Edit tour

Windows Analysis Report
random.exe

Overview

General Information

Sample name:	random.exe
Analysis ID:	1615904
MD5:	bca58035430238fde9990df16040d699
SHA1:	12e1f30c10f8d228e70d28bd6e315679d91aa46e
SHA256:	6c64e6e99e9173fd2233d7f6afe27d80d47a377eaa624ee1ca7cc0df803c5cbb
Tags:	CredentialFlusherexeuser-aachum
Infos:

Detection

Credential Flusher

Score:	76
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Credential Flusher

Binary is likely a compiled AutoIt script file

Found API chain indicative of sandbox detection

Joe Sandbox ML detected suspicious sample

Connects to many different domains

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

OS version to string mapping found (often used in BOTs)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

random.exe (PID: 2432 cmdline: "C:\Users\user\Desktop\random.exe" MD5: BCA58035430238FDE9990DF16040D699)

taskkill.exe (PID: 3984 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6916 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6368 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6980 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5448 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 5988 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6524 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 1588 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 1948 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2288 -parentBuildID 20230927232528 -prefsHandle 2220 -prefMapHandle 2212 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9fbe32b-4c03-4d39-93db-854142882339} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 1ee61071110 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 2024 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4116 -parentBuildID 20230927232528 -prefsHandle 3996 -prefMapHandle 4000 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98ef1f0c-9b53-4068-86ae-42f53ec98957} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 1ee71479110 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7820 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4456 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4472 -prefMapHandle 4564 -prefsLen 33076 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {127eaadf-f0b2-40e6-aa1b-0559c96af4d0} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 1ee79169d10 utility MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: random.exe PID: 2432	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: random.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: random.exe	ReversingLabs: Detection: 29%
Source: random.exe	Virustotal: Detection: 30%			Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.2% probability

Source: random.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.193.91:443 -> 192.168.2.6:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:56398 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:56399 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:56403 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:56400 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:56401 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:56402 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:56404 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:56404 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:56405 version: TLS 1.2

Source:	Binary string: webauthn.pdb source: firefox.exe, 0000000E.00000003.2385012290.000001EE75156000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.14.dr
Source:	Binary string: NapiNSP.pdbUGP source: firefox.exe, 0000000E.00000003.2399600054.000001EE6E9A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ktmw32.pdb source: firefox.exe, 0000000E.00000003.2391825603.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2393829428.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2392776545.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: NapiNSP.pdb source: firefox.exe, 0000000E.00000003.2399600054.000001EE6E9A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: npmproxy.pdbUGP source: firefox.exe, 0000000E.00000003.2400880018.000001EE6E9A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netprofm.pdb source: firefox.exe, 0000000E.00000003.2397348606.000001EE75101000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.14.dr
Source:	Binary string: webauthn.pdbGCTL source: firefox.exe, 0000000E.00000003.2385012290.000001EE75156000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: npmproxy.pdb source: firefox.exe, 0000000E.00000003.2400880018.000001EE6E9A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ktmw32.pdbGCTL source: firefox.exe, 0000000E.00000003.2391825603.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2393829428.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2392776545.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netprofm.pdbUGP source: firefox.exe, 0000000E.00000003.2397348606.000001EE75101000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005ADBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_005ADBBE
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0057C2A2 FindFirstFileExW,	0_2_0057C2A2
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005B68EE FindFirstFileW,FindClose,	0_2_005B68EE
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005B698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_005B698F
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005AD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_005AD076
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005AD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_005AD3A9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005B9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_005B9642
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005B979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_005B979D
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005B9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_005B9B2B
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005B5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_005B5C97

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 191MB

Source: unknown

Network traffic detected: DNS query count 33

Source: global traffic	TCP traffic: 192.168.2.6:63567 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.6:56392 -> 162.159.36.2:53

Source: Joe Sandbox View	IP Address: 2.22.61.56 2.22.61.56
Source: Joe Sandbox View	IP Address: 34.149.100.209 34.149.100.209
Source: Joe Sandbox View	IP Address: 34.49.51.44 34.49.51.44

Source: Joe Sandbox View

JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_005BCE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

0_2_005BCE44

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKLast-Modified: Fri, 07 Feb 2025 06:55:57 GMTETag: 85430baed3398695717b0263807cf97cContent-Length: 453023Accept-Ranges: bytesX-Timestamp: 1738911356.44453Content-Type: application/zipX-Trans-Id: txf36a3cdb14a04fca91417-0067a71e89dfw1Cache-Control: public, max-age=245629Expires: Tue, 18 Feb 2025 12:52:23 GMTDate: Sat, 15 Feb 2025 16:38:34 GMTConnection: keep-aliveData Raw: 50 4b 03 04 14 00 00 00 08 00 cd 8d 62 4e d0 b9 df e8 52 e8 06 00 d0 97 0f 00 0f 00 00 00 67 6d 70 6f 70 65 6e 68 32 36 34 2e 64 6c 6c ec bd 0b 7c 14 45 b6 30 de 3d 99 84 49 98 a4 07 8c 18 31 c2 e8 ce ea 34 66 31 71 e3 9a 60 d4 e9 d0 93 f4 e0 04 c2 d3 80 88 71 a3 b9 a0 08 11 27 2b b8 10 08 93 68 2a 6d 7b d9 bb 7a d7 dd 6f 5f ff 7b 77 ef dd e7 c5 bd ee f2 d0 95 cc 24 92 07 28 24 41 21 c0 8a 11 7c 4c 18 81 00 42 26 41 32 ff 73 aa 7b 9e 04 44 64 f7 ff dd ff f7 f1 63 d2 55 d5 55 e7 d4 39 75 ce a9 53 a7 aa bb 4b 16 6c 60 12 18 86 d1 c3 2f 18 64 98 2d 8c fa cf c6 7c f9 bf 00 fc d2 26 be 9e c6 fc 39 f9 9d 9b b6 b0 ce 77 6e 9a b3 78 c9 d3 e6 aa 15 cb ff 69 c5 23 4f 9a 2b 1e 59 b6 6c b9 cb fc dd c7 cc 2b aa 97 99 97 2c 33 8b 33 66 9b 9f 5c fe e8 63 93 53 53 53 2c 1a 8c e9 d2 cf b7 a4 f0 fd fe d0 ef b1 92 cf 8f 4e a4 d7 d3 47 47 d1 eb 99 a3 ff 46 af 27 8f 26 d3 3a 27 fd 4b e0 5a 26 9c 3e 9a 40 af 67 8e de 4d af 9f 1f 4d d7 60 fc 13 fc 2a 84 fe a3 a3 e9 f5 14 bd ce 5a 52 b1 18 ef 85 fa 5e 6a 67 98 47 9f 4b 62 8e 6f 7e 76 61 a8 ac 9f b9 d9 3c 5a 97 c6 31 2e 23 c3 8c 4f a0 65 19 99 a3 19 c6 44 93 eb 58 fc 8b 69 1d c3 24 69 6d 42 57 c6 c3 51 26 be ba c1 04 b7 cb d9 50 a3 d0 e5 c2 bc 9a 2c 4d e4 98 2c a8 bd 3a 89 63 ac d1 cc 2d e5 98 0d 12 5c 9f e5 98 ce 1b e1 fa 2a c7 d4 01 8a ce 2d 69 cc 9c 4b 8c 49 f6 d6 34 86 61 a3 0a 36 18 99 2a dd c5 eb 4f 76 3d b6 d2 05 57 cb d3 46 b5 43 48 bb 3e b6 8e 99 61 ca 27 af 78 f4 11 d7 23 40 66 8d 8e c2 64 d6 c1 75 a5 31 a6 9e 0d fe 4f 56 ab 31 6f 7d 1b 09 84 0e 67 c2 35 90 16 5f cf 33 b9 4a ad 48 69 04 5a 99 69 70 4d e7 2e 84 b7 62 b9 5a 11 86 81 f9 25 dc 47 94 8b 46 aa f7 d8 d2 e5 15 0c e5 11 f2 8a d2 f2 f8 05 f5 0a 2f ce 89 ff 33 ff 71 9b d9 4a af c7 d0 f2 b6 f6 6f de 03 b3 25 f7 67 d9 4e d2 2a 91 7d 12 d9 29 c9 33 0d 4e 25 f1 21 b7 91 71 2a a9 0b e0 e2 eb b8 8b 81 b4 f1 5e 49 9e 6d 90 c8 7e 07 09 f8 36 dd 85 23 e9 7e 2b fb c1 87 17 85 41 d1 7f 12 49 5d 72 03 c7 e4 78 b4 e2 b9 2a 82 3c 49 59 6a c9 96 da ec cc 70 30 18 8c 60 53 ae 4d 40 14 45 f7 8f 66 ea 3d ae 3b 21 cf 40 1e b0 f8 be 0d 45 c4 bb 05 45 bb be a3 fa 9e ad 1b 20 e1 9b 9c 30 1a 6e da 03 12 f1 4a 64 c8 b7 1c 64 d2 7f fd d6 06 bc 75 4d ec 2d 94 71 49 c6 6c 52 8e 07 7a 9a 07 3d 7d a8 a5 72 83 44 e6 58 4c 5a a7 ac 92 f2 78 b6 24 97 04 7c 63 a1 31 d2 63 55 6b 4d e6 26 d6 51 6e 5d ac fe 61 5d 74 fd 68 fa a1 2a d4 b4 21 b9 36 20 37 80 e4 4a 64 af 44 76 4b 4a 22 57 67 64 2a 25 6e 99 07 d2 bf 77 ab e9 f6 4a 6e 69 fb 69 6e 6d 72 9b 40 4d 85 24 27 5a c7 73 8c 04 ec 18 23 29 25 Data Ascii: PKbNRgmpopenh264.dll|E0=I14f1q`

Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip HTTP/1.1Host: ciscobinary.openh264.orgUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 0000000E.00000003.2435388126.0000123336704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: )://www.facebook.com/Zysl equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2435126989.00003F96D3703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: )://www.youtube.com/Zysl equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2435388126.0000123336704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: )www.facebook.comZysl equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2435388126.0000123336704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2435388126.0000123336704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/Zysl equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2317072156.000001EE73695000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2435126989.00003F96D3703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2435126989.00003F96D3703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.youtube.com/Zysl equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2379233232.000001EE7D0F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2438402118.000001EE7D196000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2378397958.000001EE7D196000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2455607158.000001EE7D6CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2379830332.000001EE7AB48000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2451474520.000001EE747AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2379830332.000001EE7AB48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2381207211.000001EE7A22B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2379233232.000001EE7D0F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2496792868.000001EE72496000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2465770044.000001EE7DD25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2293864107.000001EE73C51000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2473278422.000001EE73C4B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2458908999.000001EE73C37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2293864107.000001EE73C51000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2473278422.000001EE73C4B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2458908999.000001EE73C37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2379830332.000001EE7AB48000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2451474520.000001EE747AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2379830332.000001EE7AB48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000002.4056352239.000001E504D0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4056160514.00000200CB70C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000002.4056352239.000001E504D0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4056160514.00000200CB70C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000012.00000002.4056352239.000001E504D0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4056160514.00000200CB70C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2381207211.000001EE7A22B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2473682299.000001EE738C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2379233232.000001EE7D0F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2435388126.0000123336704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.comZysl equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2465770044.000001EE7DD25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2483360866.000001EE7C7C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2379610914.000001EE7C77D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com- equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2496792868.000001EE72487000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2459908255.000001EE736C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2496792868.000001EE72419000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: shavar.prod.mozaws.net
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy.tombstone.experimenter.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: a19.dscg10.akamai.net

Source: firefox.exe, 0000000E.00000003.2496357966.000001EE7272E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: firefox.exe, 0000000E.00000003.2463348557.000001EE793CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 0000000E.00000003.2463348557.000001EE793CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 0000000E.00000003.2463348557.000001EE793CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 0000000E.00000003.2463348557.000001EE793CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: firefox.exe, 0000000E.00000003.2389039249.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: firefox.exe, 0000000E.00000003.2389039249.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: firefox.exe, 0000000E.00000003.2389039249.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: firefox.exe, 0000000E.00000003.2389039249.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: firefox.exe, 0000000E.00000003.2389039249.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: firefox.exe, 0000000E.00000003.2389039249.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: firefox.exe, 0000000E.00000003.2389039249.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: firefox.exe, 0000000E.00000003.2389039249.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: firefox.exe, 0000000E.00000003.2389039249.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: firefox.exe, 0000000E.00000003.2389039249.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: firefox.exe, 0000000E.00000003.2389039249.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: firefox.exe, 0000000E.00000003.2389039249.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: firefox.exe, 0000000E.00000003.2442451801.000001EE7DD5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000000E.00000003.2379830332.000001EE7AB48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 0000000E.00000003.2451245011.000001EE74BC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2498451606.000001EE7975C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000000E.00000003.2455847135.000001EE7D19D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2442451801.000001EE7DD5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000000E.00000003.2470927765.000001EE79675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000000E.00000003.2458413611.000001EE73CD4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2293864107.000001EE73CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.comP
Source: firefox.exe, 0000000E.00000003.2496792868.000001EE724AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 0000000E.00000003.2496792868.000001EE724AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 0000000E.00000003.2401314880.000001EE72C3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 0000000E.00000003.2437309660.000014523E303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/
Source: firefox.exe, 0000000E.00000003.2435616759.000004051C903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/0
Source: firefox.exe, 0000000E.00000003.2357228520.000001EE74DB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2432101297.000001EE7167A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2441972096.000001EE7319E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2441721673.000001EE73212000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2383857337.000001EE732E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2384187293.000001EE73256000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2392875478.000001EE6E7D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2404540226.000001EE72FC2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2403928138.000001EE7311B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2271402982.000001EE6E7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2432101297.000001EE71668000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2423384120.000001EE73259000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2485090808.000001EE729F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2389534013.000001EE71663000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2450165564.000001EE7924C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2425397499.000001EE7321F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2352357721.000001EE7328B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2454640414.000001EE7165D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2500771610.000001EE71EA6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2405054723.000001EE72F7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2442515255.000001EE73293000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 0000000E.00000003.2435616759.000004051C903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/Zysl
Source: firefox.exe, 0000000E.00000003.2437556303.00003D1006703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2437309660.000014523E303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/l
Source: firefox.exe, 0000000E.00000003.2437556303.00003D1006703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/t
Source: firefox.exe, 0000000E.00000003.2389039249.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: firefox.exe, 0000000E.00000003.2389039249.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: firefox.exe, 0000000E.00000003.2389039249.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: firefox.exe, 0000000E.00000003.2389039249.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: firefox.exe, 0000000E.00000003.2382440806.000001EE792AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 0000000E.00000003.2382440806.000001EE792AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 0000000E.00000003.2382440806.000001EE792AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: firefox.exe, 0000000E.00000003.2389039249.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://www.mozilla.com0
Source: firefox.exe, 0000000E.00000003.2470009260.000001EE7B85F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 0000000E.00000003.2463348557.000001EE793CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 0000000E.00000003.2474166958.000001EE73774000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2459530512.000001EE7375B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2459908255.000001EE736B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: mozilla-temp-41.14.dr	String found in binary or memory: http://www.videolan.org/x264.html
Source: firefox.exe, 0000000E.00000003.2382440806.000001EE792AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: firefox.exe, 0000000E.00000003.2382440806.000001EE792AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000000E.00000003.2316682203.000001EE797E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://youtube.com/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000000E.00000003.2473682299.000001EE738C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: firefox.exe, 0000000E.00000003.2265564993.000001EE70F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2265741112.000001EE6EB0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2265921114.000001EE6EB31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2266127194.000001EE6EB52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 0000000E.00000003.2493369793.000001EE7D066000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2439329306.000001EE7D05A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 0000000E.00000003.2464318248.000001EE79204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2379610914.000001EE7C77D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000000E.00000003.2316251199.000001EE7ABAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2483781411.000001EE7ABAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2498015661.000001EE7ABAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2462448631.000001EE7ABAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2379830332.000001EE7ABAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2301327449.000001EE7ABAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 0000000E.00000003.2382311996.000001EE792BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000000E.00000003.2382311996.000001EE792BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwdp
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-users/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000000E.00000003.2483360866.000001EE7C7C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2379610914.000001EE7C77D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/enhancer-for-youtube/
Source: firefox.exe, 0000000E.00000003.2483360866.000001EE7C7C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2379610914.000001EE7C77D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/facebook-container/
Source: firefox.exe, 0000000E.00000003.2483360866.000001EE7C7C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2379610914.000001EE7C77D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/reddit-enhancement-suite/
Source: firefox.exe, 0000000E.00000003.2483360866.000001EE7C7C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2379610914.000001EE7C77D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/to-google-translate/
Source: firefox.exe, 0000000E.00000003.2483360866.000001EE7C7C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2379610914.000001EE7C77D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/wikipedia-context-menu-search/
Source: firefox.exe, 0000000E.00000003.2460006844.000001EE736AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads-us.rd.linksynergy.com/as.php
Source: firefox.exe, 0000000E.00000003.2496792868.000001EE72487000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2459908255.000001EE736C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2496792868.000001EE72419000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2496792868.000001EE724E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2317072156.000001EE73695000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000000E.00000003.2301670018.000001EE7AB2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2456540245.000001EE7AB2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000000E.00000003.2379610914.000001EE7C77D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
Source: firefox.exe, 0000000E.00000003.2379610914.000001EE7C77D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.adjust.com/a8bxj8j?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000000E.00000003.2379610914.000001EE7C77D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000000E.00000003.2463298452.000001EE79623000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000000E.00000003.2493077580.000001EE7D08B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2473682299.000001EE738AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2439329306.000001EE7D07B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2496028826.000001EE727DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: firefox.exe, 00000010.00000002.4056829027.0000024345CCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.4056352239.000001E504DEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4059182345.00000200CB903000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: firefox.exe, 00000010.00000002.4056829027.0000024345CCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.4056352239.000001E504DEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4059182345.00000200CB903000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: firefox.exe, 0000000E.00000003.2439329306.000001EE7D05A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000000E.00000003.2363796106.000001EE72A20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2362169912.000001EE72A11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2363134554.000001EE72A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1189266
Source: firefox.exe, 0000000E.00000003.2363796106.000001EE72A20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2362169912.000001EE72A11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2362996583.000001EE72A1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2363134554.000001EE72A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1193802
Source: firefox.exe, 0000000E.00000003.2362169912.000001EE72A11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2362169912.000001EE72A07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2363134554.000001EE72A11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2363256449.000001EE728BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1207993
Source: firefox.exe, 0000000E.00000003.2362169912.000001EE72A07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2363134554.000001EE72A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1266220
Source: firefox.exe, 0000000E.00000003.2363796106.000001EE72A20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2362169912.000001EE72A11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2363134554.000001EE72A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1283601
Source: firefox.exe, 0000000E.00000003.2363796106.000001EE72A20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2362169912.000001EE72A11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2362996583.000001EE72A1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2363134554.000001EE72A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1678448
Source: firefox.exe, 0000000E.00000003.2441972096.000001EE7319E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1694699#c21
Source: firefox.exe, 0000000E.00000003.2362169912.000001EE72A11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2363134554.000001EE72A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=792480
Source: firefox.exe, 0000000E.00000003.2362169912.000001EE72A11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2362169912.000001EE72A07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2363134554.000001EE72A11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2363256449.000001EE728BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=809550
Source: firefox.exe, 0000000E.00000003.2362169912.000001EE72A11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2362169912.000001EE72A07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2363134554.000001EE72A11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2363256449.000001EE728BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=840161
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000000E.00000003.2265564993.000001EE70F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2265741112.000001EE6EB0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2265921114.000001EE6EB31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2266127194.000001EE6EB52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000000E.00000003.2451474520.000001EE747E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: firefox.exe, 00000010.00000002.4056829027.0000024345CCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.4056352239.000001E504DEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4059182345.00000200CB903000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: firefox.exe, 00000010.00000002.4056829027.0000024345CCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.4056352239.000001E504DEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4059182345.00000200CB903000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000000E.00000003.2295021512.000001EE738CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2499801184.000001EE738C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2295077018.000001EE738C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 0000000E.00000003.2473649352.000001EE738CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 0000000E.00000003.2473649352.000001EE738CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000000E.00000003.2288543144.000001EE79423000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000000E.00000003.2460006844.000001EE736AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://datastudio.google.com/embed/reporting/
Source: firefox.exe, 0000000E.00000003.2496792868.000001EE724AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored
Source: firefox.exe, 0000000E.00000003.2326920435.000001EE732D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2359279168.000001EE732D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2318615169.000001EE732D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2383857337.000001EE732D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 0000000E.00000003.2288543144.000001EE79423000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000000E.00000003.2288543144.000001EE79423000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000000E.00000003.2288543144.000001EE79423000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000000E.00000003.2265564993.000001EE70F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2265741112.000001EE6EB0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2265921114.000001EE6EB31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2474731327.000001EE73683000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2460447284.000001EE73681000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2424654007.000001EE7A32E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2266127194.000001EE6EB52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2460191555.000001EE736A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2474603426.000001EE736A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2403023942.000001EE7A32E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 0000000E.00000003.2382543008.000001EE79288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: firefox.exe, 0000000E.00000003.2379830332.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2316251199.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2462448631.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2451245011.000001EE74B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2301327449.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.4056352239.000001E504D12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4056160514.00000200CB713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000000E.00000003.2308477242.000001EE72C3F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2304522057.000001EE72C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 0000000E.00000003.2304522057.000001EE72C35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2308418199.000001EE72C52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2308504631.000001EE72C5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000000E.00000003.2295127667.000001EE729F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000000E.00000003.2493206941.000001EE7D084000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2439329306.000001EE7D07B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com
Source: firefox.exe, 0000000E.00000003.2471013509.000001EE79364000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/
Source: firefox.exe, 0000000E.00000003.2468421001.000001EE7D14C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000000E.00000003.2379830332.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2316251199.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2462448631.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2451245011.000001EE74B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2301327449.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.4056352239.000001E504D12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4056160514.00000200CB713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000014.00000002.4056160514.00000200CB7C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000014.00000002.4056160514.00000200CB7C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000014.00000002.4056160514.00000200CB730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000000E.00000003.2463591154.000001EE7939D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 0000000E.00000003.2463591154.000001EE7939D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 0000000E.00000003.2463591154.000001EE7939D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 0000000E.00000003.2463591154.000001EE7939D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 0000000E.00000003.2463591154.000001EE7939D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 0000000E.00000003.2463591154.000001EE7939D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 0000000E.00000003.2463591154.000001EE7939D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 00000014.00000002.4056160514.00000200CB7C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000000E.00000003.2379830332.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2316251199.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2462448631.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2301327449.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 0000000E.00000003.2463591154.000001EE7939D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 0000000E.00000003.2463660050.000001EE7937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000000E.00000003.2463591154.000001EE7939D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 00000014.00000002.4056160514.00000200CB7C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000000E.00000003.2379830332.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2316251199.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2462448631.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2301327449.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 0000000E.00000003.2379830332.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2316251199.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2462448631.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2301327449.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 0000000E.00000003.2379830332.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2316251199.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2462448631.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2301327449.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000000E.00000003.2288543144.000001EE79423000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000000E.00000003.2394045508.000001EE74DE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2288938633.000001EE74DEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2354369550.000001EE74DE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2357228520.000001EE74DE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000000E.00000003.2394045508.000001EE74DE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2288938633.000001EE74DEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2354369550.000001EE74DE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2357228520.000001EE74DE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000000E.00000003.2288543144.000001EE79423000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000000E.00000003.2288543144.000001EE79423000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000000E.00000003.2265564993.000001EE70F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2265741112.000001EE6EB0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2265921114.000001EE6EB31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000000E.00000003.2378397958.000001EE7D1A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: firefox.exe, 0000000E.00000003.2379830332.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2316251199.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2462448631.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2483956770.000001EE7AB8F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2301327449.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000000E.00000003.2435616759.000004051C903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2440321388.000001EE7AA7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ib.absa.co.za/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000000E.00000003.2439329306.000001EE7D041000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/oldsyncS
Source: firefox.exe, 0000000E.00000003.2484166207.000001EE7AA42000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2380620120.000001EE7AA3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/relay
Source: firefox.exe, 0000000E.00000003.2439329306.000001EE7D041000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/H
Source: firefox.exe, 0000000E.00000003.2439329306.000001EE7D041000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/HCX
Source: firefox.exe, 0000000E.00000003.2439329306.000001EE7D041000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryU
Source: firefox.exe, 0000000E.00000003.2439329306.000001EE7D041000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryUFj
Source: firefox.exe, 0000000E.00000003.2463660050.000001EE7937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: prefs-1.js.14.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000000E.00000003.2379610914.000001EE7C77D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000000E.00000003.2472719886.000001EE74B0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.4056352239.000001E504D88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4056160514.00000200CB7F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000000E.00000003.2379610914.000001EE7C77D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/events/1/3d4ac6f1-2b22-4eb0-9880-8270e
Source: firefox.exe, 0000000E.00000003.2455607158.000001EE7D6DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/metrics/1/fd4e1ddd-2738-4e30-9308-56ad
Source: firefox.exe, 0000000E.00000003.2475230132.000001EE73612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/messaging-system/undesired-events/1/834260a2-7142-40b7
Source: firefox.exe, 0000000E.00000003.2379830332.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2316251199.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2462448631.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2301327449.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 0000000E.00000003.2288543144.000001EE79423000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000000E.00000003.2316682203.000001EE797B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2470625384.000001EE797C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2449211826.000001EE797B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302450826.000001EE797C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2462830826.000001EE797C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000000E.00000003.2288543144.000001EE79423000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000000E.00000003.2288543144.000001EE79423000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000000E.00000003.2288543144.000001EE79423000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000000E.00000003.2301670018.000001EE7AB2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000000E.00000003.2405054723.000001EE72F8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.li
Source: firefox.exe, 0000000E.00000003.2460006844.000001EE736AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lookerstudio.google.com/embed/reporting/
Source: firefox.exe, 00000012.00000002.4056352239.000001E504D86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4056160514.00000200CB78F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000000E.00000003.2389039249.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org0/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000000E.00000003.2379233232.000001EE7D0F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2438223477.000001EE7D1E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com
Source: firefox.exe, 0000000E.00000003.2379610914.000001EE7C77D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com/
Source: firefox.exe, 0000000E.00000003.2301327449.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000000E.00000003.2496028826.000001EE727DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000000E.00000003.2473610028.000001EE738D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000000E.00000003.2265921114.000001EE6EB31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000000E.00000003.2326920435.000001EE732D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2359279168.000001EE732D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2318615169.000001EE732D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2383857337.000001EE732D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000000E.00000003.2501056072.000001EE71E94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000000E.00000003.2382031130.000001EE79675000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com
Source: firefox.exe, 0000000E.00000003.2470927765.000001EE79675000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000000E.00000003.2499361195.000001EE79319000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2470810226.000001EE796CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000000E.00000003.2317072156.000001EE73695000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000000E.00000003.2317072156.000001EE73695000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000000E.00000003.2316990862.000001EE796C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2450057515.000001EE7926C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 0000000E.00000003.2464318248.000001EE79204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2451245011.000001EE74B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2301327449.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.4056352239.000001E504D12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4056160514.00000200CB713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000000E.00000003.2464318248.000001EE79204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2499801184.000001EE738C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2295077018.000001EE738C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000000E.00000003.2463591154.000001EE7939D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 0000000E.00000003.2463591154.000001EE7939D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 0000000E.00000003.2379830332.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2316251199.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2472719886.000001EE74B0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2462448631.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2301327449.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.4056352239.000001E504D88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4056160514.00000200CB7F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000014.00000002.4056160514.00000200CB7F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/useru
Source: firefox.exe, 0000000E.00000003.2381207211.000001EE7A2A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2496792868.000001EE724E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2456670552.000001EE7A2A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2317072156.000001EE73695000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000000E.00000003.2496792868.000001EE72487000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2496792868.000001EE72419000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2381207211.000001EE7A2A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2496792868.000001EE724E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2456670552.000001EE7A2A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2317072156.000001EE73695000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: places.sqlite-wal.14.dr	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-user-removal
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000000E.00000003.2308477242.000001EE72C3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000000E.00000003.2468421001.000001EE7D14C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2293864107.000001EE73C13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2485419894.000001EE727F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000000E.00000003.2443203202.000001EE7A2D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2381032083.000001EE7A2D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/firefox-relay-integration
Source: firefox.exe, 0000000E.00000003.2317072156.000001EE736D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 0000000E.00000003.2460847622.000001EE7B2BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2456136946.000001EE7B2CE000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.14.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000000E.00000003.2496792868.000001EE724AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaPlatformDecoderNotFound
Source: firefox.exe, 0000000E.00000003.2496792868.000001EE724AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaWMFNeeded
Source: firefox.exe, 0000000E.00000003.2389219113.000001EE719A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000000E.00000003.2451474520.000001EE74773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 0000000E.00000003.2460847622.000001EE7B2BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2456136946.000001EE7B2CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: places.sqlite-wal.14.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.
Source: firefox.exe, 0000000E.00000003.2288543144.000001EE79423000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000000E.00000003.2451474520.000001EE747AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000000E.00000003.2379830332.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2316251199.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2462448631.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2483956770.000001EE7AB8F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2301327449.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000000E.00000003.2288543144.000001EE79423000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000000E.00000003.2472245727.000001EE74BC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2451245011.000001EE74BC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000000E.00000003.2472245727.000001EE74BC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2451245011.000001EE74BC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 0000000E.00000003.2301670018.000001EE7AB2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2456540245.000001EE7AB2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 0000000E.00000003.2451474520.000001EE747AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2451245011.000001EE74BC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: firefox.exe, 0000000E.00000003.2379830332.000001EE7AB48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/(
Source: firefox.exe, 00000010.00000002.4056829027.0000024345CCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.4056352239.000001E504DEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4059182345.00000200CB903000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: firefox.exe, 0000000E.00000003.2449211826.000001EE797B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2403023942.000001EE7A32E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000000E.00000003.2472245727.000001EE74BC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2451245011.000001EE74BC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 0000000E.00000003.2472245727.000001EE74BC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2451245011.000001EE74BC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 0000000E.00000003.2301670018.000001EE7AB2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2456540245.000001EE7AB2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000000E.00000003.2293864107.000001EE73C51000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2473278422.000001EE73C4B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2458908999.000001EE73C37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000000E.00000003.2301670018.000001EE7AB2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2456540245.000001EE7AB2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: firefox.exe, 0000000E.00000003.2293864107.000001EE73C51000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2473278422.000001EE73C4B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2458908999.000001EE73C37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 0000000E.00000003.2389039249.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: firefox.exe, 0000000E.00000003.2293864107.000001EE73C51000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2473278422.000001EE73C4B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2458908999.000001EE73C37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 0000000E.00000003.2472245727.000001EE74BC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2451245011.000001EE74BC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: firefox.exe, 0000000E.00000003.2293864107.000001EE73C51000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2473278422.000001EE73C4B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2458908999.000001EE73C37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000000E.00000003.2471458367.000001EE792C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2382311996.000001EE792BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 0000000E.00000003.2290604426.000001EE7951E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000000E.00000003.2316682203.000001EE797E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: firefox.exe, 0000000E.00000003.2475067911.000001EE73625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2265564993.000001EE70F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2265741112.000001EE6EB0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2265921114.000001EE6EB31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2424654007.000001EE7A32E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2266127194.000001EE6EB52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2403023942.000001EE7A32E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000000E.00000003.2301670018.000001EE7AB2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2456540245.000001EE7AB2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000000E.00000003.2301670018.000001EE7AB2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2456540245.000001EE7AB2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000000E.00000003.2301670018.000001EE7AB2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2456540245.000001EE7AB2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 0000000E.00000003.2475067911.000001EE73625000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mobilesuica.com/
Source: firefox.exe, 0000000E.00000003.2301015181.000001EE7ABF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2494848310.000001EE7923F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2316682203.000001EE797D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2495222616.000001EE7921F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2464318248.000001EE7921F000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.14.dr	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000000E.00000003.2493778425.000001EE7978A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: firefox.exe, 0000000E.00000003.2437309660.000014523E303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/Zysl
Source: firefox.exe, 0000000E.00000003.2460847622.000001EE7B2BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2456136946.000001EE7B2CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: places.sqlite-wal.14.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.
Source: firefox.exe, 0000000E.00000003.2304522057.000001EE72C35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2308418199.000001EE72C52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2308504631.000001EE72C5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 0000000E.00000003.2483493164.000001EE7C7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2379610914.000001EE7C77D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/anything/?
Source: firefox.exe, 0000000E.00000003.2460847622.000001EE7B2BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2456136946.000001EE7B2CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: places.sqlite-wal.14.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.
Source: firefox.exe, 0000000E.00000003.2443203202.000001EE7A2D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2381032083.000001EE7A2D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/about/legal/terms/subscription-services/
Source: firefox.exe, 0000000E.00000003.2443203202.000001EE7A2D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2381032083.000001EE7A2D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/subscription-services/
Source: firefox.exe, 0000000E.00000003.2460847622.000001EE7B2BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2456136946.000001EE7B2CE000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.14.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000000E.00000003.2483360866.000001EE7C7C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2379610914.000001EE7C77D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-mod
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 00000012.00000002.4056352239.000001E504DC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4056160514.00000200CB78F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000000E.00000003.2463591154.000001EE7939D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 00000010.00000002.4056829027.0000024345CCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/7
Source: firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000000E.00000003.2463591154.000001EE7939D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: firefox.exe, 0000000E.00000003.2472245727.000001EE74BC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2301670018.000001EE7AB2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2456540245.000001EE7AB2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2451245011.000001EE74BC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000000E.00000003.2496792868.000001EE724AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000000E.00000003.2451474520.000001EE747AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2451245011.000001EE74BC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000010.00000002.4056829027.0000024345CCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.4056352239.000001E504DEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4059182345.00000200CB903000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: firefox.exe, 0000000E.00000003.2435388126.0000123336704000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2438944650.000001EE7D0F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2499115713.000001EE79364000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2379233232.000001EE7D0F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2471013509.000001EE79364000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/
Source: firefox.exe, 0000000E.00000003.2472245727.000001EE74BC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2451245011.000001EE74BC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 0000000E.00000003.2379830332.000001EE7AB48000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2473278422.000001EE73C4B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2458908999.000001EE73C37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.4056352239.000001E504D0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4056160514.00000200CB70C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000000E.00000003.2496792868.000001EE724AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 0000000E.00000003.2459407032.000001EE737AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000000E.00000003.2472807911.000001EE747AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2451474520.000001EE747AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000000E.00000003.2459623834.000001EE736DC000.00000004.00000800.00020000.00000000.sdmp, recovery.jsonlz4.tmp.14.dr	String found in binary or memory: https://youtube.com/account?=
Source: firefox.exe, 00000014.00000002.4055045280.00000200CB530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://ac
Source: firefox.exe, 00000012.00000002.4055895476.000001E504BF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://acB
Source: firefox.exe, 0000000E.00000003.2498451606.000001EE7975C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.4054976123.000002434582A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.4056354782.0000024345BE4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.4054810218.000001E504B0A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.4054810218.000001E504B00000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.4055895476.000001E504BF4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4054658181.00000200CB3FA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4055045280.00000200CB534000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000000C.00000002.2253427516.000001F9F72B9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000002.2260331449.0000023F292CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000012.00000002.4054810218.000001E504B0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd?9X
Source: firefox.exe, 00000010.00000002.4054976123.0000024345820000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.4056354782.0000024345BE4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.4054810218.000001E504B00000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.4055895476.000001E504BF4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4055045280.00000200CB534000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4054658181.00000200CB3F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 00000014.00000002.4054658181.00000200CB3FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdd
Source: firefox.exe, 00000010.00000002.4054976123.000002434582A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdg
Source: firefox.exe, 00000014.00000002.4054658181.00000200CB3F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdp
Source: firefox.exe, 00000010.00000002.4054976123.0000024345820000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwds
Source: firefox.exe, 0000000E.00000003.2316682203.000001EE797B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2449211826.000001EE797B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2470625384.000001EE797CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2462830826.000001EE797C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56401 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 56409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56409
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56404
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56405
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56407
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56400
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56401
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56403
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 56402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56399 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56403 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56398
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56399
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.193.91:443 -> 192.168.2.6:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:56398 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:56399 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:56403 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:56400 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:56401 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:56402 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:56404 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:56404 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:56405 version: TLS 1.2

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_005BEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_005BEAFF

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_005BED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_005BED6A

Source: C:\Users\user\Desktop\random.exe

0_2_005BEAFF

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_005AAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_005AAA57

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_005D9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_005D9576

System Summary

Binary is likely a compiled AutoIt script file

Source: random.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: random.exe, 00000000.00000000.2206520291.0000000000602000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_056897ea-c
Source: random.exe, 00000000.00000000.2206520291.0000000000602000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_5c7052e6-5
Source: random.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_0d44d91e-b
Source: random.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_799c4a80-6

Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 18_2_000001E504BC3877 NtQuerySystemInformation,		18_2_000001E504BC3877
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 18_2_000001E504BE5672 NtQuerySystemInformation,		18_2_000001E504BE5672

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_005AD5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_005AD5EB

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_005A1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_005A1201

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_005AE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_005AE8F6

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0054BF40	0_2_0054BF40
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005B2046	0_2_005B2046
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00548060	0_2_00548060
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005A8298	0_2_005A8298
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0057E4FF	0_2_0057E4FF
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0057676B	0_2_0057676B
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005D4873	0_2_005D4873
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0054CAF0	0_2_0054CAF0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0056CAA0	0_2_0056CAA0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0055CC39	0_2_0055CC39
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00576DD9	0_2_00576DD9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0055B119	0_2_0055B119
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005491C0	0_2_005491C0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00561394	0_2_00561394
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0056781B	0_2_0056781B
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0055997D	0_2_0055997D
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00547920	0_2_00547920
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00567A4A	0_2_00567A4A
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00567CA7	0_2_00567CA7
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005CBE44	0_2_005CBE44
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00579EEE	0_2_00579EEE
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 18_2_000001E504BC3877	18_2_000001E504BC3877
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 18_2_000001E504BE5672	18_2_000001E504BE5672
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 18_2_000001E504BE5D9C	18_2_000001E504BE5D9C
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 18_2_000001E504BE56B2	18_2_000001E504BE56B2

Source: C:\Users\user\Desktop\random.exe	Code function: String function: 00549CB3 appears 31 times
Source: C:\Users\user\Desktop\random.exe	Code function: String function: 00560A30 appears 46 times
Source: C:\Users\user\Desktop\random.exe	Code function: String function: 0055F9F2 appears 40 times

Source: random.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal76.troj.evad.winEXE@34/38@74/14

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_005B37B5 GetLastError,FormatMessageW,

0_2_005B37B5

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005A10BF AdjustTokenPrivileges,CloseHandle,		0_2_005A10BF
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005A16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_005A16C3

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_005B51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_005B51CD

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_005AD4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_005AD4DC

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_005B648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_005B648E

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_005442A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_005442A2

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File created: C:\Users\user\AppData\Local\Mozilla\Firefox\SkeletonUILock-c388d246

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6008:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1968:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2268:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3052:120:WilError_03

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File created: C:\Users\user\AppData\Local\Temp\firefox

Jump to behavior

Source: random.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: firefox.exe, 0000000E.00000003.2493247868.000001EE7D07B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2439329306.000001EE7D07B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE timestamp BETWEEN date(:dateFrom) AND date(:dateTo);
Source: firefox.exe, 0000000E.00000003.2493247868.000001EE7D07B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2439329306.000001EE7D07B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE events (id INTEGER PRIMARY KEY, type INTEGER NOT NULL, count INTEGER NOT NULL, timestamp DATE );
Source: firefox.exe, 0000000E.00000003.2493247868.000001EE7D07B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2439329306.000001EE7D07B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INSERT INTO events (type, count, timestamp) VALUES (:type, 1, date(:date));
Source: firefox.exe, 0000000E.00000003.2493247868.000001EE7D07B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2439329306.000001EE7D07B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;
Source: firefox.exe, 0000000E.00000003.2438402118.000001EE7D196000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2378397958.000001EE7D196000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;
Source: firefox.exe, 0000000E.00000003.2493247868.000001EE7D07B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2439329306.000001EE7D07B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;Fy6
Source: firefox.exe, 0000000E.00000003.2493247868.000001EE7D07B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2439329306.000001EE7D07B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE events SET count = count + 1 WHERE id = :id;-
Source: firefox.exe, 0000000E.00000003.2493247868.000001EE7D07B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2439329306.000001EE7D07B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9'
Source: firefox.exe, 0000000E.00000003.2493247868.000001EE7D07B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2439329306.000001EE7D07B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9
Source: firefox.exe, 0000000E.00000003.2493247868.000001EE7D07B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2439329306.000001EE7D07B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE type = :type AND timestamp = date(:date);

Source: random.exe	ReversingLabs: Detection: 29%
Source: random.exe	Virustotal: Detection: 30%

Source: unknown	Process created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2288 -parentBuildID 20230927232528 -prefsHandle 2220 -prefMapHandle 2212 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9fbe32b-4c03-4d39-93db-854142882339} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 1ee61071110 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4116 -parentBuildID 20230927232528 -prefsHandle 3996 -prefMapHandle 4000 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98ef1f0c-9b53-4068-86ae-42f53ec98957} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 1ee71479110 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4456 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4472 -prefMapHandle 4564 -prefsLen 33076 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {127eaadf-f0b2-40e6-aa1b-0559c96af4d0} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 1ee79169d10 utility
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2288 -parentBuildID 20230927232528 -prefsHandle 2220 -prefMapHandle 2212 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9fbe32b-4c03-4d39-93db-854142882339} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 1ee61071110 socket	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4116 -parentBuildID 20230927232528 -prefsHandle 3996 -prefMapHandle 4000 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98ef1f0c-9b53-4068-86ae-42f53ec98957} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 1ee71479110 rdd	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4456 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4472 -prefMapHandle 4564 -prefsLen 33076 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {127eaadf-f0b2-40e6-aa1b-0559c96af4d0} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 1ee79169d10 utility	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: random.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: webauthn.pdb source: firefox.exe, 0000000E.00000003.2385012290.000001EE75156000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.14.dr
Source:	Binary string: NapiNSP.pdbUGP source: firefox.exe, 0000000E.00000003.2399600054.000001EE6E9A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ktmw32.pdb source: firefox.exe, 0000000E.00000003.2391825603.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2393829428.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2392776545.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: NapiNSP.pdb source: firefox.exe, 0000000E.00000003.2399600054.000001EE6E9A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: npmproxy.pdbUGP source: firefox.exe, 0000000E.00000003.2400880018.000001EE6E9A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netprofm.pdb source: firefox.exe, 0000000E.00000003.2397348606.000001EE75101000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.14.dr
Source:	Binary string: webauthn.pdbGCTL source: firefox.exe, 0000000E.00000003.2385012290.000001EE75156000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: npmproxy.pdb source: firefox.exe, 0000000E.00000003.2400880018.000001EE6E9A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ktmw32.pdbGCTL source: firefox.exe, 0000000E.00000003.2391825603.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2393829428.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2392776545.000001EE6E98C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netprofm.pdbUGP source: firefox.exe, 0000000E.00000003.2397348606.000001EE75101000.00000004.00000020.00020000.00000000.sdmp

Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_005442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_005442DE

Source: gmpopenh264.dll.tmp.14.dr

Static PE information: section name: .rodata

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00560A76 push ecx; ret

0_2_00560A89

Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)			Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0055F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_0055F98E
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005D1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_005D1C41

Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\random.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-95153

Source: C:\Program Files\Mozilla Firefox\firefox.exe

Code function: 18_2_000001E504BC3877 rdtsc

18_2_000001E504BC3877

Source: C:\Users\user\Desktop\random.exe

API coverage: 3.8 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005ADBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_005ADBBE
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0057C2A2 FindFirstFileExW,	0_2_0057C2A2
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005B68EE FindFirstFileW,FindClose,	0_2_005B68EE
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005B698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_005B698F
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005AD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_005AD076
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005AD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_005AD3A9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005B9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_005B9642
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005B979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_005B979D
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005B9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_005B9B2B
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005B5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_005B5C97

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_005442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_005442DE

Source: firefox.exe, 00000010.00000002.4060139559.0000024345E00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW<
Source: firefox.exe, 00000012.00000002.4054810218.000001E504B0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp]&
Source: firefox.exe, 00000012.00000002.4058967728.000001E505260000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllYHV
Source: firefox.exe, 00000010.00000002.4054976123.000002434582A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: random.exe, 00000000.00000003.2290385686.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.2291246325.0000000000FBB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.2290278643.0000000000F73000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.2290922013.0000000000F82000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4054658181.00000200CB3FA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4058545002.00000200CB814000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 00000010.00000002.4059695655.0000024345D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: firefox.exe, 00000012.00000002.4058967728.000001E505260000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll!^
Source: firefox.exe, 00000012.00000002.4058967728.000001E505260000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW2U)
Source: firefox.exe, 00000012.00000002.4058967728.000001E505260000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll,H
Source: random.exe, 00000000.00000002.2295098388.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.2290385686.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.2292654557.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.2290278643.0000000000F73000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.2290922013.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW!
Source: firefox.exe, 00000012.00000002.4058967728.000001E505260000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll B
Source: firefox.exe, 00000010.00000002.4060139559.0000024345E00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\random.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

Code function: 18_2_000001E504BC3877 rdtsc

18_2_000001E504BC3877

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_005BEAA2 BlockInput,

0_2_005BEAA2

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00572622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00572622

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_005442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_005442DE

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00564CE8 mov eax, dword ptr fs:[00000030h]

0_2_00564CE8

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_005A0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_005A0B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00572622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00572622
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0056083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0056083F
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005609D5 SetUnhandledExceptionFilter,	0_2_005609D5
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00560C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00560C21

Source: C:\Users\user\Desktop\random.exe

0_2_005A1201

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00582BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00582BA5

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_005AB226 SendInput,keybd_event,

0_2_005AB226

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_005C22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_005C22DA

Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior

Source: C:\Users\user\Desktop\random.exe

0_2_005A0B62

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_005A1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_005A1663

Source: random.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: random.exe	Binary or memory string: Shell_TrayWnd
Source: firefox.exe, 0000000E.00000003.2392547860.000001EE75156000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hSoftware\Policies\Microsoft\Windows\PersonalizationNoChangingStartMenuBackgroundPersonalColors_BackgroundWilStaging_02RtlDisownModuleHeapAllocationRtlQueryFeatureConfigurationRtlRegisterFeatureConfigurationChangeNotificationRtlSubscribeWnfStateChangeNotificationRtlDllShutdownInProgressntdll.dllNtQueryWnfStateDataLocal\SM0:%d:%d:%hs_p0Local\SessionImmersiveColorPreferenceBEGINTHMthmfile\Sessions\%d\Windows\ThemeSectionMessageWindowendthemewndThemeApiConnectionRequest\ThemeApiPortwinsta0SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\PersonalizeAppsUseLightThemeSystemUsesLightThemedefaultshell\themes\uxtheme\render.cppCompositedWindow::WindowdeletedrcacheMDIClientSoftware\Microsoft\Windows\DWMColorPrevalenceSoftware\Microsoft\Windows\CurrentVersion\ImmersiveShellTabletModeMENUAccentColorSoftware\Microsoft\Windows\CurrentVersion\Explorer\AccentDefaultStartColorControl Panel\DesktopAutoColorizationAccentColorMenuStartColorMenuAutoColorSoftware\Microsoft\Windows\CurrentVersion\Themes\History\ColorsSoftware\Microsoft\Windows\CurrentVersion\Themes\HistoryAccentPaletteTab$Shell_TrayWndLocal\SessionImmersiveColorMutex

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00560698 cpuid

0_2_00560698

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_0059D21C GetLocalTime,

0_2_0059D21C

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_0059D27A GetUserNameW,

0_2_0059D27A

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_0057B952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_0057B952

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_005442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_005442DE

Stealing of Sensitive Information

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: random.exe PID: 2432, type: MEMORYSTR

Source: random.exe	Binary or memory string: WIN_81
Source: random.exe	Binary or memory string: WIN_XP
Source: random.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: random.exe	Binary or memory string: WIN_XPe
Source: random.exe	Binary or memory string: WIN_VISTA
Source: random.exe	Binary or memory string: WIN_7
Source: random.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: random.exe PID: 2432, type: MEMORYSTR

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005C1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_005C1204
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_005C1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_005C1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	2 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	1 DLL Side-Loading	NTDS	16 System Information Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 Extra Window Memory Injection	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Process Injection	1 Masquerading	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	2 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
random.exe	30%	ReversingLabs	Win32.Trojan.Generic
random.exe	31%	Virustotal		Browse
random.exe	100%	Avira	TR/ATRAPS.Gen

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://youtube.com0	0%	Avira URL Cloud	safe
http://detectportal.firefox.comP	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	23.215.0.132	true	false	high
star-mini.c10r.facebook.com	157.240.252.35	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
twitter.com	104.244.42.193	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
shavar.prod.mozaws.net	34.209.7.244	true	false	high
services.addons.mozilla.org	151.101.193.91	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
dyna.wikimedia.org	185.15.59.224	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
youtube.com	172.217.18.14	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
a19.dscg10.akamai.net	2.22.61.56	true	false	high
youtube-ui.l.google.com	172.217.16.206	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
reddit.map.fastly.net	151.101.193.140	true	false	high
ipv4only.arpa	192.0.0.170	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
normandy.tombstone.experimenter.prod.webservices.mozgcp.net	34.49.51.44	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
www.reddit.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
normandy.cdn.mozilla.net	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 00000014.00000002.4056160514.00000200CB7C4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://detectportal.firefox.com/	firefox.exe, 0000000E.00000003.2379830332.000001EE7AB48000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://datastudio.google.com/embed/reporting/	firefox.exe, 0000000E.00000003.2460006844.000001EE736AF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.mozilla.com0	gmpopenh264.dll.tmp.14.dr	false		high
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	firefox.exe, 0000000E.00000003.2288543144.000001EE79423000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000012.00000002.4056352239.000001E504D86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4056160514.00000200CB78F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.leboncoin.fr/	firefox.exe, 0000000E.00000003.2301670018.000001EE7AB2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2456540245.000001EE7AB2B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 0000000E.00000003.2464318248.000001EE79204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2499801184.000001EE738C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2295077018.000001EE738C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://shavar.services.mozilla.com	firefox.exe, 0000000E.00000003.2382031130.000001EE79675000.00000004.00000800.00020000.00000000.sdmp	false		high
https://completion.amazon.com/search/complete?q=	firefox.exe, 0000000E.00000003.2265564993.000001EE70F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2265741112.000001EE6EB0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2265921114.000001EE6EB31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2266127194.000001EE6EB52000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000000E.00000003.2496792868.000001EE72487000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2459908255.000001EE736C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2496792868.000001EE72419000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2496792868.000001EE724E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2317072156.000001EE73695000.00000004.00000800.00020000.00000000.sdmp	false		high
https://identity.mozilla.com/ids/ecosystem_telemetryU	firefox.exe, 0000000E.00000003.2439329306.000001EE7D041000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/breach-details/	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 0000000E.00000003.2496792868.000001EE724AD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000000E.00000003.2449211826.000001EE797B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2403023942.000001EE7A32E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/0	firefox.exe, 0000000E.00000003.2435616759.000004051C903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 0000000E.00000003.2265564993.000001EE70F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2265741112.000001EE6EB0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2265921114.000001EE6EB31000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/addon/	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	firefox.exe, 0000000E.00000003.2308477242.000001EE72C3F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://youtube.com/	firefox.exe, 0000000E.00000003.2472807911.000001EE747AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2451474520.000001EE747AC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://youtube.com0	firefox.exe, 0000000E.00000003.2316682203.000001EE797B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2449211826.000001EE797B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2470625384.000001EE797CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2462830826.000001EE797C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://youtube.com/account?=https://ac	firefox.exe, 00000014.00000002.4055045280.00000200CB530000.00000004.00000020.00020000.00000000.sdmp	false		high
https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht	firefox.exe, 0000000E.00000003.2379610914.000001EE7C77D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://api.accounts.firefox.com/v1	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://login.li	firefox.exe, 0000000E.00000003.2405054723.000001EE72F8C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	prefs-1.js.14.dr	false		high
https://www.amazon.com/	firefox.exe, 0000000E.00000003.2451474520.000001EE747AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2451245011.000001EE74BC4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/(	firefox.exe, 0000000E.00000003.2379830332.000001EE7AB48000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	firefox.exe, 0000000E.00000003.2379830332.000001EE7AB48000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2473278422.000001EE73C4B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2458908999.000001EE73C37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.4056352239.000001E504D0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4056160514.00000200CB70C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1283601	firefox.exe, 0000000E.00000003.2363796106.000001EE72A20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2362169912.000001EE72A11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2363134554.000001EE72A11000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://MD8.mozilla.org/1/m	firefox.exe, 0000000E.00000003.2473682299.000001EE738C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bbc.co.uk/	firefox.exe, 0000000E.00000003.2301670018.000001EE7AB2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2456540245.000001EE7AB2B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/firefox/addon/to-google-translate/	firefox.exe, 0000000E.00000003.2483360866.000001EE7C7C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2379610914.000001EE7C77D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000014.00000002.4056160514.00000200CB7C4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:	firefox.exe, 0000000E.00000003.2496357966.000001EE7272E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1266220	firefox.exe, 0000000E.00000003.2362169912.000001EE72A07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2363134554.000001EE72A11000.00000004.00000800.00020000.00000000.sdmp	false		high
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 0000000E.00000003.2326920435.000001EE732D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2359279168.000001EE732D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2318615169.000001EE732D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2383857337.000001EE732D4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 0000000E.00000003.2439329306.000001EE7D05A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
http://detectportal.firefox.comP	firefox.exe, 0000000E.00000003.2458413611.000001EE73CD4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2293864107.000001EE73CD4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000000E.00000003.2381207211.000001EE7A2A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2496792868.000001EE724E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2456670552.000001EE7A2A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2317072156.000001EE73695000.00000004.00000800.00020000.00000000.sdmp	false		high
https://youtube.com/account?=	firefox.exe, 0000000E.00000003.2459623834.000001EE736DC000.00000004.00000800.00020000.00000000.sdmp, recovery.jsonlz4.tmp.14.dr	false		high
https://shavar.services.mozilla.com/	firefox.exe, 0000000E.00000003.2470927765.000001EE79675000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 0000000E.00000003.2464318248.000001EE79204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2451245011.000001EE74B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2301327449.000001EE7AB75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.4056352239.000001E504D12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4056160514.00000200CB713000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 0000000E.00000003.2301670018.000001EE7AB2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2456540245.000001EE7AB2B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.	places.sqlite-wal.14.dr	false		high
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
http://a9.com/-/spec/opensearch/1.0/	firefox.exe, 0000000E.00000003.2463348557.000001EE793CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/user/dashboard	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/about	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
http://mozilla.org/MPL/2.0/.	firefox.exe, 0000000E.00000003.2357228520.000001EE74DB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2432101297.000001EE7167A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2441972096.000001EE7319E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2441721673.000001EE73212000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2383857337.000001EE732E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2384187293.000001EE73256000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2392875478.000001EE6E7D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2404540226.000001EE72FC2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2403928138.000001EE7311B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2271402982.000001EE6E7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2432101297.000001EE71668000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2423384120.000001EE73259000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2485090808.000001EE729F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2389534013.000001EE71663000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2450165564.000001EE7924C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2425397499.000001EE7321F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2352357721.000001EE7328B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2454640414.000001EE7165D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2500771610.000001EE71EA6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2405054723.000001EE72F7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2442515255.000001EE73293000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.openh264.org/	firefox.exe, 0000000E.00000003.2496792868.000001EE724AD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://youtube.com/	firefox.exe, 0000000E.00000003.2316682203.000001EE797E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://coverage.mozilla.org	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	gmpopenh264.dll.tmp.14.dr	false		high
http://x1.c.lencr.org/0	firefox.exe, 0000000E.00000003.2382440806.000001EE792AD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	firefox.exe, 0000000E.00000003.2382440806.000001EE792AD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://a9.com/-/spec/opensearch/1.1/	firefox.exe, 0000000E.00000003.2463348557.000001EE793CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 0000000E.00000003.2288543144.000001EE79423000.00000004.00000800.00020000.00000000.sdmp	false		high
https://blocked.cdn.mozilla.net/	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored	firefox.exe, 0000000E.00000003.2496792868.000001EE724AD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2019-09/schema	firefox.exe, 0000000E.00000003.2316682203.000001EE797B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2470625384.000001EE797C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2449211826.000001EE797B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302450826.000001EE797C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2462830826.000001EE797C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://developer.mozilla.org/en/docs/DOM:element.addEventListener	firefox.exe, 0000000E.00000003.2496792868.000001EE724AD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/?t=ffab&q=	firefox.exe, 0000000E.00000003.2382543008.000001EE79288000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://identity.mozilla.com/apps/relay	firefox.exe, 0000000E.00000003.2484166207.000001EE7AA42000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2380620120.000001EE7AA3E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mozilla.cloudflare-dns.com/dns-query	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	firefox.exe, 0000000E.00000003.2451474520.000001EE74773000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1678448	firefox.exe, 0000000E.00000003.2363796106.000001EE72A20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2362169912.000001EE72A11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2362996583.000001EE72A1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2363134554.000001EE72A11000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/Zysl	firefox.exe, 0000000E.00000003.2435616759.000004051C903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/firefox/addon/reddit-enhancement-suite/	firefox.exe, 0000000E.00000003.2483360866.000001EE7C7C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2379610914.000001EE7C77D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000000E.00000003.2473649352.000001EE738CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.amazon.co.uk/	firefox.exe, 0000000E.00000003.2301670018.000001EE7AB2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2456540245.000001EE7AB2B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/	firefox.exe, 0000000E.00000003.2468421001.000001EE7D14C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/preferences	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://screenshots.firefox.com/	firefox.exe, 0000000E.00000003.2265921114.000001EE6EB31000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/search	firefox.exe, 0000000E.00000003.2475067911.000001EE73625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2265564993.000001EE70F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2265741112.000001EE6EB0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2265921114.000001EE6EB31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2424654007.000001EE7A32E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2266127194.000001EE6EB52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2403023942.000001EE7A32E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://relay.firefox.com/api/v1/	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://topsites.services.mozilla.com/cid/	firefox.exe, 00000010.00000002.4056158820.0000024345B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.4055087733.000001E504B40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.4055672507.00000200CB570000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.wykop.pl/	firefox.exe, 0000000E.00000003.2472245727.000001EE74BC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2451245011.000001EE74BC4000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.209.7.244	shavar.prod.mozaws.net	United States	16509	AMAZON-02US	false
172.217.18.14	youtube.com	United States	15169	GOOGLEUS	false
2.22.61.56	a19.dscg10.akamai.net	European Union	20940	AKAMAI-ASN1EU	false
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.107.243.93	push.services.mozilla.com	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.49.51.44	normandy.tombstone.experimenter.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
151.101.193.91	services.addons.mozilla.org	United States	54113	FASTLYUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1615904
Start date and time:	2025-02-15 17:36:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	random.exe
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@34/38@74/14
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 96% Number of executed functions: 51 Number of non-executed functions: 290
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.80.78, 142.250.184.202, 216.58.206.42, 142.250.186.46, 142.250.185.142, 13.107.246.45, 2.18.97.153, 52.149.20.212
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ciscobinary.openh264.org, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, 7.4.8.4.4.3.1.4.0.0.0.0.0.0.0.0.0.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, incoming.telemetry.mozilla.org, ctldl.windowsupdate.com, aus5.mozilla.org, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, redirector.gvt1.com, azureedge-t-prod.trafficmanager.net, safebrowsing.googleapis.com, location.services.mozilla.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.49.51.44	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	https://click.email.active.com/f/a/QSi9x4aE2he14davSEuWGA~~/AAOtGhA~/kCsxXIFUFIqn8bLjeBjiWvXzS1oALejcnJaENGD5HzxCxYcQPgOnguf7W7QR0nstNy3af6IEFijde20JNtyjlBNxLI0bX7JKoy33NtFXuonYqm1BW9Wf6skdSQzo3eWILaXt_wuE4A6m9d1Klo8VXs3rqTVh6-1Al9IfjjWdQJOKyrlNb176zlF8FZpTlnqm5WBncvTjE56A2A6kqUXCIJMwI6xmadyYYBsgJGHSm9iQ2lk7sYftRmiO3y-Sbg-z	Get hash	malicious	Unknown	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	4114122C0DCA23F637D83EED33F9ABCDC92709E2AC6F63FFD55F5AAE519B58AB.zip	Get hash	malicious	Unknown	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
2.22.61.56	random.exe	Get hash	malicious	Credential Flusher	Browse	ciscobinary.openh264.org/openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
	random.exe	Get hash	malicious	Credential Flusher	Browse	ciscobinary.openh264.org/openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
	random.exe	Get hash	malicious	Credential Flusher	Browse	ciscobinary.openh264.org/openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
34.149.100.209	https://steamecomrmunity.com/s/10423910953	Get hash	malicious	Unknown	Browse
	Notification Detail.html	Get hash	malicious	Unknown	Browse
	https://storage.googleapis.com/yasinsoulaiman00200102055/yasinsoulaiman00200102055.html#4Laxsc88075pMVT611lryovfdyzn369QPMJEJMGSLMNNGI223458FFVC3610M25	Get hash	malicious	Phisher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	https://click.email.active.com/f/a/QSi9x4aE2he14davSEuWGA~~/AAOtGhA~/kCsxXIFUFIqn8bLjeBjiWvXzS1oALejcnJaENGD5HzxCxYcQPgOnguf7W7QR0nstNy3af6IEFijde20JNtyjlBNxLI0bX7JKoy33NtFXuonYqm1BW9Wf6skdSQzo3eWILaXt_wuE4A6m9d1Klo8VXs3rqTVh6-1Al9IfjjWdQJOKyrlNb176zlF8FZpTlnqm5WBncvTjE56A2A6kqUXCIJMwI6xmadyYYBsgJGHSm9iQ2lk7sYftRmiO3y-Sbg-z	Get hash	malicious	Unknown	Browse
	px4Y74kUj2.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
example.org	https://steamecomrmunity.com/s/10423910953	Get hash	malicious	Unknown	Browse	23.215.0.132
	Notification Detail.html	Get hash	malicious	Unknown	Browse	23.215.0.133
	https://drive.google.com/file/d/1FVDnmU54G6_GaADSmojqRgpCVK0Y1U9s/view?usp=sharing	Get hash	malicious	Remcos	Browse	96.7.128.186
	random.exe	Get hash	malicious	Credential Flusher	Browse	96.7.128.192
	random.exe	Get hash	malicious	Credential Flusher	Browse	23.215.0.132
	https://click.email.active.com/f/a/QSi9x4aE2he14davSEuWGA~~/AAOtGhA~/kCsxXIFUFIqn8bLjeBjiWvXzS1oALejcnJaENGD5HzxCxYcQPgOnguf7W7QR0nstNy3af6IEFijde20JNtyjlBNxLI0bX7JKoy33NtFXuonYqm1BW9Wf6skdSQzo3eWILaXt_wuE4A6m9d1Klo8VXs3rqTVh6-1Al9IfjjWdQJOKyrlNb176zlF8FZpTlnqm5WBncvTjE56A2A6kqUXCIJMwI6xmadyYYBsgJGHSm9iQ2lk7sYftRmiO3y-Sbg-z	Get hash	malicious	Unknown	Browse	23.215.0.132
	YWih6T9PUp.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Stealc	Browse	23.215.0.133
	random.exe	Get hash	malicious	Credential Flusher	Browse	23.215.0.132
	random.exe	Get hash	malicious	Credential Flusher	Browse	96.7.128.186
shavar.prod.mozaws.net	https://steamecomrmunity.com/s/10423910953	Get hash	malicious	Unknown	Browse	34.208.172.229
	Notification Detail.html	Get hash	malicious	Unknown	Browse	34.208.172.229
	https://drive.google.com/file/d/1FVDnmU54G6_GaADSmojqRgpCVK0Y1U9s/view?usp=sharing	Get hash	malicious	Remcos	Browse	52.35.152.253
	random.exe	Get hash	malicious	Credential Flusher	Browse	52.35.181.117
	random.exe	Get hash	malicious	Credential Flusher	Browse	34.208.172.229
	https://click.email.active.com/f/a/QSi9x4aE2he14davSEuWGA~~/AAOtGhA~/kCsxXIFUFIqn8bLjeBjiWvXzS1oALejcnJaENGD5HzxCxYcQPgOnguf7W7QR0nstNy3af6IEFijde20JNtyjlBNxLI0bX7JKoy33NtFXuonYqm1BW9Wf6skdSQzo3eWILaXt_wuE4A6m9d1Klo8VXs3rqTVh6-1Al9IfjjWdQJOKyrlNb176zlF8FZpTlnqm5WBncvTjE56A2A6kqUXCIJMwI6xmadyYYBsgJGHSm9iQ2lk7sYftRmiO3y-Sbg-z	Get hash	malicious	Unknown	Browse	52.35.181.117
	YWih6T9PUp.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Stealc	Browse	52.35.181.117
	random.exe	Get hash	malicious	Credential Flusher	Browse	52.35.152.253
	random.exe	Get hash	malicious	Credential Flusher	Browse	52.35.152.253
twitter.com	https://steamecomrmunity.com/s/10423910953	Get hash	malicious	Unknown	Browse	104.244.42.65
	Notification Detail.html	Get hash	malicious	Unknown	Browse	104.244.42.129
	https://storage.googleapis.com/yasinsoulaiman00200102055/yasinsoulaiman00200102055.html#4Laxsc88075pMVT611lryovfdyzn369QPMJEJMGSLMNNGI223458FFVC3610M25	Get hash	malicious	Phisher	Browse	104.244.42.129
star-mini.c10r.facebook.com	https://we324msnbi.pages.dev/Xfi_files/prism-ui.esm-53da3fe.js	Get hash	malicious	HTMLPhisher	Browse	157.240.252.35
	https://we324msnbi.pages.dev/assets/favicons/default/site.webmanifest	Get hash	malicious	HTMLPhisher	Browse	157.240.252.35
	http://avaliadordemarcas.net.br/	Get hash	malicious	Unknown	Browse	157.240.0.35
	https://steamecomrmunity.com/s/10423910953	Get hash	malicious	Unknown	Browse	157.240.252.35
	Notification Detail.html	Get hash	malicious	Unknown	Browse	157.240.252.35
	https://storage.googleapis.com/yasinsoulaiman00200102055/yasinsoulaiman00200102055.html#4Laxsc88075pMVT611lryovfdyzn369QPMJEJMGSLMNNGI223458FFVC3610M25	Get hash	malicious	Phisher	Browse	157.240.0.35
	https://notifications.google.com/g/p/ANiao5qKfpKGd2jYVQDb7vORoVGY96M_apQZWQcfuLgUh0GZyBJANTtYK9_noZQ1711qN-Nnm0DMf_B0c07RxsIpTsLOXIG6nNUkP7-522wWZZkizIeUQoaYMxfvubAPN7K6vgKfJCjpF3Y3VSFZPtNm5n34HM86QMFnOVYHFycjRojvprEeSViyQqV_RbPVd9Nh3y1jQx8FWiMJd_UXkRWlNs4	Get hash	malicious	Unknown	Browse	157.240.251.35
	http://hookersbaits.co.uk	Get hash	malicious	Unknown	Browse	157.240.253.35
	http://hrworld.org	Get hash	malicious	Unknown	Browse	157.240.251.35

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	na.elf	Get hash	malicious	Prometei	Browse	54.171.230.55
	na.elf	Get hash	malicious	Prometei	Browse	54.171.230.55
	arm6.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	pdf946946.msi	Get hash	malicious	AteraAgent	Browse	35.157.63.229
	efjepc.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	main_ppc.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	CUD--Quotation list.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	telnet.x86.elf	Get hash	malicious	Unknown	Browse	44.241.44.184
	telnet.sh4.elf	Get hash	malicious	Unknown	Browse	52.52.139.161
AKAMAI-ASN1EU	GasTechnologyPartnership.pdf	Get hash	malicious	HTMLPhisher	Browse	95.101.182.112
	arm4.elf	Get hash	malicious	Mirai	Browse	88.221.149.135
	arm5.elf	Get hash	malicious	Mirai	Browse	95.100.100.163
	x86.elf	Get hash	malicious	Mirai	Browse	88.221.95.65
	https://cle.soundestlink.com/ce/c/67af4e08a90b85f6c51e3649/67af4e37c622ca8b13b0643e/67af4e500930257798ab6691?signature=6622e2772a21e189f04bbff6dbd8020cb3c1977d0aa04e3285c329f387017382	Get hash	malicious	Unknown	Browse	95.101.182.65
	https://blovkdappfixkk.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	2.22.242.136
	https://reprogrammer.livraison.3-75-178-102.cprapid.com/dpd/update.php	Get hash	malicious	Unknown	Browse	2.22.242.130
	http://gaer.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	2.21.65.135
	http://ctakkponmndiri.siitusressmi.web.id/	Get hash	malicious	Unknown	Browse	23.213.161.219
ATGS-MMD-ASUS	telnet.x86.elf	Get hash	malicious	Unknown	Browse	48.72.1.111
	telnet.spc.elf	Get hash	malicious	Unknown	Browse	34.179.18.251
	telnet.ppc.elf	Get hash	malicious	Unknown	Browse	32.168.123.169
	res.spc.elf	Get hash	malicious	Unknown	Browse	33.118.35.157
	res.mpsl.elf	Get hash	malicious	Unknown	Browse	32.59.106.150
	https://blovkdappfixkk.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	34.149.94.206
	https://reprogrammer.livraison.3-75-178-102.cprapid.com/dpd/update.php	Get hash	malicious	Unknown	Browse	57.129.39.243
	https://junoupdatesecurity.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	57.129.39.243
	res.arm5.elf	Get hash	malicious	Unknown	Browse	51.35.40.188
ATGS-MMD-ASUS	telnet.x86.elf	Get hash	malicious	Unknown	Browse	48.72.1.111
	telnet.spc.elf	Get hash	malicious	Unknown	Browse	34.179.18.251
	telnet.ppc.elf	Get hash	malicious	Unknown	Browse	32.168.123.169
	res.spc.elf	Get hash	malicious	Unknown	Browse	33.118.35.157
	res.mpsl.elf	Get hash	malicious	Unknown	Browse	32.59.106.150
	https://blovkdappfixkk.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	34.149.94.206
	https://reprogrammer.livraison.3-75-178-102.cprapid.com/dpd/update.php	Get hash	malicious	Unknown	Browse	57.129.39.243
	https://junoupdatesecurity.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	57.129.39.243
	res.arm5.elf	Get hash	malicious	Unknown	Browse	51.35.40.188

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fb0aa01abe9d8e4037eb3473ca6e2dca	random.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	random.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, RedLine, Stealc, Vidar	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	https://drive.google.com/file/d/1FVDnmU54G6_GaADSmojqRgpCVK0Y1U9s/view?usp=sharing	Get hash	malicious	Remcos	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	px4Y74kUj2.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	4114122C0DCA23F637D83EED33F9ABCDC92709E2AC6F63FFD55F5AAE519B58AB.zip	Get hash	malicious	Unknown	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	https://drive.google.com/file/d/1FVDnmU54G6_GaADSmojqRgpCVK0Y1U9s/view?usp=sharing	Get hash	malicious	Remcos	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	px4Y74kUj2.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	4114122C0DCA23F637D83EED33F9ABCDC92709E2AC6F63FFD55F5AAE519B58AB.zip	Get hash	malicious	Unknown	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse

Created / dropped Files

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_08642342-5486-44eb-bd21-1fa03f6f0ef5.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7946
Entropy (8bit):	5.175983223495298
Encrypted:	false
SSDEEP:	192:sBMX51utbhbVbTbfbRbObtbyEl7n0NKJA6unSrDtTkdxSofim:siWtNhnzFSJUNZ1nSrDhkdx+m
MD5:	86CE58CE94E8D534FE129CA4C6D19FAA
SHA1:	4BB248437051DE29EF3E92529662E3669E2E80D8
SHA-256:	9AC3EEB58589B68E42DD61D5DB0987E05458EBCC4F5FF32F599175ECF4EA9AAA
SHA-512:	77CAD5B9FAC34217CDFAA2B3FBD7394EA91BA38AC3F4DD74C740F51F9B366070C8659E81F493C719D69D67A8FEDCB6C48248682951B34D52F98D1384503DEAB1
Malicious:	false
Preview:	{"type":"uninstall","id":"08642342-5486-44eb-bd21-1fa03f6f0ef5","creationDate":"2025-02-15T18:20:19.530Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"7340e351-fad3-4a0f-b554-971fbfafe8fb","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_08642342-5486-44eb-bd21-1fa03f6f0ef5.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7946
Entropy (8bit):	5.175983223495298
Encrypted:	false
SSDEEP:	192:sBMX51utbhbVbTbfbRbObtbyEl7n0NKJA6unSrDtTkdxSofim:siWtNhnzFSJUNZ1nSrDhkdx+m
MD5:	86CE58CE94E8D534FE129CA4C6D19FAA
SHA1:	4BB248437051DE29EF3E92529662E3669E2E80D8
SHA-256:	9AC3EEB58589B68E42DD61D5DB0987E05458EBCC4F5FF32F599175ECF4EA9AAA
SHA-512:	77CAD5B9FAC34217CDFAA2B3FBD7394EA91BA38AC3F4DD74C740F51F9B366070C8659E81F493C719D69D67A8FEDCB6C48248682951B34D52F98D1384503DEAB1
Malicious:	false
Preview:	{"type":"uninstall","id":"08642342-5486-44eb-bd21-1fa03f6f0ef5","creationDate":"2025-02-15T18:20:19.530Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"7340e351-fad3-4a0f-b554-971fbfafe8fb","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\tmpaddon

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	453023
Entropy (8bit):	7.997718157581587
Encrypted:	true
SSDEEP:	12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5:	85430BAED3398695717B0263807CF97C
SHA1:	FFFBEE923CEA216F50FCE5D54219A188A5100F41
SHA-256:	A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
SHA-512:	06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
Malicious:	false
Preview:	PK.........bN...R..........gmpopenh264.dll..\|.E.0.=..I.....1....4f1q.`.........q.....'+....hm{.z..o_.{w........$..($A!...\|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....\|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`............ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\...........-i.K.I..4.a..6.....Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N..}..).3.N%.!..q........^I.m..~...6.#.~+.....A...I]r...x...<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..\|c.1.cUkM.&.Qn]..a]t.h...!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:\|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\40371339ad31a7e6.customDestinations-ms (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	5488
Entropy (8bit):	3.316995205435863
Encrypted:	false
SSDEEP:	48:QdbGL9UgdwkzSdbGLD6Bdw0AdbGLjadwW1:jsQ
MD5:	CDBE01882EF55A077D35724FF3721605
SHA1:	88C0ECEF70CCF8314ADD591F0BF1E6DDD3E56FC6
SHA-256:	764F4E5229E629C001C2709F85D0D41C4CF7198493996D381F3C72C8547EE1AC
SHA-512:	31DA207873008B5600431D374407D49E6D47D690D8E5FA83C9F2BEA9F972678EE4315CAE6357AFD930B7B64387B94CA8995436003B92699C092A3DAB92913888
Malicious:	false
Preview:	...................................FL..................F.@.. ...p.......................S...........................P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.IOZ......B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1.....CW.X..MOZILL~1..P......CW}WOZ..............................>.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.....b.2..S..<W,. .firefox.exe.H......CW}WOZ................................f.i.r.e.f.o.x...e.x.e.......[...............-.......Z....................C:\Program Files\Mozilla Firefox\firefox.exe....O.p.e.n. .a. .n.e.w. .b.r.o.w.s.e.r. .t.a.b.....-.n.e.w.-.t.a.b. .a.b.o.u.t.:.b.l.a.n.k.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.\.f.i.r.e.f.o.x...e.x.e.........%ProgramFiles%\Mozilla Firefox\firefox.exe................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5G9YKO8EYRTCEKYNETZF.temp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	modified
Size (bytes):	5488
Entropy (8bit):	3.316995205435863
Encrypted:	false
SSDEEP:	48:QdbGL9UgdwkzSdbGLD6Bdw0AdbGLjadwW1:jsQ
MD5:	CDBE01882EF55A077D35724FF3721605
SHA1:	88C0ECEF70CCF8314ADD591F0BF1E6DDD3E56FC6
SHA-256:	764F4E5229E629C001C2709F85D0D41C4CF7198493996D381F3C72C8547EE1AC
SHA-512:	31DA207873008B5600431D374407D49E6D47D690D8E5FA83C9F2BEA9F972678EE4315CAE6357AFD930B7B64387B94CA8995436003B92699C092A3DAB92913888
Malicious:	false
Preview:	...................................FL..................F.@.. ...p.......................S...........................P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.IOZ......B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1.....CW.X..MOZILL~1..P......CW}WOZ..............................>.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.....b.2..S..<W,. .firefox.exe.H......CW}WOZ................................f.i.r.e.f.o.x...e.x.e.......[...............-.......Z....................C:\Program Files\Mozilla Firefox\firefox.exe....O.p.e.n. .a. .n.e.w. .b.r.o.w.s.e.r. .t.a.b.....-.n.e.w.-.t.a.b. .a.b.o.u.t.:.b.l.a.n.k.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.\.f.i.r.e.f.o.x...e.x.e.........%ProgramFiles%\Mozilla Firefox\firefox.exe................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	5488
Entropy (8bit):	3.316995205435863
Encrypted:	false
SSDEEP:	48:QdbGL9UgdwkzSdbGLD6Bdw0AdbGLjadwW1:jsQ
MD5:	CDBE01882EF55A077D35724FF3721605
SHA1:	88C0ECEF70CCF8314ADD591F0BF1E6DDD3E56FC6
SHA-256:	764F4E5229E629C001C2709F85D0D41C4CF7198493996D381F3C72C8547EE1AC
SHA-512:	31DA207873008B5600431D374407D49E6D47D690D8E5FA83C9F2BEA9F972678EE4315CAE6357AFD930B7B64387B94CA8995436003B92699C092A3DAB92913888
Malicious:	false
Preview:	...................................FL..................F.@.. ...p.......................S...........................P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.IOZ......B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1.....CW.X..MOZILL~1..P......CW}WOZ..............................>.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.....b.2..S..<W,. .firefox.exe.H......CW}WOZ................................f.i.r.e.f.o.x...e.x.e.......[...............-.......Z....................C:\Program Files\Mozilla Firefox\firefox.exe....O.p.e.n. .a. .n.e.w. .b.r.o.w.s.e.r. .t.a.b.....-.n.e.w.-.t.a.b. .a.b.o.u.t.:.b.l.a.n.k.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.\.f.i.r.e.f.o.x...e.x.e.........%ProgramFiles%\Mozilla Firefox\firefox.exe................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KAM4ES32A3063RQV4BQ6.temp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	5488
Entropy (8bit):	3.316995205435863
Encrypted:	false
SSDEEP:	48:QdbGL9UgdwkzSdbGLD6Bdw0AdbGLjadwW1:jsQ
MD5:	CDBE01882EF55A077D35724FF3721605
SHA1:	88C0ECEF70CCF8314ADD591F0BF1E6DDD3E56FC6
SHA-256:	764F4E5229E629C001C2709F85D0D41C4CF7198493996D381F3C72C8547EE1AC
SHA-512:	31DA207873008B5600431D374407D49E6D47D690D8E5FA83C9F2BEA9F972678EE4315CAE6357AFD930B7B64387B94CA8995436003B92699C092A3DAB92913888
Malicious:	false
Preview:	...................................FL..................F.@.. ...p.......................S...........................P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.IOZ......B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1.....CW.X..MOZILL~1..P......CW}WOZ..............................>.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.....b.2..S..<W,. .firefox.exe.H......CW}WOZ................................f.i.r.e.f.o.x...e.x.e.......[...............-.......Z....................C:\Program Files\Mozilla Firefox\firefox.exe....O.p.e.n. .a. .n.e.w. .b.r.o.w.s.e.r. .t.a.b.....-.n.e.w.-.t.a.b. .a.b.o.u.t.:.b.l.a.n.k.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.\.f.i.r.e.f.o.x...e.x.e.........%ProgramFiles%\Mozilla Firefox\firefox.exe................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\ExperimentStoreData.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4419
Entropy (8bit):	4.931553379688595
Encrypted:	false
SSDEEP:	96:gXiNFS+OcPUFEOdwNIOdwBjvYVbsLKvIv8P:gXiNFS+OcUGOdwiOdwBjkYLKQv8P
MD5:	D6A04E5D168216BE90B534D758E20442
SHA1:	5D81E3C9FD1D932AC3270B05F0E7EBAD8811ED14
SHA-256:	15BCC8F4C765CACE84A54245A7AFDB987F7E2A1E7D744850EBFA1A0EB4239F2E
SHA-512:	8DE05D35C72A96352352E0DE826AA3B3EF99ECF0BA5C04A2AF29D914059FB84DCAA233617E20E858BDA25DE24EDF888A8D746253E4A744F165EFBC6D7534BE56
Malicious:	false
Preview:	{"bookmarks-toolbar-default-on":{"slug":"bookmarks-toolbar-default-on","branch":{"slug":"treatment-a","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"enableBookmarksToolbar":"always"},"enabled":true,"featureId":"bookmarks"}]},"active":true,"enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201","experimentType":"nimbus","source":"rs-loader","userFacingName":"Bookmarks Toolbar Default On","userFacingDescription":"An experiment that turns the bookmarks toolbar on by default.","lastSeen":"2023-10-05T06:20:35.557Z","featureIds":["bookmarks"],"prefs":[{"name":"browser.toolbars.bookmarks.visibility","branch":"user","featureId":"bookmarks","variable":"enableBookmarksToolbar","originalValue":null}],"isRollout":false},"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\ExperimentStoreData.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4419
Entropy (8bit):	4.931553379688595
Encrypted:	false
SSDEEP:	96:gXiNFS+OcPUFEOdwNIOdwBjvYVbsLKvIv8P:gXiNFS+OcUGOdwiOdwBjkYLKQv8P
MD5:	D6A04E5D168216BE90B534D758E20442
SHA1:	5D81E3C9FD1D932AC3270B05F0E7EBAD8811ED14
SHA-256:	15BCC8F4C765CACE84A54245A7AFDB987F7E2A1E7D744850EBFA1A0EB4239F2E
SHA-512:	8DE05D35C72A96352352E0DE826AA3B3EF99ECF0BA5C04A2AF29D914059FB84DCAA233617E20E858BDA25DE24EDF888A8D746253E4A744F165EFBC6D7534BE56
Malicious:	false
Preview:	{"bookmarks-toolbar-default-on":{"slug":"bookmarks-toolbar-default-on","branch":{"slug":"treatment-a","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"enableBookmarksToolbar":"always"},"enabled":true,"featureId":"bookmarks"}]},"active":true,"enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201","experimentType":"nimbus","source":"rs-loader","userFacingName":"Bookmarks Toolbar Default On","userFacingDescription":"An experiment that turns the bookmarks toolbar on by default.","lastSeen":"2023-10-05T06:20:35.557Z","featureIds":["bookmarks"],"prefs":[{"name":"browser.toolbars.bookmarks.visibility","branch":"user","featureId":"bookmarks","variable":"enableBookmarksToolbar","originalValue":null}],"isRollout":false},"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 22422 bytes
Category:	dropped
Size (bytes):	5308
Entropy (8bit):	6.599374203470186
Encrypted:	false
SSDEEP:	96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMg6Uhm:zTx2x2t0FDJ4NpkuvjdeplTMohm
MD5:	EB56C2F4DA9435F3D5574161F414CD17
SHA1:	74A8FC3EC0559740FD9D835B638354985E2DEAB6
SHA-256:	394E803D5FF8E156DFA7D15E96B51A683F4624A1BCF88EAA532399AC2C9B0966
SHA-512:	DF90568D191C757392FB85BDDA5333C7FE7E3BB370C5DE8C50DD810B938D732E39B5608FB4494CAADAE99E1601989FDFC0FEBDCF70F27FFE581F904170A81E0F
Malicious:	false
Preview:	mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 22422 bytes
Category:	dropped
Size (bytes):	5308
Entropy (8bit):	6.599374203470186
Encrypted:	false
SSDEEP:	96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMg6Uhm:zTx2x2t0FDJ4NpkuvjdeplTMohm
MD5:	EB56C2F4DA9435F3D5574161F414CD17
SHA1:	74A8FC3EC0559740FD9D835B638354985E2DEAB6
SHA-256:	394E803D5FF8E156DFA7D15E96B51A683F4624A1BCF88EAA532399AC2C9B0966
SHA-512:	DF90568D191C757392FB85BDDA5333C7FE7E3BB370C5DE8C50DD810B938D732E39B5608FB4494CAADAE99E1601989FDFC0FEBDCF70F27FFE581F904170A81E0F
Malicious:	false
Preview:	mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addons.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addons.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\content-prefs.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.04905141882491872
Encrypted:	false
SSDEEP:	24:DLSvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DKwae+QtMImelekKDa5
MD5:	8736A542C5564A922C47B19D9CC5E0F2
SHA1:	CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A
SHA-256:	97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
SHA-512:	99777325893DC7A95FD49B2DA18D32D65F97CC7A8E482D78EDC32F63245457FA5A52750800C074D552D20B6A215604161FDC88763D93C76A8703470C3064196B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\store.json.mozlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\store.json.mozlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\extensions.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185052013683835
Encrypted:	false
SSDEEP:	768:AI4wvfCXh496G4C4U1W4z4xuHhvp4N4Tc4Z4S4t24U:AruBv3
MD5:	10E2D85FEF0DB266E519048D63617FA8
SHA1:	EBB307C44EBEFFA271AC58FDDE5C3A1BA52AE7B0
SHA-256:	92143A48F55639B5BD01385D0E4E78EDED4F84401A91C12AC06251EE188CFE0E
SHA-512:	164CBE725B44020AD40D165A1B1C242A7016ED8933AB9502D0D38E6CD99887D9DF49533DE54068AA4E5D8476C7791B52518A8477B8961475B7CB2C3AF54B81B1
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{87ef1fa3-cb84-4bbf-a615-45a1d14b629d}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\extensions.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185052013683835
Encrypted:	false
SSDEEP:	768:AI4wvfCXh496G4C4U1W4z4xuHhvp4N4Tc4Z4S4t24U:AruBv3
MD5:	10E2D85FEF0DB266E519048D63617FA8
SHA1:	EBB307C44EBEFFA271AC58FDDE5C3A1BA52AE7B0
SHA-256:	92143A48F55639B5BD01385D0E4E78EDED4F84401A91C12AC06251EE188CFE0E
SHA-512:	164CBE725B44020AD40D165A1B1C242A7016ED8933AB9502D0D38E6CD99887D9DF49533DE54068AA4E5D8476C7791B52518A8477B8961475B7CB2C3AF54B81B1
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{87ef1fa3-cb84-4bbf-a615-45a1d14b629d}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: px4Y74kUj2.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: 4114122C0DCA23F637D83EED33F9ABCDC92709E2AC6F63FFD55F5AAE519B58AB.zip, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: px4Y74kUj2.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: 4114122C0DCA23F637D83EED33F9ABCDC92709E2AC6F63FFD55F5AAE519B58AB.zip, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\permissions.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.07330954253084002
Encrypted:	false
SSDEEP:	12:DBl/A0OWla0mwPxRymgObsCVR45wcYR4fmnsCVR4zki:DLhesh7Owd4+ji
MD5:	A842B5AC12902828AF9DEB27BEE27143
SHA1:	3D5F0C727A26B0A202807BD0F6C27AEA58BE9ECA
SHA-256:	391D683FA419A9256B3E1E276CB8C5DF420079B132F2B501AFADAB241AF13391
SHA-512:	9D77701C2884A1BAC1A17DFB94D2AC21AC5952AA0D2F30F1F9C531ACEE930200C62543A333F1AF449895E351A4A4106867F8CD60D77822679888F55351CC3FA6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......~s..F~s........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.039629310946426154
Encrypted:	false
SSDEEP:	3:GHlhVi7YndYFlhVi7YndYslol8a9//Ylll4llqlyllel4lt:G7Vi8aJVi8asGL9XIwlio
MD5:	8D743CAE3AC101AA74E6249F25D33688
SHA1:	6C5CFE168C7C035F0DE0D53B15CD6EBE372BB68D
SHA-256:	8BA66A65DA79DAE40EF7FCDEA52211574735205A8E5BCE172D4F2313622793BF
SHA-512:	572314EB11C3A5C3788F9C6A46EFAD79E9C792B9B7C0BB923FB097FF1F7733BB5D0741DFD3083A75BAA9689977A7D8FD60501186FD5E748D9F9719001176D045
Malicious:	false
Preview:	..-...........................z3.&u.z..M..=..}Z...-...........................z3.&u.z..M..=..}Z.........................................................'...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	163992
Entropy (8bit):	0.09520620911300949
Encrypted:	false
SSDEEP:	24:KQy8jP/M7tyrHLxs9YCiyNo5xsMldCCQE/TSKCrsCs81xsayAytG4gmwlk2iEg:51Pot8sKJzJKDC8XVyAOG4U2
MD5:	0EF0E09A387017B3103B0B0BBEB835CF
SHA1:	FD4CFBBAE640FE0C2ADCEB3DE9614271B5012B0C
SHA-256:	7DF545D73449A8EA1CD101357A1EA7FE92D7AC6AA319362C582D38D6A07D5E1E
SHA-512:	A389974A926DD73D6DF6A00A0C0D09ECE45DBB70307BF125F4AF8FDE9B7EFD51A2D1D6EE9FE6EB8F5C665CEB1F4F4E3B2AC4D757A8A5EF89261E31EB6C32D354
Malicious:	false
Preview:	7....-...........&u.z..M.<)..W...........&u.z..MT...$.<.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	14081
Entropy (8bit):	5.468214952557115
Encrypted:	false
SSDEEP:	192:ynTFTRRUYbBp61LZNMGaXy6qU4OTzy+/3/7KQS5RYiNBw8sbSl:YKeQFNMlRvyCKrdw90
MD5:	173806A917965E34CB770C3E5915822D
SHA1:	EB90515ABFB35C120BDDF35D0A0C0CA2F38FA37E
SHA-256:	AA120C51B44CD01525DD0B75D60477D66A15DFAACA5A856CEF8E47B1ACD7D6B9
SHA-512:	68B136D81973B5C0D3BC283922E182ADD5E216A2F0AD437360E400FC6008B9887FF24D129DDFAA8A6DBD4F4A45B53AE70BA1AFD876A5FD9D868F46E241C6A539
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1739643589);..user_pref("app.update.lastUpdateTime.background-update-timer", 1739643589);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1739643589);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 173964

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	14081
Entropy (8bit):	5.468214952557115
Encrypted:	false
SSDEEP:	192:ynTFTRRUYbBp61LZNMGaXy6qU4OTzy+/3/7KQS5RYiNBw8sbSl:YKeQFNMlRvyCKrdw90
MD5:	173806A917965E34CB770C3E5915822D
SHA1:	EB90515ABFB35C120BDDF35D0A0C0CA2F38FA37E
SHA-256:	AA120C51B44CD01525DD0B75D60477D66A15DFAACA5A856CEF8E47B1ACD7D6B9
SHA-512:	68B136D81973B5C0D3BC283922E182ADD5E216A2F0AD437360E400FC6008B9887FF24D129DDFAA8A6DBD4F4A45B53AE70BA1AFD876A5FD9D868F46E241C6A539
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1739643589);..user_pref("app.update.lastUpdateTime.background-update-timer", 1739643589);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1739643589);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 173964

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\protections.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.04062825861060003
Encrypted:	false
SSDEEP:	3:lSGBl/l/zl9l/AltllPltlnKollzvulJOlzALRWemFxu7TuRjBFbrl58lcV+wgn8:ltBl/lqN1K4BEJYqWvLue3FMOrMZ0l
MD5:	60C09456D6362C6FBED48C69AA342C3C
SHA1:	58B6E22DAA48C75958B429F662DEC1C011AE74D3
SHA-256:	FE1A432A2CD096B7EEA870D46D07F5197E34B4D10666E6E1C357FAA3F2FE2389
SHA-512:	936DBC887276EF07732783B50EAFE450A8598B0492B8F6C838B337EF3E8A6EA595E7C7A2FA4B3E881887FAAE2D207B953A4C65ED8C964D93118E00D3E03882BD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\recovery.baklz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	6.332913401963869
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSMbl+LXnIgi/pnxQwRlszT5sKL0IKsHVvwKXT4amhujJmyOOxmOmaR:GUpOxB+ynR66sNwCT44JNKRh4
MD5:	BDA1D2F6CCF8565172C11C15D01393FD
SHA1:	6F50072667C0815EECA5737DF6AF3D57A6A75687
SHA-256:	6EFD64A8006E13EDC874B8DEC53C7030DAC1A2CA06000674B8AF16347D6BFC50
SHA-512:	55B8576F79CC04E0D669883B7AB47EA92425E2F3D68CC0E08A7B8E25EE6566812AD5E97DA9C1FF6E10CA8A8C2C64612A8058779D46E32D1E1922718563268A13
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{4cf14dac-a5cb-4d7b-9061-6e1250308bf9}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1739643594040,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...46f3a197-db49-410a-81b3-94975c835573","zD..1...Wm..l........j..:....1":{..jUpdate.....wtartTim..P59223...centCrash..B0},".....Dcook....host":"addons.mozilla.org","valu...Abfc0b67c202aaf415a5b7a51708a5c3270bb6f2f7664428a48797f00afbef6fc","path":"/","na..a"taarI\|.Recure...,`.Donly..fexpiry...69106,"originA...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	6.332913401963869
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSMbl+LXnIgi/pnxQwRlszT5sKL0IKsHVvwKXT4amhujJmyOOxmOmaR:GUpOxB+ynR66sNwCT44JNKRh4
MD5:	BDA1D2F6CCF8565172C11C15D01393FD
SHA1:	6F50072667C0815EECA5737DF6AF3D57A6A75687
SHA-256:	6EFD64A8006E13EDC874B8DEC53C7030DAC1A2CA06000674B8AF16347D6BFC50
SHA-512:	55B8576F79CC04E0D669883B7AB47EA92425E2F3D68CC0E08A7B8E25EE6566812AD5E97DA9C1FF6E10CA8A8C2C64612A8058779D46E32D1E1922718563268A13
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{4cf14dac-a5cb-4d7b-9061-6e1250308bf9}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1739643594040,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...46f3a197-db49-410a-81b3-94975c835573","zD..1...Wm..l........j..:....1":{..jUpdate.....wtartTim..P59223...centCrash..B0},".....Dcook....host":"addons.mozilla.org","valu...Abfc0b67c202aaf415a5b7a51708a5c3270bb6f2f7664428a48797f00afbef6fc","path":"/","na..a"taarI\|.Recure...,`.Donly..fexpiry...69106,"originA...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	6.332913401963869
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSMbl+LXnIgi/pnxQwRlszT5sKL0IKsHVvwKXT4amhujJmyOOxmOmaR:GUpOxB+ynR66sNwCT44JNKRh4
MD5:	BDA1D2F6CCF8565172C11C15D01393FD
SHA1:	6F50072667C0815EECA5737DF6AF3D57A6A75687
SHA-256:	6EFD64A8006E13EDC874B8DEC53C7030DAC1A2CA06000674B8AF16347D6BFC50
SHA-512:	55B8576F79CC04E0D669883B7AB47EA92425E2F3D68CC0E08A7B8E25EE6566812AD5E97DA9C1FF6E10CA8A8C2C64612A8058779D46E32D1E1922718563268A13
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{4cf14dac-a5cb-4d7b-9061-6e1250308bf9}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1739643594040,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...46f3a197-db49-410a-81b3-94975c835573","zD..1...Wm..l........j..:....1":{..jUpdate.....wtartTim..P59223...centCrash..B0},".....Dcook....host":"addons.mozilla.org","valu...Abfc0b67c202aaf415a5b7a51708a5c3270bb6f2f7664428a48797f00afbef6fc","path":"/","na..a"taarI\|.Recure...,`.Donly..fexpiry...69106,"originA...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 4, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.042811512334329
Encrypted:	false
SSDEEP:	24:JBkSldh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jkSWEUo9LXtR+JdkOnohYsl
MD5:	21235938025E2102017AC8C9748948A4
SHA1:	A1EED1C4588724A8396C95FC9923C0A33B360FF8
SHA-256:	E34B06B180E3F73DC8E441650BB7FE694A9D58E927412D6ED40B0852B784824E
SHA-512:	D334B419A2A75179C17D7F53BF65FCC132ADE03B21059F0007ACDBB08284A281D8CE1C1CC598E6A070024D0DAE158E2E9618E121342BE068E87A051FE33D6061
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\targeting.snapshot.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4411
Entropy (8bit):	5.009782503816822
Encrypted:	false
SSDEEP:	48:YrSAYfHqUQZpExB1+anOdW6VhOGVpWJzzcsYMsku7f86SLAVL775FtsfAcbyJFde:ycfCTEr5NfJzzcBvbw6Kkvrc2Rn27
MD5:	C242E2107E597C4E0243A03CE4FE462F
SHA1:	9A67C1CC7B4E36B5904F25D8DBB1F59FC2CB1FFC
SHA-256:	D3CB91BEBC4118DF689DD1D73F67E30FBD98F819739E8F7BB485658219151B86
SHA-512:	69E029ED9FB6931A1E5D19D2FCF118DDA6BA0577F95ADA2113D0ACC3ADCCA248787817C3ADC17D1DD5BF20C1B7813855D6F2FA636EB70E50228466E65F1A30FA
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2025-02-15T18:19:36.469Z","profileAgeCreated":1696486829272,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\targeting.snapshot.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4411
Entropy (8bit):	5.009782503816822
Encrypted:	false
SSDEEP:	48:YrSAYfHqUQZpExB1+anOdW6VhOGVpWJzzcsYMsku7f86SLAVL775FtsfAcbyJFde:ycfCTEr5NfJzzcBvbw6Kkvrc2Rn27
MD5:	C242E2107E597C4E0243A03CE4FE462F
SHA1:	9A67C1CC7B4E36B5904F25D8DBB1F59FC2CB1FFC
SHA-256:	D3CB91BEBC4118DF689DD1D73F67E30FBD98F819739E8F7BB485658219151B86
SHA-512:	69E029ED9FB6931A1E5D19D2FCF118DDA6BA0577F95ADA2113D0ACC3ADCCA248787817C3ADC17D1DD5BF20C1B7813855D6F2FA636EB70E50228466E65F1A30FA
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2025-02-15T18:19:36.469Z","profileAgeCreated":1696486829272,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.703402848309974
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	random.exe
File size:	970'752 bytes
MD5:	bca58035430238fde9990df16040d699
SHA1:	12e1f30c10f8d228e70d28bd6e315679d91aa46e
SHA256:	6c64e6e99e9173fd2233d7f6afe27d80d47a377eaa624ee1ca7cc0df803c5cbb
SHA512:	9c406772c7cd60374ba75e7a578c1bcb9319c6067bec6bb55c8f8a0176c5f0d4a71e8bc013bf51fba1d3fae5d9d7b1f97703029128602b77dcc0136fc6dd8d12
SSDEEP:	24576:LqDEvCTbMWu7rQYlBQcBiT6rprG8a9xSma:LTvC/MTQYxsWR7a9x
TLSH:	3A259E0273D1C062FF9B92334B5AF6515BBC69260123E61F13A81DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67B0B253 [Sat Feb 15 15:27:15 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F4650D91B43h
jmp 00007F4650D9144Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F4650D9162Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F4650D915FAh
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F4650D941EDh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F4650D94238h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F4650D94221h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x16478	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xeb000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x16478	0x16600	4d0be74dd98be48d52e9475d3bd7a54c	False	0.7017610858938548	data	7.175656214223087	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xeb000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd4718	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd4840	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4968	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c50	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d78	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5c20	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd64c8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd6a30	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8fd8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda080	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4e8	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xda538	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xda634	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdabc8	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb254	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb6e4	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbce0	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc33c	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc7a4	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc8fc	0xd5fa	data			1.000474643104896
RT_GROUP_ICON	0xe9ef8	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xe9f70	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xe9f84	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xe9f98	0x14	data	English	Great Britain	1.25
RT_VERSION	0xe9fac	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xea088	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Version Infos

Description	Data
Translation	0x0809 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 15, 2025 17:38:05.434037924 CET	49778	443	192.168.2.6	172.217.18.14
Feb 15, 2025 17:38:05.434079885 CET	443	49778	172.217.18.14	192.168.2.6
Feb 15, 2025 17:38:05.434163094 CET	49779	443	192.168.2.6	172.217.18.14
Feb 15, 2025 17:38:05.434253931 CET	443	49779	172.217.18.14	192.168.2.6
Feb 15, 2025 17:38:05.434317112 CET	49780	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:05.434786081 CET	49778	443	192.168.2.6	172.217.18.14
Feb 15, 2025 17:38:05.434793949 CET	49779	443	192.168.2.6	172.217.18.14
Feb 15, 2025 17:38:05.439260960 CET	80	49780	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:05.439531088 CET	49778	443	192.168.2.6	172.217.18.14
Feb 15, 2025 17:38:05.439546108 CET	443	49778	172.217.18.14	192.168.2.6
Feb 15, 2025 17:38:05.440494061 CET	49780	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:05.441237926 CET	49779	443	192.168.2.6	172.217.18.14
Feb 15, 2025 17:38:05.441276073 CET	443	49779	172.217.18.14	192.168.2.6
Feb 15, 2025 17:38:05.441508055 CET	49782	443	192.168.2.6	35.190.72.216
Feb 15, 2025 17:38:05.441550970 CET	443	49782	35.190.72.216	192.168.2.6
Feb 15, 2025 17:38:05.441569090 CET	49780	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:05.443733931 CET	49782	443	192.168.2.6	35.190.72.216
Feb 15, 2025 17:38:05.445034027 CET	49782	443	192.168.2.6	35.190.72.216
Feb 15, 2025 17:38:05.445056915 CET	443	49782	35.190.72.216	192.168.2.6
Feb 15, 2025 17:38:05.446322918 CET	80	49780	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:05.721049070 CET	49784	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:05.721138954 CET	443	49784	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:05.721554041 CET	49784	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:05.723042011 CET	49784	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:05.723059893 CET	443	49784	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:05.731934071 CET	49785	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:05.731960058 CET	443	49785	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:05.732197046 CET	49785	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:05.733333111 CET	49785	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:05.733350039 CET	443	49785	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:05.733999014 CET	49786	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:05.734009027 CET	443	49786	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:05.741381884 CET	49786	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:05.741601944 CET	49786	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:05.741616011 CET	443	49786	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:05.898943901 CET	80	49780	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:05.916307926 CET	443	49782	35.190.72.216	192.168.2.6
Feb 15, 2025 17:38:05.916387081 CET	49782	443	192.168.2.6	35.190.72.216
Feb 15, 2025 17:38:05.941905022 CET	49780	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:06.081959009 CET	443	49778	172.217.18.14	192.168.2.6
Feb 15, 2025 17:38:06.082035065 CET	49778	443	192.168.2.6	172.217.18.14
Feb 15, 2025 17:38:06.082699060 CET	443	49778	172.217.18.14	192.168.2.6
Feb 15, 2025 17:38:06.082758904 CET	49778	443	192.168.2.6	172.217.18.14
Feb 15, 2025 17:38:06.087243080 CET	443	49779	172.217.18.14	192.168.2.6
Feb 15, 2025 17:38:06.087347031 CET	49779	443	192.168.2.6	172.217.18.14
Feb 15, 2025 17:38:06.088295937 CET	443	49779	172.217.18.14	192.168.2.6
Feb 15, 2025 17:38:06.088433981 CET	49779	443	192.168.2.6	172.217.18.14
Feb 15, 2025 17:38:06.199229956 CET	443	49785	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:06.199335098 CET	49785	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:06.206687927 CET	443	49786	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:06.206707954 CET	443	49786	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:06.206784010 CET	49786	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:06.208100080 CET	443	49784	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:06.208205938 CET	49784	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:06.664572954 CET	49786	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:06.664602995 CET	443	49786	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:06.665055990 CET	443	49786	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:06.669521093 CET	49779	443	192.168.2.6	172.217.18.14
Feb 15, 2025 17:38:06.669553995 CET	443	49779	172.217.18.14	192.168.2.6
Feb 15, 2025 17:38:06.669830084 CET	443	49779	172.217.18.14	192.168.2.6
Feb 15, 2025 17:38:06.669863939 CET	49779	443	192.168.2.6	172.217.18.14
Feb 15, 2025 17:38:06.669878006 CET	443	49779	172.217.18.14	192.168.2.6
Feb 15, 2025 17:38:06.670011044 CET	49778	443	192.168.2.6	172.217.18.14
Feb 15, 2025 17:38:06.670031071 CET	443	49778	172.217.18.14	192.168.2.6
Feb 15, 2025 17:38:06.670370102 CET	443	49778	172.217.18.14	192.168.2.6
Feb 15, 2025 17:38:06.670409918 CET	49778	443	192.168.2.6	172.217.18.14
Feb 15, 2025 17:38:06.670416117 CET	443	49778	172.217.18.14	192.168.2.6
Feb 15, 2025 17:38:06.672971010 CET	49782	443	192.168.2.6	35.190.72.216
Feb 15, 2025 17:38:06.673012018 CET	443	49782	35.190.72.216	192.168.2.6
Feb 15, 2025 17:38:06.673237085 CET	443	49782	35.190.72.216	192.168.2.6
Feb 15, 2025 17:38:06.673393011 CET	49782	443	192.168.2.6	35.190.72.216
Feb 15, 2025 17:38:06.673402071 CET	443	49782	35.190.72.216	192.168.2.6
Feb 15, 2025 17:38:06.676049948 CET	49784	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:06.676103115 CET	443	49784	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:06.676299095 CET	443	49784	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:06.676480055 CET	49785	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:06.676497936 CET	443	49785	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:06.676572084 CET	49784	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:06.676590919 CET	443	49784	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:06.676717043 CET	443	49785	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:06.676737070 CET	49785	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:06.676744938 CET	443	49785	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:06.676872015 CET	49786	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:06.676963091 CET	49786	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:06.677043915 CET	443	49786	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:06.678302050 CET	49786	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:06.678626060 CET	49786	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:06.875365019 CET	443	49779	172.217.18.14	192.168.2.6
Feb 15, 2025 17:38:06.875449896 CET	49779	443	192.168.2.6	172.217.18.14
Feb 15, 2025 17:38:06.879328012 CET	443	49778	172.217.18.14	192.168.2.6
Feb 15, 2025 17:38:06.879334927 CET	443	49782	35.190.72.216	192.168.2.6
Feb 15, 2025 17:38:06.879385948 CET	49778	443	192.168.2.6	172.217.18.14
Feb 15, 2025 17:38:06.879440069 CET	49782	443	192.168.2.6	35.190.72.216
Feb 15, 2025 17:38:06.883336067 CET	443	49784	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:06.883337021 CET	443	49785	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:06.883457899 CET	49785	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:06.883459091 CET	49784	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.004092932 CET	49796	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.004143000 CET	443	49796	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:07.004416943 CET	49797	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.004462004 CET	443	49797	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:07.004652977 CET	49798	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.004664898 CET	443	49798	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:07.004760981 CET	49799	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.004770994 CET	443	49799	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:07.005346060 CET	49796	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.005359888 CET	49797	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.005359888 CET	49799	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.005378962 CET	49798	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.007056952 CET	49796	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.007095098 CET	443	49796	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:07.008435965 CET	49797	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.008454084 CET	443	49797	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:07.009685993 CET	49799	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.009699106 CET	443	49799	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:07.010948896 CET	49798	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.010974884 CET	443	49798	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:07.012331963 CET	49780	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:07.017333984 CET	80	49780	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:07.021689892 CET	49780	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:07.472038031 CET	443	49799	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:07.472445965 CET	443	49797	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:07.474328995 CET	49799	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.474510908 CET	49797	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.480283976 CET	49799	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.480307102 CET	443	49799	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:07.480385065 CET	49797	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.480405092 CET	443	49797	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:07.480416059 CET	49799	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.480459929 CET	443	49799	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:07.480526924 CET	49797	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.480632067 CET	443	49797	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:07.480808973 CET	49799	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.480878115 CET	49797	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.481520891 CET	49802	443	192.168.2.6	34.160.144.191
Feb 15, 2025 17:38:07.481564999 CET	443	49802	34.160.144.191	192.168.2.6
Feb 15, 2025 17:38:07.482081890 CET	49802	443	192.168.2.6	34.160.144.191
Feb 15, 2025 17:38:07.482172012 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:07.482268095 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:07.482398033 CET	49802	443	192.168.2.6	34.160.144.191
Feb 15, 2025 17:38:07.482410908 CET	443	49802	34.160.144.191	192.168.2.6
Feb 15, 2025 17:38:07.490293980 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:07.490308046 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:07.490385056 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:07.490535975 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:07.490583897 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:07.490619898 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:07.493416071 CET	443	49796	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:07.493500948 CET	49796	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.498342037 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:07.498358011 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:07.498472929 CET	49796	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.498498917 CET	443	49796	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:07.498548985 CET	49796	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.498723030 CET	443	49796	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:07.500921011 CET	49796	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.525574923 CET	443	49798	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:07.525650024 CET	49798	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.530474901 CET	49798	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.530488014 CET	443	49798	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:07.530561924 CET	49798	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.530759096 CET	443	49798	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:07.530909061 CET	49798	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.563891888 CET	49806	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.563940048 CET	443	49806	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:07.570296049 CET	49806	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.571600914 CET	49806	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:07.571619987 CET	443	49806	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:07.602366924 CET	49807	443	192.168.2.6	34.209.7.244
Feb 15, 2025 17:38:07.602406025 CET	443	49807	34.209.7.244	192.168.2.6
Feb 15, 2025 17:38:07.603590965 CET	49807	443	192.168.2.6	34.209.7.244
Feb 15, 2025 17:38:07.605079889 CET	49807	443	192.168.2.6	34.209.7.244
Feb 15, 2025 17:38:07.605096102 CET	443	49807	34.209.7.244	192.168.2.6
Feb 15, 2025 17:38:07.937423944 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:07.937768936 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:07.966825962 CET	443	49802	34.160.144.191	192.168.2.6
Feb 15, 2025 17:38:07.966908932 CET	49802	443	192.168.2.6	34.160.144.191
Feb 15, 2025 17:38:07.973366022 CET	49802	443	192.168.2.6	34.160.144.191
Feb 15, 2025 17:38:07.973381996 CET	443	49802	34.160.144.191	192.168.2.6
Feb 15, 2025 17:38:07.973686934 CET	443	49802	34.160.144.191	192.168.2.6
Feb 15, 2025 17:38:07.976269007 CET	49802	443	192.168.2.6	34.160.144.191
Feb 15, 2025 17:38:07.976394892 CET	49802	443	192.168.2.6	34.160.144.191
Feb 15, 2025 17:38:07.976449966 CET	443	49802	34.160.144.191	192.168.2.6
Feb 15, 2025 17:38:07.976814985 CET	49812	443	192.168.2.6	34.160.144.191
Feb 15, 2025 17:38:07.976854086 CET	443	49812	34.160.144.191	192.168.2.6
Feb 15, 2025 17:38:07.976862907 CET	49802	443	192.168.2.6	34.160.144.191
Feb 15, 2025 17:38:07.977003098 CET	49812	443	192.168.2.6	34.160.144.191
Feb 15, 2025 17:38:07.977204084 CET	49812	443	192.168.2.6	34.160.144.191
Feb 15, 2025 17:38:07.977212906 CET	443	49812	34.160.144.191	192.168.2.6
Feb 15, 2025 17:38:07.986819029 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:07.986944914 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:08.059936047 CET	443	49806	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:08.061400890 CET	49806	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:08.066637993 CET	49806	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:08.066654921 CET	443	49806	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:08.066735983 CET	49806	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:08.066977978 CET	443	49806	34.117.188.166	192.168.2.6
Feb 15, 2025 17:38:08.067034960 CET	49806	443	192.168.2.6	34.117.188.166
Feb 15, 2025 17:38:08.381423950 CET	443	49807	34.209.7.244	192.168.2.6
Feb 15, 2025 17:38:08.382105112 CET	49807	443	192.168.2.6	34.209.7.244
Feb 15, 2025 17:38:08.387706041 CET	49807	443	192.168.2.6	34.209.7.244
Feb 15, 2025 17:38:08.387721062 CET	443	49807	34.209.7.244	192.168.2.6
Feb 15, 2025 17:38:08.387798071 CET	49807	443	192.168.2.6	34.209.7.244
Feb 15, 2025 17:38:08.388017893 CET	443	49807	34.209.7.244	192.168.2.6
Feb 15, 2025 17:38:08.388122082 CET	49807	443	192.168.2.6	34.209.7.244
Feb 15, 2025 17:38:08.413687944 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:08.419683933 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:08.431937933 CET	443	49812	34.160.144.191	192.168.2.6
Feb 15, 2025 17:38:08.432019949 CET	49812	443	192.168.2.6	34.160.144.191
Feb 15, 2025 17:38:08.435266018 CET	49812	443	192.168.2.6	34.160.144.191
Feb 15, 2025 17:38:08.435277939 CET	443	49812	34.160.144.191	192.168.2.6
Feb 15, 2025 17:38:08.435568094 CET	443	49812	34.160.144.191	192.168.2.6
Feb 15, 2025 17:38:08.438457012 CET	49812	443	192.168.2.6	34.160.144.191
Feb 15, 2025 17:38:08.438539982 CET	49812	443	192.168.2.6	34.160.144.191
Feb 15, 2025 17:38:08.438636065 CET	443	49812	34.160.144.191	192.168.2.6
Feb 15, 2025 17:38:08.438690901 CET	49812	443	192.168.2.6	34.160.144.191
Feb 15, 2025 17:38:08.509063959 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:08.528742075 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:08.533598900 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:08.557352066 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:08.623410940 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:08.673660040 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:12.177277088 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:12.182118893 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:12.271668911 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:12.322499990 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:13.044641018 CET	49847	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:13.044678926 CET	443	49847	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:13.044872046 CET	49847	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:13.045625925 CET	49847	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:13.045646906 CET	443	49847	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:13.054800034 CET	49848	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:13.054853916 CET	443	49848	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:13.062634945 CET	49848	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:13.079416037 CET	49848	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:13.079452991 CET	443	49848	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:13.233866930 CET	49851	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:13.233915091 CET	443	49851	34.107.243.93	192.168.2.6
Feb 15, 2025 17:38:13.238903046 CET	49851	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:13.240278006 CET	49851	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:13.240300894 CET	443	49851	34.107.243.93	192.168.2.6
Feb 15, 2025 17:38:13.339972019 CET	49854	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:13.339999914 CET	443	49854	34.149.100.209	192.168.2.6
Feb 15, 2025 17:38:13.354846954 CET	49854	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:13.359097958 CET	49854	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:13.359111071 CET	443	49854	34.149.100.209	192.168.2.6
Feb 15, 2025 17:38:13.520170927 CET	443	49847	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:13.529258013 CET	49847	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:13.532140017 CET	49847	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:13.532156944 CET	443	49847	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:13.532399893 CET	443	49847	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:13.534162045 CET	49847	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:13.534270048 CET	49847	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:13.534337997 CET	443	49847	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:13.538741112 CET	443	49848	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:13.538758993 CET	443	49848	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:13.539072037 CET	49847	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:13.539362907 CET	49848	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:13.546694994 CET	49848	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:13.546715021 CET	443	49848	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:13.546777010 CET	49848	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:13.546947956 CET	443	49848	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:13.555295944 CET	49848	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:13.573976040 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:13.578763962 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:13.611603022 CET	49855	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:13.611639977 CET	443	49855	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:13.612920046 CET	49855	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:13.614264965 CET	49855	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:13.614279985 CET	443	49855	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:13.668514013 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:13.674344063 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:13.679101944 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:13.716373920 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:13.721524954 CET	443	49851	34.107.243.93	192.168.2.6
Feb 15, 2025 17:38:13.721612930 CET	49851	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:13.788363934 CET	49851	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:13.788418055 CET	443	49851	34.107.243.93	192.168.2.6
Feb 15, 2025 17:38:13.788458109 CET	49851	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:13.788753986 CET	443	49851	34.107.243.93	192.168.2.6
Feb 15, 2025 17:38:13.791110039 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:13.792117119 CET	49851	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:13.796049118 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:13.814629078 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:13.861673117 CET	443	49854	34.149.100.209	192.168.2.6
Feb 15, 2025 17:38:13.861687899 CET	443	49854	34.149.100.209	192.168.2.6
Feb 15, 2025 17:38:13.861768007 CET	49854	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:13.863636017 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:13.869086027 CET	49854	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:13.869100094 CET	443	49854	34.149.100.209	192.168.2.6
Feb 15, 2025 17:38:13.869157076 CET	49854	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:13.869342089 CET	443	49854	34.149.100.209	192.168.2.6
Feb 15, 2025 17:38:13.873362064 CET	49854	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:13.885484934 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:13.948247910 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:14.237081051 CET	443	49855	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:14.240442038 CET	49855	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:14.846240044 CET	49855	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:14.846262932 CET	443	49855	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:14.846385002 CET	49855	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:14.846455097 CET	443	49855	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:14.847690105 CET	49855	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:19.379672050 CET	49895	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:19.379708052 CET	443	49895	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:19.381127119 CET	49895	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:19.381355047 CET	49895	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:19.381370068 CET	443	49895	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:19.445777893 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:19.446638107 CET	49896	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:19.446669102 CET	443	49896	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:19.447124958 CET	49896	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:19.447470903 CET	49896	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:19.447484970 CET	443	49896	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:19.450604916 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:19.540180922 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:19.585184097 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:19.839251041 CET	443	49895	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:19.842088938 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:19.844398975 CET	49900	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:19.844439983 CET	443	49900	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:19.845966101 CET	49895	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:19.845993996 CET	49900	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:19.847081900 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:19.849721909 CET	49895	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:19.849769115 CET	443	49895	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:19.850012064 CET	443	49895	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:19.853060007 CET	49900	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:19.853085041 CET	443	49900	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:19.853827953 CET	49901	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:19.853843927 CET	443	49901	34.107.243.93	192.168.2.6
Feb 15, 2025 17:38:19.854121923 CET	49901	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:19.856606960 CET	49901	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:19.856625080 CET	443	49901	34.107.243.93	192.168.2.6
Feb 15, 2025 17:38:19.858119011 CET	49895	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:19.858268023 CET	49895	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:19.858313084 CET	443	49895	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:19.858551025 CET	49895	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:19.910181046 CET	443	49896	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:19.912600040 CET	49896	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:19.915704966 CET	49896	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:19.915713072 CET	443	49896	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:19.916135073 CET	443	49896	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:19.918682098 CET	49896	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:19.918765068 CET	49896	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:19.918986082 CET	443	49896	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:19.919059038 CET	49896	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:19.936649084 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:19.967375994 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:19.971967936 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:19.974575043 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:19.979147911 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:20.063034058 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:20.067820072 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:20.070611954 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:20.075428009 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:20.117877960 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:20.177362919 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:20.218205929 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:20.323478937 CET	443	49901	34.107.243.93	192.168.2.6
Feb 15, 2025 17:38:20.323565960 CET	49901	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:20.327440023 CET	49901	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:20.327454090 CET	443	49901	34.107.243.93	192.168.2.6
Feb 15, 2025 17:38:20.327663898 CET	443	49901	34.107.243.93	192.168.2.6
Feb 15, 2025 17:38:20.327694893 CET	49901	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:20.327734947 CET	443	49901	34.107.243.93	192.168.2.6
Feb 15, 2025 17:38:20.329915047 CET	49901	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:20.335593939 CET	443	49900	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:20.335695982 CET	49900	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:20.627974033 CET	49900	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:20.628000021 CET	443	49900	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:20.628010988 CET	49900	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:20.628290892 CET	443	49900	34.120.208.123	192.168.2.6
Feb 15, 2025 17:38:20.628343105 CET	49900	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:38:21.914448023 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:21.922307968 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:22.011790037 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:22.051778078 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:22.107443094 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:22.113266945 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:22.226680040 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:22.269812107 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:31.902319908 CET	49974	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:31.902373075 CET	443	49974	34.107.243.93	192.168.2.6
Feb 15, 2025 17:38:31.902445078 CET	49974	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:31.904109001 CET	49974	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:31.904120922 CET	443	49974	34.107.243.93	192.168.2.6
Feb 15, 2025 17:38:32.027602911 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:32.105658054 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:32.228169918 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:32.233127117 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:32.797410965 CET	443	49974	34.107.243.93	192.168.2.6
Feb 15, 2025 17:38:32.801320076 CET	49974	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:32.801903963 CET	49974	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:32.801915884 CET	443	49974	34.107.243.93	192.168.2.6
Feb 15, 2025 17:38:32.802001953 CET	49974	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:32.802117109 CET	443	49974	34.107.243.93	192.168.2.6
Feb 15, 2025 17:38:32.805257082 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:32.806090117 CET	49974	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:32.810139894 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:32.923784018 CET	49981	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:32.923823118 CET	443	49981	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:32.930598021 CET	49981	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:32.930598021 CET	49981	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:32.930635929 CET	443	49981	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:32.941042900 CET	49982	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:32.941107035 CET	443	49982	34.149.100.209	192.168.2.6
Feb 15, 2025 17:38:32.943806887 CET	49982	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:32.943937063 CET	49982	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:32.943954945 CET	443	49982	34.149.100.209	192.168.2.6
Feb 15, 2025 17:38:32.945164919 CET	49983	443	192.168.2.6	35.190.72.216
Feb 15, 2025 17:38:32.945178032 CET	443	49983	35.190.72.216	192.168.2.6
Feb 15, 2025 17:38:32.946012020 CET	49983	443	192.168.2.6	35.190.72.216
Feb 15, 2025 17:38:32.947441101 CET	49983	443	192.168.2.6	35.190.72.216
Feb 15, 2025 17:38:32.947453976 CET	443	49983	35.190.72.216	192.168.2.6
Feb 15, 2025 17:38:32.947782993 CET	49984	443	192.168.2.6	151.101.193.91
Feb 15, 2025 17:38:32.947828054 CET	443	49984	151.101.193.91	192.168.2.6
Feb 15, 2025 17:38:32.949273109 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:32.950831890 CET	49984	443	192.168.2.6	151.101.193.91
Feb 15, 2025 17:38:32.951134920 CET	49984	443	192.168.2.6	151.101.193.91
Feb 15, 2025 17:38:32.951153994 CET	443	49984	151.101.193.91	192.168.2.6
Feb 15, 2025 17:38:32.964973927 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:32.968930960 CET	49985	443	192.168.2.6	34.49.51.44
Feb 15, 2025 17:38:32.968957901 CET	443	49985	34.49.51.44	192.168.2.6
Feb 15, 2025 17:38:32.969907045 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:32.978003025 CET	49985	443	192.168.2.6	34.49.51.44
Feb 15, 2025 17:38:32.979613066 CET	49985	443	192.168.2.6	34.49.51.44
Feb 15, 2025 17:38:32.979626894 CET	443	49985	34.49.51.44	192.168.2.6
Feb 15, 2025 17:38:32.999339104 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:33.074069023 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:33.115180969 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:33.427792072 CET	443	49982	34.149.100.209	192.168.2.6
Feb 15, 2025 17:38:33.427921057 CET	49982	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:33.431016922 CET	49982	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:33.431029081 CET	443	49982	34.149.100.209	192.168.2.6
Feb 15, 2025 17:38:33.431278944 CET	443	49982	34.149.100.209	192.168.2.6
Feb 15, 2025 17:38:33.431806087 CET	443	49984	151.101.193.91	192.168.2.6
Feb 15, 2025 17:38:33.432281017 CET	49984	443	192.168.2.6	151.101.193.91
Feb 15, 2025 17:38:33.434804916 CET	49984	443	192.168.2.6	151.101.193.91
Feb 15, 2025 17:38:33.434812069 CET	443	49984	151.101.193.91	192.168.2.6
Feb 15, 2025 17:38:33.435045958 CET	443	49984	151.101.193.91	192.168.2.6
Feb 15, 2025 17:38:33.436023951 CET	49982	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:33.436120033 CET	49982	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:33.436177015 CET	443	49982	34.149.100.209	192.168.2.6
Feb 15, 2025 17:38:33.436714888 CET	49982	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:33.437577963 CET	49984	443	192.168.2.6	151.101.193.91
Feb 15, 2025 17:38:33.437642097 CET	49984	443	192.168.2.6	151.101.193.91
Feb 15, 2025 17:38:33.437724113 CET	443	49984	151.101.193.91	192.168.2.6
Feb 15, 2025 17:38:33.437788010 CET	49984	443	192.168.2.6	151.101.193.91
Feb 15, 2025 17:38:33.442006111 CET	443	49985	34.49.51.44	192.168.2.6
Feb 15, 2025 17:38:33.442025900 CET	443	49985	34.49.51.44	192.168.2.6
Feb 15, 2025 17:38:33.442085981 CET	49985	443	192.168.2.6	34.49.51.44
Feb 15, 2025 17:38:33.446199894 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:33.446890116 CET	49985	443	192.168.2.6	34.49.51.44
Feb 15, 2025 17:38:33.446902990 CET	443	49985	34.49.51.44	192.168.2.6
Feb 15, 2025 17:38:33.447094917 CET	49985	443	192.168.2.6	34.49.51.44
Feb 15, 2025 17:38:33.447113991 CET	443	49985	34.49.51.44	192.168.2.6
Feb 15, 2025 17:38:33.447309017 CET	49985	443	192.168.2.6	34.49.51.44
Feb 15, 2025 17:38:33.448472023 CET	443	49981	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.448483944 CET	443	49981	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.450423002 CET	49981	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.451080084 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:33.452884912 CET	49981	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.452903986 CET	443	49981	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.453146935 CET	443	49981	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.453217983 CET	49988	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.453248024 CET	443	49988	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.454551935 CET	49988	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.454719067 CET	49988	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.454727888 CET	443	49988	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.455471039 CET	443	49983	35.190.72.216	192.168.2.6
Feb 15, 2025 17:38:33.455538034 CET	49981	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.455621958 CET	49981	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.455755949 CET	443	49981	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.457060099 CET	49983	443	192.168.2.6	35.190.72.216
Feb 15, 2025 17:38:33.457228899 CET	49981	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.460875988 CET	49983	443	192.168.2.6	35.190.72.216
Feb 15, 2025 17:38:33.460882902 CET	443	49983	35.190.72.216	192.168.2.6
Feb 15, 2025 17:38:33.460963964 CET	49983	443	192.168.2.6	35.190.72.216
Feb 15, 2025 17:38:33.461010933 CET	443	49983	35.190.72.216	192.168.2.6
Feb 15, 2025 17:38:33.464675903 CET	49983	443	192.168.2.6	35.190.72.216
Feb 15, 2025 17:38:33.465163946 CET	49989	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.465184927 CET	443	49989	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.465248108 CET	49989	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.465322971 CET	49989	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.465337992 CET	443	49989	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.468606949 CET	49990	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.468631029 CET	443	49990	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.468852997 CET	49990	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.468941927 CET	49990	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.468955994 CET	443	49990	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.472395897 CET	49992	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:33.472404003 CET	443	49992	34.149.100.209	192.168.2.6
Feb 15, 2025 17:38:33.473011017 CET	49992	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:33.473052025 CET	49992	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:33.473058939 CET	443	49992	34.149.100.209	192.168.2.6
Feb 15, 2025 17:38:33.540564060 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:33.544547081 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:33.549367905 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:33.585350037 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:33.638652086 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:33.685625076 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:33.908644915 CET	443	49988	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.908734083 CET	49988	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.911794901 CET	49988	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.911804914 CET	443	49988	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.912054062 CET	443	49988	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.914717913 CET	49988	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.914834023 CET	49988	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.914894104 CET	443	49988	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.915227890 CET	49988	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.920572996 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:33.925422907 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:33.926579952 CET	443	49990	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.926665068 CET	49990	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.929217100 CET	49990	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.929227114 CET	443	49990	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.929461002 CET	443	49990	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.931638002 CET	443	49992	34.149.100.209	192.168.2.6
Feb 15, 2025 17:38:33.931907892 CET	49992	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:33.934644938 CET	49992	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:33.934647083 CET	49990	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.934665918 CET	443	49992	34.149.100.209	192.168.2.6
Feb 15, 2025 17:38:33.934792995 CET	443	49990	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.934900045 CET	443	49992	34.149.100.209	192.168.2.6
Feb 15, 2025 17:38:33.935026884 CET	49990	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.935035944 CET	443	49990	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.937849045 CET	49992	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:33.937997103 CET	49992	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:33.938008070 CET	443	49992	34.149.100.209	192.168.2.6
Feb 15, 2025 17:38:33.938015938 CET	443	49992	34.149.100.209	192.168.2.6
Feb 15, 2025 17:38:33.939539909 CET	443	49989	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.939659119 CET	49989	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.942231894 CET	49989	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.942243099 CET	443	49989	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.942491055 CET	443	49989	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.944319010 CET	49989	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.944402933 CET	49989	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.944483042 CET	443	49989	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:33.947613001 CET	49989	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.947629929 CET	49989	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:33.977040052 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:33.982868910 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:33.982943058 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:33.983076096 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:33.987844944 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.015775919 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:34.020207882 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:34.025976896 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:34.071202993 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:34.139389038 CET	443	49990	35.244.181.201	192.168.2.6
Feb 15, 2025 17:38:34.139492989 CET	49990	443	192.168.2.6	35.244.181.201
Feb 15, 2025 17:38:34.147329092 CET	443	49992	34.149.100.209	192.168.2.6
Feb 15, 2025 17:38:34.147476912 CET	49992	443	192.168.2.6	34.149.100.209
Feb 15, 2025 17:38:34.152426004 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:34.206103086 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:34.681910038 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.681962967 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.682001114 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.682157993 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.683500051 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.683536053 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.683561087 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.683588982 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.683640003 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.684705019 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.684741974 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.684777021 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.684818029 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.685621023 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.685683012 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.686988115 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.687041044 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.687145948 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.688210964 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.688245058 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.688280106 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.688338041 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.767402887 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.767421961 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.767647028 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.767795086 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.767807961 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.767817974 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.767823935 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.767868996 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.767882109 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.769033909 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.769047976 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.769058943 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.769069910 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.769107103 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.769318104 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.770306110 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.774471998 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.774486065 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.774497032 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.774538994 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.774624109 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.774740934 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.774751902 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.774763107 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.774894953 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.776952982 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.776964903 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.777076960 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.777106047 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.777117014 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.777128935 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.777139902 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.777256966 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.779660940 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.779675961 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.779687881 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.779699087 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.779778004 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.779958010 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.780013084 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.858851910 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.858993053 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.859006882 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.859024048 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.859036922 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.859122992 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.859160900 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.859183073 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.859194040 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.859205961 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.859216928 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.859225988 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.859252930 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.859287024 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.859888077 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.859899998 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.859910965 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.859921932 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.859935045 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.859946012 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.859956980 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.859961033 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.860045910 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.860837936 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.861011982 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.861022949 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.861187935 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.861556053 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.861569881 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.861625910 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.863573074 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.863589048 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.863603115 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.863612890 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.863625050 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.863635063 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.863641024 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.863646984 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.863676071 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.863687038 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.863697052 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.863838911 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.864785910 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.864801884 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.864844084 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.865153074 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.865166903 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.865179062 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.865190029 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.865200996 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.865211010 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.865212917 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.865287066 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.865502119 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.865514994 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.865567923 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.866517067 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.866528034 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.866540909 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.866595984 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.866678953 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.866689920 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.866717100 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.866781950 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.867222071 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.867234945 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.867245913 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.867285967 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.868705034 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.868720055 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.868773937 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.868832111 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.868845940 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.868856907 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.869004965 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.944456100 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.944622993 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.944634914 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.944689989 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.944802046 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.944818974 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.944829941 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.944839954 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.944850922 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.944855928 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.944863081 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.944874048 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.944920063 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.944992065 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.945003033 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.945013046 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.945031881 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.945061922 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.945142031 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.945849895 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.945877075 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.945923090 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.945933104 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.945976019 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.946099043 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.946122885 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.946199894 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.946203947 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.946212053 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.946223021 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.946232080 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.946249962 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.946265936 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.946276903 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.946331978 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.948759079 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.948770046 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.948779106 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.948818922 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.949284077 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.949417114 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.949451923 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.949630976 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.949641943 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.949651003 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.949661016 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.949671984 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.949682951 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.949693918 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.949695110 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.949758053 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.950242996 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.950298071 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.950339079 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.950376034 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.950392008 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.950412989 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.950448036 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.950450897 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.950491905 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.950526953 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.950535059 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.950563908 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.950598955 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.950634956 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.950670958 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.950721025 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.950774908 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.951601028 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.951662064 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.951705933 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.951740980 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.951776981 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.951797962 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.951829910 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.951865911 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.951915979 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.951925993 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.951951981 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.951982975 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.951987028 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.952023983 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.952040911 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.952058077 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.952092886 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.952126980 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.952162027 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.952178001 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.952440977 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.952476025 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.952510118 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.952510118 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.952570915 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.953794003 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.953825951 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.953898907 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.953958035 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.954349995 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.954385042 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.954421043 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.954441071 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.954502106 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.954540968 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.954576969 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.954612017 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.954647064 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.954680920 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.954699039 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.954716921 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.954790115 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.955043077 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.955080032 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.955115080 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.955149889 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.955177069 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.955185890 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.955220938 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.955255985 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.955261946 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.955291033 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.955307961 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.955354929 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.955360889 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.955395937 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.955410004 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.955432892 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:34.955446005 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:34.955495119 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.153263092 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.153311968 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.153347015 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.153399944 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.153434038 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.153470039 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.153503895 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.153556108 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.153592110 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.153630018 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.153635979 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.153664112 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.153702021 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.153738022 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.153773069 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.153772116 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.153809071 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.153862000 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.153882027 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.153915882 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.153951883 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.153985023 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154002905 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.154038906 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154073000 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.154076099 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154113054 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154139042 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.154148102 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154179096 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154196978 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.154211998 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154249907 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154284000 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154294014 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.154320002 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154354095 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.154355049 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154391050 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154411077 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.154426098 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154460907 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154495955 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154515028 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.154530048 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154561996 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.154583931 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154623032 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154653072 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154659033 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.154687881 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154706955 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.154726028 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154777050 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154795885 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.154831886 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154866934 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154882908 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.154903889 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154937983 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.154973030 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.154973030 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155009031 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155021906 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.155042887 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155073881 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155123949 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155128956 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.155158997 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155190945 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.155194998 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155230045 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155245066 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.155283928 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155350924 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155354023 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.155385017 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155441046 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155476093 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155510902 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155539036 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155564070 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155577898 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155594110 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155610085 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155625105 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155636072 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155646086 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155654907 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155664921 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155675888 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155687094 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155697107 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155708075 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155718088 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155729055 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155740976 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155754089 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155762911 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155774117 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155791044 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155801058 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155811071 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155822039 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155833006 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155843019 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155853033 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155864954 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155874968 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155885935 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155899048 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155937910 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155949116 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155965090 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155966997 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155977964 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155987024 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.155997038 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156007051 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156018972 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156028986 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156039953 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156049967 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156060934 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156078100 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156090021 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156100035 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156115055 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156122923 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156131029 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156137943 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156143904 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156152010 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156158924 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156161070 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156166077 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156182051 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156188011 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156188965 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156191111 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156196117 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156200886 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156239033 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156254053 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156264067 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156275988 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156292915 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156295061 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156299114 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156308889 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156322956 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156341076 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156352997 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156352997 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.156363964 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156377077 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156388044 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156398058 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156409025 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156419039 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156430006 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156440973 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156452894 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156459093 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156470060 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156480074 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156483889 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.156491995 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156502962 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156507969 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.156517029 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156529903 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156539917 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156549931 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156562090 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.156615019 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.156677961 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.156730890 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.156790018 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.156846046 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.156919956 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.157016039 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.161777973 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.161807060 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.161818981 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.161875010 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.161925077 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162024021 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.162074089 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162086964 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162097931 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162110090 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162121058 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162130117 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162142992 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162156105 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162168026 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162164927 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.162180901 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162194967 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.162198067 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162210941 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162223101 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162282944 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162285089 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.162300110 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162306070 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162322998 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162336111 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162348032 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162358999 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162396908 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.162492037 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.162512064 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162663937 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162677050 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162689924 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162702084 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162714958 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162729025 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162764072 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.162807941 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162821054 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162832975 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.162844896 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.162928104 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.163028955 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.163043022 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.163054943 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.163068056 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.163079977 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.163094044 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.163105011 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.163111925 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.163117886 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.163120031 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.163130999 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.163199902 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.163222075 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.163233995 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.163245916 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.163259029 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.163270950 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.163285017 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.163362026 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.163362026 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.163434982 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.163448095 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.163532972 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.163959980 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.163975000 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.163986921 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.163991928 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.164005041 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.164017916 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.164082050 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.164100885 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.164113998 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.164127111 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.164138079 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.164156914 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.164165974 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.164171934 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.164176941 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:35.164254904 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.164371014 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:35.946706057 CET	63567	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:35.951539040 CET	53	63567	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:35.952332973 CET	63567	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:35.952332973 CET	63567	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:35.957210064 CET	53	63567	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:36.420376062 CET	53	63567	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:36.421221972 CET	63567	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:36.426278114 CET	53	63567	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:36.426359892 CET	63567	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:36.963989019 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:36.973227978 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:37.058625937 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:37.061985970 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:37.066812038 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:37.110707045 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:37.158538103 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:37.211009026 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:40.645026922 CET	56392	53	192.168.2.6	162.159.36.2
Feb 15, 2025 17:38:40.649805069 CET	53	56392	162.159.36.2	192.168.2.6
Feb 15, 2025 17:38:40.649887085 CET	56392	53	192.168.2.6	162.159.36.2
Feb 15, 2025 17:38:40.654680967 CET	53	56392	162.159.36.2	192.168.2.6
Feb 15, 2025 17:38:41.241588116 CET	56392	53	192.168.2.6	162.159.36.2
Feb 15, 2025 17:38:41.248773098 CET	53	56392	162.159.36.2	192.168.2.6
Feb 15, 2025 17:38:41.248832941 CET	56392	53	192.168.2.6	162.159.36.2
Feb 15, 2025 17:38:45.165980101 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:45.172801018 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:38:47.071748972 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:47.076627016 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:47.172091007 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:47.176846981 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:52.844364882 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:52.849206924 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:52.939404964 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:52.943142891 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:52.947946072 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:52.959587097 CET	56396	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:52.959625006 CET	443	56396	34.107.243.93	192.168.2.6
Feb 15, 2025 17:38:52.972385883 CET	56396	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:52.973957062 CET	56396	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:52.973975897 CET	443	56396	34.107.243.93	192.168.2.6
Feb 15, 2025 17:38:52.989132881 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:53.041229963 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:53.089440107 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:53.432868004 CET	443	56396	34.107.243.93	192.168.2.6
Feb 15, 2025 17:38:53.432887077 CET	443	56396	34.107.243.93	192.168.2.6
Feb 15, 2025 17:38:53.432977915 CET	56396	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:53.438134909 CET	56396	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:53.438144922 CET	443	56396	34.107.243.93	192.168.2.6
Feb 15, 2025 17:38:53.438241005 CET	56396	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:53.438323021 CET	443	56396	34.107.243.93	192.168.2.6
Feb 15, 2025 17:38:53.439043999 CET	56396	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:38:53.440819025 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:53.445679903 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:53.537029982 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:53.539825916 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:53.544651985 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:53.590960979 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:53.634134054 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:38:53.675574064 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:38:55.179907084 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:38:55.187110901 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:39:03.093703985 CET	56398	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.093813896 CET	443	56398	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.093900919 CET	56399	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.093936920 CET	443	56399	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.094096899 CET	56400	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.094125032 CET	443	56400	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.094149113 CET	56401	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.094192982 CET	443	56401	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.094264984 CET	56402	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.094274998 CET	443	56402	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.094472885 CET	56403	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.094484091 CET	443	56403	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.094645977 CET	56398	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.094657898 CET	56401	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.094659090 CET	56400	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.094660997 CET	56399	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.094852924 CET	56403	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.094855070 CET	56402	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.094865084 CET	56398	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.094885111 CET	443	56398	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.095062971 CET	56402	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.095077038 CET	443	56402	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.095144987 CET	56401	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.095171928 CET	443	56401	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.095232964 CET	56400	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.095244884 CET	443	56400	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.095324993 CET	56399	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.095339060 CET	443	56399	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.095402002 CET	56403	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.095413923 CET	443	56403	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.555962086 CET	443	56398	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.556081057 CET	56398	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.556375027 CET	443	56399	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.556448936 CET	56399	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.557529926 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:39:03.558922052 CET	443	56403	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.559626102 CET	56398	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.559660912 CET	443	56398	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.559834957 CET	56403	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.559998035 CET	443	56398	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.562140942 CET	56399	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.562150955 CET	443	56399	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.562407970 CET	443	56399	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.562416077 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:39:03.564342976 CET	56403	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.564357996 CET	443	56403	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.564564943 CET	443	56403	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.568207026 CET	443	56400	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.568789959 CET	56398	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.568984032 CET	56398	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.569067955 CET	56403	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.569184065 CET	56403	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.569255114 CET	443	56403	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.569297075 CET	443	56398	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.569587946 CET	56404	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.569621086 CET	443	56404	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.569750071 CET	56405	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.569819927 CET	443	56405	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.570023060 CET	56399	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.570091009 CET	56399	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.570275068 CET	56403	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.570298910 CET	56398	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.570336103 CET	56404	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.570338011 CET	56400	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.570485115 CET	443	56399	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.570487976 CET	56405	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.573036909 CET	56400	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.573048115 CET	443	56400	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.573180914 CET	56399	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.573383093 CET	443	56400	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.573688984 CET	56405	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.573719025 CET	443	56405	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.573750019 CET	56404	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.573762894 CET	443	56404	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.574997902 CET	443	56401	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.575371981 CET	56401	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.577594042 CET	56401	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.577600956 CET	443	56401	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.577927113 CET	443	56401	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.578406096 CET	56400	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.578536034 CET	56400	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.578708887 CET	443	56400	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.579674006 CET	56400	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.580378056 CET	56401	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.580471039 CET	56401	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.580570936 CET	443	56401	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.580893993 CET	56401	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.581779003 CET	443	56402	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.582139969 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:39:03.582573891 CET	56402	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.584963083 CET	56402	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.584968090 CET	443	56402	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.585720062 CET	443	56402	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.587126017 CET	56402	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.587218046 CET	56402	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.587256908 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:39:03.587321043 CET	443	56402	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:03.587373972 CET	56402	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:03.635705948 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:39:03.640645027 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:39:03.676603079 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:39:03.689614058 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:39:03.694653988 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:39:03.720326900 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:39:03.784439087 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:39:03.836267948 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:39:04.038003922 CET	443	56404	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:04.038192987 CET	56404	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:04.041413069 CET	56404	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:04.041425943 CET	443	56404	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:04.041657925 CET	443	56404	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:04.044174910 CET	56404	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:04.044270039 CET	56404	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:04.044343948 CET	443	56404	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:04.044415951 CET	56404	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:04.052505016 CET	443	56405	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:04.052629948 CET	56405	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:04.055377007 CET	56405	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:04.055416107 CET	443	56405	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:04.055717945 CET	443	56405	34.120.208.123	192.168.2.6
Feb 15, 2025 17:39:04.057653904 CET	56405	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:04.057728052 CET	56405	443	192.168.2.6	34.120.208.123
Feb 15, 2025 17:39:04.202874899 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:39:04.207758904 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:39:04.298321962 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:39:04.359066963 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:39:04.433295012 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:39:04.438283920 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:39:04.527795076 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:39:04.575186968 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:39:05.192712069 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:39:05.197560072 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:39:14.302114964 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:39:14.306909084 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:39:14.534028053 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:39:14.539066076 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:39:15.204824924 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:39:15.210949898 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:39:24.313760042 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:39:24.318720102 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:39:24.552097082 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:39:24.557013035 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:39:25.216582060 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:39:25.221489906 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:39:33.511220932 CET	56407	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:39:33.511249065 CET	443	56407	34.107.243.93	192.168.2.6
Feb 15, 2025 17:39:33.511318922 CET	56407	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:39:33.512823105 CET	56407	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:39:33.512837887 CET	443	56407	34.107.243.93	192.168.2.6
Feb 15, 2025 17:39:33.975162029 CET	443	56407	34.107.243.93	192.168.2.6
Feb 15, 2025 17:39:33.975338936 CET	56407	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:39:33.980415106 CET	56407	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:39:33.980436087 CET	443	56407	34.107.243.93	192.168.2.6
Feb 15, 2025 17:39:33.980546951 CET	56407	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:39:33.980638981 CET	443	56407	34.107.243.93	192.168.2.6
Feb 15, 2025 17:39:33.981482029 CET	56407	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:39:33.983599901 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:39:33.988351107 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:39:34.077991009 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:39:34.082526922 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:39:34.087344885 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:39:34.126632929 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:39:34.176558971 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:39:34.226958036 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:39:35.230109930 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:39:35.234927893 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:39:44.093465090 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:39:44.098472118 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:39:44.193629026 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:39:44.198534966 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:39:45.243675947 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:39:45.249758005 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:39:54.099606037 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:39:54.104501009 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:39:54.199919939 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:39:54.206142902 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:39:55.256227970 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:39:55.261172056 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:40:04.106278896 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:40:04.111228943 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:40:04.218226910 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:40:04.223155975 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:40:05.283668995 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:40:05.288625956 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:40:14.129991055 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:40:14.135066986 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:40:14.245908976 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:40:14.511157990 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:40:15.295857906 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:40:15.300936937 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:40:24.136759043 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:40:24.141908884 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:40:24.521697998 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:40:24.526549101 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:40:25.308247089 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:40:25.313210964 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:40:31.078201056 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:40:31.083611012 CET	80	49995	2.22.61.56	192.168.2.6
Feb 15, 2025 17:40:31.084433079 CET	49995	80	192.168.2.6	2.22.61.56
Feb 15, 2025 17:40:34.148205042 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:40:34.153613091 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:40:34.533293962 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:40:34.538975954 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:40:44.160548925 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:40:44.165538073 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:40:44.546184063 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:40:44.551254034 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:40:54.008371115 CET	56409	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:40:54.008410931 CET	443	56409	34.107.243.93	192.168.2.6
Feb 15, 2025 17:40:54.008584976 CET	56409	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:40:54.010781050 CET	56409	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:40:54.010795116 CET	443	56409	34.107.243.93	192.168.2.6
Feb 15, 2025 17:40:54.173084974 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:40:54.178523064 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:40:54.465617895 CET	443	56409	34.107.243.93	192.168.2.6
Feb 15, 2025 17:40:54.465785980 CET	56409	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:40:54.473474979 CET	56409	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:40:54.473493099 CET	443	56409	34.107.243.93	192.168.2.6
Feb 15, 2025 17:40:54.473582983 CET	56409	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:40:54.473711967 CET	443	56409	34.107.243.93	192.168.2.6
Feb 15, 2025 17:40:54.474049091 CET	56409	443	192.168.2.6	34.107.243.93
Feb 15, 2025 17:40:54.477216005 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:40:54.482054949 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:40:54.558780909 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:40:54.563659906 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:40:54.572474003 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:40:54.577296019 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:40:54.582056046 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:40:54.621309042 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:40:54.671437025 CET	80	49803	34.107.221.82	192.168.2.6
Feb 15, 2025 17:40:54.721565008 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:41:04.587615013 CET	49804	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:41:04.592628956 CET	80	49804	34.107.221.82	192.168.2.6
Feb 15, 2025 17:41:04.687906027 CET	49803	80	192.168.2.6	34.107.221.82
Feb 15, 2025 17:41:04.692994118 CET	80	49803	34.107.221.82	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 15, 2025 17:38:05.400821924 CET	57598	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:05.402029991 CET	59793	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:05.408895016 CET	53	57598	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:05.409497023 CET	53	59793	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:05.434345007 CET	60490	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:05.434669018 CET	53055	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:05.435955048 CET	54035	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:05.440876961 CET	53	60490	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:05.441471100 CET	53	53055	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:05.442789078 CET	53	54035	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:05.444308996 CET	60441	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:05.448971987 CET	55972	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:05.449335098 CET	52196	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:05.452424049 CET	53	60441	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:05.456990957 CET	53	55972	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:05.457003117 CET	53	52196	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:05.713202953 CET	57805	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:05.719959974 CET	59151	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:05.719965935 CET	53	57805	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:05.721395016 CET	50494	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:05.726644039 CET	53	59151	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:05.728157997 CET	53	50494	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:05.730882883 CET	57690	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:05.732048988 CET	62757	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:05.734119892 CET	55035	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:05.737948895 CET	53	57690	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:05.738749981 CET	53	62757	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:05.741897106 CET	53	55035	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:05.742351055 CET	57044	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:05.742655039 CET	62996	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:05.749289989 CET	53	57044	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:05.749311924 CET	53	62996	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:07.010973930 CET	62159	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:07.011539936 CET	59885	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:07.017807007 CET	53	62159	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:07.018141985 CET	53	59885	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:07.465018988 CET	53505	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:07.466655970 CET	62661	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:07.473853111 CET	53	53505	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:07.475055933 CET	53	62661	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:07.483601093 CET	50547	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:07.498718977 CET	53	50547	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:07.503341913 CET	49945	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:07.513158083 CET	53	49945	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:07.576590061 CET	62808	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:07.585680008 CET	53	62808	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:07.602545023 CET	50333	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:07.612216949 CET	53	50333	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:07.661001921 CET	54723	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:07.669730902 CET	53	54723	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:11.168899059 CET	53897	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:11.176769972 CET	53	53897	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:11.241122007 CET	65291	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:11.252243996 CET	53	65291	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:11.254106045 CET	64018	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:11.263120890 CET	53	64018	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:12.888418913 CET	59559	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:12.895899057 CET	53	59559	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:12.896960020 CET	57534	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:12.904686928 CET	53	57534	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:12.905390978 CET	64686	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:12.912265062 CET	53	64686	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:13.053488016 CET	61801	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:13.060234070 CET	53	61801	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:13.071815968 CET	56376	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:13.078985929 CET	53	56376	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:13.331482887 CET	64668	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:13.338551044 CET	53	64668	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:13.340666056 CET	63330	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:13.347759962 CET	53	63330	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:13.362492085 CET	65178	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:13.369141102 CET	53	65178	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:19.089179993 CET	56739	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:19.106501102 CET	53	56739	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:19.852947950 CET	59847	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:19.859836102 CET	53	59847	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:21.885858059 CET	53922	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:21.886257887 CET	52695	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:21.886343956 CET	53554	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:21.895790100 CET	53	53922	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:21.895807028 CET	53	52695	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:21.896505117 CET	53369	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:21.896538973 CET	53	53554	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:21.896605968 CET	50118	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:21.897102118 CET	58605	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:21.906277895 CET	53	53369	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:21.906291008 CET	53	50118	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:21.906857014 CET	54585	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:21.907025099 CET	55417	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:21.908091068 CET	53	58605	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:21.908489943 CET	59912	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:21.917402029 CET	53	54585	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:21.917414904 CET	53	55417	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:21.918036938 CET	53	59912	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:21.918603897 CET	59305	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:21.919167995 CET	53073	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:21.927484989 CET	53	59305	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:21.928121090 CET	55097	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:21.928241968 CET	53	53073	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:21.928807974 CET	52838	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:21.937463999 CET	53	52838	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:21.937596083 CET	53	55097	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:21.939325094 CET	50244	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:21.939774036 CET	54093	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:21.947750092 CET	53	50244	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:21.948543072 CET	53	54093	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:31.902731895 CET	56278	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:32.106960058 CET	53	56278	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:32.806139946 CET	51939	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:32.813002110 CET	53	51939	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:32.937058926 CET	56044	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:32.944164991 CET	53	56044	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:32.948527098 CET	54415	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:32.951836109 CET	60204	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:32.956340075 CET	53	54415	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:32.959636927 CET	53	60204	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:32.964845896 CET	64057	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:32.969959974 CET	55875	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:32.971656084 CET	53	64057	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:32.977957964 CET	53	55875	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:32.980360985 CET	57310	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:32.987802029 CET	53	57310	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:33.977668047 CET	59787	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:33.986493111 CET	53	59787	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:33.987116098 CET	61240	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:33.997529030 CET	53	61240	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:35.945947886 CET	53	63996	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:37.418711901 CET	53	64986	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:38.421967983 CET	53	51104	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:40.644407988 CET	53	51363	162.159.36.2	192.168.2.6
Feb 15, 2025 17:38:41.292570114 CET	53	62704	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:52.948683977 CET	65494	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:52.955548048 CET	53	65494	1.1.1.1	192.168.2.6
Feb 15, 2025 17:38:52.958509922 CET	59019	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:38:52.967248917 CET	53	59019	1.1.1.1	192.168.2.6
Feb 15, 2025 17:39:03.092782021 CET	53843	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:39:03.099457979 CET	53	53843	1.1.1.1	192.168.2.6
Feb 15, 2025 17:39:03.582509041 CET	55728	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:39:03.589701891 CET	53	55728	1.1.1.1	192.168.2.6
Feb 15, 2025 17:39:33.510190010 CET	62687	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:39:33.517307997 CET	53	62687	1.1.1.1	192.168.2.6
Feb 15, 2025 17:39:33.518547058 CET	61543	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:39:33.525227070 CET	53	61543	1.1.1.1	192.168.2.6
Feb 15, 2025 17:40:53.992122889 CET	63490	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:40:53.999385118 CET	53	63490	1.1.1.1	192.168.2.6
Feb 15, 2025 17:40:54.000576019 CET	63312	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:40:54.007369041 CET	53	63312	1.1.1.1	192.168.2.6
Feb 15, 2025 17:40:54.008199930 CET	58363	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:40:54.015254021 CET	53	58363	1.1.1.1	192.168.2.6
Feb 15, 2025 17:40:54.478032112 CET	60467	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:40:54.484755993 CET	53	60467	1.1.1.1	192.168.2.6
Feb 15, 2025 17:40:54.574148893 CET	59483	53	192.168.2.6	1.1.1.1
Feb 15, 2025 17:40:54.581119061 CET	53	59483	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 15, 2025 17:38:05.400821924 CET	192.168.2.6	1.1.1.1	0x9832	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.402029991 CET	192.168.2.6	1.1.1.1	0x7df6	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.434345007 CET	192.168.2.6	1.1.1.1	0xf6b4	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.434669018 CET	192.168.2.6	1.1.1.1	0xa54f	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.435955048 CET	192.168.2.6	1.1.1.1	0x866c	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.444308996 CET	192.168.2.6	1.1.1.1	0xe5cf	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Feb 15, 2025 17:38:05.448971987 CET	192.168.2.6	1.1.1.1	0x157c	Standard query (0)	youtube.com	28	IN (0x0001)	false
Feb 15, 2025 17:38:05.449335098 CET	192.168.2.6	1.1.1.1	0x418e	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Feb 15, 2025 17:38:05.713202953 CET	192.168.2.6	1.1.1.1	0x8d19	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.719959974 CET	192.168.2.6	1.1.1.1	0x2477	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.721395016 CET	192.168.2.6	1.1.1.1	0x30a0	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.730882883 CET	192.168.2.6	1.1.1.1	0x7dab	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Feb 15, 2025 17:38:05.732048988 CET	192.168.2.6	1.1.1.1	0xe8af	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.734119892 CET	192.168.2.6	1.1.1.1	0x2fb3	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.742351055 CET	192.168.2.6	1.1.1.1	0x2a4d	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Feb 15, 2025 17:38:05.742655039 CET	192.168.2.6	1.1.1.1	0x1f6f	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Feb 15, 2025 17:38:07.010973930 CET	192.168.2.6	1.1.1.1	0x2187	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:07.011539936 CET	192.168.2.6	1.1.1.1	0x1724	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:07.465018988 CET	192.168.2.6	1.1.1.1	0x442c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:07.466655970 CET	192.168.2.6	1.1.1.1	0xf3e7	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:07.483601093 CET	192.168.2.6	1.1.1.1	0x734e	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:07.503341913 CET	192.168.2.6	1.1.1.1	0x6e1a	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Feb 15, 2025 17:38:07.576590061 CET	192.168.2.6	1.1.1.1	0xe961	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:07.602545023 CET	192.168.2.6	1.1.1.1	0x71bf	Standard query (0)	shavar.prod.mozaws.net	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:07.661001921 CET	192.168.2.6	1.1.1.1	0xfa80	Standard query (0)	shavar.prod.mozaws.net	28	IN (0x0001)	false
Feb 15, 2025 17:38:11.168899059 CET	192.168.2.6	1.1.1.1	0x1d23	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:11.241122007 CET	192.168.2.6	1.1.1.1	0xce24	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:11.254106045 CET	192.168.2.6	1.1.1.1	0x6534	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Feb 15, 2025 17:38:12.888418913 CET	192.168.2.6	1.1.1.1	0x466c	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:12.896960020 CET	192.168.2.6	1.1.1.1	0x3d42	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:12.905390978 CET	192.168.2.6	1.1.1.1	0x20c6	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Feb 15, 2025 17:38:13.053488016 CET	192.168.2.6	1.1.1.1	0xf1e7	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:13.071815968 CET	192.168.2.6	1.1.1.1	0x4a7b	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Feb 15, 2025 17:38:13.331482887 CET	192.168.2.6	1.1.1.1	0x67e3	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:13.340666056 CET	192.168.2.6	1.1.1.1	0x770c	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:13.362492085 CET	192.168.2.6	1.1.1.1	0xad8c	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Feb 15, 2025 17:38:19.089179993 CET	192.168.2.6	1.1.1.1	0x7f6d	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Feb 15, 2025 17:38:19.852947950 CET	192.168.2.6	1.1.1.1	0xa1cb	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Feb 15, 2025 17:38:21.885858059 CET	192.168.2.6	1.1.1.1	0x76af	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.886257887 CET	192.168.2.6	1.1.1.1	0x4dfa	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.886343956 CET	192.168.2.6	1.1.1.1	0x8921	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.896505117 CET	192.168.2.6	1.1.1.1	0x5f04	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.896605968 CET	192.168.2.6	1.1.1.1	0x1bf0	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.897102118 CET	192.168.2.6	1.1.1.1	0xfba0	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.906857014 CET	192.168.2.6	1.1.1.1	0x717d	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Feb 15, 2025 17:38:21.907025099 CET	192.168.2.6	1.1.1.1	0x61c	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Feb 15, 2025 17:38:21.908489943 CET	192.168.2.6	1.1.1.1	0xf6b6	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Feb 15, 2025 17:38:21.918603897 CET	192.168.2.6	1.1.1.1	0x4fbc	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.919167995 CET	192.168.2.6	1.1.1.1	0xabc5	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.928121090 CET	192.168.2.6	1.1.1.1	0x5060	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.928807974 CET	192.168.2.6	1.1.1.1	0x7e7a	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.939325094 CET	192.168.2.6	1.1.1.1	0xc6ea	Standard query (0)	twitter.com	28	IN (0x0001)	false
Feb 15, 2025 17:38:21.939774036 CET	192.168.2.6	1.1.1.1	0x65c0	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Feb 15, 2025 17:38:31.902731895 CET	192.168.2.6	1.1.1.1	0x382f	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Feb 15, 2025 17:38:32.806139946 CET	192.168.2.6	1.1.1.1	0x417c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:32.937058926 CET	192.168.2.6	1.1.1.1	0x9912	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:32.948527098 CET	192.168.2.6	1.1.1.1	0x3582	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:32.951836109 CET	192.168.2.6	1.1.1.1	0xc343	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:32.964845896 CET	192.168.2.6	1.1.1.1	0xc106	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Feb 15, 2025 17:38:32.969959974 CET	192.168.2.6	1.1.1.1	0xc7de	Standard query (0)	normandy.tombstone.experimenter.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:32.980360985 CET	192.168.2.6	1.1.1.1	0x30a7	Standard query (0)	normandy.tombstone.experimenter.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Feb 15, 2025 17:38:33.977668047 CET	192.168.2.6	1.1.1.1	0xa9ae	Standard query (0)	a19.dscg10.akamai.net	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:33.987116098 CET	192.168.2.6	1.1.1.1	0xac0c	Standard query (0)	a19.dscg10.akamai.net	28	IN (0x0001)	false
Feb 15, 2025 17:38:52.948683977 CET	192.168.2.6	1.1.1.1	0x8bd	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:52.958509922 CET	192.168.2.6	1.1.1.1	0x1ff	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Feb 15, 2025 17:39:03.092782021 CET	192.168.2.6	1.1.1.1	0x9310	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Feb 15, 2025 17:39:03.582509041 CET	192.168.2.6	1.1.1.1	0x741c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:39:33.510190010 CET	192.168.2.6	1.1.1.1	0x1db2	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:39:33.518547058 CET	192.168.2.6	1.1.1.1	0x4270	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Feb 15, 2025 17:40:53.992122889 CET	192.168.2.6	1.1.1.1	0x6214	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:40:54.000576019 CET	192.168.2.6	1.1.1.1	0x9c1c	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:40:54.008199930 CET	192.168.2.6	1.1.1.1	0x68ed	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Feb 15, 2025 17:40:54.478032112 CET	192.168.2.6	1.1.1.1	0xf755	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:40:54.574148893 CET	192.168.2.6	1.1.1.1	0x49aa	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 15, 2025 17:37:55.328696012 CET	1.1.1.1	192.168.2.6	0xbb94	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:37:55.328696012 CET	1.1.1.1	192.168.2.6	0xbb94	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.408327103 CET	1.1.1.1	192.168.2.6	0x2207	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.408895016 CET	1.1.1.1	192.168.2.6	0x9832	No error (0)	youtube.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.409497023 CET	1.1.1.1	192.168.2.6	0x7df6	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:05.409497023 CET	1.1.1.1	192.168.2.6	0x7df6	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:05.409497023 CET	1.1.1.1	192.168.2.6	0x7df6	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.440876961 CET	1.1.1.1	192.168.2.6	0xf6b4	No error (0)	youtube.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.441471100 CET	1.1.1.1	192.168.2.6	0xa54f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.442789078 CET	1.1.1.1	192.168.2.6	0x866c	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.456990957 CET	1.1.1.1	192.168.2.6	0x157c	No error (0)	youtube.com			28	IN (0x0001)	false
Feb 15, 2025 17:38:05.457003117 CET	1.1.1.1	192.168.2.6	0x418e	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Feb 15, 2025 17:38:05.719965935 CET	1.1.1.1	192.168.2.6	0x8d19	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.726644039 CET	1.1.1.1	192.168.2.6	0x2477	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:05.726644039 CET	1.1.1.1	192.168.2.6	0x2477	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.727736950 CET	1.1.1.1	192.168.2.6	0xdd3c	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:05.727736950 CET	1.1.1.1	192.168.2.6	0xdd3c	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.728157997 CET	1.1.1.1	192.168.2.6	0x30a0	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.738749981 CET	1.1.1.1	192.168.2.6	0xe8af	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.741897106 CET	1.1.1.1	192.168.2.6	0x2fb3	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:05.749311924 CET	1.1.1.1	192.168.2.6	0x1f6f	No error (0)	prod.balrog.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Feb 15, 2025 17:38:07.017807007 CET	1.1.1.1	192.168.2.6	0x2187	No error (0)	example.org		23.215.0.132	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:07.017807007 CET	1.1.1.1	192.168.2.6	0x2187	No error (0)	example.org		96.7.128.186	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:07.017807007 CET	1.1.1.1	192.168.2.6	0x2187	No error (0)	example.org		96.7.128.192	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:07.017807007 CET	1.1.1.1	192.168.2.6	0x2187	No error (0)	example.org		23.215.0.133	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:07.018141985 CET	1.1.1.1	192.168.2.6	0x1724	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:07.018141985 CET	1.1.1.1	192.168.2.6	0x1724	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:07.473853111 CET	1.1.1.1	192.168.2.6	0x442c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:07.473853111 CET	1.1.1.1	192.168.2.6	0x442c	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:07.473853111 CET	1.1.1.1	192.168.2.6	0x442c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:07.475055933 CET	1.1.1.1	192.168.2.6	0xf3e7	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:07.475055933 CET	1.1.1.1	192.168.2.6	0xf3e7	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:07.475055933 CET	1.1.1.1	192.168.2.6	0xf3e7	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:07.498718977 CET	1.1.1.1	192.168.2.6	0x734e	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:07.513158083 CET	1.1.1.1	192.168.2.6	0x6e1a	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Feb 15, 2025 17:38:07.585680008 CET	1.1.1.1	192.168.2.6	0xe961	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:07.585680008 CET	1.1.1.1	192.168.2.6	0xe961	No error (0)	shavar.prod.mozaws.net		34.209.7.244	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:07.585680008 CET	1.1.1.1	192.168.2.6	0xe961	No error (0)	shavar.prod.mozaws.net		34.208.172.229	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:07.585680008 CET	1.1.1.1	192.168.2.6	0xe961	No error (0)	shavar.prod.mozaws.net		52.24.11.115	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:07.612216949 CET	1.1.1.1	192.168.2.6	0x71bf	No error (0)	shavar.prod.mozaws.net		52.24.11.115	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:07.612216949 CET	1.1.1.1	192.168.2.6	0x71bf	No error (0)	shavar.prod.mozaws.net		34.208.172.229	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:07.612216949 CET	1.1.1.1	192.168.2.6	0x71bf	No error (0)	shavar.prod.mozaws.net		34.209.7.244	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:11.176769972 CET	1.1.1.1	192.168.2.6	0x1d23	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:11.176769972 CET	1.1.1.1	192.168.2.6	0x1d23	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:11.176769972 CET	1.1.1.1	192.168.2.6	0x1d23	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:11.252243996 CET	1.1.1.1	192.168.2.6	0xce24	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:12.895899057 CET	1.1.1.1	192.168.2.6	0x466c	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:12.904686928 CET	1.1.1.1	192.168.2.6	0x3d42	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:13.037051916 CET	1.1.1.1	192.168.2.6	0xa83f	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:13.037051916 CET	1.1.1.1	192.168.2.6	0xa83f	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:13.052294970 CET	1.1.1.1	192.168.2.6	0x46e8	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:13.060234070 CET	1.1.1.1	192.168.2.6	0xf1e7	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:13.338551044 CET	1.1.1.1	192.168.2.6	0x67e3	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:13.338551044 CET	1.1.1.1	192.168.2.6	0x67e3	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:13.347759962 CET	1.1.1.1	192.168.2.6	0x770c	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:13.582786083 CET	1.1.1.1	192.168.2.6	0x1956	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.895790100 CET	1.1.1.1	192.168.2.6	0x76af	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:21.895790100 CET	1.1.1.1	192.168.2.6	0x76af	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.895790100 CET	1.1.1.1	192.168.2.6	0x76af	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.895790100 CET	1.1.1.1	192.168.2.6	0x76af	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.895790100 CET	1.1.1.1	192.168.2.6	0x76af	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.895790100 CET	1.1.1.1	192.168.2.6	0x76af	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.895790100 CET	1.1.1.1	192.168.2.6	0x76af	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.895790100 CET	1.1.1.1	192.168.2.6	0x76af	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.895790100 CET	1.1.1.1	192.168.2.6	0x76af	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.895790100 CET	1.1.1.1	192.168.2.6	0x76af	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.895790100 CET	1.1.1.1	192.168.2.6	0x76af	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.895790100 CET	1.1.1.1	192.168.2.6	0x76af	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.895790100 CET	1.1.1.1	192.168.2.6	0x76af	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.895790100 CET	1.1.1.1	192.168.2.6	0x76af	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.895790100 CET	1.1.1.1	192.168.2.6	0x76af	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.895790100 CET	1.1.1.1	192.168.2.6	0x76af	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.895790100 CET	1.1.1.1	192.168.2.6	0x76af	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.895807028 CET	1.1.1.1	192.168.2.6	0x4dfa	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:21.895807028 CET	1.1.1.1	192.168.2.6	0x4dfa	No error (0)	star-mini.c10r.facebook.com		157.240.252.35	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.896538973 CET	1.1.1.1	192.168.2.6	0x8921	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:21.896538973 CET	1.1.1.1	192.168.2.6	0x8921	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.906277895 CET	1.1.1.1	192.168.2.6	0x5f04	No error (0)	star-mini.c10r.facebook.com		157.240.0.35	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.906291008 CET	1.1.1.1	192.168.2.6	0x1bf0	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.906291008 CET	1.1.1.1	192.168.2.6	0x1bf0	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.906291008 CET	1.1.1.1	192.168.2.6	0x1bf0	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.906291008 CET	1.1.1.1	192.168.2.6	0x1bf0	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.906291008 CET	1.1.1.1	192.168.2.6	0x1bf0	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.906291008 CET	1.1.1.1	192.168.2.6	0x1bf0	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.906291008 CET	1.1.1.1	192.168.2.6	0x1bf0	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.906291008 CET	1.1.1.1	192.168.2.6	0x1bf0	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.906291008 CET	1.1.1.1	192.168.2.6	0x1bf0	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.906291008 CET	1.1.1.1	192.168.2.6	0x1bf0	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.906291008 CET	1.1.1.1	192.168.2.6	0x1bf0	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.906291008 CET	1.1.1.1	192.168.2.6	0x1bf0	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.906291008 CET	1.1.1.1	192.168.2.6	0x1bf0	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.906291008 CET	1.1.1.1	192.168.2.6	0x1bf0	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.906291008 CET	1.1.1.1	192.168.2.6	0x1bf0	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.906291008 CET	1.1.1.1	192.168.2.6	0x1bf0	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.908091068 CET	1.1.1.1	192.168.2.6	0xfba0	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.917402029 CET	1.1.1.1	192.168.2.6	0x717d	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Feb 15, 2025 17:38:21.917402029 CET	1.1.1.1	192.168.2.6	0x717d	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Feb 15, 2025 17:38:21.917402029 CET	1.1.1.1	192.168.2.6	0x717d	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Feb 15, 2025 17:38:21.917402029 CET	1.1.1.1	192.168.2.6	0x717d	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Feb 15, 2025 17:38:21.917414904 CET	1.1.1.1	192.168.2.6	0x61c	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Feb 15, 2025 17:38:21.918036938 CET	1.1.1.1	192.168.2.6	0xf6b6	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Feb 15, 2025 17:38:21.927484989 CET	1.1.1.1	192.168.2.6	0x4fbc	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:21.927484989 CET	1.1.1.1	192.168.2.6	0x4fbc	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.927484989 CET	1.1.1.1	192.168.2.6	0x4fbc	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.927484989 CET	1.1.1.1	192.168.2.6	0x4fbc	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.927484989 CET	1.1.1.1	192.168.2.6	0x4fbc	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.928241968 CET	1.1.1.1	192.168.2.6	0xabc5	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.937463999 CET	1.1.1.1	192.168.2.6	0x7e7a	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.937463999 CET	1.1.1.1	192.168.2.6	0x7e7a	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.937463999 CET	1.1.1.1	192.168.2.6	0x7e7a	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.937463999 CET	1.1.1.1	192.168.2.6	0x7e7a	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.937596083 CET	1.1.1.1	192.168.2.6	0x5060	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.937596083 CET	1.1.1.1	192.168.2.6	0x5060	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.937596083 CET	1.1.1.1	192.168.2.6	0x5060	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:21.937596083 CET	1.1.1.1	192.168.2.6	0x5060	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:32.813002110 CET	1.1.1.1	192.168.2.6	0x417c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:32.813002110 CET	1.1.1.1	192.168.2.6	0x417c	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:32.813002110 CET	1.1.1.1	192.168.2.6	0x417c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:32.944164991 CET	1.1.1.1	192.168.2.6	0x9912	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:32.944164991 CET	1.1.1.1	192.168.2.6	0x9912	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:32.944164991 CET	1.1.1.1	192.168.2.6	0x9912	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:32.944164991 CET	1.1.1.1	192.168.2.6	0x9912	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:32.956340075 CET	1.1.1.1	192.168.2.6	0x3582	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:32.956340075 CET	1.1.1.1	192.168.2.6	0x3582	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:32.956340075 CET	1.1.1.1	192.168.2.6	0x3582	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:32.956340075 CET	1.1.1.1	192.168.2.6	0x3582	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:32.959636927 CET	1.1.1.1	192.168.2.6	0xc343	No error (0)	normandy.cdn.mozilla.net	normandy.tombstone.experimenter.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:32.959636927 CET	1.1.1.1	192.168.2.6	0xc343	No error (0)	normandy.tombstone.experimenter.prod.webservices.mozgcp.net		34.49.51.44	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:32.971656084 CET	1.1.1.1	192.168.2.6	0xc106	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Feb 15, 2025 17:38:32.971656084 CET	1.1.1.1	192.168.2.6	0xc106	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Feb 15, 2025 17:38:32.971656084 CET	1.1.1.1	192.168.2.6	0xc106	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Feb 15, 2025 17:38:32.971656084 CET	1.1.1.1	192.168.2.6	0xc106	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Feb 15, 2025 17:38:32.977957964 CET	1.1.1.1	192.168.2.6	0xc7de	No error (0)	normandy.tombstone.experimenter.prod.webservices.mozgcp.net		34.49.51.44	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:33.976196051 CET	1.1.1.1	192.168.2.6	0xc84b	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:33.976196051 CET	1.1.1.1	192.168.2.6	0xc84b	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:33.976196051 CET	1.1.1.1	192.168.2.6	0xc84b	No error (0)	a17.rackcdn.com.mdc.edgesuite.net	a19.dscg10.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:38:33.976196051 CET	1.1.1.1	192.168.2.6	0xc84b	No error (0)	a19.dscg10.akamai.net		2.22.61.56	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:33.976196051 CET	1.1.1.1	192.168.2.6	0xc84b	No error (0)	a19.dscg10.akamai.net		2.22.61.59	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:33.986493111 CET	1.1.1.1	192.168.2.6	0xa9ae	No error (0)	a19.dscg10.akamai.net		2.18.121.73	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:33.986493111 CET	1.1.1.1	192.168.2.6	0xa9ae	No error (0)	a19.dscg10.akamai.net		2.18.121.79	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:38:33.997529030 CET	1.1.1.1	192.168.2.6	0xac0c	No error (0)	a19.dscg10.akamai.net			28	IN (0x0001)	false
Feb 15, 2025 17:38:33.997529030 CET	1.1.1.1	192.168.2.6	0xac0c	No error (0)	a19.dscg10.akamai.net			28	IN (0x0001)	false
Feb 15, 2025 17:38:52.955548048 CET	1.1.1.1	192.168.2.6	0x8bd	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:39:03.091476917 CET	1.1.1.1	192.168.2.6	0xddc3	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:39:03.589701891 CET	1.1.1.1	192.168.2.6	0x741c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:39:03.589701891 CET	1.1.1.1	192.168.2.6	0x741c	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:39:03.589701891 CET	1.1.1.1	192.168.2.6	0x741c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:39:33.517307997 CET	1.1.1.1	192.168.2.6	0x1db2	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:40:53.999385118 CET	1.1.1.1	192.168.2.6	0x6214	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:40:54.007369041 CET	1.1.1.1	192.168.2.6	0x9c1c	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:40:54.484755993 CET	1.1.1.1	192.168.2.6	0xf755	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:40:54.484755993 CET	1.1.1.1	192.168.2.6	0xf755	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 17:40:54.484755993 CET	1.1.1.1	192.168.2.6	0xf755	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:40:54.581119061 CET	1.1.1.1	192.168.2.6	0x49aa	No error (0)	example.org		96.7.128.192	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:40:54.581119061 CET	1.1.1.1	192.168.2.6	0x49aa	No error (0)	example.org		23.215.0.133	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:40:54.581119061 CET	1.1.1.1	192.168.2.6	0x49aa	No error (0)	example.org		23.215.0.132	A (IP address)	IN (0x0001)	false
Feb 15, 2025 17:40:54.581119061 CET	1.1.1.1	192.168.2.6	0x49aa	No error (0)	example.org		96.7.128.186	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

detectportal.firefox.com

ciscobinary.openh264.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49780	34.107.221.82	80	1588	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Feb 15, 2025 17:38:05.441569090 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 15, 2025 17:38:05.898943901 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 14 Feb 2025 19:11:46 GMT Age: 77179 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49803	34.107.221.82	80	1588	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Feb 15, 2025 17:38:07.490535975 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 15, 2025 17:38:07.937423944 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 15 Feb 2025 07:59:17 GMT Age: 31130 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 15, 2025 17:38:08.413687944 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 15, 2025 17:38:08.509063959 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 15 Feb 2025 07:59:17 GMT Age: 31131 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 15, 2025 17:38:12.177277088 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 15, 2025 17:38:12.271668911 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 15 Feb 2025 07:59:17 GMT Age: 31135 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 15, 2025 17:38:13.674344063 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 15, 2025 17:38:13.814629078 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 15 Feb 2025 07:59:17 GMT Age: 31136 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 15, 2025 17:38:19.445777893 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 15, 2025 17:38:19.540180922 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 15 Feb 2025 07:59:17 GMT Age: 31142 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 15, 2025 17:38:19.967375994 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 15, 2025 17:38:20.063034058 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 15 Feb 2025 07:59:17 GMT Age: 31143 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 15, 2025 17:38:20.070611954 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 15, 2025 17:38:20.177362919 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 15 Feb 2025 07:59:17 GMT Age: 31143 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 15, 2025 17:38:22.107443094 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 15, 2025 17:38:22.226680040 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 15 Feb 2025 07:59:17 GMT Age: 31145 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 15, 2025 17:38:32.228169918 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 15, 2025 17:38:32.964973927 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 15, 2025 17:38:33.074069023 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 15 Feb 2025 07:59:17 GMT Age: 31156 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 15, 2025 17:38:33.544547081 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 15, 2025 17:38:33.638652086 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 15 Feb 2025 07:59:17 GMT Age: 31156 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 15, 2025 17:38:34.020207882 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 15, 2025 17:38:34.152426004 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 15 Feb 2025 07:59:17 GMT Age: 31157 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 15, 2025 17:38:37.061985970 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 15, 2025 17:38:37.158538103 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 15 Feb 2025 07:59:17 GMT Age: 31160 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 15, 2025 17:38:47.172091007 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 15, 2025 17:38:52.943142891 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 15, 2025 17:38:53.041229963 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 15 Feb 2025 07:59:17 GMT Age: 31175 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 15, 2025 17:38:53.539825916 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 15, 2025 17:38:53.634134054 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 15 Feb 2025 07:59:17 GMT Age: 31176 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 15, 2025 17:39:03.635705948 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 15, 2025 17:39:03.689614058 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 15, 2025 17:39:03.784439087 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 15 Feb 2025 07:59:17 GMT Age: 31186 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 15, 2025 17:39:04.433295012 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 15, 2025 17:39:04.527795076 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 15 Feb 2025 07:59:17 GMT Age: 31187 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 15, 2025 17:39:14.534028053 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 15, 2025 17:39:24.552097082 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 15, 2025 17:39:34.082526922 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 15, 2025 17:39:34.176558971 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 15 Feb 2025 07:59:17 GMT Age: 31217 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 15, 2025 17:39:44.193629026 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 15, 2025 17:39:54.199919939 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 15, 2025 17:40:04.218226910 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 15, 2025 17:40:14.245908976 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 15, 2025 17:40:24.521697998 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 15, 2025 17:40:54.577296019 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 15, 2025 17:40:54.671437025 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 15 Feb 2025 07:59:17 GMT Age: 31297 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49804	34.107.221.82	80	1588	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Feb 15, 2025 17:38:07.490619898 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 15, 2025 17:38:07.937768936 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 14 Feb 2025 19:11:46 GMT Age: 77181 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 15, 2025 17:38:08.528742075 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 15, 2025 17:38:08.623410940 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 14 Feb 2025 19:11:46 GMT Age: 77182 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 15, 2025 17:38:13.573976040 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 15, 2025 17:38:13.668514013 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 14 Feb 2025 19:11:46 GMT Age: 77187 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 15, 2025 17:38:13.791110039 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 15, 2025 17:38:13.885484934 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 14 Feb 2025 19:11:46 GMT Age: 77187 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 15, 2025 17:38:19.842088938 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 15, 2025 17:38:19.936649084 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 14 Feb 2025 19:11:46 GMT Age: 77193 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 15, 2025 17:38:19.971967936 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 15, 2025 17:38:20.067820072 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 14 Feb 2025 19:11:46 GMT Age: 77194 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 15, 2025 17:38:21.914448023 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 15, 2025 17:38:22.011790037 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 14 Feb 2025 19:11:46 GMT Age: 77195 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 15, 2025 17:38:32.027602911 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 15, 2025 17:38:32.805257082 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 15, 2025 17:38:32.949273109 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 14 Feb 2025 19:11:46 GMT Age: 77206 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 15, 2025 17:38:33.446199894 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 15, 2025 17:38:33.540564060 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 14 Feb 2025 19:11:46 GMT Age: 77207 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 15, 2025 17:38:33.920572996 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 15, 2025 17:38:34.015775919 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 14 Feb 2025 19:11:46 GMT Age: 77207 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 15, 2025 17:38:36.963989019 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 15, 2025 17:38:37.058625937 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 14 Feb 2025 19:11:46 GMT Age: 77211 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 15, 2025 17:38:47.071748972 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 15, 2025 17:38:52.844364882 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 15, 2025 17:38:52.939404964 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 14 Feb 2025 19:11:46 GMT Age: 77226 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 15, 2025 17:38:53.440819025 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 15, 2025 17:38:53.537029982 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 14 Feb 2025 19:11:46 GMT Age: 77227 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 15, 2025 17:39:03.557529926 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 15, 2025 17:39:03.582139969 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 15, 2025 17:39:03.676603079 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 14 Feb 2025 19:11:46 GMT Age: 77237 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 15, 2025 17:39:04.202874899 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 15, 2025 17:39:04.298321962 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 14 Feb 2025 19:11:46 GMT Age: 77238 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 15, 2025 17:39:14.302114964 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 15, 2025 17:39:24.313760042 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 15, 2025 17:39:33.983599901 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 15, 2025 17:39:34.077991009 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 14 Feb 2025 19:11:46 GMT Age: 77268 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 15, 2025 17:39:44.093465090 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 15, 2025 17:39:54.099606037 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 15, 2025 17:40:04.106278896 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 15, 2025 17:40:14.129991055 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 15, 2025 17:40:24.136759043 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 15, 2025 17:40:54.477216005 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 15, 2025 17:40:54.572474003 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 14 Feb 2025 19:11:46 GMT Age: 77348 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49995	2.22.61.56	80	1588	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Feb 15, 2025 17:38:33.983076096 CET	305	OUT	GET /openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip HTTP/1.1 Host: ciscobinary.openh264.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive
Feb 15, 2025 17:38:34.681910038 CET	1236	IN	HTTP/1.1 200 OK Last-Modified: Fri, 07 Feb 2025 06:55:57 GMT ETag: 85430baed3398695717b0263807cf97c Content-Length: 453023 Accept-Ranges: bytes X-Timestamp: 1738911356.44453 Content-Type: application/zip X-Trans-Id: txf36a3cdb14a04fca91417-0067a71e89dfw1 Cache-Control: public, max-age=245629 Expires: Tue, 18 Feb 2025 12:52:23 GMT Date: Sat, 15 Feb 2025 16:38:34 GMT Connection: keep-alive Data Raw: 50 4b 03 04 14 00 00 00 08 00 cd 8d 62 4e d0 b9 df e8 52 e8 06 00 d0 97 0f 00 0f 00 00 00 67 6d 70 6f 70 65 6e 68 32 36 34 2e 64 6c 6c ec bd 0b 7c 14 45 b6 30 de 3d 99 84 49 98 a4 07 8c 18 31 c2 e8 ce ea 34 66 31 71 e3 9a 60 d4 e9 d0 93 f4 e0 04 c2 d3 80 88 71 a3 b9 a0 08 11 27 2b b8 10 08 93 68 2a 6d 7b d9 bb 7a d7 dd 6f 5f ff 7b 77 ef dd e7 c5 bd ee f2 d0 95 cc 24 92 07 28 24 41 21 c0 8a 11 7c 4c 18 81 00 42 26 41 32 ff 73 aa 7b 9e 04 44 64 f7 ff dd ff f7 f1 63 d2 55 d5 55 e7 d4 39 75 ce a9 53 a7 aa bb 4b 16 6c 60 12 18 86 d1 c3 2f 18 64 98 2d 8c fa cf c6 7c f9 bf 00 fc d2 26 be 9e c6 fc 39 f9 9d 9b b6 b0 ce 77 6e 9a b3 78 c9 d3 e6 aa 15 cb ff 69 c5 23 4f 9a 2b 1e 59 b6 6c b9 cb fc dd c7 cc 2b aa 97 99 97 2c 33 8b 33 66 9b 9f 5c fe e8 63 93 53 53 53 2c 1a 8c e9 d2 cf b7 a4 f0 fd fe d0 ef b1 92 cf 8f 4e a4 d7 d3 47 47 d1 eb 99 a3 ff 46 af 27 8f 26 d3 3a 27 fd 4b e0 5a 26 9c 3e 9a 40 af 67 8e de 4d af 9f 1f 4d d7 60 fc 13 fc 2a 84 fe a3 a3 e9 f5 14 bd ce 5a 52 b1 18 ef 85 fa 5e 6a 67 98 47 9f 4b 62 [TRUNCATED] Data Ascii: PKbNRgmpopenh264.dll\|E0=I14f1q`q'+hm{zo_{w$($A!\|LB&A2s{DdcUU9uSKl`/d-\|&9wnxi#O+Yl+,33f\cSSS,NGGF'&:'KZ&>@gMM`ZR^jgGKbo~va<Z1.#OeDXi$imBWQ&P,M,:c-\-iKI4a6Ov=WFCH>a'x#@fdu1OV1o}g5_3JHiZipM.bZ%GF/3qJo%gN})3N%!q^Im~6#~+AI]rx<IYjp0`SM@Ef=;!@EE 0nJdduM-qIlRz=}rDXLZx$\|c1cUkM&Qn]a]th!6 7JdDvKJ"Wgd*%nwJniinmr@M$'Zs#)%
Feb 15, 2025 17:38:34.681962967 CET	1236	IN	Data Raw: bd c1 52 73 bd a7 3a 09 68 e9 f5 eb 80 14 52 9c 01 ad ef 5c 1f 81 74 b2 36 16 12 27 91 67 cc 95 dc 09 0f a4 8b f3 f0 8f 55 6a 2b 46 bd 63 72 3a 7c 07 a7 21 9f 8a 4b e1 57 c6 59 13 b3 a0 31 37 a6 b8 aa ad b8 02 2c f5 8a b6 e2 72 f1 b1 8a e5 ad c5 Data Ascii: Rs:hR\t6'gUj+Fcr:\|!KWY17,r>N3RY_\IrDNJdM k&V-z%-Di&672T)>0%&;`Zc,)T;jI~yRr&=V4C\|-h(*dIUkq9[d
Feb 15, 2025 17:38:34.682001114 CET	448	IN	Data Raw: 76 05 c4 dc 61 8a ee 89 36 03 dd 1b 08 cd 40 d9 ea 04 bd 6e 44 fc 07 c7 c5 f9 37 23 49 13 20 6b 79 26 c2 ef b5 cf c4 f9 36 c0 ee 95 21 56 4f bf 34 ab 1d 51 ac fe f7 81 91 58 5d 54 d5 5a 44 59 dd bb 12 e9 2b 02 56 4f 8f 9f b8 ad c8 db ba c2 58 de Data Ascii: va6@nD7#I ky&6!VO4QX]TZDY+VOXrm!m%R4Re"*2Xohu}G9gVP8ghhlW4CUR7wv$Y`X%k\|h``\"^w\>(y':@V6
Feb 15, 2025 17:38:34.683500051 CET	1236	IN	Data Raw: 65 e2 0d ce 32 21 19 aa db 2d d7 98 d0 d6 7e 3b ca d6 1a a8 31 35 44 db da 9b c0 63 78 25 ec 31 3c a4 ce da e1 9a 60 76 3f 50 67 39 d5 2d 33 f9 3b a3 fc 87 b9 21 0f 42 0a 7b 10 2a 72 31 84 fc a6 4b 22 af ce f4 a7 46 a3 4a 8d 41 85 e3 2f c5 74 2b Data Ascii: e2!-~;15Dcx%1<`v?Pg9-3;!B{r1K"FJA/t+j72~coyFG1lARYJoiwDJ+ujuDHYl(deTeIzG`TNjhb[NjHT$S.vRh(5;\|3ph{v::
Feb 15, 2025 17:38:34.683536053 CET	1236	IN	Data Raw: 7f b5 c6 f8 af a3 3f bd 4a fe eb 73 89 97 f6 df 2a 13 43 f4 c5 5a 8a 72 8e 77 c1 3a 1f dd fd 44 dd e9 b4 48 8c b5 02 56 b1 09 ab 0c 8d f3 4b 9d f2 23 12 67 7a 2a cf 29 2f 31 01 cd d9 52 38 38 29 cf b4 3a 15 97 c5 86 fb 02 67 3e 87 79 53 9e 67 6e Data Ascii: ?JsCZrw:DHVK#gz)/1R88):g>ySgnX-P16E)XA!^8>9"Z[Q&%>+xFz^XCWr_-j&(CFSHy+IOJ}Oqc$FZz+a yj$j'8+e
Feb 15, 2025 17:38:34.683588982 CET	448	IN	Data Raw: 62 59 a1 3a 30 da 1f c7 46 38 f7 c6 ae b7 e7 c5 9f 5d a8 36 5f d5 9d 87 6c ad 47 1b 46 c6 e7 3b 33 98 32 52 3c 2a 7c ff bd 41 4d 6d c3 e7 1d cc 76 b2 cb 49 da 24 b2 93 ee 1d dc b1 15 a7 08 df 1f 0f a0 b9 ab d2 f6 0e 3e 2d d7 34 b2 0c b5 d2 2c 92 Data Ascii: bY:0F8]6_lGF;32R<\|AMmvI$>-4,kx@<w LP#a=5;byI bIj+pB1\X*%]"^\no%S<ov\|2z_gOg/n}{6{ED$Y'1ZHBF
Feb 15, 2025 17:38:34.684705019 CET	1236	IN	Data Raw: 5d a9 21 56 d8 03 7a ff 68 27 e9 2b 01 43 fe 1e e8 be 9d f4 df af a4 af 13 dc ab df cd 66 6a 36 39 14 e3 bb 20 48 d9 0e 79 f5 bb 79 0e 79 ce bb b6 9c b3 95 1b e4 82 cd c8 cf 42 b6 60 1d f8 84 06 59 ff aa db f3 05 d1 49 f2 2a 83 54 a1 df cc b6 48 Data Ascii: ]!Vzh'+Cfj69 HyyyB`YITHl3X)uugr#p<I0}UhQAg4o\|B%[XG!\(r7KGfKWj4n&(\Lrb>/rsj\|~j
Feb 15, 2025 17:38:34.684741974 CET	1236	IN	Data Raw: 0e 58 3d bd ec 65 3b 48 7b e8 78 63 24 de 92 1d 7e be 44 d6 a9 15 9b d7 6d ab c2 5d 24 ae 6e 3d fc 6d e8 52 b2 92 dd db 75 a2 fc a2 0b f7 d0 f2 df 71 99 c9 52 3c d7 9b 78 ff 2c b4 b8 6a 9c cf f7 c4 1f 92 19 f2 5f 58 45 4e 02 55 af 5e a0 41 71 cd Data Ascii: X=e;H{xc$~Dm]$n=mRuqR<x,j_XENU^Aq+95d>wszknfoj{>#_D]}$gzm"b]{5>I? aT=t_sPQFM{_>6!kF&9U5D
Feb 15, 2025 17:38:34.684777021 CET	448	IN	Data Raw: 8e 80 f1 d6 7f 38 46 eb 3f 1c 23 ff 8f c5 d8 58 38 5e ff 5a c1 75 dc f3 45 f8 0e 91 4d 9e 26 d6 b0 8e 91 b8 7f 6f e3 dc b9 f8 7a 11 3a 17 65 de e0 6e 61 b5 ee 2c 6c 8a cc 0d 47 e8 dc f0 f5 04 cb 7d 84 8d e9 d1 3f 18 23 41 f5 49 58 9d e6 3d a2 a3 Data Ascii: 8F?#X8^ZuEM&oz:ena,lG}?#AIX=)lWhn)U1o+dw~`#z=W,3&7`kG)EdnjT3sTF?/0'^kuQD=8d^[Q*WdHhP7
Feb 15, 2025 17:38:34.685621023 CET	1236	IN	Data Raw: 99 ab a9 73 7e 10 21 b3 7f 3f 98 f2 0a 83 52 f4 85 bb f5 bc aa 6a d7 51 ff 65 c7 5c 50 b5 82 5a 91 f4 f0 81 9a 55 64 d0 ef fc ca 7e cc f3 73 23 7e 8c 48 1d 19 ee c5 3a 8d db 47 a8 2d e9 db 05 d9 82 0d 5c dd 12 50 df 82 cf b9 ba 47 f0 9a c5 d5 cd Data Ascii: s~!?RjQe\PZUd~s#~H:G-\PGk_H?ff)\{ZL$Ney?u2,qe\|+WJx@W9h.k,s)]d{ q{;bl@,S/(^z1
Feb 15, 2025 17:38:34.686988115 CET	1236	IN	Data Raw: 54 88 af 6b 46 21 96 c5 bc 17 f8 0b 33 f5 a2 5c 8c f3 a5 7a 0f eb 92 0f 50 32 86 fd 65 5b 30 c8 b2 e7 30 e0 fb 80 1a be 7d a4 46 35 7c d3 69 08 ed 2b a1 bc e9 40 0c 46 75 4f b0 5b 0d 12 e4 5d 29 77 a0 15 ab 42 4b 58 cd 29 e9 2f 53 ed 53 3b ff 20 Data Ascii: TkF!3\zP2e[00}F5\|i+@FuO[])wBKX)/SS; <NEfql]M.dRro7/tk>)0(k"?1!cY[D8w5U:1\|hEfwS"'<^`c7

Target ID:	0
Start time:	11:37:56
Start date:	15/02/2025
Path:	C:\Users\user\Desktop\random.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\random.exe"
Imagebase:	0x540000
File size:	970'752 bytes
MD5 hash:	BCA58035430238FDE9990DF16040D699
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:37:57
Start date:	15/02/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x980000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:37:57
Start date:	15/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:37:59
Start date:	15/02/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x980000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:37:59
Start date:	15/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:37:59
Start date:	15/02/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x980000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:37:59
Start date:	15/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:37:59
Start date:	15/02/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x980000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:37:59
Start date:	15/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:38:00
Start date:	15/02/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x980000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:38:00
Start date:	15/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:38:00
Start date:	15/02/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:38:00
Start date:	15/02/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:38:00
Start date:	15/02/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	11:38:01
Start date:	15/02/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2288 -parentBuildID 20230927232528 -prefsHandle 2220 -prefMapHandle 2212 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9fbe32b-4c03-4d39-93db-854142882339} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 1ee61071110 socket
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	11:38:03
Start date:	15/02/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4116 -parentBuildID 20230927232528 -prefsHandle 3996 -prefMapHandle 4000 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98ef1f0c-9b53-4068-86ae-42f53ec98957} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 1ee71479110 rdd
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	11:38:11
Start date:	15/02/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4456 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4472 -prefMapHandle 4564 -prefsLen 33076 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {127eaadf-f0b2-40e6-aa1b-0559c96af4d0} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 1ee79169d10 utility
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report random.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_08642342-5486-44eb-bd21-1fa03f6f0ef5.json (copy)

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_08642342-5486-44eb-bd21-1fa03f6f0ef5.json.tmp

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

C:\Users\user\AppData\Local\Temp\tmpaddon

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\40371339ad31a7e6.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5G9YKO8EYRTCEKYNETZF.temp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KAM4ES32A3063RQV4BQ6.temp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\ExperimentStoreData.json (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\ExperimentStoreData.json.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4 (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addons.json (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addons.json.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\content-prefs.sqlite

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\store.json.mozlz4 (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\store.json.mozlz4.tmp

Windows Analysis Report
random.exe