CET	443	49769	34.149.100.209	192.168.2.4
Jan 22, 2025 15:33:42.468825102 CET	49769	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:42.473568916 CET	49769	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:42.473602057 CET	443	49769	34.149.100.209	192.168.2.4
Jan 22, 2025 15:33:42.473651886 CET	49769	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:42.473853111 CET	443	49769	34.149.100.209	192.168.2.4
Jan 22, 2025 15:33:42.473962069 CET	49769	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:42.484411001 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:42.544580936 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:42.574852943 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:42.575234890 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:42.579720020 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:42.580163956 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:42.601744890 CET	49771	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:42.601795912 CET	443	49771	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:42.602169991 CET	49771	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:42.602328062 CET	49771	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:42.602346897 CET	443	49771	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:42.669785023 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:42.673341036 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:42.723028898 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:42.723042011 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:42.751157999 CET	49772	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:42.751256943 CET	443	49772	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:42.752499104 CET	49772	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:42.752784014 CET	49772	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:42.752821922 CET	443	49772	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:42.909897089 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:42.914812088 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:42.915775061 CET	443	49770	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:42.915798903 CET	443	49770	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:42.918301105 CET	49770	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:42.922501087 CET	49770	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:42.922518969 CET	443	49770	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:42.922581911 CET	49770	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:42.922986031 CET	443	49770	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:42.923639059 CET	49770	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:43.005013943 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:43.046370029 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:43.071609020 CET	443	49771	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:43.071711063 CET	49771	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:43.222872019 CET	443	49772	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:43.222955942 CET	49772	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:44.463418961 CET	49772	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:44.463481903 CET	443	49772	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:44.464446068 CET	443	49772	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:44.465775967 CET	49771	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:44.465861082 CET	443	49771	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:44.466231108 CET	443	49771	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:44.470045090 CET	49772	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:44.470530987 CET	443	49772	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:44.470752954 CET	49772	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:44.512814045 CET	49771	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:44.692231894 CET	49772	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:44.692260981 CET	443	49772	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:44.692483902 CET	49771	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:44.692545891 CET	49771	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:44.692995071 CET	49773	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:44.693058014 CET	443	49773	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:44.693249941 CET	49773	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:44.693407059 CET	49773	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:44.693418026 CET	443	49773	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:44.829854965 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:44.834830046 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:44.876363993 CET	49774	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:44.876398087 CET	443	49774	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:44.876713991 CET	49774	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:44.878134012 CET	49774	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:44.878153086 CET	443	49774	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:44.928658009 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:44.946090937 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:44.951042891 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:44.983025074 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:45.041076899 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:45.083328009 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:45.165405989 CET	443	49773	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:45.165505886 CET	49773	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:45.168814898 CET	49773	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:45.168826103 CET	443	49773	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:45.169100046 CET	443	49773	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:45.171446085 CET	49773	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:45.171556950 CET	49773	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:45.171627998 CET	443	49773	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:45.172122002 CET	49773	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:45.174067974 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:45.179085970 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:45.274014950 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:45.281343937 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:45.286247015 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:45.315190077 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:45.359672070 CET	443	49774	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:45.360491037 CET	49774	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:45.377054930 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:45.431108952 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:46.691402912 CET	49774	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:46.691402912 CET	49774	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:46.691514969 CET	443	49774	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:46.691782951 CET	443	49774	34.120.208.123	192.168.2.4
Jan 22, 2025 15:33:46.704013109 CET	49774	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:33:47.665008068 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:47.670950890 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:47.763984919 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:47.807260990 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:47.952351093 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:47.957317114 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:47.958034992 CET	49775	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:33:47.958077908 CET	443	49775	34.107.243.93	192.168.2.4
Jan 22, 2025 15:33:47.958178997 CET	49775	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:33:47.959579945 CET	49775	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:33:47.959597111 CET	443	49775	34.107.243.93	192.168.2.4
Jan 22, 2025 15:33:48.047169924 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:48.092583895 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:48.420605898 CET	443	49775	34.107.243.93	192.168.2.4
Jan 22, 2025 15:33:48.423549891 CET	49775	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:33:48.428401947 CET	49775	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:33:48.428415060 CET	443	49775	34.107.243.93	192.168.2.4
Jan 22, 2025 15:33:48.428518057 CET	49775	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:33:48.428595066 CET	443	49775	34.107.243.93	192.168.2.4
Jan 22, 2025 15:33:48.429421902 CET	49775	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:33:48.431780100 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:48.436583042 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:48.747864962 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:48.768469095 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:48.773363113 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:48.783714056 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:48.783797979 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:48.888025045 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:48.941857100 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:56.008270025 CET	49776	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:56.008333921 CET	443	49776	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:56.013271093 CET	49776	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:56.013734102 CET	49776	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:56.013746023 CET	443	49776	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:56.034193993 CET	49777	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:56.034256935 CET	443	49777	34.149.100.209	192.168.2.4
Jan 22, 2025 15:33:56.035381079 CET	49777	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:56.035667896 CET	49777	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:56.035698891 CET	443	49777	34.149.100.209	192.168.2.4
Jan 22, 2025 15:33:56.041230917 CET	49778	443	192.168.2.4	151.101.65.91
Jan 22, 2025 15:33:56.041285992 CET	443	49778	151.101.65.91	192.168.2.4
Jan 22, 2025 15:33:56.042428970 CET	49779	443	192.168.2.4	35.190.72.216
Jan 22, 2025 15:33:56.042467117 CET	443	49779	35.190.72.216	192.168.2.4
Jan 22, 2025 15:33:56.050941944 CET	49778	443	192.168.2.4	151.101.65.91
Jan 22, 2025 15:33:56.051491976 CET	49779	443	192.168.2.4	35.190.72.216
Jan 22, 2025 15:33:56.066843987 CET	49778	443	192.168.2.4	151.101.65.91
Jan 22, 2025 15:33:56.066884041 CET	443	49778	151.101.65.91	192.168.2.4
Jan 22, 2025 15:33:56.068348885 CET	49779	443	192.168.2.4	35.190.72.216
Jan 22, 2025 15:33:56.068370104 CET	443	49779	35.190.72.216	192.168.2.4
Jan 22, 2025 15:33:56.068859100 CET	49780	443	192.168.2.4	35.201.103.21
Jan 22, 2025 15:33:56.068901062 CET	443	49780	35.201.103.21	192.168.2.4
Jan 22, 2025 15:33:56.069255114 CET	49780	443	192.168.2.4	35.201.103.21
Jan 22, 2025 15:33:56.070699930 CET	49780	443	192.168.2.4	35.201.103.21
Jan 22, 2025 15:33:56.070714951 CET	443	49780	35.201.103.21	192.168.2.4
Jan 22, 2025 15:33:56.489865065 CET	443	49777	34.149.100.209	192.168.2.4
Jan 22, 2025 15:33:56.490008116 CET	49777	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:56.494576931 CET	49777	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:56.494592905 CET	443	49777	34.149.100.209	192.168.2.4
Jan 22, 2025 15:33:56.494836092 CET	443	49777	34.149.100.209	192.168.2.4
Jan 22, 2025 15:33:56.497893095 CET	49777	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:56.498023033 CET	49777	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:56.498055935 CET	443	49777	34.149.100.209	192.168.2.4
Jan 22, 2025 15:33:56.498220921 CET	49777	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:56.504936934 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:56.509848118 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:56.522923946 CET	443	49778	151.101.65.91	192.168.2.4
Jan 22, 2025 15:33:56.522936106 CET	443	49778	151.101.65.91	192.168.2.4
Jan 22, 2025 15:33:56.523049116 CET	49778	443	192.168.2.4	151.101.65.91
Jan 22, 2025 15:33:56.525417089 CET	443	49779	35.190.72.216	192.168.2.4
Jan 22, 2025 15:33:56.525465965 CET	443	49779	35.190.72.216	192.168.2.4
Jan 22, 2025 15:33:56.526240110 CET	49778	443	192.168.2.4	151.101.65.91
Jan 22, 2025 15:33:56.526253939 CET	443	49778	151.101.65.91	192.168.2.4
Jan 22, 2025 15:33:56.526396036 CET	49779	443	192.168.2.4	35.190.72.216
Jan 22, 2025 15:33:56.526489019 CET	443	49778	151.101.65.91	192.168.2.4
Jan 22, 2025 15:33:56.529278994 CET	443	49780	35.201.103.21	192.168.2.4
Jan 22, 2025 15:33:56.529444933 CET	49780	443	192.168.2.4	35.201.103.21
Jan 22, 2025 15:33:56.533427000 CET	49778	443	192.168.2.4	151.101.65.91
Jan 22, 2025 15:33:56.533586979 CET	443	49778	151.101.65.91	192.168.2.4
Jan 22, 2025 15:33:56.533605099 CET	49778	443	192.168.2.4	151.101.65.91
Jan 22, 2025 15:33:56.533613920 CET	443	49778	151.101.65.91	192.168.2.4
Jan 22, 2025 15:33:56.533885956 CET	49779	443	192.168.2.4	35.190.72.216
Jan 22, 2025 15:33:56.533899069 CET	443	49779	35.190.72.216	192.168.2.4
Jan 22, 2025 15:33:56.533936024 CET	49779	443	192.168.2.4	35.190.72.216
Jan 22, 2025 15:33:56.534215927 CET	443	49779	35.190.72.216	192.168.2.4
Jan 22, 2025 15:33:56.535543919 CET	49780	443	192.168.2.4	35.201.103.21
Jan 22, 2025 15:33:56.535552979 CET	443	49780	35.201.103.21	192.168.2.4
Jan 22, 2025 15:33:56.535662889 CET	49780	443	192.168.2.4	35.201.103.21
Jan 22, 2025 15:33:56.535758972 CET	443	49780	35.201.103.21	192.168.2.4
Jan 22, 2025 15:33:56.536840916 CET	49779	443	192.168.2.4	35.190.72.216
Jan 22, 2025 15:33:56.536871910 CET	49780	443	192.168.2.4	35.201.103.21
Jan 22, 2025 15:33:56.546577930 CET	49781	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:56.546618938 CET	443	49781	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:56.546811104 CET	49782	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:56.546844959 CET	443	49782	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:56.547878981 CET	49781	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:56.547884941 CET	49782	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:56.548053026 CET	49781	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:56.548077106 CET	443	49781	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:56.548208952 CET	49782	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:56.548221111 CET	443	49782	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:56.549763918 CET	49783	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:56.549781084 CET	443	49783	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:56.550173998 CET	49783	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:56.550292015 CET	49783	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:56.550303936 CET	443	49783	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:56.563662052 CET	49784	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:56.563698053 CET	443	49784	34.149.100.209	192.168.2.4
Jan 22, 2025 15:33:56.563795090 CET	49784	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:56.563950062 CET	49784	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:56.563966036 CET	443	49784	34.149.100.209	192.168.2.4
Jan 22, 2025 15:33:56.596426010 CET	443	49776	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:56.596537113 CET	49776	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:56.600429058 CET	49776	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:56.600446939 CET	443	49776	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:56.600723982 CET	443	49776	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:56.604229927 CET	49776	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:56.604365110 CET	49776	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:56.604479074 CET	443	49776	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:56.604994059 CET	49776	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:56.628024101 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:56.631778002 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:56.636575937 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:56.668404102 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:56.726686001 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:56.751338959 CET	443	49778	151.101.65.91	192.168.2.4
Jan 22, 2025 15:33:56.751461983 CET	49778	443	192.168.2.4	151.101.65.91
Jan 22, 2025 15:33:56.768676043 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:56.999675989 CET	443	49782	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:56.999775887 CET	49782	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:57.001719952 CET	443	49781	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:57.003689051 CET	49782	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:57.003705025 CET	443	49782	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:57.003974915 CET	443	49782	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:57.006365061 CET	49782	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:57.006427050 CET	49782	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:57.006573915 CET	443	49782	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:57.011333942 CET	443	49782	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:57.011347055 CET	443	49781	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:57.014652967 CET	443	49783	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:57.015676975 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:57.016222954 CET	49782	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:57.016242981 CET	49782	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:57.016509056 CET	49782	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:57.016511917 CET	49781	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:57.019351959 CET	443	49783	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:57.019706964 CET	49781	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:57.019715071 CET	443	49781	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:57.020023108 CET	443	49781	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:57.020477057 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:57.027334929 CET	49783	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:57.029963970 CET	49783	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:57.029973030 CET	443	49783	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:57.030344009 CET	443	49783	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:57.031913996 CET	49781	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:57.032026052 CET	49781	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:57.032135010 CET	443	49781	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:57.033365011 CET	49783	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:57.033409119 CET	49783	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:57.033593893 CET	443	49783	35.244.181.201	192.168.2.4
Jan 22, 2025 15:33:57.033659935 CET	49781	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:57.033682108 CET	49783	443	192.168.2.4	35.244.181.201
Jan 22, 2025 15:33:57.036956072 CET	443	49784	34.149.100.209	192.168.2.4
Jan 22, 2025 15:33:57.037699938 CET	49784	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:57.040997028 CET	49784	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:57.041013002 CET	443	49784	34.149.100.209	192.168.2.4
Jan 22, 2025 15:33:57.041235924 CET	443	49784	34.149.100.209	192.168.2.4
Jan 22, 2025 15:33:57.044282913 CET	49784	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:57.044375896 CET	49784	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:57.044486046 CET	443	49784	34.149.100.209	192.168.2.4
Jan 22, 2025 15:33:57.045068026 CET	49784	443	192.168.2.4	34.149.100.209
Jan 22, 2025 15:33:57.113604069 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:57.117427111 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:57.122282982 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:57.154181957 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:57.212374926 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:57.254512072 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:58.680254936 CET	49786	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:33:58.680310011 CET	443	49786	34.107.243.93	192.168.2.4
Jan 22, 2025 15:33:58.680773020 CET	49786	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:33:58.682492018 CET	49786	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:33:58.682512045 CET	443	49786	34.107.243.93	192.168.2.4
Jan 22, 2025 15:33:59.167654037 CET	443	49786	34.107.243.93	192.168.2.4
Jan 22, 2025 15:33:59.167779922 CET	49786	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:33:59.174515009 CET	49786	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:33:59.174559116 CET	443	49786	34.107.243.93	192.168.2.4
Jan 22, 2025 15:33:59.174745083 CET	443	49786	34.107.243.93	192.168.2.4
Jan 22, 2025 15:33:59.174891949 CET	49786	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:33:59.174910069 CET	443	49786	34.107.243.93	192.168.2.4
Jan 22, 2025 15:33:59.178355932 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:59.183187008 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:59.278486013 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:59.282099962 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:59.287012100 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:59.322813034 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:33:59.377491951 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:33:59.379331112 CET	443	49786	34.107.243.93	192.168.2.4
Jan 22, 2025 15:33:59.379393101 CET	49786	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:33:59.423130989 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:09.289601088 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:09.294579029 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:34:09.389838934 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:09.394777060 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:34:19.303864002 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:19.308762074 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:34:19.404180050 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:19.410413980 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:34:19.449225903 CET	49813	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:34:19.449261904 CET	443	49813	34.107.243.93	192.168.2.4
Jan 22, 2025 15:34:19.449703932 CET	49813	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:34:19.451286077 CET	49813	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:34:19.451297045 CET	443	49813	34.107.243.93	192.168.2.4
Jan 22, 2025 15:34:19.917058945 CET	443	49813	34.107.243.93	192.168.2.4
Jan 22, 2025 15:34:19.917131901 CET	49813	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:34:19.922446012 CET	49813	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:34:19.922451973 CET	443	49813	34.107.243.93	192.168.2.4
Jan 22, 2025 15:34:19.922553062 CET	49813	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:34:19.922615051 CET	443	49813	34.107.243.93	192.168.2.4
Jan 22, 2025 15:34:19.922801018 CET	49813	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:34:19.925416946 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:19.930270910 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:34:20.023957968 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:34:20.027481079 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:20.032336950 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:34:20.068502903 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:20.123342037 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:34:20.168880939 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:26.917953014 CET	49861	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:26.917957067 CET	49860	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:26.918001890 CET	443	49860	34.120.208.123	192.168.2.4
Jan 22, 2025 15:34:26.918004036 CET	443	49861	34.120.208.123	192.168.2.4
Jan 22, 2025 15:34:26.918451071 CET	49861	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:26.918452978 CET	49860	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:26.918452978 CET	49860	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:26.918486118 CET	443	49860	34.120.208.123	192.168.2.4
Jan 22, 2025 15:34:26.918585062 CET	49861	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:26.918597937 CET	443	49861	34.120.208.123	192.168.2.4
Jan 22, 2025 15:34:26.920445919 CET	49862	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:26.920456886 CET	443	49862	34.120.208.123	192.168.2.4
Jan 22, 2025 15:34:26.921768904 CET	49862	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:26.922234058 CET	49862	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:26.922244072 CET	443	49862	34.120.208.123	192.168.2.4
Jan 22, 2025 15:34:27.378669977 CET	443	49860	34.120.208.123	192.168.2.4
Jan 22, 2025 15:34:27.379028082 CET	49860	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:27.382735968 CET	443	49861	34.120.208.123	192.168.2.4
Jan 22, 2025 15:34:27.382771969 CET	49860	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:27.382788897 CET	443	49860	34.120.208.123	192.168.2.4
Jan 22, 2025 15:34:27.383277893 CET	49861	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:27.384443045 CET	443	49860	34.120.208.123	192.168.2.4
Jan 22, 2025 15:34:27.385472059 CET	443	49862	34.120.208.123	192.168.2.4
Jan 22, 2025 15:34:27.385803938 CET	49861	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:27.385831118 CET	443	49861	34.120.208.123	192.168.2.4
Jan 22, 2025 15:34:27.386082888 CET	443	49861	34.120.208.123	192.168.2.4
Jan 22, 2025 15:34:27.388199091 CET	49860	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:27.388521910 CET	49860	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:27.388658047 CET	443	49860	34.120.208.123	192.168.2.4
Jan 22, 2025 15:34:27.389149904 CET	49861	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:27.389225960 CET	49861	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:27.389372110 CET	443	49861	34.120.208.123	192.168.2.4
Jan 22, 2025 15:34:27.389417887 CET	49860	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:27.389417887 CET	49861	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:27.389451027 CET	49860	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:27.389451027 CET	49862	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:27.392724037 CET	49862	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:27.392736912 CET	443	49862	34.120.208.123	192.168.2.4
Jan 22, 2025 15:34:27.393095016 CET	443	49862	34.120.208.123	192.168.2.4
Jan 22, 2025 15:34:27.394916058 CET	49861	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:27.397186041 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:27.397244930 CET	49862	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:27.397326946 CET	49862	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:27.397546053 CET	443	49862	34.120.208.123	192.168.2.4
Jan 22, 2025 15:34:27.399935007 CET	49862	443	192.168.2.4	34.120.208.123
Jan 22, 2025 15:34:27.403599024 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:34:27.498374939 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:34:27.502475023 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:27.508164883 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:34:27.542047024 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:27.598416090 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:34:27.642513990 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:28.103130102 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:28.107985020 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:34:28.202270031 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:34:28.205502033 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:28.211358070 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:34:28.244158983 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:28.301970959 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:34:28.344465971 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:38.209533930 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:38.214369059 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:34:38.310408115 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:38.315184116 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:34:48.218033075 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:48.222845078 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:34:48.340698004 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:48.345594883 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:34:58.231693983 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:58.236495972 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:34:58.347651958 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:34:58.352520943 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:35:00.148499012 CET	50058	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:35:00.148555994 CET	443	50058	34.107.243.93	192.168.2.4
Jan 22, 2025 15:35:00.148614883 CET	50058	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:35:00.150207043 CET	50058	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:35:00.150235891 CET	443	50058	34.107.243.93	192.168.2.4
Jan 22, 2025 15:35:00.660286903 CET	443	50058	34.107.243.93	192.168.2.4
Jan 22, 2025 15:35:00.660495043 CET	50058	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:35:00.668687105 CET	50058	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:35:00.668713093 CET	443	50058	34.107.243.93	192.168.2.4
Jan 22, 2025 15:35:00.668801069 CET	50058	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:35:00.668997049 CET	443	50058	34.107.243.93	192.168.2.4
Jan 22, 2025 15:35:00.669097900 CET	50058	443	192.168.2.4	34.107.243.93
Jan 22, 2025 15:35:00.671780109 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:35:00.676562071 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:35:00.770287991 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:35:00.774326086 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:35:00.779072046 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:35:00.823359013 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:35:00.869112968 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:35:00.923700094 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:35:10.780894995 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:35:10.785815954 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:35:10.881190062 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:35:10.886140108 CET	80	49757	34.107.221.82	192.168.2.4
Jan 22, 2025 15:35:20.794995070 CET	49751	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:35:20.799859047 CET	80	49751	34.107.221.82	192.168.2.4
Jan 22, 2025 15:35:20.894828081 CET	49757	80	192.168.2.4	34.107.221.82
Jan 22, 2025 15:35:20.899749041 CET	80	49757	34.107.221.82	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 22, 2025 15:33:27.667960882 CET	56267	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:27.675177097 CET	53	56267	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:27.681361914 CET	53709	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:27.688570976 CET	53	53709	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:29.406997919 CET	54434	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:29.415463924 CET	53	54434	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:29.417478085 CET	59698	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:29.418922901 CET	62062	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:29.424681902 CET	53	59698	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:29.426141977 CET	53	62062	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:29.427618980 CET	62384	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:29.429996014 CET	57964	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:29.434120893 CET	53	62384	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:29.435715914 CET	62984	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:29.436666965 CET	53	57964	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:29.443662882 CET	53	62984	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:30.347309113 CET	51986	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:30.347712040 CET	61599	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:30.354376078 CET	53	51986	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:30.356136084 CET	53	61599	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:30.363482952 CET	49532	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:30.370450974 CET	53	49532	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:30.381253004 CET	59579	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:30.382777929 CET	49999	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:30.389576912 CET	53	59579	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:30.389852047 CET	53	49999	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:30.401443005 CET	49972	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:30.408546925 CET	53	49972	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:30.422698975 CET	58982	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:30.430121899 CET	53	58982	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:30.437231064 CET	49695	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:30.445662022 CET	53	49695	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:30.881197929 CET	49745	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:30.881436110 CET	56392	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:30.887813091 CET	53	49745	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:30.888190985 CET	53	56392	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:30.925210953 CET	64408	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:30.932291031 CET	53	64408	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:30.933290958 CET	62020	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:30.940135956 CET	53	62020	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:30.940812111 CET	55971	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:30.947721958 CET	53	55971	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:30.961174011 CET	60928	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:30.968513966 CET	53	60928	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:36.961909056 CET	63056	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:36.964006901 CET	59199	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:36.969583988 CET	53	63056	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:36.971134901 CET	53	59199	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:36.981270075 CET	53291	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:36.983979940 CET	60656	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:36.990812063 CET	53	53291	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:36.991157055 CET	53	60656	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:36.991544008 CET	51414	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:36.992125988 CET	60268	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:36.999376059 CET	53	60268	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:36.999387980 CET	53	51414	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:37.419159889 CET	55845	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:37.426146984 CET	53	55845	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:37.427274942 CET	49360	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:37.433909893 CET	53	49360	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:37.434459925 CET	58564	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:37.441327095 CET	53	58564	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:41.242924929 CET	54835	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:41.247164965 CET	61979	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:41.249933958 CET	53	54835	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:41.254095078 CET	53	61979	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:41.265736103 CET	57640	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:41.272551060 CET	53	57640	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:41.513649940 CET	61634	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:41.520704031 CET	53	61634	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:41.521814108 CET	55700	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:41.529958010 CET	53	55700	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:41.533128977 CET	62785	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:41.541637897 CET	53	62785	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:47.959098101 CET	51009	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:47.966466904 CET	53	51009	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:50.724220037 CET	52975	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:50.724663019 CET	59447	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:50.725056887 CET	63481	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:50.731228113 CET	53	52975	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:50.731342077 CET	53	59447	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:50.732255936 CET	53	63481	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:50.732295990 CET	50290	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:50.733329058 CET	61710	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:50.733684063 CET	57578	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:50.739276886 CET	53	50290	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:50.740000963 CET	53	61710	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:50.740458965 CET	57820	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:50.741101980 CET	53	57578	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:50.746532917 CET	50417	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:50.746871948 CET	64953	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:50.747442961 CET	53	57820	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:50.748344898 CET	60461	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:50.753882885 CET	53	64953	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:50.753957987 CET	53	50417	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:50.754755020 CET	55624	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:50.755037069 CET	53	60461	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:50.755764008 CET	60022	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:50.761677027 CET	53	55624	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:50.762401104 CET	60301	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:50.762980938 CET	53	60022	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:50.763519049 CET	50271	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:50.769351959 CET	53	60301	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:50.769931078 CET	49672	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:50.771172047 CET	53	50271	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:50.776807070 CET	53	49672	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:56.009468079 CET	49547	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:56.016118050 CET	53	49547	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:56.030064106 CET	56680	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:56.037396908 CET	53	56680	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:56.043375969 CET	56891	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:56.050087929 CET	53	56891	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:56.050112009 CET	57571	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:56.051935911 CET	60168	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:56.059809923 CET	53	57571	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:56.059822083 CET	53	60168	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:56.061661959 CET	50072	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:56.069356918 CET	53	50072	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:56.071921110 CET	62975	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:56.078597069 CET	53	62975	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:57.046248913 CET	56769	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:57.055255890 CET	53	56769	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:57.056027889 CET	64822	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:57.064405918 CET	53	64822	1.1.1.1	192.168.2.4
Jan 22, 2025 15:33:58.680437088 CET	65212	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:33:58.687349081 CET	53	65212	1.1.1.1	192.168.2.4
Jan 22, 2025 15:34:19.440114021 CET	65348	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:34:19.448040009 CET	53	65348	1.1.1.1	192.168.2.4
Jan 22, 2025 15:34:19.449507952 CET	53245	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:34:19.458939075 CET	53	53245	1.1.1.1	192.168.2.4
Jan 22, 2025 15:34:26.969778061 CET	49298	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:34:26.976583004 CET	53	49298	1.1.1.1	192.168.2.4
Jan 22, 2025 15:34:28.103329897 CET	49183	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:34:28.110451937 CET	53	49183	1.1.1.1	192.168.2.4
Jan 22, 2025 15:35:00.140423059 CET	53277	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:35:00.147340059 CET	53	53277	1.1.1.1	192.168.2.4
Jan 22, 2025 15:35:00.148439884 CET	59888	53	192.168.2.4	1.1.1.1
Jan 22, 2025 15:35:00.156429052 CET	53	59888	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 22, 2025 15:33:27.667960882 CET	192.168.2.4	1.1.1.1	0x968a	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:27.681361914 CET	192.168.2.4	1.1.1.1	0x5b47	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jan 22, 2025 15:33:29.406997919 CET	192.168.2.4	1.1.1.1	0xe352	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:29.417478085 CET	192.168.2.4	1.1.1.1	0xc514	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:29.418922901 CET	192.168.2.4	1.1.1.1	0x28f8	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:29.427618980 CET	192.168.2.4	1.1.1.1	0x7e7a	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:29.429996014 CET	192.168.2.4	1.1.1.1	0xf39e	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jan 22, 2025 15:33:29.435715914 CET	192.168.2.4	1.1.1.1	0x6b23	Standard query (0)	youtube.com	28	IN (0x0001)	false
Jan 22, 2025 15:33:30.347309113 CET	192.168.2.4	1.1.1.1	0xb8ec	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.347712040 CET	192.168.2.4	1.1.1.1	0x5584	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.363482952 CET	192.168.2.4	1.1.1.1	0x1fa3	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.381253004 CET	192.168.2.4	1.1.1.1	0x47c7	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Jan 22, 2025 15:33:30.382777929 CET	192.168.2.4	1.1.1.1	0x903a	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.401443005 CET	192.168.2.4	1.1.1.1	0x989e	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jan 22, 2025 15:33:30.422698975 CET	192.168.2.4	1.1.1.1	0xf490	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.437231064 CET	192.168.2.4	1.1.1.1	0x7218	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jan 22, 2025 15:33:30.881197929 CET	192.168.2.4	1.1.1.1	0xcd74	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.881436110 CET	192.168.2.4	1.1.1.1	0xc1b7	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.925210953 CET	192.168.2.4	1.1.1.1	0x22c0	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.933290958 CET	192.168.2.4	1.1.1.1	0xbcc6	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.940812111 CET	192.168.2.4	1.1.1.1	0xc384	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jan 22, 2025 15:33:30.961174011 CET	192.168.2.4	1.1.1.1	0x9aff	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:36.961909056 CET	192.168.2.4	1.1.1.1	0xb8e7	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:36.964006901 CET	192.168.2.4	1.1.1.1	0xb0e	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:36.981270075 CET	192.168.2.4	1.1.1.1	0xce81	Standard query (0)	shavar.prod.mozaws.net	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:36.983979940 CET	192.168.2.4	1.1.1.1	0xdbe9	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:36.991544008 CET	192.168.2.4	1.1.1.1	0x2b6b	Standard query (0)	shavar.prod.mozaws.net	28	IN (0x0001)	false
Jan 22, 2025 15:33:36.992125988 CET	192.168.2.4	1.1.1.1	0xf730	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jan 22, 2025 15:33:37.419159889 CET	192.168.2.4	1.1.1.1	0xef5d	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:37.427274942 CET	192.168.2.4	1.1.1.1	0x2ce1	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:37.434459925 CET	192.168.2.4	1.1.1.1	0x9f02	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Jan 22, 2025 15:33:41.242924929 CET	192.168.2.4	1.1.1.1	0xb449	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jan 22, 2025 15:33:41.247164965 CET	192.168.2.4	1.1.1.1	0xd2f2	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:41.265736103 CET	192.168.2.4	1.1.1.1	0x5d6a	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Jan 22, 2025 15:33:41.513649940 CET	192.168.2.4	1.1.1.1	0xa7ef	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:41.521814108 CET	192.168.2.4	1.1.1.1	0x9098	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:41.533128977 CET	192.168.2.4	1.1.1.1	0xeafd	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jan 22, 2025 15:33:47.959098101 CET	192.168.2.4	1.1.1.1	0x3f5a	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Jan 22, 2025 15:33:50.724220037 CET	192.168.2.4	1.1.1.1	0x5aca	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.724663019 CET	192.168.2.4	1.1.1.1	0xad3a	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.725056887 CET	192.168.2.4	1.1.1.1	0xebc2	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.732295990 CET	192.168.2.4	1.1.1.1	0x9a19	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.733329058 CET	192.168.2.4	1.1.1.1	0x592	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.733684063 CET	192.168.2.4	1.1.1.1	0x15a2	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.740458965 CET	192.168.2.4	1.1.1.1	0xd0b5	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Jan 22, 2025 15:33:50.746532917 CET	192.168.2.4	1.1.1.1	0xbf1d	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Jan 22, 2025 15:33:50.746871948 CET	192.168.2.4	1.1.1.1	0x6c8e	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Jan 22, 2025 15:33:50.748344898 CET	192.168.2.4	1.1.1.1	0xc2d6	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.754755020 CET	192.168.2.4	1.1.1.1	0xcde0	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.755764008 CET	192.168.2.4	1.1.1.1	0x1857	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.762401104 CET	192.168.2.4	1.1.1.1	0xaffc	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.763519049 CET	192.168.2.4	1.1.1.1	0x9baa	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Jan 22, 2025 15:33:50.769931078 CET	192.168.2.4	1.1.1.1	0x412e	Standard query (0)	twitter.com	28	IN (0x0001)	false
Jan 22, 2025 15:33:56.009468079 CET	192.168.2.4	1.1.1.1	0x2e9e	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jan 22, 2025 15:33:56.030064106 CET	192.168.2.4	1.1.1.1	0xf077	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:56.043375969 CET	192.168.2.4	1.1.1.1	0x7d3a	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:56.050112009 CET	192.168.2.4	1.1.1.1	0x3e8f	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:56.051935911 CET	192.168.2.4	1.1.1.1	0xc30	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Jan 22, 2025 15:33:56.061661959 CET	192.168.2.4	1.1.1.1	0x2445	Standard query (0)	normandy-cdn.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:56.071921110 CET	192.168.2.4	1.1.1.1	0xd248	Standard query (0)	normandy-cdn.services.mozilla.com	28	IN (0x0001)	false
Jan 22, 2025 15:33:57.046248913 CET	192.168.2.4	1.1.1.1	0x343c	Standard query (0)	a19.dscg10.akamai.net	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:57.056027889 CET	192.168.2.4	1.1.1.1	0x350a	Standard query (0)	a19.dscg10.akamai.net	28	IN (0x0001)	false
Jan 22, 2025 15:33:58.680437088 CET	192.168.2.4	1.1.1.1	0x46b9	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Jan 22, 2025 15:34:19.440114021 CET	192.168.2.4	1.1.1.1	0x54d	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:34:19.449507952 CET	192.168.2.4	1.1.1.1	0xa642	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Jan 22, 2025 15:34:26.969778061 CET	192.168.2.4	1.1.1.1	0x9f72	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Jan 22, 2025 15:34:28.103329897 CET	192.168.2.4	1.1.1.1	0x98fd	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:35:00.140423059 CET	192.168.2.4	1.1.1.1	0xc12d	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:35:00.148439884 CET	192.168.2.4	1.1.1.1	0x31f5	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 22, 2025 15:33:27.622952938 CET	1.1.1.1	192.168.2.4	0x962c	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:27.675177097 CET	1.1.1.1	192.168.2.4	0x968a	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:29.415463924 CET	1.1.1.1	192.168.2.4	0xe352	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:33:29.415463924 CET	1.1.1.1	192.168.2.4	0xe352	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:33:29.415463924 CET	1.1.1.1	192.168.2.4	0xe352	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:29.424681902 CET	1.1.1.1	192.168.2.4	0xc514	No error (0)	youtube.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:29.426141977 CET	1.1.1.1	192.168.2.4	0x28f8	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:29.434120893 CET	1.1.1.1	192.168.2.4	0x7e7a	No error (0)	youtube.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:29.436666965 CET	1.1.1.1	192.168.2.4	0xf39e	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Jan 22, 2025 15:33:29.443662882 CET	1.1.1.1	192.168.2.4	0x6b23	No error (0)	youtube.com			28	IN (0x0001)	false
Jan 22, 2025 15:33:30.354376078 CET	1.1.1.1	192.168.2.4	0xb8ec	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.356136084 CET	1.1.1.1	192.168.2.4	0x5584	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:33:30.356136084 CET	1.1.1.1	192.168.2.4	0x5584	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.370450974 CET	1.1.1.1	192.168.2.4	0x1fa3	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.389852047 CET	1.1.1.1	192.168.2.4	0x903a	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.417511940 CET	1.1.1.1	192.168.2.4	0x7952	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:33:30.417511940 CET	1.1.1.1	192.168.2.4	0x7952	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.430121899 CET	1.1.1.1	192.168.2.4	0xf490	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.887813091 CET	1.1.1.1	192.168.2.4	0xcd74	No error (0)	example.org		96.7.128.186	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.887813091 CET	1.1.1.1	192.168.2.4	0xcd74	No error (0)	example.org		23.215.0.132	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.887813091 CET	1.1.1.1	192.168.2.4	0xcd74	No error (0)	example.org		23.215.0.133	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.887813091 CET	1.1.1.1	192.168.2.4	0xcd74	No error (0)	example.org		96.7.128.192	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.888190985 CET	1.1.1.1	192.168.2.4	0xc1b7	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.888190985 CET	1.1.1.1	192.168.2.4	0xc1b7	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.932291031 CET	1.1.1.1	192.168.2.4	0x22c0	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:33:30.932291031 CET	1.1.1.1	192.168.2.4	0x22c0	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:33:30.932291031 CET	1.1.1.1	192.168.2.4	0x22c0	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.940135956 CET	1.1.1.1	192.168.2.4	0xbcc6	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:30.947721958 CET	1.1.1.1	192.168.2.4	0xc384	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Jan 22, 2025 15:33:30.968513966 CET	1.1.1.1	192.168.2.4	0x9aff	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:33:30.968513966 CET	1.1.1.1	192.168.2.4	0x9aff	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:33:30.968513966 CET	1.1.1.1	192.168.2.4	0x9aff	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:36.969583988 CET	1.1.1.1	192.168.2.4	0xb8e7	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:33:36.969583988 CET	1.1.1.1	192.168.2.4	0xb8e7	No error (0)	shavar.prod.mozaws.net		34.211.125.135	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:36.969583988 CET	1.1.1.1	192.168.2.4	0xb8e7	No error (0)	shavar.prod.mozaws.net		44.233.129.8	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:36.969583988 CET	1.1.1.1	192.168.2.4	0xb8e7	No error (0)	shavar.prod.mozaws.net		34.211.101.148	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:36.971134901 CET	1.1.1.1	192.168.2.4	0xb0e	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:33:36.971134901 CET	1.1.1.1	192.168.2.4	0xb0e	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:33:36.971134901 CET	1.1.1.1	192.168.2.4	0xb0e	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:36.990812063 CET	1.1.1.1	192.168.2.4	0xce81	No error (0)	shavar.prod.mozaws.net		44.233.129.8	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:36.990812063 CET	1.1.1.1	192.168.2.4	0xce81	No error (0)	shavar.prod.mozaws.net		34.211.125.135	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:36.990812063 CET	1.1.1.1	192.168.2.4	0xce81	No error (0)	shavar.prod.mozaws.net		34.211.101.148	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:36.991157055 CET	1.1.1.1	192.168.2.4	0xdbe9	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:37.426146984 CET	1.1.1.1	192.168.2.4	0xef5d	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:37.433909893 CET	1.1.1.1	192.168.2.4	0x2ce1	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:41.234060049 CET	1.1.1.1	192.168.2.4	0x8405	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:33:41.234060049 CET	1.1.1.1	192.168.2.4	0x8405	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:41.235384941 CET	1.1.1.1	192.168.2.4	0xfad3	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:41.254095078 CET	1.1.1.1	192.168.2.4	0xd2f2	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:41.520704031 CET	1.1.1.1	192.168.2.4	0xa7ef	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:33:41.520704031 CET	1.1.1.1	192.168.2.4	0xa7ef	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:41.529958010 CET	1.1.1.1	192.168.2.4	0x9098	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:42.397897005 CET	1.1.1.1	192.168.2.4	0xd22d	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.731228113 CET	1.1.1.1	192.168.2.4	0x5aca	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:33:50.731228113 CET	1.1.1.1	192.168.2.4	0x5aca	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.731228113 CET	1.1.1.1	192.168.2.4	0x5aca	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.731228113 CET	1.1.1.1	192.168.2.4	0x5aca	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.731228113 CET	1.1.1.1	192.168.2.4	0x5aca	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.731228113 CET	1.1.1.1	192.168.2.4	0x5aca	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.731228113 CET	1.1.1.1	192.168.2.4	0x5aca	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.731228113 CET	1.1.1.1	192.168.2.4	0x5aca	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.731228113 CET	1.1.1.1	192.168.2.4	0x5aca	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.731228113 CET	1.1.1.1	192.168.2.4	0x5aca	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.731228113 CET	1.1.1.1	192.168.2.4	0x5aca	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.731228113 CET	1.1.1.1	192.168.2.4	0x5aca	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.731228113 CET	1.1.1.1	192.168.2.4	0x5aca	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.731228113 CET	1.1.1.1	192.168.2.4	0x5aca	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.731228113 CET	1.1.1.1	192.168.2.4	0x5aca	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.731228113 CET	1.1.1.1	192.168.2.4	0x5aca	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.731228113 CET	1.1.1.1	192.168.2.4	0x5aca	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.731342077 CET	1.1.1.1	192.168.2.4	0xad3a	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:33:50.731342077 CET	1.1.1.1	192.168.2.4	0xad3a	No error (0)	star-mini.c10r.facebook.com		157.240.253.35	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.732255936 CET	1.1.1.1	192.168.2.4	0xebc2	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:33:50.732255936 CET	1.1.1.1	192.168.2.4	0xebc2	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.739276886 CET	1.1.1.1	192.168.2.4	0x9a19	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.739276886 CET	1.1.1.1	192.168.2.4	0x9a19	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.739276886 CET	1.1.1.1	192.168.2.4	0x9a19	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.739276886 CET	1.1.1.1	192.168.2.4	0x9a19	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.739276886 CET	1.1.1.1	192.168.2.4	0x9a19	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.739276886 CET	1.1.1.1	192.168.2.4	0x9a19	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.739276886 CET	1.1.1.1	192.168.2.4	0x9a19	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.739276886 CET	1.1.1.1	192.168.2.4	0x9a19	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.739276886 CET	1.1.1.1	192.168.2.4	0x9a19	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.739276886 CET	1.1.1.1	192.168.2.4	0x9a19	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.739276886 CET	1.1.1.1	192.168.2.4	0x9a19	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.739276886 CET	1.1.1.1	192.168.2.4	0x9a19	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.739276886 CET	1.1.1.1	192.168.2.4	0x9a19	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.739276886 CET	1.1.1.1	192.168.2.4	0x9a19	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.739276886 CET	1.1.1.1	192.168.2.4	0x9a19	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.739276886 CET	1.1.1.1	192.168.2.4	0x9a19	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.740000963 CET	1.1.1.1	192.168.2.4	0x592	No error (0)	star-mini.c10r.facebook.com		157.240.251.35	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.741101980 CET	1.1.1.1	192.168.2.4	0x15a2	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.747442961 CET	1.1.1.1	192.168.2.4	0xd0b5	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jan 22, 2025 15:33:50.747442961 CET	1.1.1.1	192.168.2.4	0xd0b5	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jan 22, 2025 15:33:50.747442961 CET	1.1.1.1	192.168.2.4	0xd0b5	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jan 22, 2025 15:33:50.747442961 CET	1.1.1.1	192.168.2.4	0xd0b5	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jan 22, 2025 15:33:50.753882885 CET	1.1.1.1	192.168.2.4	0x6c8e	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Jan 22, 2025 15:33:50.753957987 CET	1.1.1.1	192.168.2.4	0xbf1d	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Jan 22, 2025 15:33:50.755037069 CET	1.1.1.1	192.168.2.4	0xc2d6	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:33:50.755037069 CET	1.1.1.1	192.168.2.4	0xc2d6	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.755037069 CET	1.1.1.1	192.168.2.4	0xc2d6	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.755037069 CET	1.1.1.1	192.168.2.4	0xc2d6	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.755037069 CET	1.1.1.1	192.168.2.4	0xc2d6	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.761677027 CET	1.1.1.1	192.168.2.4	0xcde0	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.762980938 CET	1.1.1.1	192.168.2.4	0x1857	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.762980938 CET	1.1.1.1	192.168.2.4	0x1857	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.762980938 CET	1.1.1.1	192.168.2.4	0x1857	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.762980938 CET	1.1.1.1	192.168.2.4	0x1857	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.769351959 CET	1.1.1.1	192.168.2.4	0xaffc	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.769351959 CET	1.1.1.1	192.168.2.4	0xaffc	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.769351959 CET	1.1.1.1	192.168.2.4	0xaffc	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:50.769351959 CET	1.1.1.1	192.168.2.4	0xaffc	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:56.037396908 CET	1.1.1.1	192.168.2.4	0xf077	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:56.037396908 CET	1.1.1.1	192.168.2.4	0xf077	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:56.037396908 CET	1.1.1.1	192.168.2.4	0xf077	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:56.037396908 CET	1.1.1.1	192.168.2.4	0xf077	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:56.050087929 CET	1.1.1.1	192.168.2.4	0x7d3a	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:56.050087929 CET	1.1.1.1	192.168.2.4	0x7d3a	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:56.050087929 CET	1.1.1.1	192.168.2.4	0x7d3a	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:56.050087929 CET	1.1.1.1	192.168.2.4	0x7d3a	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:56.059809923 CET	1.1.1.1	192.168.2.4	0x3e8f	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:33:56.059809923 CET	1.1.1.1	192.168.2.4	0x3e8f	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:56.059822083 CET	1.1.1.1	192.168.2.4	0xc30	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Jan 22, 2025 15:33:56.059822083 CET	1.1.1.1	192.168.2.4	0xc30	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Jan 22, 2025 15:33:56.059822083 CET	1.1.1.1	192.168.2.4	0xc30	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Jan 22, 2025 15:33:56.059822083 CET	1.1.1.1	192.168.2.4	0xc30	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Jan 22, 2025 15:33:56.069356918 CET	1.1.1.1	192.168.2.4	0x2445	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:57.044990063 CET	1.1.1.1	192.168.2.4	0xbe43	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:33:57.044990063 CET	1.1.1.1	192.168.2.4	0xbe43	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:33:57.044990063 CET	1.1.1.1	192.168.2.4	0xbe43	No error (0)	a17.rackcdn.com.mdc.edgesuite.net	a19.dscg10.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:33:57.044990063 CET	1.1.1.1	192.168.2.4	0xbe43	No error (0)	a19.dscg10.akamai.net		2.22.61.59	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:57.044990063 CET	1.1.1.1	192.168.2.4	0xbe43	No error (0)	a19.dscg10.akamai.net		2.22.61.56	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:57.055255890 CET	1.1.1.1	192.168.2.4	0x343c	No error (0)	a19.dscg10.akamai.net		2.22.61.56	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:57.055255890 CET	1.1.1.1	192.168.2.4	0x343c	No error (0)	a19.dscg10.akamai.net		2.22.61.59	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:33:57.064405918 CET	1.1.1.1	192.168.2.4	0x350a	No error (0)	a19.dscg10.akamai.net			28	IN (0x0001)	false
Jan 22, 2025 15:33:57.064405918 CET	1.1.1.1	192.168.2.4	0x350a	No error (0)	a19.dscg10.akamai.net			28	IN (0x0001)	false
Jan 22, 2025 15:34:19.448040009 CET	1.1.1.1	192.168.2.4	0x54d	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:34:26.923830032 CET	1.1.1.1	192.168.2.4	0xc1b6	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:34:28.110451937 CET	1.1.1.1	192.168.2.4	0x98fd	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:34:28.110451937 CET	1.1.1.1	192.168.2.4	0x98fd	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 15:34:28.110451937 CET	1.1.1.1	192.168.2.4	0x98fd	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jan 22, 2025 15:35:00.147340059 CET	1.1.1.1	192.168.2.4	0xc12d	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

detectportal.firefox.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49741	34.107.221.82	80	6404	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jan 22, 2025 15:33:29.956537962 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 22, 2025 15:33:30.417473078 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 21 Jan 2025 20:33:28 GMT Age: 64802 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49749	34.107.221.82	80	6404	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jan 22, 2025 15:33:30.975363970 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 22, 2025 15:33:31.431983948 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 21 Jan 2025 16:53:21 GMT Age: 78010 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49751	34.107.221.82	80	6404	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jan 22, 2025 15:33:31.057327986 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 22, 2025 15:33:31.522878885 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 21 Jan 2025 19:16:05 GMT Age: 69446 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 22, 2025 15:33:31.780095100 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 22, 2025 15:33:31.879566908 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 21 Jan 2025 19:16:05 GMT Age: 69446 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 22, 2025 15:33:32.428936005 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 22, 2025 15:33:32.526923895 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 21 Jan 2025 19:16:05 GMT Age: 69447 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 22, 2025 15:33:41.411638021 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 22, 2025 15:33:41.509537935 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 21 Jan 2025 19:16:05 GMT Age: 69456 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 22, 2025 15:33:42.385576010 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 22, 2025 15:33:42.484411001 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 21 Jan 2025 19:16:05 GMT Age: 69457 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 22, 2025 15:33:42.575234890 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 22, 2025 15:33:42.673341036 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 21 Jan 2025 19:16:05 GMT Age: 69457 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 22, 2025 15:33:44.829854965 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 22, 2025 15:33:44.928658009 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 21 Jan 2025 19:16:05 GMT Age: 69459 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 22, 2025 15:33:45.174067974 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 22, 2025 15:33:45.274014950 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 21 Jan 2025 19:16:05 GMT Age: 69460 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 22, 2025 15:33:47.665008068 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 22, 2025 15:33:47.763984919 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 21 Jan 2025 19:16:05 GMT Age: 69462 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 22, 2025 15:33:48.431780100 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 22, 2025 15:33:48.747864962 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 21 Jan 2025 19:16:05 GMT Age: 69463 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 22, 2025 15:33:48.783714056 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 21 Jan 2025 19:16:05 GMT Age: 69463 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 22, 2025 15:33:56.504936934 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 22, 2025 15:33:56.628024101 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 21 Jan 2025 19:16:05 GMT Age: 69471 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 22, 2025 15:33:57.015676975 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 22, 2025 15:33:57.113604069 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 21 Jan 2025 19:16:05 GMT Age: 69472 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 22, 2025 15:33:59.178355932 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 22, 2025 15:33:59.278486013 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 21 Jan 2025 19:16:05 GMT Age: 69474 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 22, 2025 15:34:09.289601088 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 22, 2025 15:34:19.303864002 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 22, 2025 15:34:19.925416946 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 22, 2025 15:34:20.023957968 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 21 Jan 2025 19:16:05 GMT Age: 69494 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 22, 2025 15:34:27.397186041 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 22, 2025 15:34:27.498374939 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 21 Jan 2025 19:16:05 GMT Age: 69502 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 22, 2025 15:34:28.103130102 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 22, 2025 15:34:28.202270031 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 21 Jan 2025 19:16:05 GMT Age: 69503 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 22, 2025 15:34:38.209533930 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 22, 2025 15:34:48.218033075 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 22, 2025 15:34:58.231693983 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 22, 2025 15:35:00.671780109 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jan 22, 2025 15:35:00.770287991 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 21 Jan 2025 19:16:05 GMT Age: 69535 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jan 22, 2025 15:35:10.780894995 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 22, 2025 15:35:20.794995070 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49755	34.107.221.82	80	6404	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jan 22, 2025 15:33:31.735138893 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49756	34.107.221.82	80	6404	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jan 22, 2025 15:33:32.435230970 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49757	34.107.221.82	80	6404	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jan 22, 2025 15:33:32.873625994 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 22, 2025 15:33:33.320699930 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 21 Jan 2025 16:53:21 GMT Age: 78012 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 22, 2025 15:33:41.528084993 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 22, 2025 15:33:41.629945993 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 21 Jan 2025 16:53:21 GMT Age: 78020 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 22, 2025 15:33:42.574852943 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 22, 2025 15:33:42.669785023 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 21 Jan 2025 16:53:21 GMT Age: 78021 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 22, 2025 15:33:42.909897089 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 22, 2025 15:33:43.005013943 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 21 Jan 2025 16:53:21 GMT Age: 78021 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 22, 2025 15:33:44.946090937 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 22, 2025 15:33:45.041076899 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 21 Jan 2025 16:53:21 GMT Age: 78023 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 22, 2025 15:33:45.281343937 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 22, 2025 15:33:45.377054930 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 21 Jan 2025 16:53:21 GMT Age: 78024 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 22, 2025 15:33:47.952351093 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 22, 2025 15:33:48.047169924 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 21 Jan 2025 16:53:21 GMT Age: 78027 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 22, 2025 15:33:48.768469095 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 22, 2025 15:33:48.888025045 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 21 Jan 2025 16:53:21 GMT Age: 78027 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 22, 2025 15:33:56.631778002 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 22, 2025 15:33:56.726686001 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 21 Jan 2025 16:53:21 GMT Age: 78035 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 22, 2025 15:33:57.117427111 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 22, 2025 15:33:57.212374926 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 21 Jan 2025 16:53:21 GMT Age: 78036 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 22, 2025 15:33:59.282099962 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 22, 2025 15:33:59.377491951 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 21 Jan 2025 16:53:21 GMT Age: 78038 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 22, 2025 15:34:09.389838934 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 22, 2025 15:34:19.404180050 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 22, 2025 15:34:20.027481079 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 22, 2025 15:34:20.123342037 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 21 Jan 2025 16:53:21 GMT Age: 78059 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 22, 2025 15:34:27.502475023 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 22, 2025 15:34:27.598416090 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 21 Jan 2025 16:53:21 GMT Age: 78066 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 22, 2025 15:34:28.205502033 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 22, 2025 15:34:28.301970959 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 21 Jan 2025 16:53:21 GMT Age: 78067 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 22, 2025 15:34:38.310408115 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 22, 2025 15:34:48.340698004 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 22, 2025 15:34:58.347651958 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 22, 2025 15:35:00.774326086 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jan 22, 2025 15:35:00.869112968 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 21 Jan 2025 16:53:21 GMT Age: 78099 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jan 22, 2025 15:35:10.881190062 CET	6	OUT	Data Raw: 00 Data Ascii:
Jan 22, 2025 15:35:20.894828081 CET	6	OUT	Data Raw: 00 Data Ascii:

Target ID:	0
Start time:	09:33:18
Start date:	22/01/2025
Path:	C:\Users\user\Desktop\random.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\random.exe"
Imagebase:	0x1f0000
File size:	970'240 bytes
MD5 hash:	B986D1882535E8F044C3D091D324D2F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:33:19
Start date:	22/01/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x920000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:33:19
Start date:	22/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:33:21
Start date:	22/01/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x920000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:33:21
Start date:	22/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:33:21
Start date:	22/01/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x920000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:33:21
Start date:	22/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:33:21
Start date:	22/01/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x920000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:33:21
Start date:	22/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:33:22
Start date:	22/01/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x920000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:33:22
Start date:	22/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:33:22
Start date:	22/01/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:33:22
Start date:	22/01/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:33:22
Start date:	22/01/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	09:33:24
Start date:	22/01/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2280 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2224 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c958a673-8d2a-4932-a065-728f92b5ad4e} 6404 "\\.\pipe\gecko-crash-server-pipe.6404" 1b575770310 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	09:33:27
Start date:	22/01/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4112 -parentBuildID 20230927232528 -prefsHandle 3816 -prefMapHandle 3048 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cef76444-a689-447f-b1a3-9f982a55c08d} 6404 "\\.\pipe\gecko-crash-server-pipe.6404" 1b507bdf410 rdd
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	09:33:40
Start date:	22/01/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3984 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 2784 -prefMapHandle 2768 -prefsLen 33185 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c18f3a26-7389-4e0f-8ffe-2a8c2ec164cb} 6404 "\\.\pipe\gecko-crash-server-pipe.6404" 1b50fda6910 utility
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Source: Joe Sandbox View	IP Address: 34.149.100.209 34.149.100.209
Source: Joe Sandbox View	IP Address: 151.101.65.91 151.101.65.91
Source: Joe Sandbox View	IP Address: 34.117.188.166 34.117.188.166

Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 0000000D.00000003.1923301495.000001B57FD95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1923301495.000001B57FD71000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1798825260.000001B57FD5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1923301495.000001B57FD95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1923301495.000001B57FD71000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1798825260.000001B57FD5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000D.00000003.1923301495.000001B57FD95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1800470918.000001B57FD95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1798825260.000001B57FD95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1923301495.000001B57FD95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1800470918.000001B57FD95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1798825260.000001B57FD95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000000D.00000003.1923301495.000001B57FD95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1800470918.000001B57FD95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1798825260.000001B57FD95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000D.00000003.1920957112.000001B508F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1807852510.000001B506595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1923301495.000001B57FD8C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1798825260.000001B57FD8C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1949446880.000001B57FD8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000000D.00000003.1933832452.000001B50DA86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1806435286.000001B50DFB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1933832452.000001B50DA86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1806435286.000001B50DFB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000D.00000003.1953303570.000001B50DFE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1937661578.000001B5072E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1933214080.000001B50DFE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1935147535.000001B50D991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1809548745.000001B50D991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1955517175.000001B50D991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1935147535.000001B50D991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1809548745.000001B50D991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1955517175.000001B50D991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000D.00000003.1933832452.000001B50DA86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1806435286.000001B50DFB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1933832452.000001B50DA86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1806435286.000001B50DFB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.2954495285.000001E5CC30A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.2952868840.000002DDD660C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000002.2954495285.000001E5CC30A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.2952868840.000002DDD660C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000010.00000002.2954495285.000001E5CC30A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.2952868840.000002DDD660C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000D.00000003.1927766704.000001B5115EC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1953303570.000001B50DFE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1937661578.000001B5072E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1927766704.000001B5115EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com- equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000D.00000003.1810376032.000001B5072F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: shavar.prod.mozaws.net
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: a19.dscg10.akamai.net

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.91:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49862 version: TLS 1.2

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report random.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_469d2ee9-b6b5-412f-b851-c214e004b99c.json (copy)

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_469d2ee9-b6b5-412f-b851-c214e004b99c.json.tmp

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

C:\Users\user\AppData\Local\Temp\tmpaddon

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4 (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\store.json.mozlz4 (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\store.json.mozlz4.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm

Windows Analysis Report
random.exe