Edit tour

Windows Analysis Report
random.exe

Overview

General Information

Sample name:	random.exe
Analysis ID:	1622958
MD5:	e9a8537a4efba5386c2a5adf0355eb4b
SHA1:	485d296515a96ef01972021da0571c5c03192b21
SHA256:	e1cf2ba38614911db7f8a5f595b03697f76c79fe0de026f3571090db401b2c25
Tags:	exeuser-skocherhan
Infos:

Detection

Credential Flusher

Score:	76
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Credential Flusher

Binary is likely a compiled AutoIt script file

Found API chain indicative of sandbox detection

Joe Sandbox ML detected suspicious sample

Connects to many different domains

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

OS version to string mapping found (often used in BOTs)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

random.exe (PID: 7672 cmdline: "C:\Users\user\Desktop\random.exe" MD5: E9A8537A4EFBA5386C2A5ADF0355EB4B)

taskkill.exe (PID: 7728 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7868 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7932 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8000 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8064 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 8140 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8172 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8188 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6932 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2264 -parentBuildID 20230927232528 -prefsHandle 2200 -prefMapHandle 2196 -prefsLen 25302 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba4e4ef8-aac1-4118-8c5a-3b35755e30c3} 8188 "\\.\pipe\gecko-crash-server-pipe.8188" 1aceca6e910 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3468 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3960 -parentBuildID 20230927232528 -prefsHandle 3984 -prefMapHandle 3980 -prefsLen 26317 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {53f9218a-6893-4da7-89c2-5475210359ad} 8188 "\\.\pipe\gecko-crash-server-pipe.8188" 1acfecbc510 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3256 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5144 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5148 -prefMapHandle 5136 -prefsLen 33202 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e2b3a79-822c-48e8-ad97-04fffcc6b6de} 8188 "\\.\pipe\gecko-crash-server-pipe.8188" 1acfec1e910 utility MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: random.exe PID: 7672	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: random.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: random.exe

ReversingLabs: Detection: 31%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.7% probability

Source: random.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.91:443 -> 192.168.2.7:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49950 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50035 version: TLS 1.2

Source:	Binary string: UxTheme.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: rsaenh.pdb source: firefox.exe, 0000000F.00000003.1551383140.000001ACFE1B6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: xWindows.Security.Integrity.pdb source: firefox.exe, 0000000F.00000003.1541748564.000001AD0087A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winsta.pdb source: firefox.exe, 0000000F.00000003.1535644921.000001AD062B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: bcrypt.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ktmw32.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: freebl3.pdbP4 source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: WscApi.pdb source: firefox.exe, 0000000F.00000003.1535644921.000001AD062B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: NapiNSP.pdb source: firefox.exe, 0000000F.00000003.1590066087.000001ACFC174000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: xWindows.StateRepositoryPS.pdb source: firefox.exe, 0000000F.00000003.1541748564.000001AD0087A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1541828586.000001AD0083F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8WinTypes.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: webauthn.pdbGCTL source: firefox.exe, 0000000F.00000003.1585828503.000001AD07C5D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: xul.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nssckbi.pdb source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winhttp.pdb`e source: firefox.exe, 0000000F.00000003.1551383140.000001ACFE1B6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: firefox.exe, 0000000F.00000003.1538320293.000001AD05721000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winnsi.pdb source: firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dcomp.pdb source: firefox.exe, 0000000F.00000003.1535644921.000001AD062B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: cryptsp.pdb source: firefox.exe, 0000000F.00000003.1551383140.000001ACFE1B6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8dhcpcsvc6.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8softokn3.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntmarta.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: CLBCatQ.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: urlmon.pdb source: firefox.exe, 0000000F.00000003.1535644921.000001AD062B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8twinapi.appcore.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8kernelbase.pdb source: firefox.exe, 0000000F.00000003.1556154042.000001ACFCBD3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shlwapi.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8CoreMessaging.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dwmapi.pdb source: firefox.exe, 0000000F.00000003.1535644921.000001AD062B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: firefox.pdb source: firefox.exe, 0000000F.00000003.1561423264.000001AD00811000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: srvcli.pdb source: firefox.exe, 0000000F.00000003.1535644921.000001AD062B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: imm32.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: webauthn.pdb source: firefox.exe, 0000000F.00000003.1585828503.000001AD07C5D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws2_32.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8imagehlp.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1570303230.000001ACFCD9E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mswsock.pdb source: firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8gkcodecs.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8iphlpapi.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8ExplorerFrame.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1570303230.000001ACFCD9E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nsi.pdb source: firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winmm.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8OnDemandConnRouteHelper.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1570303230.000001ACFCD9E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ole32.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8CoreUIComponents.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8osclientcerts.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8cfgmgr32.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: msasn1.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: DWrite.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: combase.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8iertutil.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8dhcpcsvc.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: pnrpnsp.pdbUGP source: firefox.exe, 0000000F.00000003.1590762702.000001ACFC188000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 8msvcp140.amd64.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1556154042.000001ACFCBD3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ncrypt.pdb source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8webauthn.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8Kernel.Appcore.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8powrprof.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8ColorAdapterClient.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wsock32.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8MMDevAPI.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wininet.pdb source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: UMPDC.pdb source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1535644921.000001AD062B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8oleaut32.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8kernel32.pdb source: firefox.exe, 0000000F.00000003.1556154042.000001ACFCBD3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wininet.pdb0 source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: rpcrt4.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8TextInputFramework.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: pnrpnsp.pdb source: firefox.exe, 0000000F.00000003.1590762702.000001ACFC188000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wshbth.pdb source: firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8InputHost.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8ucrtbase.pdb source: firefox.exe, 0000000F.00000003.1556154042.000001ACFCBD3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: xOneCoreUAPCommonProxyStub.pdb source: firefox.exe, 0000000F.00000003.1541748564.000001AD0087A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8audioses.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8Bcp47mrm.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8netutils.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shell32.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8rasadhlp.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1570303230.000001ACFCD9E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: sspicli.pdb source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8Bcp47Langs.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8wtsapi32.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8taskschd.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1570303230.000001ACFCD9E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8msvcp_win.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: NapiNSP.pdbUGP source: firefox.exe, 0000000F.00000003.1590066087.000001ACFC174000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnsapi.pdb source: firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: userenv.pdb source: firefox.exe, 0000000F.00000003.1535644921.000001AD062B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8Windows.UI.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nlaapi.pdb source: firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8fwpuclnt.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1570303230.000001ACFCD9E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winhttp.pdb source: firefox.exe, 0000000F.00000003.1551383140.000001ACFE1B6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: msimg32.pdb source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: freebl3.pdbEditorTransaction source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntasn1.pdb source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: devobj.pdb source: firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: d3d11.pdb source: firefox.exe, 0000000F.00000003.1535644921.000001AD062B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8Windows.Storage.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8OnDemandConnRouteHelper.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1570303230.000001ACFCD9E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dbghelp.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8netprofm.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: gdi32.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: profapi.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8Windows.Globalization.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: avrt.pdb source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: WLDP.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8directmanipulation.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: sechost.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8setupapi.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8vcruntime140_1.amd64.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1556154042.000001ACFCBD3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: propsys.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8lgpllibs.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.15.dr
Source:	Binary string: 8gdi32full.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8vcruntime140.amd64.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1556154042.000001ACFCBD3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winrnr.pdb source: firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: msctf.pdb source: firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: version.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dbgcore.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mscms.pdb source: firefox.exe, 0000000F.00000003.1535644921.000001AD062B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: user32.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: twinapi.pdb source: firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8DataExchange.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.15.dr
Source:	Binary string: 8wintrust.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: psapi.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8WindowManagementAPI.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: firefox.exe, 0000000F.00000003.1561423264.000001AD00811000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1538320293.000001AD05721000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dxgi.pdb source: firefox.exe, 0000000F.00000003.1535644921.000001AD062B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8npmproxy.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8linkinfo.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1570303230.000001ACFCD9E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8Windows.UI.Immersive.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: crypt32.pdb source: firefox.exe, 0000000F.00000003.1538320293.000001AD05721000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FCDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00FCDBBE
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F9C2A2 FindFirstFileExW,	0_2_00F9C2A2
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FD68EE FindFirstFileW,FindClose,	0_2_00FD68EE
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FD698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00FD698F
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FCD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00FCD076
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FCD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00FCD3A9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FD9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00FD9642
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FD979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00FD979D
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FD9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00FD9B2B
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FD5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00FD5C97

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 196MB

Source: unknown

Network traffic detected: DNS query count 33

Source: Joe Sandbox View	IP Address: 2.22.61.59 2.22.61.59
Source: Joe Sandbox View	IP Address: 34.149.100.209 34.149.100.209
Source: Joe Sandbox View	IP Address: 151.101.65.91 151.101.65.91

Source: Joe Sandbox View

JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00FDCE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

0_2_00FDCE44

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKLast-Modified: Fri, 07 Feb 2025 06:55:57 GMTETag: 85430baed3398695717b0263807cf97cContent-Length: 453023Accept-Ranges: bytesX-Timestamp: 1738911356.44453Content-Type: application/zipX-Trans-Id: txf36a3cdb14a04fca91417-0067a71e89dfw1Cache-Control: public, max-age=163835Expires: Wed, 26 Feb 2025 15:15:26 GMTDate: Mon, 24 Feb 2025 17:44:51 GMTConnection: keep-aliveData Raw: 50 4b 03 04 14 00 00 00 08 00 cd 8d 62 4e d0 b9 df e8 52 e8 06 00 d0 97 0f 00 0f 00 00 00 67 6d 70 6f 70 65 6e 68 32 36 34 2e 64 6c 6c ec bd 0b 7c 14 45 b6 30 de 3d 99 84 49 98 a4 07 8c 18 31 c2 e8 ce ea 34 66 31 71 e3 9a 60 d4 e9 d0 93 f4 e0 04 c2 d3 80 88 71 a3 b9 a0 08 11 27 2b b8 10 08 93 68 2a 6d 7b d9 bb 7a d7 dd 6f 5f ff 7b 77 ef dd e7 c5 bd ee f2 d0 95 cc 24 92 07 28 24 41 21 c0 8a 11 7c 4c 18 81 00 42 26 41 32 ff 73 aa 7b 9e 04 44 64 f7 ff dd ff f7 f1 63 d2 55 d5 55 e7 d4 39 75 ce a9 53 a7 aa bb 4b 16 6c 60 12 18 86 d1 c3 2f 18 64 98 2d 8c fa cf c6 7c f9 bf 00 fc d2 26 be 9e c6 fc 39 f9 9d 9b b6 b0 ce 77 6e 9a b3 78 c9 d3 e6 aa 15 cb ff 69 c5 23 4f 9a 2b 1e 59 b6 6c b9 cb fc dd c7 cc 2b aa 97 99 97 2c 33 8b 33 66 9b 9f 5c fe e8 63 93 53 53 53 2c 1a 8c e9 d2 cf b7 a4 f0 fd fe d0 ef b1 92 cf 8f 4e a4 d7 d3 47 47 d1 eb 99 a3 ff 46 af 27 8f 26 d3 3a 27 fd 4b e0 5a 26 9c 3e 9a 40 af 67 8e de 4d af 9f 1f 4d d7 60 fc 13 fc 2a 84 fe a3 a3 e9 f5 14 bd ce 5a 52 b1 18 ef 85 fa 5e 6a 67 98 47 9f 4b 62 8e 6f 7e 76 61 a8 ac 9f b9 d9 3c 5a 97 c6 31 2e 23 c3 8c 4f a0 65 19 99 a3 19 c6 44 93 eb 58 fc 8b 69 1d c3 24 69 6d 42 57 c6 c3 51 26 be ba c1 04 b7 cb d9 50 a3 d0 e5 c2 bc 9a 2c 4d e4 98 2c a8 bd 3a 89 63 ac d1 cc 2d e5 98 0d 12 5c 9f e5 98 ce 1b e1 fa 2a c7 d4 01 8a ce 2d 69 cc 9c 4b 8c 49 f6 d6 34 86 61 a3 0a 36 18 99 2a dd c5 eb 4f 76 3d b6 d2 05 57 cb d3 46 b5 43 48 bb 3e b6 8e 99 61 ca 27 af 78 f4 11 d7 23 40 66 8d 8e c2 64 d6 c1 75 a5 31 a6 9e 0d fe 4f 56 ab 31 6f 7d 1b 09 84 0e 67 c2 35 90 16 5f cf 33 b9 4a ad 48 69 04 5a 99 69 70 4d e7 2e 84 b7 62 b9 5a 11 86 81 f9 25 dc 47 94 8b 46 aa f7 d8 d2 e5 15 0c e5 11 f2 8a d2 f2 f8 05 f5 0a 2f ce 89 ff 33 ff 71 9b d9 4a af c7 d0 f2 b6 f6 6f de 03 b3 25 f7 67 d9 4e d2 2a 91 7d 12 d9 29 c9 33 0d 4e 25 f1 21 b7 91 71 2a a9 0b e0 e2 eb b8 8b 81 b4 f1 5e 49 9e 6d 90 c8 7e 07 09 f8 36 dd 85 23 e9 7e 2b fb c1 87 17 85 41 d1 7f 12 49 5d 72 03 c7 e4 78 b4 e2 b9 2a 82 3c 49 59 6a c9 96 da ec cc 70 30 18 8c 60 53 ae 4d 40 14 45 f7 8f 66 ea 3d ae 3b 21 cf 40 1e b0 f8 be 0d 45 c4 bb 05 45 bb be a3 fa 9e ad 1b 20 e1 9b 9c 30 1a 6e da 03 12 f1 4a 64 c8 b7 1c 64 d2 7f fd d6 06 bc 75 4d ec 2d 94 71 49 c6 6c 52 8e 07 7a 9a 07 3d 7d a8 a5 72 83 44 e6 58 4c 5a a7 ac 92 f2 78 b6 24 97 04 7c 63 a1 31 d2 63 55 6b 4d e6 26 d6 51 6e 5d ac fe 61 5d 74 fd 68 fa a1 2a d4 b4 21 b9 36 20 37 80 e4 4a 64 af 44 76 4b 4a 22 57 67 64 2a 25 6e 99 07 d2 bf 77 ab e9 f6 4a 6e 69 fb 69 6e 6d 72 9b 40 4d 85 24 27 5a c7 73 8c 04 ec 18 23 29 25 Data Ascii: PKbNRgmpopenh264.dll|E0=I14f1q`

Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip HTTP/1.1Host: ciscobinary.openh264.orgUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 0000000F.00000003.1517744917.000001AD06FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000F.00000003.1556887784.000001ACFC8B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1556154042.000001ACFCBD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000F.00000003.1550969101.000001ACFE1DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000F.00000003.1548155017.000001ACFE5F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1568986504.000001ACFE167000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1556887784.000001ACFC8B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000F.00000003.1550969101.000001ACFE1DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000013.00000002.2542049323.00000246EEC03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2542091381.000002188B20C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000013.00000002.2542049323.00000246EEC03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2542091381.000002188B20C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000013.00000002.2542049323.00000246EEC03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2542091381.000002188B20C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000F.00000003.1552188274.000001ACFDED3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1517744917.000001AD06FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: moz-extension://2a8a4ba3-32a0-495a-bbc2-63871e7b7005/injections/js/bug1842437-www.youtube.com-performance-now-precision.js equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000F.00000003.1548155017.000001ACFE5F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1568986504.000001ACFE167000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1556887784.000001ACFC8B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000F.00000003.1569676744.000001ACFDCE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1550969101.000001ACFE1DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1552769149.000001ACFDCD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000F.00000003.1554060069.000001ACFCF60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: shavar.prod.mozaws.net
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy.tombstone.experimenter.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: a19.dscg10.akamai.net

Source: firefox.exe, 0000000F.00000003.1557298974.000001ACFC47C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540813764.000001AD04C87000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1557298974.000001ACFC49C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: firefox.exe, 0000000F.00000003.1541748564.000001AD0087A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 0000000F.00000003.1541748564.000001AD0087A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 0000000F.00000003.1541748564.000001AD0087A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 0000000F.00000003.1541748564.000001AD0087A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574089976.000001AD07CC1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580785432.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577508342.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1587719751.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1588167280.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1587972849.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1592702849.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: firefox.exe, 0000000F.00000003.1574089976.000001AD07CC1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574317888.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579328268.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573669409.000001AD07CA8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1578631421.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574089976.000001AD07CC1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1587719751.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1588167280.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1587972849.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: firefox.exe, 0000000F.00000003.1574089976.000001AD07CC1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580785432.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580844783.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574317888.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1583445896.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590182282.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577508342.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1584407658.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1592187395.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573669409.000001AD07CA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: firefox.exe, 0000000F.00000003.1574089976.000001AD07CC1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579328268.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573669409.000001AD07CA8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1578631421.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: firefox.exe, 0000000F.00000003.1534843537.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534137819.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: gmpopenh264.dll.tmp.15.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1572512721.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534279184.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1571226520.000001AD07CA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534726514.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.di
Source: firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1572512721.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534279184.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1571226520.000001AD07CA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534726514.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digic
Source: firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1572512721.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534279184.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1571226520.000001AD07CA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534726514.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digice
Source: firefox.exe, 0000000F.00000003.1574089976.000001AD07CC1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574317888.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579328268.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573669409.000001AD07CA8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1578631421.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574089976.000001AD07CC1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580785432.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577508342.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1587719751.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1588167280.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1587972849.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1592702849.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: firefox.exe, 0000000F.00000003.1574089976.000001AD07CC1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580844783.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574317888.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1583445896.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590182282.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1584407658.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1592187395.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573669409.000001AD07CA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: firefox.exe, 0000000F.00000003.1574089976.000001AD07CC1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579328268.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573669409.000001AD07CA8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1578631421.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574089976.000001AD07CC1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1587719751.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1588167280.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1587972849.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1572512721.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534279184.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1571226520.000001AD07CA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534726514.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.dig
Source: firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1572512721.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534279184.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1571226520.000001AD07CA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534726514.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.co
Source: firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574089976.000001AD07CC1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580785432.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577508342.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1587719751.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1588167280.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1587972849.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1592702849.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574089976.000001AD07CC1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1587719751.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1588167280.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1587972849.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: gmpopenh264.dll.tmp.15.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: firefox.exe, 0000000F.00000003.1568824848.000001ACFE190000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1549040622.000001ACFE469000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000000F.00000003.1552188274.000001ACFDED3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 0000000F.00000003.1556154042.000001ACFCBD3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1551383140.000001ACFE1C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000000F.00000003.1556154042.000001ACFCBD3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1551383140.000001ACFE1C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000000F.00000003.1403410157.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1561755251.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1530544606.000001AD059AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1468574127.000001AD0595C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1419822243.000001AD05D55000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1402263287.000001AD004ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1416081182.000001ACFDDF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1528486764.000001ACFD7C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1545583750.000001ACFFE1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1395993280.000001AD007F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1566043359.000001ACFED57000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573592704.000001AD007EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1552188274.000001ACFDECF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1473896248.000001AD00125000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1477503128.000001ACFE0BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1487108301.000001ACFA461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1476931321.000001AD0050E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1543875732.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1490945997.000001AD059B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1545583750.000001ACFFE4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400344711.000001AD00539000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1572512721.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534279184.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1571226520.000001AD07CA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534726514.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digice
Source: firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1572512721.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534279184.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1571226520.000001AD07CA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534726514.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert
Source: firefox.exe, 0000000F.00000003.1534279184.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534726514.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1533770669.000001AD07CA3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534053107.000001AD07CA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.c6
Source: firefox.exe, 0000000F.00000003.1574089976.000001AD07CC1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579328268.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573669409.000001AD07CA8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1578631421.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574089976.000001AD07CC1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580785432.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574317888.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577508342.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574089976.000001AD07CC1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1587719751.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1588167280.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1587972849.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: firefox.exe, 0000000F.00000003.1574089976.000001AD07CC1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580785432.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580844783.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574317888.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1583445896.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590182282.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577508342.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1584407658.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1592187395.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573669409.000001AD07CA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1572512721.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534279184.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1571226520.000001AD07CA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534726514.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.dij
Source: firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1572512721.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534279184.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1571226520.000001AD07CA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534726514.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.h
Source: gmpopenh264.dll.tmp.15.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: firefox.exe, 0000000F.00000003.1549842149.000001ACFE262000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1556271950.000001ACFCB5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1566344676.000001ACFE269000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: firefox.exe, 0000000F.00000003.1402263287.000001AD004CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 0000000F.00000003.1549842149.000001ACFE262000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1556271950.000001ACFCB5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1402263287.000001AD004CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1566344676.000001ACFE269000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: gmpopenh264.dll.tmp.15.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: gmpopenh264.dll.tmp.15.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: gmpopenh264.dll.tmp.15.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1572512721.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534279184.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1571226520.000001AD07CA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534726514.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/
Source: firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574089976.000001AD07CC1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1587719751.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1588167280.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1587972849.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: gmpopenh264.dll.tmp.15.dr	String found in binary or memory: http://www.mozilla.com0
Source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 0000000F.00000003.1541748564.000001AD0087A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 0000000F.00000003.1557498043.000001ACFC33C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540813764.000001AD04C63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000013.00000003.1397104995.00000246EF41C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2547220754.00000246EF41C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000013.00000003.1396023501.00000246EF41C000.00000004.00000020.00020000.00000000.sdmp, mozilla-temp-41.15.dr	String found in binary or memory: http://www.videolan.org/x264.html
Source: firefox.exe, 0000000F.00000003.1549842149.000001ACFE262000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1402263287.000001AD004CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1566344676.000001ACFE269000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: firefox.exe, 0000000F.00000003.1549842149.000001ACFE262000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1402263287.000001AD004CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1566344676.000001ACFE269000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000000F.00000003.1363430603.000001ACFC640000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363620739.000001ACFC660000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363091100.000001ACFC400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363289008.000001ACFC621000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363791304.000001ACFC67F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 0000000F.00000003.1549040622.000001ACFE4C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1404049630.000001ACFE4C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 0000000F.00000003.1551383140.000001ACFE1A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000000F.00000003.1552188274.000001ACFDEEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000000F.00000003.1550969101.000001ACFE1ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1554060069.000001ACFCF60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000000F.00000003.1535405939.000001AD062D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
Source: firefox.exe, 0000000F.00000003.1535405939.000001AD062D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.adjust.com/a8bxj8j?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000000F.00000003.1552188274.000001ACFDED3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000000F.00000003.1552188274.000001ACFDED3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000000F.00000003.1557298974.000001ACFC47C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1568986504.000001ACFE139000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540813764.000001AD04C87000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1547501425.000001ACFECEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: firefox.exe, 00000011.00000002.2543492829.000001FFA9CBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2542049323.00000246EECE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2545484996.000002188B503000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.15.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: firefox.exe, 00000011.00000002.2543492829.000001FFA9CBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2542049323.00000246EECE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2545484996.000002188B503000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.15.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: firefox.exe, 0000000F.00000003.1551383140.000001ACFE1C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000000F.00000003.1403410157.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1561755251.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1543875732.000001AD00470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000000F.00000003.1403410157.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1561755251.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1543875732.000001AD00470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000000F.00000003.1403410157.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1561755251.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1543875732.000001AD00470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000000F.00000003.1403410157.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1561755251.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1543875732.000001AD00470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000000F.00000003.1363430603.000001ACFC640000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363620739.000001ACFC660000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363091100.000001ACFC400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363289008.000001ACFC621000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363791304.000001ACFC67F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000000F.00000003.1541379943.000001AD008B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: firefox.exe, 00000011.00000002.2543492829.000001FFA9CBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2542049323.00000246EECE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2545484996.000002188B503000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.15.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: firefox.exe, 00000011.00000002.2543492829.000001FFA9CBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2542049323.00000246EECE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2545484996.000002188B503000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.15.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000000F.00000003.1542021903.000001AD006DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 0000000F.00000003.1542021903.000001AD006DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1403410157.000001AD00441000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000000F.00000003.1400036294.000001AD0055B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1405993121.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400471664.000001AD00565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1396243399.000001AD0056D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1476291628.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1484997218.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1395034277.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400879773.000001AD00572000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000000F.00000003.1479061046.000001ACFDDEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 0000000F.00000003.1400036294.000001AD0055B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1405993121.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400471664.000001AD00565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1396243399.000001AD0056D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1476291628.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1484997218.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1395034277.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400879773.000001AD00572000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000000F.00000003.1400036294.000001AD0055B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1405993121.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400471664.000001AD00565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1396243399.000001AD0056D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1476291628.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1484997218.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1395034277.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400879773.000001AD00572000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000000F.00000003.1400036294.000001AD0055B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1405993121.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400471664.000001AD00565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1396243399.000001AD0056D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1476291628.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1484997218.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1395034277.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400879773.000001AD00572000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000000F.00000003.1363430603.000001ACFC640000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1422015797.000001ACFE0F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1492651245.000001ACFE0F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1415072611.000001ACFE0F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1457913928.000001ACFE0F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363620739.000001ACFC660000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363091100.000001ACFC400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1568986504.000001ACFE153000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363289008.000001ACFC621000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363791304.000001ACFC67F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1551671099.000001ACFE153000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1549040622.000001ACFE469000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 0000000F.00000003.1508253915.000001ACFA435000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1365927227.000001ACFA433000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1472222880.000001ACFA410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1487108301.000001ACFA432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000000F.00000003.1508253915.000001ACFA435000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1365927227.000001ACFA433000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1472222880.000001ACFA410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1487108301.000001ACFA432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000000F.00000003.1403813209.000001AD0037A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1562664191.000001AD00379000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1558394439.000001AD06EEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2542049323.00000246EEC12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2542091381.000002188B213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000000F.00000003.1570303230.000001ACFCDD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/
Source: firefox.exe, 0000000F.00000003.1552188274.000001ACFDEEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000000F.00000003.1403813209.000001AD0037A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1562664191.000001AD00379000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1558394439.000001AD06EEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2542049323.00000246EEC12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2542091381.000002188B213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000015.00000002.2542091381.000002188B2C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000015.00000002.2542091381.000002188B2C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000013.00000002.2542049323.00000246EEC2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2542091381.000002188B230000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000000F.00000003.1542219086.000001AD006A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 0000000F.00000003.1542219086.000001AD006A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 0000000F.00000003.1542219086.000001AD006A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 0000000F.00000003.1542219086.000001AD006A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 0000000F.00000003.1542219086.000001AD006A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 0000000F.00000003.1542219086.000001AD006A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 0000000F.00000003.1542219086.000001AD006A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 00000015.00000002.2542091381.000002188B2C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000000F.00000003.1403813209.000001AD0037A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1562664191.000001AD00379000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 0000000F.00000003.1542219086.000001AD006A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 0000000F.00000003.1542435438.000001AD0066E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000000F.00000003.1542219086.000001AD006A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 00000015.00000002.2542091381.000002188B2C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000000F.00000003.1403813209.000001AD0037A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1562664191.000001AD00379000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 0000000F.00000003.1403813209.000001AD0037A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1562664191.000001AD00379000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 0000000F.00000003.1403813209.000001AD0037A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1562664191.000001AD00379000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000000F.00000003.1400036294.000001AD0055B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1405993121.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400471664.000001AD00565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1396243399.000001AD0056D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1476291628.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1484997218.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1395034277.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400879773.000001AD00572000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000000F.00000003.1400344711.000001AD00539000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1401078501.000001AD00546000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1396548901.000001AD0053C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1476291628.000001AD0053C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000000F.00000003.1400344711.000001AD00539000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1401078501.000001AD00546000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1396548901.000001AD0053C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1476291628.000001AD0053C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000000F.00000003.1400036294.000001AD0055B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1405993121.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400471664.000001AD00565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1396243399.000001AD0056D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1476291628.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1484997218.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1395034277.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400879773.000001AD00572000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000000F.00000003.1400036294.000001AD0055B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1405993121.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400471664.000001AD00565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1396243399.000001AD0056D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1476291628.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1484997218.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1395034277.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400879773.000001AD00572000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000000F.00000003.1363430603.000001ACFC640000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363620739.000001ACFC660000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363091100.000001ACFC400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363289008.000001ACFC621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000000F.00000003.1403410157.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1561755251.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1543875732.000001AD00470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000000F.00000003.1403410157.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1561755251.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1543875732.000001AD00470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000000F.00000003.1403813209.000001AD0037A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1562664191.000001AD00379000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000000F.00000003.1403410157.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1561755251.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1543875732.000001AD00470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000000F.00000003.1488862612.000001ACFE097000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1508975146.000001AD062D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1535405939.000001AD062D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ib.absa.co.za/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000000F.00000003.1537446322.000001AD057C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1539597720.000001AD057C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/relay
Source: firefox.exe, 0000000F.00000003.1542397001.000001AD00678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: prefs-1.js.15.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: firefox.exe, 0000000F.00000003.1555105330.000001ACFCDEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1549842149.000001ACFE225000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1568057973.000001ACFE225000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000000F.00000003.1562874026.000001AD000F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2542049323.00000246EECEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2542091381.000002188B2F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000000F.00000003.1557298974.000001ACFC49C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/events/1/a04279b7-52f9-4166-b551-b73de
Source: firefox.exe, 0000000F.00000003.1565255747.000001ACFEE7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05EE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1538866834.000001AD05EE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/messaging-system/1/12672553-cb8c-4210-
Source: firefox.exe, 0000000F.00000003.1570303230.000001ACFCDD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/metrics/1/e3abfed3-7bf2-4a39-b5f4-ebe7
Source: firefox.exe, 0000000F.00000003.1403813209.000001AD0037A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1562664191.000001AD00379000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 0000000F.00000003.1400036294.000001AD0055B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1405993121.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400471664.000001AD00565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1396243399.000001AD0056D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1476291628.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1484997218.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1395034277.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400879773.000001AD00572000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000000F.00000003.1400036294.000001AD0055B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1405993121.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400471664.000001AD00565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1396243399.000001AD0056D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1476291628.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1484997218.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1395034277.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400879773.000001AD00572000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000000F.00000003.1400036294.000001AD0055B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1405993121.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400471664.000001AD00565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1396243399.000001AD0056D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1476291628.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1484997218.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1395034277.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400879773.000001AD00572000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000000F.00000003.1400036294.000001AD0055B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1405993121.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400471664.000001AD00565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1396243399.000001AD0056D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1476291628.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1484997218.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1395034277.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400879773.000001AD00572000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000000F.00000003.1403813209.000001AD003C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1556887784.000001ACFC8B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000000F.00000003.1403813209.000001AD003C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1562203837.000001AD003C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000000F.00000003.1549040622.000001ACFE4C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1404049630.000001ACFE4C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000000F.00000003.1549040622.000001ACFE4C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1404049630.000001ACFE4C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000000F.00000003.1508253915.000001ACFA435000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1365927227.000001ACFA433000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1472222880.000001ACFA410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1487108301.000001ACFA432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000000F.00000003.1508253915.000001ACFA435000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1365927227.000001ACFA433000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1472222880.000001ACFA410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1487108301.000001ACFA432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000000F.00000003.1508253915.000001ACFA435000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1365927227.000001ACFA433000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1472222880.000001ACFA410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1487108301.000001ACFA432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000015.00000002.2542091381.000002188B28F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000000F.00000003.1489089289.000001ACFE080000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mochitest.youtube.com/
Source: firefox.exe, 0000000F.00000003.1552188274.000001ACFDEEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000000F.00000003.1574089976.000001AD07CC1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580785432.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580844783.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574317888.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1583445896.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590182282.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577508342.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1584407658.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1592187395.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org0/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000000F.00000003.1508253915.000001ACFA435000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1365927227.000001ACFA433000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1472222880.000001ACFA410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1487108301.000001ACFA432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000000F.00000003.1493543091.000001ACFE081000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1489089289.000001ACFE080000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/page/
Source: firefox.exe, 0000000F.00000003.1493543091.000001ACFE081000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1489089289.000001ACFE080000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/player/
Source: firefox.exe, 0000000F.00000003.1508253915.000001ACFA435000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1365927227.000001ACFA433000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1472222880.000001ACFA410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1487108301.000001ACFA432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000000F.00000003.1508253915.000001ACFA435000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1365927227.000001ACFA433000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1472222880.000001ACFA410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1487108301.000001ACFA432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s4
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000000F.00000003.1557298974.000001ACFC49C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com
Source: firefox.exe, 0000000F.00000003.1557298974.000001ACFC49C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com/
Source: firefox.exe, 0000000F.00000003.1562664191.000001AD00379000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000000F.00000003.1552586800.000001ACFDE82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000000F.00000003.1540813764.000001AD04C87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2&
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000000F.00000003.1557298974.000001ACFC4D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000000F.00000003.1540813764.000001AD04C87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000000F.00000003.1540813764.000001AD04C87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000000F.00000003.1363791304.000001ACFC67F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000000F.00000003.1479061046.000001ACFDDEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000000F.00000003.1552586800.000001ACFDE9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000000F.00000003.1556154042.000001ACFCBFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com
Source: firefox.exe, 0000000F.00000003.1555105330.000001ACFCDEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000000F.00000003.1552769149.000001ACFDCD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000000F.00000003.1403410157.000001AD00416000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1558394439.000001AD06EEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2542049323.00000246EEC12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2542091381.000002188B213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000000F.00000003.1403410157.000001AD00416000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1552838190.000001ACFDC3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000000F.00000003.1542219086.000001AD006A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 0000000F.00000003.1542219086.000001AD006A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 0000000F.00000003.1403813209.000001AD0037A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1562874026.000001AD000F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1562664191.000001AD00379000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2542049323.00000246EECC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2542091381.000002188B2F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000000F.00000003.1550969101.000001ACFE1ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000000F.00000003.1550969101.000001ACFE1ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1554060069.000001ACFCF60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000000F.00000003.1552838190.000001ACFDC48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000000F.00000003.1552188274.000001ACFDEEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000000F.00000003.1566043359.000001ACFED99000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1552586800.000001ACFDE77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1547192430.000001ACFED99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000000F.00000003.1509033333.000001AD062D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1535405939.000001AD062D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/firefox-relay-integration
Source: firefox.exe, 0000000F.00000003.1569676744.000001ACFDCE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1568824848.000001ACFE18A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD0574B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1552188274.000001ACFDEC0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1542021903.000001AD006FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1551671099.000001ACFE167000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1552769149.000001ACFDCD5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 0000000F.00000003.1535677717.000001AD0624F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000000F.00000003.1560728987.000001AD04CDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540285541.000001AD04CDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 0000000F.00000003.1535677717.000001AD0624F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: firefox.exe, 0000000F.00000003.1400036294.000001AD0055B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1405993121.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400471664.000001AD00565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1396243399.000001AD0056D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1476291628.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1484997218.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1395034277.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400879773.000001AD00572000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000000F.00000003.1552188274.000001ACFDEEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com/
Source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000000F.00000003.1551671099.000001ACFE10C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://watch.sling.com/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000000F.00000003.1403813209.000001AD0037A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1562664191.000001AD00379000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000000F.00000003.1400036294.000001AD0055B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1405993121.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400471664.000001AD00565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1396243399.000001AD0056D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1476291628.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1484997218.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1395034277.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400879773.000001AD00572000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: firefox.exe, 00000011.00000002.2543492829.000001FFA9CBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2542049323.00000246EECE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2545484996.000002188B503000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.15.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: firefox.exe, 0000000F.00000003.1363430603.000001ACFC640000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1422015797.000001ACFE0F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1492651245.000001ACFE0F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1415072611.000001ACFE0F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1457913928.000001ACFE0F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363620739.000001ACFC660000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363091100.000001ACFC400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1552586800.000001ACFDE9B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363289008.000001ACFC621000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363791304.000001ACFC67F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574089976.000001AD07CC1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580785432.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577508342.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1587719751.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1588167280.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1587972849.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1592702849.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000000F.00000003.1561548323.000001AD00665000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 0000000F.00000003.1400036294.000001AD0055B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400471664.000001AD00565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1395245762.000001AD0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000000F.00000003.1363430603.000001ACFC640000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363620739.000001ACFC660000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363091100.000001ACFC400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363289008.000001ACFC621000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363791304.000001ACFC67F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: firefox.exe, 0000000F.00000003.1363430603.000001ACFC640000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1422015797.000001ACFE0F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1492651245.000001ACFE0F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1415072611.000001ACFE0F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1457913928.000001ACFE0F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363620739.000001ACFC660000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363091100.000001ACFC400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1552586800.000001ACFDE9B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363289008.000001ACFC621000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363791304.000001ACFC67F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000000F.00000003.1493543091.000001ACFE081000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1489089289.000001ACFE080000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hulu.com/watch/
Source: firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000000F.00000003.1493543091.000001ACFE081000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1489089289.000001ACFE080000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.instagram.com/
Source: firefox.exe, 00000011.00000002.2543492829.000001FFA9CBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2542049323.00000246EECE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2545484996.000002188B503000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.15.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 0000000F.00000003.1569676744.000001ACFDCE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1552769149.000001ACFDCD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mobilesuica.com/
Source: firefox.exe, 0000000F.00000003.1552838190.000001ACFDC48000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1402263287.000001AD004ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1542940719.000001AD004EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000000F.00000003.1552188274.000001ACFDEEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1567386853.000001ACFE25F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: firefox.exe, 0000000F.00000003.1535677717.000001AD0624F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: firefox.exe, 0000000F.00000003.1535677717.000001AD0624F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: firefox.exe, 0000000F.00000003.1509033333.000001AD062D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1535405939.000001AD062D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/about/legal/terms/subscription-services/
Source: firefox.exe, 0000000F.00000003.1552769149.000001ACFDCD5000.00000004.00000800.00020000.00000000.sdmp, targeting.snapshot.json.tmp.15.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: firefox.exe, 0000000F.00000003.1535677717.000001AD0624F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: firefox.exe, 0000000F.00000003.1509033333.000001AD062D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1535405939.000001AD062D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/subscription-services/
Source: firefox.exe, 0000000F.00000003.1535677717.000001AD0624F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000000F.00000003.1535405939.000001AD062D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-mod
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 00000011.00000002.2543492829.000001FFA9CBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2542049323.00000246EECC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2542091381.000002188B2F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000000F.00000003.1542219086.000001AD006A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000000F.00000003.1542219086.000001AD006A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: firefox.exe, 0000000F.00000003.1535677717.000001AD0624F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000013.00000002.2542049323.00000246EECC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/j
Source: firefox.exe, 0000000F.00000003.1549040622.000001ACFE4C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1404049630.000001ACFE4C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000000F.00000003.1542940719.000001AD004EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1402263287.000001AD004FD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000000F.00000003.1551671099.000001ACFE10C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sling.com/
Source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/
Source: firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2542049323.00000246EEC03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2542091381.000002188B20C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000000F.00000003.1542940719.000001AD004EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1402263287.000001AD004FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000000F.00000003.1549842149.000001ACFE27C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1555311928.000001ACFCDD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1570303230.000001ACFCDD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1549040622.000001ACFE469000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000000F.00000003.1556887784.000001ACFC8B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1565255747.000001ACFEE7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1403410157.000001AD00416000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000000F.00000003.1565255747.000001ACFEE7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/P4
Source: recovery.jsonlz4.tmp.15.dr	String found in binary or memory: https://youtube.com/account?=
Source: firefox.exe, 00000015.00000002.2544985380.000002188B310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=ht
Source: firefox.exe, 00000015.00000002.2541007709.000002188B04A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accoun
Source: firefox.exe, 0000000F.00000003.1552838190.000001ACFDC3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481389184.000001AD05486000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1490770484.000001AD05487000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1552769149.000001ACFDCD5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1489046307.000001ACFE086000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1549040622.000001ACFE4B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.2543053915.000001FFA9BD4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.2540943206.000001FFA986A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2540507011.00000246EEAA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2539741070.00000246EE930000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2539741070.00000246EE93A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2544985380.000002188B314000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2541007709.000002188B04A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000000D.00000002.1341333030.0000021D07D01000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000002.1357567500.000001B537C6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000011.00000002.2540943206.000001FFA9860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdB
Source: firefox.exe, 00000011.00000002.2543053915.000001FFA9BD4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.2540943206.000001FFA9860000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2540507011.00000246EEAA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2539741070.00000246EE930000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2544985380.000002188B314000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2541007709.000002188B040000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 00000011.00000002.2540943206.000001FFA986A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdV
Source: firefox.exe, 00000015.00000002.2541007709.000002188B04A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwda
Source: firefox.exe, 00000015.00000002.2541007709.000002188B040000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdu

Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.91:443 -> 192.168.2.7:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49950 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50035 version: TLS 1.2

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00FDEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00FDEAFF

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00FDED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00FDED6A

Source: C:\Users\user\Desktop\random.exe

0_2_00FDEAFF

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00FCAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00FCAA57

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00FF9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00FF9576

System Summary

Binary is likely a compiled AutoIt script file

Source: random.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: random.exe, 00000000.00000000.1293573994.0000000001022000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_a80bf5bb-3
Source: random.exe, 00000000.00000000.1293573994.0000000001022000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_f13ca6e6-8
Source: random.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_592be7c2-a
Source: random.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_2de0fbc0-d

Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 19_2_00000246EF2B7AB7 NtQuerySystemInformation,		19_2_00000246EF2B7AB7
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 19_2_00000246EF2D4572 NtQuerySystemInformation,		19_2_00000246EF2D4572

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00FCD5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00FCD5EB

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00FC1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00FC1201

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00FCE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00FCE8F6

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F68060	0_2_00F68060
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FD2046	0_2_00FD2046
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FC8298	0_2_00FC8298
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F9E4FF	0_2_00F9E4FF
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F9676B	0_2_00F9676B
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FF4873	0_2_00FF4873
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F6CAF0	0_2_00F6CAF0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F8CAA0	0_2_00F8CAA0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F7CC39	0_2_00F7CC39
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F96DD9	0_2_00F96DD9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F691C0	0_2_00F691C0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F7B119	0_2_00F7B119
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F81394	0_2_00F81394
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F81706	0_2_00F81706
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F8781B	0_2_00F8781B
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F819B0	0_2_00F819B0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F7997D	0_2_00F7997D
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F67920	0_2_00F67920
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F87A4A	0_2_00F87A4A
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FB3CE7	0_2_00FB3CE7
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F87CA7	0_2_00F87CA7
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F81C77	0_2_00F81C77
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F99EEE	0_2_00F99EEE
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FEBE44	0_2_00FEBE44
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F81F32	0_2_00F81F32
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 19_2_00000246EF2B7AB7	19_2_00000246EF2B7AB7
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 19_2_00000246EF2D4572	19_2_00000246EF2D4572
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 19_2_00000246EF2D45B2	19_2_00000246EF2D45B2
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 19_2_00000246EF2D4C9C	19_2_00000246EF2D4C9C

Source: C:\Users\user\Desktop\random.exe	Code function: String function: 00F7F9F2 appears 40 times
Source: C:\Users\user\Desktop\random.exe	Code function: String function: 00F69CB3 appears 31 times
Source: C:\Users\user\Desktop\random.exe	Code function: String function: 00F80A30 appears 46 times

Source: random.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal76.troj.evad.winEXE@34/34@69/14

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00FD37B5 GetLastError,FormatMessageW,

0_2_00FD37B5

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FC10BF AdjustTokenPrivileges,CloseHandle,		0_2_00FC10BF
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FC16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00FC16C3

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00FD51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00FD51CD

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00FCD4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00FCD4DC

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00FD648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00FD648E

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00F642A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00F642A2

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File created: C:\Users\user\AppData\Local\Mozilla\Firefox\SkeletonUILock-c388d246

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7876:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8008:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7736:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7940:120:WilError_03

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File created: C:\Users\user~1\AppData\Local\Temp\firefox

Jump to behavior

Source: random.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: firefox.exe, 0000000F.00000003.1557155422.000001ACFC827000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE timestamp BETWEEN date(:dateFrom) AND date(:dateTo);
Source: firefox.exe, 0000000F.00000003.1552188274.000001ACFDED3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;

Source: random.exe

ReversingLabs: Detection: 31%

Source: unknown	Process created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2264 -parentBuildID 20230927232528 -prefsHandle 2200 -prefMapHandle 2196 -prefsLen 25302 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba4e4ef8-aac1-4118-8c5a-3b35755e30c3} 8188 "\\.\pipe\gecko-crash-server-pipe.8188" 1aceca6e910 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3960 -parentBuildID 20230927232528 -prefsHandle 3984 -prefMapHandle 3980 -prefsLen 26317 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {53f9218a-6893-4da7-89c2-5475210359ad} 8188 "\\.\pipe\gecko-crash-server-pipe.8188" 1acfecbc510 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5144 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5148 -prefMapHandle 5136 -prefsLen 33202 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e2b3a79-822c-48e8-ad97-04fffcc6b6de} 8188 "\\.\pipe\gecko-crash-server-pipe.8188" 1acfec1e910 utility
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2264 -parentBuildID 20230927232528 -prefsHandle 2200 -prefMapHandle 2196 -prefsLen 25302 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba4e4ef8-aac1-4118-8c5a-3b35755e30c3} 8188 "\\.\pipe\gecko-crash-server-pipe.8188" 1aceca6e910 socket	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3960 -parentBuildID 20230927232528 -prefsHandle 3984 -prefMapHandle 3980 -prefsLen 26317 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {53f9218a-6893-4da7-89c2-5475210359ad} 8188 "\\.\pipe\gecko-crash-server-pipe.8188" 1acfecbc510 rdd	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5144 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5148 -prefMapHandle 5136 -prefsLen 33202 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e2b3a79-822c-48e8-ad97-04fffcc6b6de} 8188 "\\.\pipe\gecko-crash-server-pipe.8188" 1acfec1e910 utility	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: random.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: UxTheme.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: rsaenh.pdb source: firefox.exe, 0000000F.00000003.1551383140.000001ACFE1B6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: xWindows.Security.Integrity.pdb source: firefox.exe, 0000000F.00000003.1541748564.000001AD0087A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winsta.pdb source: firefox.exe, 0000000F.00000003.1535644921.000001AD062B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: bcrypt.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ktmw32.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: freebl3.pdbP4 source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: WscApi.pdb source: firefox.exe, 0000000F.00000003.1535644921.000001AD062B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: NapiNSP.pdb source: firefox.exe, 0000000F.00000003.1590066087.000001ACFC174000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: xWindows.StateRepositoryPS.pdb source: firefox.exe, 0000000F.00000003.1541748564.000001AD0087A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1541828586.000001AD0083F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8WinTypes.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: webauthn.pdbGCTL source: firefox.exe, 0000000F.00000003.1585828503.000001AD07C5D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: xul.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nssckbi.pdb source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winhttp.pdb`e source: firefox.exe, 0000000F.00000003.1551383140.000001ACFE1B6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: firefox.exe, 0000000F.00000003.1538320293.000001AD05721000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winnsi.pdb source: firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dcomp.pdb source: firefox.exe, 0000000F.00000003.1535644921.000001AD062B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: cryptsp.pdb source: firefox.exe, 0000000F.00000003.1551383140.000001ACFE1B6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8dhcpcsvc6.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8softokn3.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntmarta.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: CLBCatQ.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: urlmon.pdb source: firefox.exe, 0000000F.00000003.1535644921.000001AD062B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8twinapi.appcore.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8kernelbase.pdb source: firefox.exe, 0000000F.00000003.1556154042.000001ACFCBD3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shlwapi.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8CoreMessaging.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dwmapi.pdb source: firefox.exe, 0000000F.00000003.1535644921.000001AD062B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: firefox.pdb source: firefox.exe, 0000000F.00000003.1561423264.000001AD00811000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: srvcli.pdb source: firefox.exe, 0000000F.00000003.1535644921.000001AD062B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: imm32.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: webauthn.pdb source: firefox.exe, 0000000F.00000003.1585828503.000001AD07C5D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws2_32.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8imagehlp.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1570303230.000001ACFCD9E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mswsock.pdb source: firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8gkcodecs.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8iphlpapi.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8ExplorerFrame.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1570303230.000001ACFCD9E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nsi.pdb source: firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winmm.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8OnDemandConnRouteHelper.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1570303230.000001ACFCD9E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ole32.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8CoreUIComponents.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8osclientcerts.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8cfgmgr32.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: msasn1.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: DWrite.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: combase.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8iertutil.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8dhcpcsvc.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: pnrpnsp.pdbUGP source: firefox.exe, 0000000F.00000003.1590762702.000001ACFC188000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 8msvcp140.amd64.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1556154042.000001ACFCBD3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ncrypt.pdb source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8webauthn.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8Kernel.Appcore.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8powrprof.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8ColorAdapterClient.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wsock32.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8MMDevAPI.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wininet.pdb source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: UMPDC.pdb source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1535644921.000001AD062B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8oleaut32.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8kernel32.pdb source: firefox.exe, 0000000F.00000003.1556154042.000001ACFCBD3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wininet.pdb0 source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: rpcrt4.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8TextInputFramework.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: pnrpnsp.pdb source: firefox.exe, 0000000F.00000003.1590762702.000001ACFC188000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wshbth.pdb source: firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8InputHost.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8ucrtbase.pdb source: firefox.exe, 0000000F.00000003.1556154042.000001ACFCBD3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: xOneCoreUAPCommonProxyStub.pdb source: firefox.exe, 0000000F.00000003.1541748564.000001AD0087A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8audioses.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8Bcp47mrm.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8netutils.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shell32.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8rasadhlp.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1570303230.000001ACFCD9E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: sspicli.pdb source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8Bcp47Langs.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8wtsapi32.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8taskschd.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1570303230.000001ACFCD9E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8msvcp_win.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: NapiNSP.pdbUGP source: firefox.exe, 0000000F.00000003.1590066087.000001ACFC174000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnsapi.pdb source: firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: userenv.pdb source: firefox.exe, 0000000F.00000003.1535644921.000001AD062B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8Windows.UI.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nlaapi.pdb source: firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8fwpuclnt.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1570303230.000001ACFCD9E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winhttp.pdb source: firefox.exe, 0000000F.00000003.1551383140.000001ACFE1B6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: msimg32.pdb source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: freebl3.pdbEditorTransaction source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntasn1.pdb source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: devobj.pdb source: firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: d3d11.pdb source: firefox.exe, 0000000F.00000003.1535644921.000001AD062B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8Windows.Storage.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8OnDemandConnRouteHelper.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1570303230.000001ACFCD9E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dbghelp.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8netprofm.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: gdi32.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: profapi.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8Windows.Globalization.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: avrt.pdb source: firefox.exe, 0000000F.00000003.1558532910.000001AD06E45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: WLDP.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8directmanipulation.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: sechost.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8setupapi.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8vcruntime140_1.amd64.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1556154042.000001ACFCBD3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: propsys.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8lgpllibs.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.15.dr
Source:	Binary string: 8gdi32full.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8vcruntime140.amd64.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1556154042.000001ACFCBD3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winrnr.pdb source: firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: msctf.pdb source: firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: version.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dbgcore.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mscms.pdb source: firefox.exe, 0000000F.00000003.1535644921.000001AD062B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: user32.pdb source: firefox.exe, 0000000F.00000003.1538192369.000001AD05740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540056730.000001AD05740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: twinapi.pdb source: firefox.exe, 0000000F.00000003.1538866834.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1536513352.000001AD05ED4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8DataExchange.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.15.dr
Source:	Binary string: 8wintrust.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: psapi.pdb source: firefox.exe, 0000000F.00000003.1539653497.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1537501604.000001AD057C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8WindowManagementAPI.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: firefox.exe, 0000000F.00000003.1561423264.000001AD00811000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1538320293.000001AD05721000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dxgi.pdb source: firefox.exe, 0000000F.00000003.1535644921.000001AD062B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8npmproxy.pdb source: firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8linkinfo.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1570303230.000001ACFCD9E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8Windows.UI.Immersive.pdb source: firefox.exe, 0000000F.00000003.1555311928.000001ACFCD8B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: crypt32.pdb source: firefox.exe, 0000000F.00000003.1538320293.000001AD05721000.00000004.00000800.00020000.00000000.sdmp

Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00F642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00F642DE

Source: gmpopenh264.dll.tmp.15.dr

Static PE information: section name: .rodata

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00F80A76 push ecx; ret

0_2_00F80A89

Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp			Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)			Jump to dropped file

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F7F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00F7F98E
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FF1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00FF1C41

Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\random.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-97653

Source: C:\Program Files\Mozilla Firefox\firefox.exe

Code function: 19_2_00000246EF2B7AB7 rdtsc

19_2_00000246EF2B7AB7

Source: C:\Users\user\Desktop\random.exe

API coverage: 3.7 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FCDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00FCDBBE
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F9C2A2 FindFirstFileExW,	0_2_00F9C2A2
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FD68EE FindFirstFileW,FindClose,	0_2_00FD68EE
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FD698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00FD698F
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FCD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00FCD076
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FCD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00FCD3A9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FD9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00FD9642
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FD979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00FD979D
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FD9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00FD9B2B
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FD5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00FD5C97

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00F642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00F642DE

Source: firefox.exe, 00000011.00000002.2540943206.000001FFA986A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWv
Source: firefox.exe, 00000013.00000002.2545120010.00000246EF160000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll3$6
Source: firefox.exe, 00000011.00000002.2540943206.000001FFA986A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2545120010.00000246EF160000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2539741070.00000246EE93A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2545289935.000002188B320000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2541007709.000002188B04A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 00000011.00000002.2546026036.000001FFA9D13000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: random.exe, 00000000.00000003.1391994316.0000000001906000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1386332137.00000000018D3000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1374974068.00000000018CD000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1393357802.0000000001909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW]
Source: firefox.exe, 00000011.00000002.2547130326.000001FFA9E00000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2545120010.00000246EF160000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\random.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

Code function: 19_2_00000246EF2B7AB7 rdtsc

19_2_00000246EF2B7AB7

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00FDEAA2 BlockInput,

0_2_00FDEAA2

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00F92622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00F92622

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00F642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00F642DE

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00F84CE8 mov eax, dword ptr fs:[00000030h]

0_2_00F84CE8

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00FC0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00FC0B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F92622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00F92622
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F8083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00F8083F
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F809D5 SetUnhandledExceptionFilter,	0_2_00F809D5
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00F80C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00F80C21

Source: C:\Users\user\Desktop\random.exe

0_2_00FC1201

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00FA2BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00FA2BA5

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00FCB226 SendInput,keybd_event,

0_2_00FCB226

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00FE22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_00FE22DA

Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior

Source: C:\Users\user\Desktop\random.exe

0_2_00FC0B62

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00FC1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00FC1663

Source: random.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: random.exe	Binary or memory string: Shell_TrayWnd
Source: firefox.exe, 0000000F.00000003.1533770669.000001AD07C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hSoftware\Policies\Microsoft\Windows\PersonalizationNoChangingStartMenuBackgroundPersonalColors_BackgroundWilStaging_02RtlDisownModuleHeapAllocationRtlQueryFeatureConfigurationRtlRegisterFeatureConfigurationChangeNotificationRtlSubscribeWnfStateChangeNotificationRtlDllShutdownInProgressntdll.dllNtQueryWnfStateDataLocal\SM0:%d:%d:%hs_p0Local\SessionImmersiveColorPreferenceBEGINTHMthmfile\Sessions\%d\Windows\ThemeSectionMessageWindowendthemewndThemeApiConnectionRequest\ThemeApiPortwinsta0SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\PersonalizeAppsUseLightThemeSystemUsesLightThemedefaultshell\themes\uxtheme\render.cppCompositedWindow::WindowdeletedrcacheMDIClientSoftware\Microsoft\Windows\DWMColorPrevalenceSoftware\Microsoft\Windows\CurrentVersion\ImmersiveShellTabletModeMENUAccentColorSoftware\Microsoft\Windows\CurrentVersion\Explorer\AccentDefaultStartColorControl Panel\DesktopAutoColorizationAccentColorMenuStartColorMenuAutoColorSoftware\Microsoft\Windows\CurrentVersion\Themes\History\ColorsSoftware\Microsoft\Windows\CurrentVersion\Themes\HistoryAccentPaletteTab$Shell_TrayWndLocal\SessionImmersiveColorMutex

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00F80698 cpuid

0_2_00F80698

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00FBD21C GetLocalTime,

0_2_00FBD21C

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00FBD27A GetUserNameW,

0_2_00FBD27A

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00F9B952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_00F9B952

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00F642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00F642DE

Stealing of Sensitive Information

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: random.exe PID: 7672, type: MEMORYSTR

Source: random.exe	Binary or memory string: WIN_81
Source: random.exe	Binary or memory string: WIN_XP
Source: random.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: random.exe	Binary or memory string: WIN_XPe
Source: random.exe	Binary or memory string: WIN_VISTA
Source: random.exe	Binary or memory string: WIN_7
Source: random.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: random.exe PID: 7672, type: MEMORYSTR

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FE1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00FE1204
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00FE1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00FE1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	2 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	1 DLL Side-Loading	NTDS	16 System Information Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 Extra Window Memory Injection	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Process Injection	1 Masquerading	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	2 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
random.exe	32%	ReversingLabs	Win32.Trojan.Generic
random.exe	100%	Avira	TR/ATRAPS.Gen

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
http://crl3.di	0%	Avira URL Cloud	safe
http://crl3.digice	0%	Avira URL Cloud	safe
http://crl3.digic	0%	Avira URL Cloud	safe
http://ocsp.digicert.c6	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	23.215.0.133	true	false	high
star-mini.c10r.facebook.com	157.240.253.35	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
twitter.com	104.244.42.1	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
shavar.prod.mozaws.net	52.26.30.181	true	false	high
services.addons.mozilla.org	151.101.65.91	true	false	high
dyna.wikimedia.org	185.15.59.224	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
youtube.com	142.250.186.110	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
a19.dscg10.akamai.net	2.22.61.59	true	false	high
youtube-ui.l.google.com	142.250.185.238	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
reddit.map.fastly.net	151.101.1.140	true	false	high
ipv4only.arpa	192.0.0.170	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
normandy.tombstone.experimenter.prod.webservices.mozgcp.net	34.49.51.44	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
www.reddit.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
normandy.cdn.mozilla.net	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 00000015.00000002.2542091381.000002188B2C4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl3.di	firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1572512721.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534279184.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1571226520.000001AD07CA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534726514.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://detectportal.firefox.com/	firefox.exe, 0000000F.00000003.1552188274.000001ACFDED3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoft	firefox.exe, 0000000F.00000003.1534843537.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534137819.000001ACFC172000.00000004.00000020.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
http://www.mozilla.com0	gmpopenh264.dll.tmp.15.dr	false		high
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	firefox.exe, 0000000F.00000003.1400036294.000001AD0055B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1405993121.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400471664.000001AD00565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1396243399.000001AD0056D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1476291628.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1484997218.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1395034277.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400879773.000001AD00572000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000015.00000002.2542091381.000002188B28F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.leboncoin.fr/	firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 0000000F.00000003.1403410157.000001AD00416000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1552838190.000001ACFDC3E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://shavar.services.mozilla.com	firefox.exe, 0000000F.00000003.1556154042.000001ACFCBFA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://completion.amazon.com/search/complete?q=	firefox.exe, 0000000F.00000003.1363430603.000001ACFC640000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363620739.000001ACFC660000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363091100.000001ACFC400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363289008.000001ACFC621000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363791304.000001ACFC67F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000000F.00000003.1550969101.000001ACFE1ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1554060069.000001ACFCF60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/breach-details/	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://github.com/w3c/csswg-drafts/issues/4650	firefox.exe, 0000000F.00000003.1403410157.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1561755251.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1543875732.000001AD00470000.00000004.00000800.00020000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000000F.00000003.1363430603.000001ACFC640000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1422015797.000001ACFE0F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1492651245.000001ACFE0F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1415072611.000001ACFE0F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1457913928.000001ACFE0F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363620739.000001ACFC660000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363091100.000001ACFC400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1552586800.000001ACFDE9B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363289008.000001ACFC621000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363791304.000001ACFC67F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.msn.com	firefox.exe, 0000000F.00000003.1549040622.000001ACFE4C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1404049630.000001ACFE4C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 0000000F.00000003.1363430603.000001ACFC640000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363620739.000001ACFC660000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363091100.000001ACFC400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363289008.000001ACFC621000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/addon/	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://youtube.com/	firefox.exe, 0000000F.00000003.1556887784.000001ACFC8B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1565255747.000001ACFEE7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1403410157.000001AD00416000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	firefox.exe, 0000000F.00000003.1535677717.000001AD0624F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht	firefox.exe, 0000000F.00000003.1535405939.000001AD062D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.instagram.com/	firefox.exe, 0000000F.00000003.1493543091.000001ACFE081000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1489089289.000001ACFE080000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://api.accounts.firefox.com/v1	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/	firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.youtube.com/	firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2542049323.00000246EEC03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2542091381.000002188B20C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.bbc.co.uk/	firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000015.00000002.2542091381.000002188B2C4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:	firefox.exe, 0000000F.00000003.1557298974.000001ACFC47C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540813764.000001AD04C87000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1557298974.000001ACFC49C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 0000000F.00000003.1479061046.000001ACFDDEB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 0000000F.00000003.1551383140.000001ACFE1C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000000F.00000003.1550969101.000001ACFE1ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://youtube.com/account?=	recovery.jsonlz4.tmp.15.dr	false		high
https://shavar.services.mozilla.com/	firefox.exe, 0000000F.00000003.1555105330.000001ACFCDEF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl3.digic	firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1572512721.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534279184.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1571226520.000001AD07CA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534726514.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl4.dig	firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1572512721.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534279184.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1571226520.000001AD07CA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534726514.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	firefox.exe, 00000011.00000002.2543492829.000001FFA9CBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2542049323.00000246EECE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2545484996.000002188B503000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.15.dr	false		high
http://crl3.digice	firefox.exe, 0000000F.00000003.1583445896.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1581774150.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1572512721.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579839014.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534279184.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582301509.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1574725942.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591553012.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1577662140.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1579506716.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1590986696.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589839749.000001AD07CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1586576351.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1585828503.000001AD07CB1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1571226520.000001AD07CA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1582012440.000001AD07CBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1591200290.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573891550.000001AD07CB7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1589315324.000001AD07C9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1580518420.000001AD07CAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534726514.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://spocs.getpocket.com/	firefox.exe, 0000000F.00000003.1403410157.000001AD00416000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1558394439.000001AD06EEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2542049323.00000246EEC12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2542091381.000002188B213000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://addons.mozilla.org/	firefox.exe, 0000000F.00000003.1552188274.000001ACFDEEA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 0000000F.00000003.1403410157.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1561755251.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1543875732.000001AD00470000.00000004.00000800.00020000.00000000.sdmp	false		high
http://a9.com/-/spec/opensearch/1.0/	firefox.exe, 0000000F.00000003.1541748564.000001AD0087A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/user/dashboard	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
http://ocsp.digicert.c6	firefox.exe, 0000000F.00000003.1534279184.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534726514.000001AD07CB9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1533770669.000001AD07CA3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1534053107.000001AD07CA4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/about	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
http://mozilla.org/MPL/2.0/.	firefox.exe, 0000000F.00000003.1403410157.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1561755251.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1530544606.000001AD059AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1468574127.000001AD0595C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1419822243.000001AD05D55000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1402263287.000001AD004ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1416081182.000001ACFDDF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1528486764.000001ACFD7C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1545583750.000001ACFFE1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1395993280.000001AD007F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1566043359.000001ACFED57000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1573592704.000001AD007EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1552188274.000001ACFDECF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1473896248.000001AD00125000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1477503128.000001ACFE0BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1487108301.000001ACFA461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1476931321.000001AD0050E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1543875732.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1490945997.000001AD059B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1545583750.000001ACFFE4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400344711.000001AD00539000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.bellmedia.c	firefox.exe, 0000000F.00000003.1549040622.000001ACFE4C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1404049630.000001ACFE4C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com	firefox.exe, 0000000F.00000003.1549040622.000001ACFE4C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1404049630.000001ACFE4C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://coverage.mozilla.org	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	gmpopenh264.dll.tmp.15.dr	false		high
https://www.zhihu.com/	firefox.exe, 0000000F.00000003.1542940719.000001AD004EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1402263287.000001AD004FD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	firefox.exe, 0000000F.00000003.1549842149.000001ACFE262000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1402263287.000001AD004CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1566344676.000001ACFE269000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	firefox.exe, 0000000F.00000003.1549842149.000001ACFE262000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1402263287.000001AD004CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1566344676.000001ACFE269000.00000004.00000800.00020000.00000000.sdmp	false		high
http://a9.com/-/spec/opensearch/1.1/	firefox.exe, 0000000F.00000003.1541748564.000001AD0087A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 0000000F.00000003.1400036294.000001AD0055B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1405993121.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400471664.000001AD00565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1396243399.000001AD0056D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1476291628.000001AD00569000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1484997218.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1395034277.000001AD00570000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1400879773.000001AD00572000.00000004.00000800.00020000.00000000.sdmp	false		high
https://blocked.cdn.mozilla.net/	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://json-schema.org/draft/2019-09/schema	firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://outlook.live.com/default.aspx?rru=compose&to=%s	firefox.exe, 0000000F.00000003.1508253915.000001ACFA435000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1365927227.000001ACFA433000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1472222880.000001ACFA410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1487108301.000001ACFA432000.00000004.00000800.00020000.00000000.sdmp	false		high
https://identity.mozilla.com/apps/relay	firefox.exe, 0000000F.00000003.1537446322.000001AD057C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1539597720.000001AD057C9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mozilla.cloudflare-dns.com/dns-query	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	firefox.exe, 0000000F.00000003.1560728987.000001AD04CDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1540285541.000001AD04CDF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000000F.00000003.1508253915.000001ACFA435000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1365927227.000001ACFA433000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1472222880.000001ACFA410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1487108301.000001ACFA432000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1403410157.000001AD00441000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.amazon.co.uk/	firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/	firefox.exe, 0000000F.00000003.1570303230.000001ACFCDD2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/preferences	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://screenshots.firefox.com/	firefox.exe, 0000000F.00000003.1363791304.000001ACFC67F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://truecolors.firefox.com/	firefox.exe, 0000000F.00000003.1552188274.000001ACFDEEA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/search	firefox.exe, 0000000F.00000003.1363430603.000001ACFC640000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1422015797.000001ACFE0F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1492651245.000001ACFE0F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1415072611.000001ACFE0F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1457913928.000001ACFE0F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363620739.000001ACFC660000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363091100.000001ACFC400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1552586800.000001ACFDE9B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363289008.000001ACFC621000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363791304.000001ACFC67F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gpuweb.github.io/gpuweb/	firefox.exe, 0000000F.00000003.1403410157.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1561755251.000001AD00470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1543875732.000001AD00470000.00000004.00000800.00020000.00000000.sdmp	false		high
https://relay.firefox.com/api/v1/	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	firefox.exe, 00000011.00000002.2543492829.000001FFA9CBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.2542049323.00000246EECE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2545484996.000002188B503000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.15.dr	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://topsites.services.mozilla.com/cid/	firefox.exe, 00000011.00000002.2542854668.000001FFA9B00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2545365267.00000246EF260000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2541435513.000002188B080000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.wykop.pl/	firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://twitter.com/	firefox.exe, 0000000F.00000003.1555815001.000001ACFCD4A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.olx.pl/	firefox.exe, 0000000F.00000003.1542940719.000001AD004EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1402263287.000001AD004FD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1544643778.000001AD0043D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/	firefox.exe, 0000000F.00000003.1552188274.000001ACFDEEA000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
2.22.61.59	a19.dscg10.akamai.net	European Union	20940	AKAMAI-ASN1EU	false
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.107.243.93	push.services.mozilla.com	United States	15169	GOOGLEUS	false
151.101.65.91	services.addons.mozilla.org	United States	54113	FASTLYUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.49.51.44	normandy.tombstone.experimenter.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
52.26.30.181	shavar.prod.mozaws.net	United States	16509	AMAZON-02US	false
142.250.186.110	youtube.com	United States	15169	GOOGLEUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1622958
Start date and time:	2025-02-24 18:43:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	random.exe
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@34/34@69/14
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 96% Number of executed functions: 47 Number of non-executed functions: 294
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.138, 216.58.212.138, 216.58.212.142, 172.217.23.110, 13.107.246.60, 2.19.106.160, 172.202.163.200
Excluded domains from analysis (whitelisted): fs.microsoft.com, ciscobinary.openh264.org, redirector.gvt1.com, otelrules.azureedge.net, slscr.update.microsoft.com, incoming.telemetry.mozilla.org, ctldl.windowsupdate.com, safebrowsing.googleapis.com, aus5.mozilla.org, time.windows.com, location.services.mozilla.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:25:12	API Interceptor	1x Sleep call for process: firefox.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
2.22.61.59	random.exe	Get hash	malicious	Credential Flusher	Browse	ciscobinary.openh264.org/openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
	random.exe	Get hash	malicious	Credential Flusher	Browse	ciscobinary.openh264.org/openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
	random.exe	Get hash	malicious	Credential Flusher	Browse	ciscobinary.openh264.org/openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
34.149.100.209	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	https://steamecomrmunity.com/s/10423910953	Get hash	malicious	Unknown	Browse
	Notification Detail.html	Get hash	malicious	Unknown	Browse
	https://storage.googleapis.com/yasinsoulaiman00200102055/yasinsoulaiman00200102055.html#4Laxsc88075pMVT611lryovfdyzn369QPMJEJMGSLMNNGI223458FFVC3610M25	Get hash	malicious	Phisher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	https://click.email.active.com/f/a/QSi9x4aE2he14davSEuWGA~~/AAOtGhA~/kCsxXIFUFIqn8bLjeBjiWvXzS1oALejcnJaENGD5HzxCxYcQPgOnguf7W7QR0nstNy3af6IEFijde20JNtyjlBNxLI0bX7JKoy33NtFXuonYqm1BW9Wf6skdSQzo3eWILaXt_wuE4A6m9d1Klo8VXs3rqTVh6-1Al9IfjjWdQJOKyrlNb176zlF8FZpTlnqm5WBncvTjE56A2A6kqUXCIJMwI6xmadyYYBsgJGHSm9iQ2lk7sYftRmiO3y-Sbg-z	Get hash	malicious	Unknown	Browse
	px4Y74kUj2.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
151.101.65.91	http://awebmailaccount.wixsite.com/my-site	Get hash	malicious	Unknown	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	https://hopp.bio/universeglobalcent	Get hash	malicious	Unknown	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	https://jarqiull.com/	Get hash	malicious	Unknown	Browse
	http://facebooksafety23.wixsite.com/verify	Get hash	malicious	Unknown	Browse
	http://mww1761.wixsite.com/my-site-1	Get hash	malicious	Unknown	Browse
	http://coinbasecomlogiin.wixsite.com/coinbasecomlogin	Get hash	malicious	Unknown	Browse
	http://krienkekiim.wixsite.com/my-site-2	Get hash	malicious	HTMLPhisher	Browse
	http://flowto.it/eVqmHdTP1Q	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
twitter.com	http://pearltimes.co.ug/wp-content/reports/qnts/au/auth/auhs1	Get hash	malicious	Unknown	Browse	104.244.42.65
example.org	lX1M7MPt7Y.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	23.215.0.132
	random.exe	Get hash	malicious	Credential Flusher	Browse	23.215.0.132
	random.exe	Get hash	malicious	Credential Flusher	Browse	23.215.0.132
	https://steamecomrmunity.com/s/10423910953	Get hash	malicious	Unknown	Browse	23.215.0.132
	Notification Detail.html	Get hash	malicious	Unknown	Browse	23.215.0.133
	https://drive.google.com/file/d/1FVDnmU54G6_GaADSmojqRgpCVK0Y1U9s/view?usp=sharing	Get hash	malicious	Remcos	Browse	96.7.128.186
	random.exe	Get hash	malicious	Credential Flusher	Browse	96.7.128.192
	random.exe	Get hash	malicious	Credential Flusher	Browse	23.215.0.132
	https://click.email.active.com/f/a/QSi9x4aE2he14davSEuWGA~~/AAOtGhA~/kCsxXIFUFIqn8bLjeBjiWvXzS1oALejcnJaENGD5HzxCxYcQPgOnguf7W7QR0nstNy3af6IEFijde20JNtyjlBNxLI0bX7JKoy33NtFXuonYqm1BW9Wf6skdSQzo3eWILaXt_wuE4A6m9d1Klo8VXs3rqTVh6-1Al9IfjjWdQJOKyrlNb176zlF8FZpTlnqm5WBncvTjE56A2A6kqUXCIJMwI6xmadyYYBsgJGHSm9iQ2lk7sYftRmiO3y-Sbg-z	Get hash	malicious	Unknown	Browse	23.215.0.132
	YWih6T9PUp.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Stealc	Browse	23.215.0.133
star-mini.c10r.facebook.com	https://sxdcfvg.blob.core.windows.net/swfgm/slp.html	Get hash	malicious	Phisher	Browse	157.240.253.35
	https://t.salesmatemail.net/email/v1/track?key=4788dfbd-ffb2-4c0e-b7b1-b1e698ca06aa	Get hash	malicious	Unknown	Browse	157.240.253.35
	https://www.mediafire.com/folder/rq9keaobsyt4w/Loader	Get hash	malicious	Unknown	Browse	157.240.253.35
	http://john-lewis.top	Get hash	malicious	Unknown	Browse	157.240.0.35
	http://pearltimes.co.ug/wp-content/reports/qnts/au/auth/auhs1	Get hash	malicious	Unknown	Browse	157.240.253.35
	PhotoPosPro4_SetUp.exe	Get hash	malicious	AsyncRAT, GhostRat	Browse	157.240.0.35
	https://outook.lojaseofertas.com/	Get hash	malicious	Unknown	Browse	157.240.252.35
	http://pink-jobs.com	Get hash	malicious	Unknown	Browse	157.240.251.35
	http://weareprosquared.com	Get hash	malicious	Unknown	Browse	157.240.0.35
	https://iamsahararose.com/blog/whats-your-dharma-purpose-archetype-free-quiz-to-find-out/	Get hash	malicious	Unknown	Browse	157.240.0.35

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	http://multitran.com/m.exe	Get hash	malicious	Unknown	Browse	151.101.130.49
	https://f.io/bUMg8j0P	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	151.101.194.137
	EXTERNAL FW Complete Settlement Agreement Approved Monday February 24 2025.msg	Get hash	malicious	Gabagool, HTMLPhisher	Browse	151.101.66.137
	4338471.pdf	Get hash	malicious	Unknown	Browse	151.101.1.140
	https://www.mediafire.com/file_premium/gvsjycs9mnhqpli/Tristan_Cardinal_Proposal.pdf/file	Get hash	malicious	HTMLPhisher	Browse	151.101.1.229
	EFT Remittance_(Mmannix)CQDM.html	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	151.101.66.137
	https://github.com/obsidianmd/obsidian-releases/releases/download/v1.8.7/Obsidian-1.8.7.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	http://lookerstudio%2e%67%6f%6f%67%6c%65%2e%63%6f%6d/s/ryl1d6fWDPQ	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	http://dcuct.roisfaozi.com/rd/4mgaxw4733Bifj425sqnneagkxv6756OONFZNZGXKXTATR5427172XJTT17397o12	Get hash	malicious	Unknown	Browse	151.101.2.132
	https://captcha-desk-redirector.lovable.app/&c=E,1,xeBJ5aF-VAbZYVDMaL4VM6XTaRQl4rSunTf8j0FUJjtNQHEk6osaxStf0R4nAfD2t4C8-6e8DRvXc_rhbj7gT5i2nSefcD0G7ydnd2oaql_BNfNHpGHTfJE	Get hash	malicious	Unknown	Browse	151.101.194.208
ATGS-MMD-ASUS	http://multitran.com/m.exe	Get hash	malicious	Unknown	Browse	34.1.1.166
	https://easyupload.io/l5wpfb	Get hash	malicious	Unknown	Browse	34.1.1.166
	https://www.ausschreibungen-strabag.com	Get hash	malicious	Unknown	Browse	34.149.206.255
	http://pearltimes.co.ug/wp-content/reports/qnts/au/auth/auhs1	Get hash	malicious	Unknown	Browse	34.8.123.242
	res.x86.elf	Get hash	malicious	Unknown	Browse	56.64.166.47
	res.mpsl.elf	Get hash	malicious	Unknown	Browse	56.77.143.184
	res.arm5.elf	Get hash	malicious	Unknown	Browse	57.143.244.91
	res.m68k.elf	Get hash	malicious	Unknown	Browse	56.118.114.183
	res.mips.elf	Get hash	malicious	Unknown	Browse	48.140.203.158
	res.sh4.elf	Get hash	malicious	Unknown	Browse	51.201.195.253
AKAMAI-ASN1EU	http://multitran.com/m.exe	Get hash	malicious	Unknown	Browse	95.101.149.233
	https://sxdcfvg.blob.core.windows.net/swfgm/slp.html	Get hash	malicious	Phisher	Browse	72.247.154.177
	jli.dll.dll	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21
	EXTERNAL FW Complete Settlement Agreement Approved Monday February 24 2025.msg	Get hash	malicious	Gabagool, HTMLPhisher	Browse	2.22.242.145
	4338471.pdf	Get hash	malicious	Unknown	Browse	104.124.11.40
	https://www.mediafire.com/file_premium/gvsjycs9mnhqpli/Tristan_Cardinal_Proposal.pdf/file	Get hash	malicious	HTMLPhisher	Browse	95.101.79.80
	https://t.salesmatemail.net/email/v1/track?key=4788dfbd-ffb2-4c0e-b7b1-b1e698ca06aa	Get hash	malicious	Unknown	Browse	88.221.110.56
	Microsoft subscription purchase confirmation.eml	Get hash	malicious	HTMLPhisher	Browse	95.101.182.112
	Microsoft subscription purchase confirmation.eml	Get hash	malicious	Unknown	Browse	2.22.242.139
	http://37.221.67.207/bins/Hilix.mpsl	Get hash	malicious	Unknown	Browse	23.55.161.185
ATGS-MMD-ASUS	http://multitran.com/m.exe	Get hash	malicious	Unknown	Browse	34.1.1.166
	https://easyupload.io/l5wpfb	Get hash	malicious	Unknown	Browse	34.1.1.166
	https://www.ausschreibungen-strabag.com	Get hash	malicious	Unknown	Browse	34.149.206.255
	http://pearltimes.co.ug/wp-content/reports/qnts/au/auth/auhs1	Get hash	malicious	Unknown	Browse	34.8.123.242
	res.x86.elf	Get hash	malicious	Unknown	Browse	56.64.166.47
	res.mpsl.elf	Get hash	malicious	Unknown	Browse	56.77.143.184
	res.arm5.elf	Get hash	malicious	Unknown	Browse	57.143.244.91
	res.m68k.elf	Get hash	malicious	Unknown	Browse	56.118.114.183
	res.mips.elf	Get hash	malicious	Unknown	Browse	48.140.203.158
	res.sh4.elf	Get hash	malicious	Unknown	Browse	51.201.195.253

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fb0aa01abe9d8e4037eb3473ca6e2dca	random.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	https://drive.google.com/file/d/1FVDnmU54G6_GaADSmojqRgpCVK0Y1U9s/view?usp=sharing	Get hash	malicious	Remcos	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	px4Y74kUj2.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	4114122C0DCA23F637D83EED33F9ABCDC92709E2AC6F63FFD55F5AAE519B58AB.zip	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	https://drive.google.com/file/d/1FVDnmU54G6_GaADSmojqRgpCVK0Y1U9s/view?usp=sharing	Get hash	malicious	Remcos	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	px4Y74kUj2.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	4114122C0DCA23F637D83EED33F9ABCDC92709E2AC6F63FFD55F5AAE519B58AB.zip	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_8b049b38-8205-479a-893f-35896fdca8f2.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7957
Entropy (8bit):	5.175172626757411
Encrypted:	false
SSDEEP:	192:wMvMXpFetbhbVbTbfbRbObtbyEl7nUrhJA6unSrDtTkd/S96:wFatNhnzFSJ0rc1nSrDhkd/c6
MD5:	058BF15C329BA57416443626DAC8E852
SHA1:	047EFC07DFD6B0498685A4447AF87AD871D08585
SHA-256:	64E225965B27CB95B2F8E5E933AA371747BB606A808377DF26DB6CFA73ED1CFF
SHA-512:	5438770FD564647FCCE0AEADCAA5BEE504F1B8D7261860771407220CFAEAC48040E7FF83615E79205AAC458DE5910D2AF27EE6CF80648B60115653285B902ECB
Malicious:	false
Preview:	{"type":"uninstall","id":"8b049b38-8205-479a-893f-35896fdca8f2","creationDate":"2025-02-24T19:25:56.726Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"a12d1cd1-4ce7-42ab-ae29-5c019c43f6ba","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_8b049b38-8205-479a-893f-35896fdca8f2.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7957
Entropy (8bit):	5.175172626757411
Encrypted:	false
SSDEEP:	192:wMvMXpFetbhbVbTbfbRbObtbyEl7nUrhJA6unSrDtTkd/S96:wFatNhnzFSJ0rc1nSrDhkd/c6
MD5:	058BF15C329BA57416443626DAC8E852
SHA1:	047EFC07DFD6B0498685A4447AF87AD871D08585
SHA-256:	64E225965B27CB95B2F8E5E933AA371747BB606A808377DF26DB6CFA73ED1CFF
SHA-512:	5438770FD564647FCCE0AEADCAA5BEE504F1B8D7261860771407220CFAEAC48040E7FF83615E79205AAC458DE5910D2AF27EE6CF80648B60115653285B902ECB
Malicious:	false
Preview:	{"type":"uninstall","id":"8b049b38-8205-479a-893f-35896fdca8f2","creationDate":"2025-02-24T19:25:56.726Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"a12d1cd1-4ce7-42ab-ae29-5c019c43f6ba","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\tmpaddon

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	453023
Entropy (8bit):	7.997718157581587
Encrypted:	true
SSDEEP:	12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5:	85430BAED3398695717B0263807CF97C
SHA1:	FFFBEE923CEA216F50FCE5D54219A188A5100F41
SHA-256:	A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
SHA-512:	06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
Malicious:	false
Preview:	PK.........bN...R..........gmpopenh264.dll..\|.E.0.=..I.....1....4f1q.`.........q.....'+....hm{.z..o_.{w........$..($A!...\|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....\|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`............ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\...........-i.K.I..4.a..6.....Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N..}..).3.N%.!..q........^I.m..~...6.#.~+.....A...I]r...x...<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..\|c.1.cUkM.&.Qn]..a]t.h...!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:\|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\ExperimentStoreData.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4514
Entropy (8bit):	4.943014627282761
Encrypted:	false
SSDEEP:	96:8S+OcaPUFqOdwNIOdvtkeQjvYZUBLJL8P:8S+Oc+UAOdwiOdKeQjDLJL8P
MD5:	5E60BA3F2881CA36C7A3BB57D03173CF
SHA1:	ECAA790A55ABFEEB003CB2811FC6ACA3E35754F0
SHA-256:	19660368BBC136CB72BDD8D84CDA88153BF75A7AE28F3B0C65F6C4933302AA13
SHA-512:	A8EA05A066E04E0AF9BA20913DEC1319E07249E4D67B8B354351CC4B3FBBADAE7BEAB02872E1D9763A4E3354A35025CF84E28B12BAE431C0B69BEDE85DC5C104
Malicious:	false
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"d14ccc2f-033b-49c7-a2e0-d7a247e302f1","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-05T07:41:33.819Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"mixed-content-level-2-roll-out-release-113":{"slug":"mixed-content-level-2-roll-out-release-113","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\ExperimentStoreData.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4514
Entropy (8bit):	4.943014627282761
Encrypted:	false
SSDEEP:	96:8S+OcaPUFqOdwNIOdvtkeQjvYZUBLJL8P:8S+Oc+UAOdwiOdKeQjDLJL8P
MD5:	5E60BA3F2881CA36C7A3BB57D03173CF
SHA1:	ECAA790A55ABFEEB003CB2811FC6ACA3E35754F0
SHA-256:	19660368BBC136CB72BDD8D84CDA88153BF75A7AE28F3B0C65F6C4933302AA13
SHA-512:	A8EA05A066E04E0AF9BA20913DEC1319E07249E4D67B8B354351CC4B3FBBADAE7BEAB02872E1D9763A4E3354A35025CF84E28B12BAE431C0B69BEDE85DC5C104
Malicious:	false
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"d14ccc2f-033b-49c7-a2e0-d7a247e302f1","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-05T07:41:33.819Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"mixed-content-level-2-roll-out-release-113":{"slug":"mixed-content-level-2-roll-out-release-113","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addonStartup.json.lz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 23432 bytes
Category:	dropped
Size (bytes):	5318
Entropy (8bit):	6.62067557672702
Encrypted:	false
SSDEEP:	96:V2YbKsKNU2xWrp327tGmD4wBON6h6cHaJVJuZMd0JGkkrwLUe:VTx2x2t0FDJ4NpwZMd0EJwLv
MD5:	A0DD0256A122A64D1C1A98C36F89F368
SHA1:	B82AF63B4A4261477DA4CD2AC34B4DD7BB5EBEA0
SHA-256:	EE9278644D02739D27E4FD9D8006AD49D9A0D80AD251BA2C3F144A408F65A9F3
SHA-512:	ED3AE377C1AD9E6694307CC60554665058541DD2BB80FEB1832616ACE39623E842DB3CD9153771ABD1874703DCBF4B81CABE050E2F2553D723A96A163AA41911
Malicious:	false
Preview:	mozLz40..[....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addonStartup.json.lz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 23432 bytes
Category:	dropped
Size (bytes):	5318
Entropy (8bit):	6.62067557672702
Encrypted:	false
SSDEEP:	96:V2YbKsKNU2xWrp327tGmD4wBON6h6cHaJVJuZMd0JGkkrwLUe:VTx2x2t0FDJ4NpwZMd0EJwLv
MD5:	A0DD0256A122A64D1C1A98C36F89F368
SHA1:	B82AF63B4A4261477DA4CD2AC34B4DD7BB5EBEA0
SHA-256:	EE9278644D02739D27E4FD9D8006AD49D9A0D80AD251BA2C3F144A408F65A9F3
SHA-512:	ED3AE377C1AD9E6694307CC60554665058541DD2BB80FEB1832616ACE39623E842DB3CD9153771ABD1874703DCBF4B81CABE050E2F2553D723A96A163AA41911
Malicious:	false
Preview:	mozLz40..[....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addons.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addons.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\content-prefs.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.04905141882491872
Encrypted:	false
SSDEEP:	24:DLSvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DKwae+QtMImelekKDa5
MD5:	8736A542C5564A922C47B19D9CC5E0F2
SHA1:	CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A
SHA-256:	97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
SHA-512:	99777325893DC7A95FD49B2DA18D32D65F97CC7A8E482D78EDC32F63245457FA5A52750800C074D552D20B6A215604161FDC88763D93C76A8703470C3064196B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\store.json.mozlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\store.json.mozlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\extensions.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.186376962556299
Encrypted:	false
SSDEEP:	768:NI40vfXXQ4z6X4n44a4T4h4b4rhEhvj4Lw4m4x44g:NJhWvx
MD5:	C2A8F76D683C9F86054CA7775732A180
SHA1:	FB1F8B84825D53E58290E53D65F8A73C5794E281
SHA-256:	4744AACB03666A594CF1BB6E6491105F0AB600259D8E0BA483164F2AE9C90221
SHA-512:	F804B8CF7277D2F6E8AA8BDFFF099ECCEC00CE59FEB3F3EB47D5E4B36FBB2C23466233C966F53483F0DF365E13AB9BB9256B685645FC366A5A24C72907E54025
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{9f54712e-79e2-445b-974a-266a0185f206}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\extensions.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.186376962556299
Encrypted:	false
SSDEEP:	768:NI40vfXXQ4z6X4n44a4T4h4b4rhEhvj4Lw4m4x44g:NJhWvx
MD5:	C2A8F76D683C9F86054CA7775732A180
SHA1:	FB1F8B84825D53E58290E53D65F8A73C5794E281
SHA-256:	4744AACB03666A594CF1BB6E6491105F0AB600259D8E0BA483164F2AE9C90221
SHA-512:	F804B8CF7277D2F6E8AA8BDFFF099ECCEC00CE59FEB3F3EB47D5E4B36FBB2C23466233C966F53483F0DF365E13AB9BB9256B685645FC366A5A24C72907E54025
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{9f54712e-79e2-445b-974a-266a0185f206}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: px4Y74kUj2.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: 4114122C0DCA23F637D83EED33F9ABCDC92709E2AC6F63FFD55F5AAE519B58AB.zip, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: px4Y74kUj2.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: 4114122C0DCA23F637D83EED33F9ABCDC92709E2AC6F63FFD55F5AAE519B58AB.zip, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\permissions.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.0733216450505384
Encrypted:	false
SSDEEP:	12:DBl/A0OWla0mwPxRymgObsCVR45wcYR4fmnsCVR4zki35:DLhesh7Owd4+jip
MD5:	6F8949B5AB887683A550A156E7FFE42D
SHA1:	93F46CB7B9D0935A25956DA9704E4A870EE84D24
SHA-256:	CB02EAA63A9B157E7D41CBC714D07BDE73180F453327927361512E5D4F048CCA
SHA-512:	8AA9C373D40564991610F34842597F0117718AC07F2EC4296F6A77D91304AF88F6E43E359EA644ECE321264DADC5EA4311DF91C7DD6411E5CB36ADB261FD29FE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......~s..F~s........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.034673536944145426
Encrypted:	false
SSDEEP:	3:GtlstFZLHm8ealI/3lstFZLHm8ea/lx89//alEl:GtWtW8JSPWtW8J789XuM
MD5:	C284739D317DE7C2A96CD0BBF7941A3A
SHA1:	0DBECD16E62CE7CF27F1FE8379FA9FE1F6FFA7A9
SHA-256:	13961045C23B522B7D0E99BD00093FBD279FCD555129DF2D5EC22E8290504CA7
SHA-512:	25F0C81E11A4C6322CB145FBF677C11B0BC653679AB519C89D3168B05BBB11B2E5CB4A13F35FCE7EC04A33FD4652B97E5ED6C45411FFBD7C15E694B68D6E0FA8
Malicious:	false
Preview:	..-.........................!V....3.@.4..E{c..8..-.........................!V....3.@.4..E{c..8........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	32824
Entropy (8bit):	0.03987425719201705
Encrypted:	false
SSDEEP:	3:Ol1+jefvtI8RGzhwl8rEXsxdwhml8XW3R2:Kkefv/l8dMhm93w
MD5:	28859EB688884ED4C55E19D7C178C56E
SHA1:	3D7009D553719D01ADB87852A20EFD94F6D34276
SHA-256:	F05F09EAA09C6710FA86DEA5E7F59CB79168B54E3645477A3DEFCA14ED9D3DB9
SHA-512:	7867CC2DF804EA5933CEF310FAFA6C8CB6EA012EC4D67045DBE3CFE02FF9159257A0106F1925C499EC9648663CB4A61431EE3D34098F11DE7AA40602E4A5AE2A
Malicious:	false
Preview:	7....-............3.@.4.i...3...........3.@.4.......V!................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	modified
Size (bytes):	13214
Entropy (8bit):	5.476344065836101
Encrypted:	false
SSDEEP:	192:lTnSRkyYbBp64qUCaX36VJINJ25RHNBw8sMnSl:oeHqUyrIYPwE0
MD5:	9B539DBBBAF7FF3D8388F4AE08C171A1
SHA1:	CBF8E475F61F112E4DF89A4AA3D646CE0157ED90
SHA-256:	5B8A88F4A1D8A5F49BC9FA88F7A4CA84B824C96C52DAD252F655E8DC9AE6452F
SHA-512:	3098B66990D76036B2A16B4347E8C62E82486D0AEE9EB581502854BF501CAC8E6D1C96D342A91233345C329794A52387D25CB5C222FB0996017F7066AC6C27B0
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1740425126);..user_pref("app.update.lastUpdateTime.background-update-timer", 1740425126);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1740425126);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 174042

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	13214
Entropy (8bit):	5.476344065836101
Encrypted:	false
SSDEEP:	192:lTnSRkyYbBp64qUCaX36VJINJ25RHNBw8sMnSl:oeHqUyrIYPwE0
MD5:	9B539DBBBAF7FF3D8388F4AE08C171A1
SHA1:	CBF8E475F61F112E4DF89A4AA3D646CE0157ED90
SHA-256:	5B8A88F4A1D8A5F49BC9FA88F7A4CA84B824C96C52DAD252F655E8DC9AE6452F
SHA-512:	3098B66990D76036B2A16B4347E8C62E82486D0AEE9EB581502854BF501CAC8E6D1C96D342A91233345C329794A52387D25CB5C222FB0996017F7066AC6C27B0
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1740425126);..user_pref("app.update.lastUpdateTime.background-update-timer", 1740425126);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1740425126);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 174042

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\protections.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.04062825861060003
Encrypted:	false
SSDEEP:	3:lSGBl/l/zl9l/AltllPltlnKollzvulJOlzALRWemFxu7TuRjBFbrl58lcV+wgn8:ltBl/lqN1K4BEJYqWvLue3FMOrMZ0l
MD5:	60C09456D6362C6FBED48C69AA342C3C
SHA1:	58B6E22DAA48C75958B429F662DEC1C011AE74D3
SHA-256:	FE1A432A2CD096B7EEA870D46D07F5197E34B4D10666E6E1C357FAA3F2FE2389
SHA-512:	936DBC887276EF07732783B50EAFE450A8598B0492B8F6C838B337EF3E8A6EA595E7C7A2FA4B3E881887FAAE2D207B953A4C65ED8C964D93118E00D3E03882BD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\recovery.baklz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1565
Entropy (8bit):	6.335692965885583
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSnlxLXnIgz/pnxQwRlszT5sKhi0B3eHVVPNZTlamhuj3rOOcUb2miX:GUpOxkflnR6j3etZTl4bed7d
MD5:	42C0A3393D7100007D1B8CBE0E2C2C16
SHA1:	5B35FC682C26FFC390D78F6FB426970D8A08ED67
SHA-256:	8F43D17F1A0FAF472D1114ADC1CF3CAF2EA87A38591916BDB4B1C7D45E688F7B
SHA-512:	F775C059847F26B59F1E1FF341B986AEE6E4B3B0E969FDE45821EEC6A719EC4207175AC18A3E7E8B6D66995CA23DCC551C87DE87231A013566C6890837342480
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{96e27a26-2748-4633-90ce-5d1174b1dd15}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1740425135002,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...4b3ac14b-43e5-4896-86e8-9e7d502ce1b5","zD..1...Wm..l........j..:....1":{..jUpdate...3,"startTim..`096272...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...Abbc25ad08ccc1b2d785bc1812d8faa4d50f401055c8d3ce6d11bb3b0958223be","path":"/","na..a"taarI\|.Recure...,`.Donly..fexpiry...06995,"originA..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1565
Entropy (8bit):	6.335692965885583
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSnlxLXnIgz/pnxQwRlszT5sKhi0B3eHVVPNZTlamhuj3rOOcUb2miX:GUpOxkflnR6j3etZTl4bed7d
MD5:	42C0A3393D7100007D1B8CBE0E2C2C16
SHA1:	5B35FC682C26FFC390D78F6FB426970D8A08ED67
SHA-256:	8F43D17F1A0FAF472D1114ADC1CF3CAF2EA87A38591916BDB4B1C7D45E688F7B
SHA-512:	F775C059847F26B59F1E1FF341B986AEE6E4B3B0E969FDE45821EEC6A719EC4207175AC18A3E7E8B6D66995CA23DCC551C87DE87231A013566C6890837342480
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{96e27a26-2748-4633-90ce-5d1174b1dd15}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1740425135002,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...4b3ac14b-43e5-4896-86e8-9e7d502ce1b5","zD..1...Wm..l........j..:....1":{..jUpdate...3,"startTim..`096272...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...Abbc25ad08ccc1b2d785bc1812d8faa4d50f401055c8d3ce6d11bb3b0958223be","path":"/","na..a"taarI\|.Recure...,`.Donly..fexpiry...06995,"originA..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1565
Entropy (8bit):	6.335692965885583
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSnlxLXnIgz/pnxQwRlszT5sKhi0B3eHVVPNZTlamhuj3rOOcUb2miX:GUpOxkflnR6j3etZTl4bed7d
MD5:	42C0A3393D7100007D1B8CBE0E2C2C16
SHA1:	5B35FC682C26FFC390D78F6FB426970D8A08ED67
SHA-256:	8F43D17F1A0FAF472D1114ADC1CF3CAF2EA87A38591916BDB4B1C7D45E688F7B
SHA-512:	F775C059847F26B59F1E1FF341B986AEE6E4B3B0E969FDE45821EEC6A719EC4207175AC18A3E7E8B6D66995CA23DCC551C87DE87231A013566C6890837342480
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{96e27a26-2748-4633-90ce-5d1174b1dd15}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1740425135002,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...4b3ac14b-43e5-4896-86e8-9e7d502ce1b5","zD..1...Wm..l........j..:....1":{..jUpdate...3,"startTim..`096272...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...Abbc25ad08ccc1b2d785bc1812d8faa4d50f401055c8d3ce6d11bb3b0958223be","path":"/","na..a"taarI\|.Recure...,`.Donly..fexpiry...06995,"originA..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.0836444556178684
Encrypted:	false
SSDEEP:	24:JBwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jnEUo9LXtR+JdkOnohYsl
MD5:	8B40B1534FF0F4B533AF767EB5639A05
SHA1:	63EDB539EA39AD09D701A36B535C4C087AE08CC9
SHA-256:	AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B
SHA-512:	54AF707698CED33C206B1B193DA414D630901762E88E37E99885A50D4D5F8DDC28367C9B401DFE251CF0552B4FA446EE28F78A97C9096AFB0F2898BFBB673B53
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\targeting.snapshot.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	5.036638536542713
Encrypted:	false
SSDEEP:	48:YrSAY8eUQZpExB1+anO8e6WCVhhOjVkWAYzzc8rYMsku7f86SLAVL7J5FtsfAcb5:yc8+TEr5ZwoIhzzcHvbw6Kkdrc2Rn27
MD5:	E692BF716869347B2B35A0CF702CF492
SHA1:	F1174C1742960BFEED06FDFD98FD656D9BABBD62
SHA-256:	8A4CC6E265585CFAF8A3CBEAF2E97BD18387F327F26565A6F04687089255DAC3
SHA-512:	6451C4CC78401A0F23D1D760F097E22055BB8D5ABBC6134E907317282F71A1BE036403D6749AF1AC3F1474F8996C0A8C7D532ACB2F20DD97EF306F921BE83601
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2025-02-24T19:25:16.077Z","profileAgeCreated":1696491685971,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\targeting.snapshot.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	5.036638536542713
Encrypted:	false
SSDEEP:	48:YrSAY8eUQZpExB1+anO8e6WCVhhOjVkWAYzzc8rYMsku7f86SLAVL7J5FtsfAcb5:yc8+TEr5ZwoIhzzcHvbw6Kkdrc2Rn27
MD5:	E692BF716869347B2B35A0CF702CF492
SHA1:	F1174C1742960BFEED06FDFD98FD656D9BABBD62
SHA-256:	8A4CC6E265585CFAF8A3CBEAF2E97BD18387F327F26565A6F04687089255DAC3
SHA-512:	6451C4CC78401A0F23D1D760F097E22055BB8D5ABBC6134E907317282F71A1BE036403D6749AF1AC3F1474F8996C0A8C7D532ACB2F20DD97EF306F921BE83601
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2025-02-24T19:25:16.077Z","profileAgeCreated":1696491685971,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.699532679693213
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	random.exe
File size:	968'704 bytes
MD5:	e9a8537a4efba5386c2a5adf0355eb4b
SHA1:	485d296515a96ef01972021da0571c5c03192b21
SHA256:	e1cf2ba38614911db7f8a5f595b03697f76c79fe0de026f3571090db401b2c25
SHA512:	16aa58d8996ad1e529ebe27ab98c637b1550f686976959bc0e53db183ef33f7345964fa728fc9fcafedc8463954e11cb129c69cf4757d7a1287a9c6f0349b4c9
SSDEEP:	24576:mqDEvCTbMWu7rQYlBQcBiT6rprG8a2CWuR:mTvC/MTQYxsWR7a2v
TLSH:	46259E027391C062FF9B92334F5AF6515BBC69260123E61F13A81DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67BA0BD9 [Sat Feb 22 17:39:37 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F568D041753h
jmp 00007F568D04105Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F568D04123Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F568D04120Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F568D043DFDh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F568D043E48h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F568D043E31h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x15de4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xea000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x15de4	0x15e00	ca73268a3cc07e85379d525def8d1fec	False	0.6988950892857143	data	7.15175121262472	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xea000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd4718	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd4840	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4968	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c50	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d78	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5c20	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd64c8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd6a30	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8fd8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda080	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4e8	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xda538	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xda634	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdabc8	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb254	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb6e4	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbce0	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc33c	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc7a4	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc8fc	0xcf66	data			1.0004896975176103
RT_GROUP_ICON	0xe9864	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xe98dc	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xe98f0	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xe9904	0x14	data	English	Great Britain	1.25
RT_VERSION	0xe9918	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xe99f4	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Version Infos

Description	Data
Translation	0x0809 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 24, 2025 18:44:23.277877092 CET	49734	443	192.168.2.7	142.250.186.110
Feb 24, 2025 18:44:23.277904987 CET	443	49734	142.250.186.110	192.168.2.7
Feb 24, 2025 18:44:23.279061079 CET	49734	443	192.168.2.7	142.250.186.110
Feb 24, 2025 18:44:23.283891916 CET	49734	443	192.168.2.7	142.250.186.110
Feb 24, 2025 18:44:23.283910990 CET	443	49734	142.250.186.110	192.168.2.7
Feb 24, 2025 18:44:23.284238100 CET	49735	443	192.168.2.7	35.190.72.216
Feb 24, 2025 18:44:23.284343958 CET	443	49735	35.190.72.216	192.168.2.7
Feb 24, 2025 18:44:23.288691044 CET	49736	443	192.168.2.7	142.250.186.110
Feb 24, 2025 18:44:23.288724899 CET	443	49736	142.250.186.110	192.168.2.7
Feb 24, 2025 18:44:23.289463043 CET	49735	443	192.168.2.7	35.190.72.216
Feb 24, 2025 18:44:23.291074038 CET	49735	443	192.168.2.7	35.190.72.216
Feb 24, 2025 18:44:23.291091919 CET	443	49735	35.190.72.216	192.168.2.7
Feb 24, 2025 18:44:23.294362068 CET	49736	443	192.168.2.7	142.250.186.110
Feb 24, 2025 18:44:23.297920942 CET	49736	443	192.168.2.7	142.250.186.110
Feb 24, 2025 18:44:23.297931910 CET	443	49736	142.250.186.110	192.168.2.7
Feb 24, 2025 18:44:23.311023951 CET	49737	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:23.316574097 CET	80	49737	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:23.316999912 CET	49737	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:23.317194939 CET	49737	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:23.322715044 CET	80	49737	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:23.765065908 CET	80	49737	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:23.776972055 CET	443	49735	35.190.72.216	192.168.2.7
Feb 24, 2025 18:44:23.777050018 CET	49735	443	192.168.2.7	35.190.72.216
Feb 24, 2025 18:44:23.787712097 CET	49735	443	192.168.2.7	35.190.72.216
Feb 24, 2025 18:44:23.787729025 CET	443	49735	35.190.72.216	192.168.2.7
Feb 24, 2025 18:44:23.787847996 CET	49735	443	192.168.2.7	35.190.72.216
Feb 24, 2025 18:44:23.787992954 CET	443	49735	35.190.72.216	192.168.2.7
Feb 24, 2025 18:44:23.788152933 CET	49735	443	192.168.2.7	35.190.72.216
Feb 24, 2025 18:44:23.875487089 CET	49737	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:23.881692886 CET	49742	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:23.881725073 CET	443	49742	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:23.882045984 CET	49742	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:23.883443117 CET	49742	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:23.883455992 CET	443	49742	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:23.934745073 CET	49743	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:23.934834003 CET	443	49743	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:23.935024023 CET	49743	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:23.936427116 CET	49743	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:23.936465025 CET	443	49743	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:23.941739082 CET	443	49736	142.250.186.110	192.168.2.7
Feb 24, 2025 18:44:23.941766024 CET	443	49734	142.250.186.110	192.168.2.7
Feb 24, 2025 18:44:23.942461967 CET	443	49736	142.250.186.110	192.168.2.7
Feb 24, 2025 18:44:23.944472075 CET	443	49734	142.250.186.110	192.168.2.7
Feb 24, 2025 18:44:23.944561958 CET	49734	443	192.168.2.7	142.250.186.110
Feb 24, 2025 18:44:23.944561958 CET	49736	443	192.168.2.7	142.250.186.110
Feb 24, 2025 18:44:23.944577932 CET	443	49734	142.250.186.110	192.168.2.7
Feb 24, 2025 18:44:23.944581985 CET	443	49736	142.250.186.110	192.168.2.7
Feb 24, 2025 18:44:23.945947886 CET	49734	443	192.168.2.7	142.250.186.110
Feb 24, 2025 18:44:23.951756001 CET	49734	443	192.168.2.7	142.250.186.110
Feb 24, 2025 18:44:23.951761961 CET	443	49734	142.250.186.110	192.168.2.7
Feb 24, 2025 18:44:23.951848984 CET	49734	443	192.168.2.7	142.250.186.110
Feb 24, 2025 18:44:23.952668905 CET	443	49734	142.250.186.110	192.168.2.7
Feb 24, 2025 18:44:23.953033924 CET	49734	443	192.168.2.7	142.250.186.110
Feb 24, 2025 18:44:23.953814983 CET	49736	443	192.168.2.7	142.250.186.110
Feb 24, 2025 18:44:23.953814983 CET	49736	443	192.168.2.7	142.250.186.110
Feb 24, 2025 18:44:23.953840017 CET	443	49736	142.250.186.110	192.168.2.7
Feb 24, 2025 18:44:23.954005957 CET	443	49736	142.250.186.110	192.168.2.7
Feb 24, 2025 18:44:23.954169989 CET	49744	443	192.168.2.7	142.250.186.110
Feb 24, 2025 18:44:23.954195976 CET	443	49744	142.250.186.110	192.168.2.7
Feb 24, 2025 18:44:23.954229116 CET	49736	443	192.168.2.7	142.250.186.110
Feb 24, 2025 18:44:23.960129976 CET	49744	443	192.168.2.7	142.250.186.110
Feb 24, 2025 18:44:23.961555004 CET	49744	443	192.168.2.7	142.250.186.110
Feb 24, 2025 18:44:23.961568117 CET	443	49744	142.250.186.110	192.168.2.7
Feb 24, 2025 18:44:24.271960974 CET	49737	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:24.277110100 CET	80	49737	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:24.280097008 CET	49737	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:24.280725002 CET	49750	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:24.285805941 CET	80	49750	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:24.287048101 CET	49750	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:24.287175894 CET	49750	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:24.292151928 CET	80	49750	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:24.310059071 CET	49751	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:24.315903902 CET	80	49751	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:24.316009998 CET	49751	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:24.325877905 CET	49751	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:24.326442957 CET	49752	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:24.326483965 CET	443	49752	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:24.327327967 CET	49752	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:24.327538013 CET	49752	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:24.327548981 CET	443	49752	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:24.331224918 CET	80	49751	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:24.387536049 CET	443	49742	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:24.387604952 CET	49742	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.392806053 CET	49742	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.392812967 CET	443	49742	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:24.392832994 CET	49742	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.393032074 CET	443	49742	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:24.393238068 CET	49753	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.393248081 CET	443	49753	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:24.393311024 CET	49742	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.393349886 CET	49753	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.394728899 CET	49753	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.394742012 CET	443	49753	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:24.401599884 CET	443	49743	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:24.401698112 CET	49743	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.406372070 CET	49743	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.406378984 CET	443	49743	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:24.406506062 CET	49743	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.406517982 CET	443	49743	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:24.406713009 CET	49743	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.406879902 CET	49754	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.406910896 CET	443	49754	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:24.407084942 CET	49754	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.408550978 CET	49754	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.408566952 CET	443	49754	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:24.485122919 CET	49755	443	192.168.2.7	34.160.144.191
Feb 24, 2025 18:44:24.485137939 CET	443	49755	34.160.144.191	192.168.2.7
Feb 24, 2025 18:44:24.485492945 CET	49755	443	192.168.2.7	34.160.144.191
Feb 24, 2025 18:44:24.485703945 CET	49755	443	192.168.2.7	34.160.144.191
Feb 24, 2025 18:44:24.485717058 CET	443	49755	34.160.144.191	192.168.2.7
Feb 24, 2025 18:44:24.604481936 CET	443	49744	142.250.186.110	192.168.2.7
Feb 24, 2025 18:44:24.605186939 CET	443	49744	142.250.186.110	192.168.2.7
Feb 24, 2025 18:44:24.606137037 CET	49744	443	192.168.2.7	142.250.186.110
Feb 24, 2025 18:44:24.606146097 CET	443	49744	142.250.186.110	192.168.2.7
Feb 24, 2025 18:44:24.611620903 CET	49744	443	192.168.2.7	142.250.186.110
Feb 24, 2025 18:44:24.611635923 CET	443	49744	142.250.186.110	192.168.2.7
Feb 24, 2025 18:44:24.611722946 CET	49744	443	192.168.2.7	142.250.186.110
Feb 24, 2025 18:44:24.611805916 CET	443	49744	142.250.186.110	192.168.2.7
Feb 24, 2025 18:44:24.615581989 CET	49744	443	192.168.2.7	142.250.186.110
Feb 24, 2025 18:44:24.750807047 CET	80	49750	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:24.782305002 CET	80	49751	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:24.787866116 CET	443	49752	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:24.788194895 CET	49752	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:24.790925980 CET	49752	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:24.790932894 CET	443	49752	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:24.791239977 CET	443	49752	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:24.793261051 CET	49752	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:24.793339014 CET	49752	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:24.793468952 CET	443	49752	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:24.794497967 CET	49752	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:24.801954031 CET	49750	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:24.842372894 CET	49751	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:24.857109070 CET	443	49753	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:24.863020897 CET	49753	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.869028091 CET	49753	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.869038105 CET	443	49753	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:24.869106054 CET	49753	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.869174004 CET	443	49753	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:24.897133112 CET	443	49754	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:24.903259993 CET	49753	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.903337002 CET	443	49754	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:24.903377056 CET	49754	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.923851967 CET	49754	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.928162098 CET	49754	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.928181887 CET	443	49754	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:24.928250074 CET	49754	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.928785086 CET	443	49754	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:24.944617987 CET	49754	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:24.956495047 CET	443	49755	34.160.144.191	192.168.2.7
Feb 24, 2025 18:44:24.959068060 CET	49755	443	192.168.2.7	34.160.144.191
Feb 24, 2025 18:44:24.962295055 CET	49755	443	192.168.2.7	34.160.144.191
Feb 24, 2025 18:44:24.962306023 CET	443	49755	34.160.144.191	192.168.2.7
Feb 24, 2025 18:44:24.962605000 CET	443	49755	34.160.144.191	192.168.2.7
Feb 24, 2025 18:44:24.965466022 CET	49755	443	192.168.2.7	34.160.144.191
Feb 24, 2025 18:44:24.965583086 CET	49755	443	192.168.2.7	34.160.144.191
Feb 24, 2025 18:44:24.965621948 CET	443	49755	34.160.144.191	192.168.2.7
Feb 24, 2025 18:44:24.965979099 CET	49758	443	192.168.2.7	34.160.144.191
Feb 24, 2025 18:44:24.966015100 CET	443	49758	34.160.144.191	192.168.2.7
Feb 24, 2025 18:44:24.966067076 CET	49755	443	192.168.2.7	34.160.144.191
Feb 24, 2025 18:44:24.966144085 CET	49758	443	192.168.2.7	34.160.144.191
Feb 24, 2025 18:44:24.966267109 CET	49758	443	192.168.2.7	34.160.144.191
Feb 24, 2025 18:44:24.966275930 CET	443	49758	34.160.144.191	192.168.2.7
Feb 24, 2025 18:44:25.296689034 CET	49763	443	192.168.2.7	52.26.30.181
Feb 24, 2025 18:44:25.296719074 CET	443	49763	52.26.30.181	192.168.2.7
Feb 24, 2025 18:44:25.296993971 CET	49763	443	192.168.2.7	52.26.30.181
Feb 24, 2025 18:44:25.298337936 CET	49763	443	192.168.2.7	52.26.30.181
Feb 24, 2025 18:44:25.298351049 CET	443	49763	52.26.30.181	192.168.2.7
Feb 24, 2025 18:44:25.375766039 CET	49750	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:25.375812054 CET	49751	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:25.380964994 CET	80	49750	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:25.381211996 CET	80	49751	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:25.381503105 CET	49750	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:25.381589890 CET	49751	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:25.453635931 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:25.453845024 CET	49765	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:25.453877926 CET	443	49765	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:25.457894087 CET	49765	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:25.458705902 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:25.459343910 CET	49765	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:25.459355116 CET	443	49765	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:25.459455967 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:25.459603071 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:25.464584112 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:25.487180948 CET	443	49758	34.160.144.191	192.168.2.7
Feb 24, 2025 18:44:25.487297058 CET	49758	443	192.168.2.7	34.160.144.191
Feb 24, 2025 18:44:25.490844011 CET	49758	443	192.168.2.7	34.160.144.191
Feb 24, 2025 18:44:25.490858078 CET	443	49758	34.160.144.191	192.168.2.7
Feb 24, 2025 18:44:25.491127014 CET	443	49758	34.160.144.191	192.168.2.7
Feb 24, 2025 18:44:25.493309975 CET	49758	443	192.168.2.7	34.160.144.191
Feb 24, 2025 18:44:25.493381023 CET	49758	443	192.168.2.7	34.160.144.191
Feb 24, 2025 18:44:25.493482113 CET	443	49758	34.160.144.191	192.168.2.7
Feb 24, 2025 18:44:25.493530989 CET	49758	443	192.168.2.7	34.160.144.191
Feb 24, 2025 18:44:25.677016020 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:25.682060003 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:25.682255030 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:25.682554007 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:25.687618017 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:25.935364008 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:25.940282106 CET	443	49765	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:25.940355062 CET	49765	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:25.945745945 CET	49765	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:25.945755005 CET	443	49765	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:25.945871115 CET	49765	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:25.945919991 CET	443	49765	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:25.946269035 CET	49769	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:25.946296930 CET	443	49769	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:25.946320057 CET	49765	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:25.946393967 CET	49769	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:25.947794914 CET	49769	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:25.947807074 CET	443	49769	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:25.983196974 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:26.078990936 CET	443	49763	52.26.30.181	192.168.2.7
Feb 24, 2025 18:44:26.079242945 CET	49763	443	192.168.2.7	52.26.30.181
Feb 24, 2025 18:44:26.083795071 CET	49763	443	192.168.2.7	52.26.30.181
Feb 24, 2025 18:44:26.083800077 CET	443	49763	52.26.30.181	192.168.2.7
Feb 24, 2025 18:44:26.083890915 CET	49763	443	192.168.2.7	52.26.30.181
Feb 24, 2025 18:44:26.084006071 CET	443	49763	52.26.30.181	192.168.2.7
Feb 24, 2025 18:44:26.084095001 CET	49763	443	192.168.2.7	52.26.30.181
Feb 24, 2025 18:44:26.155710936 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:26.205895901 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:26.432580948 CET	443	49769	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:26.432662010 CET	49769	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:26.436487913 CET	49769	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:26.436495066 CET	443	49769	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:26.436582088 CET	49769	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:26.436700106 CET	443	49769	34.117.188.166	192.168.2.7
Feb 24, 2025 18:44:26.436772108 CET	49769	443	192.168.2.7	34.117.188.166
Feb 24, 2025 18:44:29.591097116 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:29.591701984 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:29.597381115 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:29.597944975 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:29.689068079 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:29.695410967 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:29.734807968 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:29.750551939 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:30.423531055 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:30.428589106 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:30.520021915 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:30.570343971 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:35.216373920 CET	49833	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:44:35.216417074 CET	443	49833	34.107.243.93	192.168.2.7
Feb 24, 2025 18:44:35.217154980 CET	49833	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:44:35.218398094 CET	49833	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:44:35.218426943 CET	443	49833	34.107.243.93	192.168.2.7
Feb 24, 2025 18:44:35.570954084 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:35.577699900 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:35.671255112 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:35.716842890 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:35.779341936 CET	443	49833	34.107.243.93	192.168.2.7
Feb 24, 2025 18:44:35.779427052 CET	49833	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:44:35.784996033 CET	49833	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:44:35.784996033 CET	49833	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:44:35.785005093 CET	443	49833	34.107.243.93	192.168.2.7
Feb 24, 2025 18:44:35.785182953 CET	443	49833	34.107.243.93	192.168.2.7
Feb 24, 2025 18:44:35.785283089 CET	49833	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:44:36.068547964 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:36.069761038 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:36.073600054 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:36.074764967 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:36.099473953 CET	49839	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:36.099504948 CET	443	49839	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:36.100935936 CET	49839	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:36.102948904 CET	49839	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:36.102961063 CET	443	49839	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:36.158637047 CET	49841	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:36.158674955 CET	443	49841	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:36.158732891 CET	49841	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:36.158817053 CET	49841	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:36.158823967 CET	443	49841	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:36.165281057 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:36.171350002 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:36.218307972 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:36.218343973 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:36.440725088 CET	49842	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:36.440745115 CET	443	49842	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:36.440964937 CET	49842	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:36.442825079 CET	49842	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:36.442835093 CET	443	49842	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:36.585844040 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:36.587244987 CET	443	49839	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:36.590848923 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:36.591944933 CET	49839	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:36.595760107 CET	49839	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:36.595778942 CET	443	49839	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:36.595832109 CET	49839	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:36.595927954 CET	443	49839	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:36.598357916 CET	49839	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:36.616364956 CET	443	49841	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:36.616444111 CET	49841	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:36.619354010 CET	49841	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:36.619359970 CET	443	49841	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:36.619621038 CET	443	49841	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:36.622416973 CET	49841	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:36.622488022 CET	49841	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:36.622634888 CET	443	49841	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:36.622685909 CET	49841	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:36.684640884 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:36.741900921 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:36.749105930 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:36.754209995 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:36.758785963 CET	49846	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:36.758800983 CET	443	49846	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:36.759691954 CET	49846	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:36.761039019 CET	49846	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:36.761050940 CET	443	49846	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:36.849734068 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:36.854108095 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:36.859152079 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:36.889045954 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:36.912127018 CET	443	49842	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:36.912203074 CET	49842	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:36.956609011 CET	49842	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:36.956634045 CET	443	49842	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:36.956703901 CET	49842	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:36.956932068 CET	443	49842	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:36.957000971 CET	49842	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:36.957040071 CET	49849	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:36.957067966 CET	443	49849	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:36.957134008 CET	49849	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:36.958580017 CET	49849	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:36.958595037 CET	443	49849	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:36.959153891 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:37.005029917 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:37.254126072 CET	443	49846	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:37.254208088 CET	49846	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:37.292042971 CET	49846	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:37.292073965 CET	443	49846	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:37.292154074 CET	49846	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:37.294143915 CET	443	49846	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:37.294454098 CET	49846	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:37.301151037 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:37.303687096 CET	49850	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:37.303728104 CET	443	49850	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:37.304138899 CET	49850	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:37.305444002 CET	49850	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:37.305457115 CET	443	49850	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:37.306206942 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:37.401381016 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:37.443892002 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:37.446630001 CET	443	49849	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:37.446700096 CET	49849	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:37.770668030 CET	443	49850	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:37.770760059 CET	49850	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:39.586447001 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:39.587973118 CET	49849	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:39.588001013 CET	443	49849	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:39.588042021 CET	49849	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:39.588294983 CET	443	49849	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:39.589561939 CET	49849	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:39.591674089 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:39.712045908 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:39.766158104 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:40.866981983 CET	49850	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:40.867006063 CET	443	49850	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:40.867052078 CET	49850	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:40.867289066 CET	443	49850	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:40.869406939 CET	49850	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:40.892013073 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:40.897258043 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:41.033049107 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:41.085642099 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:41.707338095 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:41.712692022 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:41.805227041 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:41.856822968 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:43.487525940 CET	49888	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:44:43.487584114 CET	443	49888	34.107.243.93	192.168.2.7
Feb 24, 2025 18:44:43.489217997 CET	49888	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:44:43.490679979 CET	49888	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:44:43.490701914 CET	443	49888	34.107.243.93	192.168.2.7
Feb 24, 2025 18:44:43.493454933 CET	49889	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:43.493484974 CET	443	49889	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:43.494041920 CET	49889	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:43.494170904 CET	49889	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:43.494178057 CET	443	49889	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:43.505568027 CET	49890	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:43.505597115 CET	443	49890	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:43.505824089 CET	49890	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:43.507277966 CET	49890	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:43.507288933 CET	443	49890	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:43.964441061 CET	443	49888	34.107.243.93	192.168.2.7
Feb 24, 2025 18:44:43.964504004 CET	49888	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:44:43.969466925 CET	49888	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:44:43.969472885 CET	443	49888	34.107.243.93	192.168.2.7
Feb 24, 2025 18:44:43.969566107 CET	49888	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:44:43.969657898 CET	443	49888	34.107.243.93	192.168.2.7
Feb 24, 2025 18:44:43.969796896 CET	49888	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:44:43.972464085 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:43.972556114 CET	443	49889	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:43.972754002 CET	49889	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:43.975601912 CET	49889	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:43.975608110 CET	443	49889	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:43.975898981 CET	443	49889	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:43.978462934 CET	49889	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:43.978585958 CET	49889	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:43.979034901 CET	443	49889	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:43.979202032 CET	49894	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:43.979227066 CET	443	49894	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:43.979376078 CET	49889	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:43.979424953 CET	49894	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:43.979515076 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:43.979551077 CET	49894	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:43.979561090 CET	443	49894	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:43.993729115 CET	443	49890	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:43.993890047 CET	49890	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:44.002891064 CET	49890	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:44.002908945 CET	443	49890	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:44.002923965 CET	49890	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:44.003068924 CET	443	49890	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:44.003936052 CET	49890	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:44.076662064 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:44.080014944 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:44.085045099 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:44.125842094 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:44.177166939 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:44.226160049 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:44.489068031 CET	443	49894	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:44.489159107 CET	49894	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:44.492567062 CET	49894	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:44.492588997 CET	443	49894	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:44.492865086 CET	443	49894	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:44.495208025 CET	49894	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:44.495337009 CET	49894	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:44.495424032 CET	443	49894	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:44.495768070 CET	49894	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:44.502288103 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:44.507494926 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:44.524110079 CET	49900	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:44.524163961 CET	443	49900	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:44.524444103 CET	49901	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:44.524535894 CET	443	49901	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:44.524665117 CET	49902	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:44.524679899 CET	443	49902	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:44.524810076 CET	49903	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:44.524832010 CET	443	49903	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:44.524878979 CET	49900	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:44.524902105 CET	49901	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:44.524909973 CET	49902	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:44.525019884 CET	49900	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:44.525032043 CET	443	49900	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:44.525165081 CET	49901	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:44.525216103 CET	443	49901	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:44.525239944 CET	49902	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:44.525250912 CET	443	49902	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:44.525365114 CET	49903	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:44.525434971 CET	49903	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:44.525449038 CET	443	49903	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:44.539561033 CET	49904	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:44.539602041 CET	443	49904	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:44.539861917 CET	49904	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:44.541337013 CET	49904	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:44.541358948 CET	443	49904	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:44.603140116 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:44.609496117 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:44.615509987 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:44.665081024 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:44.707075119 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:44.765388966 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:44.987555027 CET	443	49903	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:44.987879038 CET	49903	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:44.991240978 CET	49903	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:44.991252899 CET	443	49903	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:44.992187023 CET	443	49903	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:44.992259026 CET	443	49902	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:44.993314028 CET	49903	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:44.993415117 CET	49903	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:44.993762970 CET	443	49903	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:44.995807886 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:44.999337912 CET	443	49901	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:45.000385046 CET	49903	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.000385046 CET	49903	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.000407934 CET	49902	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.001034975 CET	49901	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.001274109 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:45.003690958 CET	49902	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.003720045 CET	443	49902	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:45.003984928 CET	443	49902	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:45.005944014 CET	49901	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.005949020 CET	443	49901	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:45.006848097 CET	443	49901	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:45.008362055 CET	49902	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.008438110 CET	49902	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.008605003 CET	443	49902	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:45.008635998 CET	49901	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.008685112 CET	49901	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.009057999 CET	443	49901	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:45.009118080 CET	49902	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.009133101 CET	49901	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.009133101 CET	49901	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.009152889 CET	49902	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.009479046 CET	443	49900	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:45.009906054 CET	49900	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.012321949 CET	49900	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.012345076 CET	443	49900	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:45.012578964 CET	443	49900	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:45.014318943 CET	49900	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.014422894 CET	49900	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.014486074 CET	443	49900	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:45.015139103 CET	49900	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.015158892 CET	49900	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.033768892 CET	443	49904	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:45.033854008 CET	49904	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.037087917 CET	49904	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.037101030 CET	443	49904	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:45.037158012 CET	49904	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.037388086 CET	443	49904	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:45.040241957 CET	49908	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.040270090 CET	443	49908	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:45.041342974 CET	49904	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.041373968 CET	49908	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.042769909 CET	49908	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.042788982 CET	443	49908	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:45.096544981 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:45.106075048 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:45.111174107 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:45.147739887 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:45.203042984 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:45.247998953 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:45.499130964 CET	443	49908	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:45.499234915 CET	49908	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.503422022 CET	49908	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.503453016 CET	443	49908	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:45.503520966 CET	49908	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.503649950 CET	443	49908	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:45.504302979 CET	49908	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.506453991 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:45.508884907 CET	49911	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.508934975 CET	443	49911	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:45.509124994 CET	49911	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.510412931 CET	49911	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:45.510448933 CET	443	49911	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:45.511548042 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:45.608556986 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:45.611172915 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:45.616379976 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:45.649178982 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:45.708264112 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:45.749455929 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:45.994921923 CET	443	49911	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:45.995003939 CET	49911	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:46.003967047 CET	49911	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:46.003995895 CET	443	49911	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:46.004072905 CET	49911	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:46.004205942 CET	443	49911	34.120.208.123	192.168.2.7
Feb 24, 2025 18:44:46.005443096 CET	49911	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:44:46.007075071 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:46.012675047 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:46.107516050 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:46.111735106 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:46.116856098 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:46.150626898 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:46.208534002 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:46.250932932 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:49.905911922 CET	49942	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:49.905972958 CET	443	49942	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:49.908170938 CET	49942	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:49.908452988 CET	49942	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:49.908483982 CET	443	49942	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:49.940860987 CET	49943	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:49.940963984 CET	443	49943	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:49.944451094 CET	49944	443	192.168.2.7	35.190.72.216
Feb 24, 2025 18:44:49.944500923 CET	443	49944	35.190.72.216	192.168.2.7
Feb 24, 2025 18:44:49.959752083 CET	49943	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:49.959882021 CET	49943	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:49.959893942 CET	49944	443	192.168.2.7	35.190.72.216
Feb 24, 2025 18:44:49.959898949 CET	443	49943	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:49.962795973 CET	49944	443	192.168.2.7	35.190.72.216
Feb 24, 2025 18:44:49.962825060 CET	443	49944	35.190.72.216	192.168.2.7
Feb 24, 2025 18:44:49.963274002 CET	49945	443	192.168.2.7	151.101.65.91
Feb 24, 2025 18:44:49.963306904 CET	443	49945	151.101.65.91	192.168.2.7
Feb 24, 2025 18:44:49.977638960 CET	49945	443	192.168.2.7	151.101.65.91
Feb 24, 2025 18:44:49.978174925 CET	49945	443	192.168.2.7	151.101.65.91
Feb 24, 2025 18:44:49.978188038 CET	443	49945	151.101.65.91	192.168.2.7
Feb 24, 2025 18:44:49.994997025 CET	49946	443	192.168.2.7	34.49.51.44
Feb 24, 2025 18:44:49.995059967 CET	443	49946	34.49.51.44	192.168.2.7
Feb 24, 2025 18:44:50.008970022 CET	49946	443	192.168.2.7	34.49.51.44
Feb 24, 2025 18:44:50.013606071 CET	49946	443	192.168.2.7	34.49.51.44
Feb 24, 2025 18:44:50.013652086 CET	443	49946	34.49.51.44	192.168.2.7
Feb 24, 2025 18:44:50.366086960 CET	443	49942	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.366189957 CET	49942	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.370959044 CET	49942	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.370970964 CET	443	49942	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.371212006 CET	443	49942	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.374500990 CET	49942	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.374639988 CET	49942	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.374656916 CET	443	49942	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.374862909 CET	49942	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.380155087 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:50.385302067 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:50.414124012 CET	443	49943	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:50.414139032 CET	443	49943	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:50.414212942 CET	49943	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:50.418370008 CET	49943	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:50.418395042 CET	443	49943	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:50.418668032 CET	443	49943	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:50.421737909 CET	49943	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:50.421849012 CET	49943	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:50.421931982 CET	443	49943	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:50.422205925 CET	49943	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:50.435349941 CET	443	49944	35.190.72.216	192.168.2.7
Feb 24, 2025 18:44:50.435368061 CET	443	49944	35.190.72.216	192.168.2.7
Feb 24, 2025 18:44:50.435435057 CET	49944	443	192.168.2.7	35.190.72.216
Feb 24, 2025 18:44:50.440759897 CET	443	49945	151.101.65.91	192.168.2.7
Feb 24, 2025 18:44:50.440774918 CET	443	49945	151.101.65.91	192.168.2.7
Feb 24, 2025 18:44:50.440851927 CET	49945	443	192.168.2.7	151.101.65.91
Feb 24, 2025 18:44:50.444412947 CET	49945	443	192.168.2.7	151.101.65.91
Feb 24, 2025 18:44:50.444432020 CET	443	49945	151.101.65.91	192.168.2.7
Feb 24, 2025 18:44:50.444655895 CET	443	49945	151.101.65.91	192.168.2.7
Feb 24, 2025 18:44:50.445872068 CET	49944	443	192.168.2.7	35.190.72.216
Feb 24, 2025 18:44:50.445892096 CET	443	49944	35.190.72.216	192.168.2.7
Feb 24, 2025 18:44:50.445980072 CET	49944	443	192.168.2.7	35.190.72.216
Feb 24, 2025 18:44:50.446638107 CET	443	49944	35.190.72.216	192.168.2.7
Feb 24, 2025 18:44:50.447048903 CET	49944	443	192.168.2.7	35.190.72.216
Feb 24, 2025 18:44:50.448834896 CET	49945	443	192.168.2.7	151.101.65.91
Feb 24, 2025 18:44:50.448997974 CET	443	49945	151.101.65.91	192.168.2.7
Feb 24, 2025 18:44:50.449044943 CET	49945	443	192.168.2.7	151.101.65.91
Feb 24, 2025 18:44:50.449057102 CET	443	49945	151.101.65.91	192.168.2.7
Feb 24, 2025 18:44:50.459640980 CET	49950	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.459705114 CET	443	49950	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.459935904 CET	49950	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.460043907 CET	49950	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.460062027 CET	443	49950	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.470609903 CET	49952	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.470652103 CET	443	49952	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.471064091 CET	49953	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.471126080 CET	443	49953	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.471225023 CET	49952	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.471354008 CET	49953	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.471369982 CET	49952	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.471383095 CET	443	49952	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.471515894 CET	49953	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.471549988 CET	443	49953	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.503927946 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:50.508618116 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:50.513727903 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:50.518903017 CET	443	49946	34.49.51.44	192.168.2.7
Feb 24, 2025 18:44:50.518922091 CET	443	49946	34.49.51.44	192.168.2.7
Feb 24, 2025 18:44:50.519301891 CET	49946	443	192.168.2.7	34.49.51.44
Feb 24, 2025 18:44:50.525353909 CET	49946	443	192.168.2.7	34.49.51.44
Feb 24, 2025 18:44:50.525397062 CET	443	49946	34.49.51.44	192.168.2.7
Feb 24, 2025 18:44:50.525456905 CET	49946	443	192.168.2.7	34.49.51.44
Feb 24, 2025 18:44:50.525691032 CET	443	49946	34.49.51.44	192.168.2.7
Feb 24, 2025 18:44:50.526355028 CET	49946	443	192.168.2.7	34.49.51.44
Feb 24, 2025 18:44:50.528875113 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:50.531238079 CET	49954	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:50.531267881 CET	443	49954	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:50.531403065 CET	49954	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:50.531531096 CET	49954	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:50.531543970 CET	443	49954	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:50.534020901 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:50.605293036 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:50.629232883 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:50.632584095 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:50.637844086 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:50.663336992 CET	443	49945	151.101.65.91	192.168.2.7
Feb 24, 2025 18:44:50.671298027 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:50.671350002 CET	49945	443	192.168.2.7	151.101.65.91
Feb 24, 2025 18:44:50.729336023 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:50.771581888 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:50.945434093 CET	443	49950	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.946780920 CET	49950	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.949336052 CET	49950	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.949342966 CET	443	49950	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.949755907 CET	443	49950	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.952130079 CET	443	49953	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.952202082 CET	49953	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.955199957 CET	49953	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.955213070 CET	443	49953	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.955238104 CET	49950	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.955450058 CET	443	49950	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.955563068 CET	443	49953	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.955571890 CET	49950	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.955579042 CET	443	49950	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.957742929 CET	443	49952	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.961205959 CET	49953	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.961270094 CET	49953	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.961379051 CET	443	49953	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.962202072 CET	49953	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.962227106 CET	49952	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.964827061 CET	49952	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.964842081 CET	443	49952	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.965066910 CET	443	49952	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.965214014 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:50.968449116 CET	49952	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.968519926 CET	49952	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.968595982 CET	443	49952	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:50.968961000 CET	49952	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:50.970469952 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:50.980252981 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:50.985310078 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:50.985600948 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:50.985662937 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:50.987889051 CET	443	49954	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:50.990396023 CET	49954	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:50.990756989 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:50.993215084 CET	49954	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:50.993233919 CET	443	49954	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:50.993449926 CET	443	49954	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:50.997665882 CET	49954	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:50.997821093 CET	443	49954	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:51.005268097 CET	49954	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:51.005697012 CET	49954	443	192.168.2.7	34.149.100.209
Feb 24, 2025 18:44:51.005711079 CET	443	49954	34.149.100.209	192.168.2.7
Feb 24, 2025 18:44:51.065661907 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:51.069175005 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:51.074399948 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:51.125663042 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:51.163328886 CET	443	49950	35.244.181.201	192.168.2.7
Feb 24, 2025 18:44:51.163388014 CET	49950	443	192.168.2.7	35.244.181.201
Feb 24, 2025 18:44:51.165889025 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:51.225976944 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:51.588255882 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.588272095 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.588284016 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.588295937 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.588427067 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.588505983 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.589582920 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.589596033 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.589612007 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.590081930 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.592184067 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.592195034 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.592259884 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.595366955 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.595427036 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.596395016 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.596406937 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.596417904 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.596478939 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.597351074 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.597362995 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.597373009 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.597418070 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.597507000 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.676062107 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.676101923 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.676115036 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.676126957 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.676139116 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.676187992 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.676371098 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.676573038 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.676632881 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.676645041 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.676836014 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.677014112 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.677026987 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.677032948 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.677110910 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.679173946 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.679188967 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.679203987 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.679233074 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.679321051 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.679435968 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.679447889 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.679459095 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.679497004 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.682240963 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.682255030 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.682307005 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.682383060 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.682395935 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.682406902 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.682418108 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.682446003 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.682472944 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.684335947 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.684366941 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.684379101 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.684391022 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.684401035 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.684446096 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.684479952 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.684555054 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.763030052 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.763048887 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.763062954 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.763123035 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.763166904 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.763179064 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.763201952 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.763212919 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.763217926 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.763226032 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.763310909 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.763928890 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.763942003 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.763952971 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.764027119 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.764363050 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.764374971 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.764389038 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.764400959 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.764414072 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.764424086 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.764429092 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.764511108 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.765166044 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.765178919 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.765191078 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.765201092 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.765225887 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.765315056 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.766148090 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.766168118 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.766205072 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.766308069 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.766319990 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.766365051 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.766463995 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.766474962 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.766486883 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.766499996 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.766525984 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.766583920 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.767011881 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.767024040 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.767035961 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.767046928 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.767069101 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.767138958 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.769241095 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.769253969 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.769287109 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.769310951 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.769368887 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.769382000 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.769392014 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.769478083 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.769790888 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.769804001 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.769815922 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.769826889 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.769860983 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.770287037 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.770298004 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.770344019 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.771286011 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.771296024 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.771341085 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.771344900 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.771358013 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.771363974 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.771377087 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.771410942 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.771838903 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.771857023 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.771867990 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.771878004 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.771888018 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.771898985 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.771933079 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.849951982 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.849967003 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.849978924 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.850001097 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.850073099 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.850085020 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.850095987 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.850297928 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.850311041 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.850322008 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.850399017 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.850434065 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.850451946 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.850465059 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.850476980 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.850728989 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.850739956 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.850810051 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.850821972 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.850832939 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.850939989 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.851023912 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.851036072 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.851048946 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.851059914 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.851170063 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.851170063 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.851170063 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.851430893 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.851442099 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.851501942 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.853692055 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.853703976 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.853714943 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.853732109 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.853741884 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.853751898 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.853761911 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.853763103 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.853776932 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.853787899 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.853804111 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.853815079 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.853821039 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.853823900 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.853827000 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.853857994 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.853872061 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.853882074 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.853893042 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.853894949 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.853904009 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.853915930 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.853925943 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.853936911 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.853948116 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.853948116 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.853984118 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.854290962 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.854307890 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.854362011 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.862597942 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.862612009 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.862623930 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.862637043 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.862648964 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.862662077 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.862705946 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.862759113 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.862771988 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.862785101 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.862796068 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.862807035 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.862818956 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.862831116 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.862843037 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.862854004 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.862865925 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.862867117 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.862878084 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.862931967 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.862960100 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.862962008 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.863013983 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.863126040 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863137960 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863149881 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863161087 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863173008 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863183022 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863190889 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863195896 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863207102 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863209963 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.863219976 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863231897 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863244057 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863267899 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.863325119 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.863854885 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863873005 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863886118 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863897085 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863908052 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863919973 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863933086 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863934994 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.863945007 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863957882 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863969088 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863981009 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.863981009 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.864028931 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.937129021 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.937144041 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.937170982 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.937182903 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.937216997 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.937305927 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.937316895 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.937335968 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.937341928 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.937388897 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.937434912 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.937447071 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.937458992 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.937469959 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.937602997 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.937627077 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.937663078 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.937674999 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.937688112 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.937700033 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.937711954 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.937773943 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.937947035 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.938082933 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.938189983 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.938262939 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.938280106 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.938327074 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.938414097 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.938426018 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.938437939 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.938486099 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.939826012 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.939837933 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.939848900 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.939860106 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.939872980 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.939889908 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.939924955 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.939966917 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.939980030 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.939989090 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.940048933 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.940298080 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.940310001 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.940321922 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.940356970 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.940388918 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.940450907 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.940463066 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.940475941 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.940514088 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.940594912 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.940608025 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.940619946 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.940654039 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.940709114 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.940749884 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.940762997 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.940774918 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.940785885 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.940798044 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.940809965 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.940812111 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.940884113 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.941540003 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.941560984 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.941572905 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.941617012 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.941706896 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.941719055 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.941730022 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.941740990 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.941752911 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.941768885 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.941822052 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.941873074 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.941879034 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.941890955 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.942068100 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.942080021 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.942092896 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.942111969 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.942226887 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.942430019 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.942445040 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.942456961 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.942468882 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.942481041 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.942857981 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.943052053 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.944492102 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.944504023 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.944529057 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.944554090 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.944556952 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.944566011 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.944577932 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.944590092 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.944608927 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.944621086 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.944632053 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.944638968 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.944648981 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.944660902 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.944678068 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.944685936 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.944691896 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.944698095 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.944710016 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.944721937 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.944731951 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.944744110 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.944742918 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.944868088 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.946794987 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.946805000 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.946815968 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.946937084 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.946949005 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.946949005 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.947056055 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.947112083 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.947123051 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.947134972 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.947144985 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.947156906 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.947166920 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.947191954 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.947282076 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.947468042 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.947479963 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.947491884 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.947503090 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.947515011 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.947530031 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.947607994 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.947608948 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.947624922 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.947701931 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.948071957 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.948082924 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.948093891 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.948103905 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.948115110 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.948126078 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.948127985 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.948139906 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.948210955 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.948219061 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.948224068 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.948373079 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.948385000 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:51.948415995 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:51.948446035 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:52.028740883 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.028753996 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.028764963 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.028789997 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.028799057 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.028877974 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.028888941 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.028901100 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.028909922 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.028922081 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.028932095 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029002905 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029042959 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029056072 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029133081 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029144049 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029158115 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029169083 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029288054 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029304981 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029315948 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029325962 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029337883 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029350996 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029361010 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029488087 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029501915 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029512882 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029639006 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029649973 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029665947 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029676914 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029814959 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029834986 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029845953 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029855967 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029870987 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029881001 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029891968 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029901028 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029911995 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029922962 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029933929 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029943943 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.029957056 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.030200958 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.030348063 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.030358076 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.030369997 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.030380964 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.030391932 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.030402899 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.030415058 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.030426025 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.030642986 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.030653954 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.030664921 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.030675888 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.030687094 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.030698061 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.030709028 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.030824900 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.030836105 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.030896902 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.030901909 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:52.030909061 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.030920029 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.030998945 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.031142950 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.031155109 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.031156063 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:52.031166077 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.031177998 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.031189919 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.031197071 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:52.031200886 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.031213045 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.031224012 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.031234980 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.031245947 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.031248093 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:52.031260014 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.031271935 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.031281948 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.031296015 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:52.031358957 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:52.031394005 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:52.031451941 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:52.031507969 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:52.032758951 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.032818079 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.032828093 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.032845974 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.032857895 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.032871962 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.032883883 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.032893896 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.032967091 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:52.032985926 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.033061028 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.033072948 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.033085108 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.033178091 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:52.033209085 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.033226967 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.033237934 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.033248901 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.033261061 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.033272028 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.033423901 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:52.033457994 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.033476114 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.033488035 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.033498049 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.033510923 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.033521891 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.033534050 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.033544064 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.033555984 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:44:52.033631086 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:44:54.202521086 CET	49979	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:44:54.202564955 CET	443	49979	34.107.243.93	192.168.2.7
Feb 24, 2025 18:44:54.208949089 CET	49979	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:44:54.210397959 CET	49979	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:44:54.210414886 CET	443	49979	34.107.243.93	192.168.2.7
Feb 24, 2025 18:44:54.703728914 CET	443	49979	34.107.243.93	192.168.2.7
Feb 24, 2025 18:44:54.703883886 CET	49979	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:44:54.709134102 CET	49979	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:44:54.709141016 CET	443	49979	34.107.243.93	192.168.2.7
Feb 24, 2025 18:44:54.709235907 CET	49979	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:44:54.709311962 CET	443	49979	34.107.243.93	192.168.2.7
Feb 24, 2025 18:44:54.709458113 CET	49979	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:44:54.711988926 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:54.716989994 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:54.812313080 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:54.823343039 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:54.828424931 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:54.871849060 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:44:54.920780897 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:44:54.967943907 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:02.038418055 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:45:02.043422937 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:45:04.815232038 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:04.820233107 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:04.931133032 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:04.936239958 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:12.052022934 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:45:12.057126045 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:45:14.822093010 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:14.827146053 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:14.865407944 CET	50027	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:45:14.865437984 CET	443	50027	34.107.243.93	192.168.2.7
Feb 24, 2025 18:45:14.865508080 CET	50027	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:45:14.866977930 CET	50027	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:45:14.866992950 CET	443	50027	34.107.243.93	192.168.2.7
Feb 24, 2025 18:45:14.944503069 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:14.949516058 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:15.357388973 CET	443	50027	34.107.243.93	192.168.2.7
Feb 24, 2025 18:45:15.357547998 CET	50027	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:45:15.362708092 CET	50027	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:45:15.362718105 CET	443	50027	34.107.243.93	192.168.2.7
Feb 24, 2025 18:45:15.362803936 CET	50027	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:45:15.362951994 CET	443	50027	34.107.243.93	192.168.2.7
Feb 24, 2025 18:45:15.363015890 CET	50027	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:45:15.365362883 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:15.370428085 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:15.465650082 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:15.469063044 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:15.508424044 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:15.778116941 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:16.379937887 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:16.504563093 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:16.504643917 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:16.505028963 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:16.505171061 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:16.505625010 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:16.505673885 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:16.507281065 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:16.507289886 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:16.509318113 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:16.597985029 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:16.649382114 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:20.167188883 CET	50028	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.167243004 CET	443	50028	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.167326927 CET	50028	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.167504072 CET	50028	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.167515039 CET	443	50028	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.177962065 CET	50029	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.178086042 CET	443	50029	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.179420948 CET	50029	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.179682016 CET	50029	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.179718971 CET	443	50029	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.184022903 CET	50030	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.184066057 CET	443	50030	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.184288025 CET	50031	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.184299946 CET	443	50031	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.190850973 CET	50032	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.190879107 CET	443	50032	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.191342115 CET	50030	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.191344976 CET	50031	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.191464901 CET	50030	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.191472054 CET	50032	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.191476107 CET	443	50030	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.191600084 CET	50031	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.191612959 CET	443	50031	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.191689014 CET	50032	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.191701889 CET	443	50032	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.195904970 CET	50033	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.195939064 CET	443	50033	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.196325064 CET	50033	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.196480989 CET	50033	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.196495056 CET	443	50033	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.626956940 CET	443	50028	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.627077103 CET	50028	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.630527020 CET	50028	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.630544901 CET	443	50028	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.630886078 CET	443	50028	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.633687019 CET	50028	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.633812904 CET	50028	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.633979082 CET	443	50028	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.634365082 CET	50034	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.634407997 CET	443	50034	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.638389111 CET	50028	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.638545990 CET	50034	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.638609886 CET	50034	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.638616085 CET	443	50034	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.639681101 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:20.644794941 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:20.648371935 CET	443	50032	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.648469925 CET	50032	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.651777029 CET	50032	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.651786089 CET	443	50032	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.652043104 CET	443	50032	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.652375937 CET	443	50030	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.652390003 CET	443	50030	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.652487993 CET	50030	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.654551983 CET	443	50029	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.654642105 CET	50029	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.655035973 CET	50030	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.655046940 CET	443	50030	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.655302048 CET	443	50030	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.659075022 CET	50029	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.659090042 CET	443	50029	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.659518957 CET	443	50029	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.662267923 CET	50032	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.662444115 CET	443	50032	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.662627935 CET	50032	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.662636995 CET	443	50032	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.664700985 CET	50035	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.664741039 CET	443	50035	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.664941072 CET	50035	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.665235043 CET	50030	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.665409088 CET	50030	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.665433884 CET	443	50030	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.665908098 CET	50035	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.665923119 CET	443	50035	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.666064024 CET	50030	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.666367054 CET	50029	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.666439056 CET	50029	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.666852951 CET	443	50029	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.667155981 CET	50029	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.694988012 CET	443	50033	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.695111990 CET	50033	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.696990013 CET	443	50031	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.697010040 CET	443	50031	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.697120905 CET	50031	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.698282003 CET	50033	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.698287964 CET	443	50033	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.698642969 CET	443	50033	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.700771093 CET	50031	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.700812101 CET	443	50031	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.701263905 CET	443	50031	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.704546928 CET	50033	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.704835892 CET	443	50033	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.704910994 CET	50033	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.704916954 CET	443	50033	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.705389023 CET	50031	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.705523968 CET	50031	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.705831051 CET	443	50031	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.705904007 CET	50031	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.740222931 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:20.793169975 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:20.798165083 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:20.803319931 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:20.867336035 CET	443	50032	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.867542982 CET	50032	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.894640923 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:20.911370039 CET	443	50033	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:20.911508083 CET	50033	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:20.940382004 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:21.103777885 CET	443	50034	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:21.103900909 CET	50034	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:21.106954098 CET	50034	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:21.106966019 CET	443	50034	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:21.107328892 CET	443	50034	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:21.110160112 CET	50034	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:21.110317945 CET	50034	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:21.110346079 CET	443	50034	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:21.110512018 CET	50034	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:21.153733015 CET	443	50035	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:21.153803110 CET	50035	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:21.157025099 CET	50035	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:21.157041073 CET	443	50035	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:21.157377005 CET	443	50035	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:21.159627914 CET	50035	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:21.159718037 CET	50035	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:21.159868956 CET	443	50035	34.120.208.123	192.168.2.7
Feb 24, 2025 18:45:21.159934044 CET	50035	443	192.168.2.7	34.120.208.123
Feb 24, 2025 18:45:21.305110931 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:21.310158014 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:21.407211065 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:21.464065075 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:21.583672047 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:21.589586973 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:21.682657957 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:21.727118015 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:22.065794945 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:45:22.070862055 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:45:31.409169912 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:31.414290905 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:31.694557905 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:31.699686050 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:32.073672056 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:45:32.078824043 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:45:41.424181938 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:41.429523945 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:41.702960968 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:41.708193064 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:42.088387012 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:45:42.095458984 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:45:51.451703072 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:51.457062006 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:51.714835882 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:51.720196962 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:52.100555897 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:45:52.105973005 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:45:55.377100945 CET	50036	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:45:55.377145052 CET	443	50036	34.107.243.93	192.168.2.7
Feb 24, 2025 18:45:55.377454042 CET	50036	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:45:55.379760027 CET	50036	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:45:55.379776001 CET	443	50036	34.107.243.93	192.168.2.7
Feb 24, 2025 18:45:55.877290964 CET	443	50036	34.107.243.93	192.168.2.7
Feb 24, 2025 18:45:55.877386093 CET	50036	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:45:55.886732101 CET	50036	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:45:55.886753082 CET	443	50036	34.107.243.93	192.168.2.7
Feb 24, 2025 18:45:55.886868954 CET	50036	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:45:55.887305975 CET	443	50036	34.107.243.93	192.168.2.7
Feb 24, 2025 18:45:55.888045073 CET	50036	443	192.168.2.7	34.107.243.93
Feb 24, 2025 18:45:55.890522003 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:55.896068096 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:55.991065979 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:55.999063015 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:56.004440069 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:56.043484926 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:45:56.098500967 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:45:56.143820047 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:46:02.114554882 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:46:02.119860888 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:46:05.995563030 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:46:06.001215935 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:46:06.111299992 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:46:06.116537094 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:46:12.128815889 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:46:12.134052992 CET	80	49956	2.22.61.59	192.168.2.7
Feb 24, 2025 18:46:16.005089998 CET	49767	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:46:16.010282040 CET	80	49767	34.107.221.82	192.168.2.7
Feb 24, 2025 18:46:16.118056059 CET	49764	80	192.168.2.7	34.107.221.82
Feb 24, 2025 18:46:16.123229027 CET	80	49764	34.107.221.82	192.168.2.7
Feb 24, 2025 18:46:22.135713100 CET	49956	80	192.168.2.7	2.22.61.59
Feb 24, 2025 18:46:22.140928984 CET	80	49956	2.22.61.59	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 24, 2025 18:44:23.267546892 CET	50703	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:23.267878056 CET	50016	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:23.274557114 CET	53	50703	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:23.275294065 CET	53	50016	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:23.280215025 CET	63764	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:23.280630112 CET	55536	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:23.282370090 CET	49575	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:23.287448883 CET	53	63764	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:23.288080931 CET	53	55536	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:23.291706085 CET	53	49575	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:23.295007944 CET	54184	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:23.295187950 CET	64821	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:23.295347929 CET	63823	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:23.302855015 CET	53	54184	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:23.303041935 CET	53	64821	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:23.303504944 CET	53	63823	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:23.872312069 CET	61040	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:23.875961065 CET	63099	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:23.880963087 CET	53	61040	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:23.882002115 CET	53964	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:23.883797884 CET	53	63099	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:23.884716034 CET	57936	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:23.889039040 CET	53	53964	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:23.892116070 CET	53	57936	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:23.895409107 CET	56865	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:23.902700901 CET	53	56865	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:23.918462992 CET	55976	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:23.925689936 CET	53	55976	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:23.934962034 CET	52767	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:23.943558931 CET	53	52767	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:23.946346998 CET	65447	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:23.956438065 CET	53	65447	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:24.268440008 CET	64394	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:24.276567936 CET	53	64394	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:24.326982021 CET	61377	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:24.334278107 CET	53	61377	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:24.350059986 CET	65275	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:24.358534098 CET	53	65275	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:24.476777077 CET	62628	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:24.484150887 CET	53	62628	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:24.485335112 CET	53368	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:24.493438005 CET	53	53368	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:24.494246960 CET	53068	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:24.501457930 CET	53	53068	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:25.287750006 CET	57396	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:25.295697927 CET	53	57396	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:25.296875954 CET	56942	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:25.304392099 CET	53	56942	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:25.305000067 CET	50746	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:25.312702894 CET	53	50746	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:29.483391047 CET	62021	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:29.491235971 CET	53	62021	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:29.497874975 CET	50820	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:29.505517960 CET	53	50820	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:29.506289005 CET	65263	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:29.513840914 CET	53	65263	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:35.187931061 CET	56269	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:35.195524931 CET	53	56269	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:35.198292971 CET	56400	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:35.206337929 CET	53	56400	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:35.208162069 CET	58817	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:35.215603113 CET	53	58817	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:36.099874020 CET	55920	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:36.107702971 CET	53	55920	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:36.108402014 CET	59708	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:36.115607977 CET	53	59708	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:36.431274891 CET	63652	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:36.438663960 CET	53	63652	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:36.440830946 CET	53454	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:36.448226929 CET	53	53454	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:36.459359884 CET	52733	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:36.467020988 CET	53	52733	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:43.477128029 CET	57112	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:43.477555037 CET	62559	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:43.477812052 CET	53095	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:43.484739065 CET	53	62559	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:43.484992027 CET	53	57112	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:43.486017942 CET	53	53095	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:43.491897106 CET	51607	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:43.492394924 CET	62082	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:43.492805004 CET	58617	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:43.499521971 CET	53	51607	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:43.500000954 CET	59186	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:43.500042915 CET	53	62082	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:43.500432968 CET	53	58617	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:43.500480890 CET	51452	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:43.500833988 CET	60277	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:43.507399082 CET	53	59186	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:43.507678986 CET	53	51452	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:43.508018970 CET	63433	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:43.508742094 CET	52893	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:43.509651899 CET	53	60277	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:43.510816097 CET	60201	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:43.515759945 CET	53	63433	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:43.516109943 CET	53	52893	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:43.516290903 CET	56769	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:43.516765118 CET	65327	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:43.518325090 CET	53	60201	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:43.524292946 CET	53	56769	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:43.524404049 CET	53	65327	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:43.524720907 CET	58477	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:43.524832010 CET	54121	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:43.531894922 CET	53	58477	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:43.531939030 CET	53	54121	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:44.515942097 CET	55560	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:44.523515940 CET	53	55560	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:49.932693005 CET	56204	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:49.942199945 CET	53	56204	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:49.961167097 CET	63798	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:49.969575882 CET	53	63798	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:49.976105928 CET	61305	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:49.980083942 CET	63616	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:49.986177921 CET	53	61305	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:49.989765882 CET	53	63616	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:49.996099949 CET	65155	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:50.006661892 CET	53	65155	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:50.065037012 CET	64289	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:50.073461056 CET	53	64289	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:50.380244970 CET	56316	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:50.387806892 CET	53	56316	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:50.980616093 CET	58887	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:50.990283966 CET	53	58887	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:50.991077900 CET	60616	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:50.999902964 CET	53	60616	1.1.1.1	192.168.2.7
Feb 24, 2025 18:44:54.203032970 CET	60228	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:44:54.210516930 CET	53	60228	1.1.1.1	192.168.2.7
Feb 24, 2025 18:45:14.864268064 CET	60251	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:45:14.872009039 CET	53	60251	1.1.1.1	192.168.2.7
Feb 24, 2025 18:45:14.873296022 CET	60749	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:45:14.880525112 CET	53	60749	1.1.1.1	192.168.2.7
Feb 24, 2025 18:45:20.167519093 CET	51508	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:45:20.176969051 CET	53	51508	1.1.1.1	192.168.2.7
Feb 24, 2025 18:45:55.368372917 CET	63913	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:45:55.375956059 CET	53	63913	1.1.1.1	192.168.2.7
Feb 24, 2025 18:45:55.377264977 CET	64276	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:45:55.386555910 CET	53	64276	1.1.1.1	192.168.2.7
Feb 24, 2025 18:45:55.891067982 CET	53345	53	192.168.2.7	1.1.1.1
Feb 24, 2025 18:45:55.898638010 CET	53	53345	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 24, 2025 18:44:23.267546892 CET	192.168.2.7	1.1.1.1	0x2cab	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.267878056 CET	192.168.2.7	1.1.1.1	0x3ef5	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.280215025 CET	192.168.2.7	1.1.1.1	0x95b1	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.280630112 CET	192.168.2.7	1.1.1.1	0x61ae	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.282370090 CET	192.168.2.7	1.1.1.1	0xd3ef	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.295007944 CET	192.168.2.7	1.1.1.1	0x84d5	Standard query (0)	youtube.com	28	IN (0x0001)	false
Feb 24, 2025 18:44:23.295187950 CET	192.168.2.7	1.1.1.1	0x583a	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Feb 24, 2025 18:44:23.295347929 CET	192.168.2.7	1.1.1.1	0x4f09	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Feb 24, 2025 18:44:23.872312069 CET	192.168.2.7	1.1.1.1	0xff03	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.875961065 CET	192.168.2.7	1.1.1.1	0x6244	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.882002115 CET	192.168.2.7	1.1.1.1	0xb7a3	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.884716034 CET	192.168.2.7	1.1.1.1	0xe710	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.895409107 CET	192.168.2.7	1.1.1.1	0x6251	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Feb 24, 2025 18:44:23.918462992 CET	192.168.2.7	1.1.1.1	0x28dd	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.934962034 CET	192.168.2.7	1.1.1.1	0x9832	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.946346998 CET	192.168.2.7	1.1.1.1	0xd92c	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Feb 24, 2025 18:44:24.268440008 CET	192.168.2.7	1.1.1.1	0x97b5	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:24.326982021 CET	192.168.2.7	1.1.1.1	0x3f8d	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:24.350059986 CET	192.168.2.7	1.1.1.1	0xde98	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Feb 24, 2025 18:44:24.476777077 CET	192.168.2.7	1.1.1.1	0x6763	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:24.485335112 CET	192.168.2.7	1.1.1.1	0x761c	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:24.494246960 CET	192.168.2.7	1.1.1.1	0xd9a3	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Feb 24, 2025 18:44:25.287750006 CET	192.168.2.7	1.1.1.1	0x9889	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:25.296875954 CET	192.168.2.7	1.1.1.1	0x9d21	Standard query (0)	shavar.prod.mozaws.net	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:25.305000067 CET	192.168.2.7	1.1.1.1	0x10ad	Standard query (0)	shavar.prod.mozaws.net	28	IN (0x0001)	false
Feb 24, 2025 18:44:29.483391047 CET	192.168.2.7	1.1.1.1	0x4d38	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:29.497874975 CET	192.168.2.7	1.1.1.1	0xa655	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:29.506289005 CET	192.168.2.7	1.1.1.1	0x1325	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Feb 24, 2025 18:44:35.187931061 CET	192.168.2.7	1.1.1.1	0x269f	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:35.198292971 CET	192.168.2.7	1.1.1.1	0x45b5	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:35.208162069 CET	192.168.2.7	1.1.1.1	0x228a	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Feb 24, 2025 18:44:36.099874020 CET	192.168.2.7	1.1.1.1	0xa0db	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:36.108402014 CET	192.168.2.7	1.1.1.1	0x197b	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Feb 24, 2025 18:44:36.431274891 CET	192.168.2.7	1.1.1.1	0x62bc	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:36.440830946 CET	192.168.2.7	1.1.1.1	0x7306	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:36.459359884 CET	192.168.2.7	1.1.1.1	0x4641	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Feb 24, 2025 18:44:43.477128029 CET	192.168.2.7	1.1.1.1	0x20c0	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.477555037 CET	192.168.2.7	1.1.1.1	0x44ee	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.477812052 CET	192.168.2.7	1.1.1.1	0xa0aa	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.491897106 CET	192.168.2.7	1.1.1.1	0x441a	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.492394924 CET	192.168.2.7	1.1.1.1	0x831a	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.492805004 CET	192.168.2.7	1.1.1.1	0xd82d	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.500000954 CET	192.168.2.7	1.1.1.1	0x362d	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Feb 24, 2025 18:44:43.500480890 CET	192.168.2.7	1.1.1.1	0xd689	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Feb 24, 2025 18:44:43.500833988 CET	192.168.2.7	1.1.1.1	0x14cc	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Feb 24, 2025 18:44:43.508018970 CET	192.168.2.7	1.1.1.1	0x54f8	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.508742094 CET	192.168.2.7	1.1.1.1	0xdc61	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.510816097 CET	192.168.2.7	1.1.1.1	0x36b1	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Feb 24, 2025 18:44:43.516290903 CET	192.168.2.7	1.1.1.1	0x6410	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.516765118 CET	192.168.2.7	1.1.1.1	0xcbe7	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.524720907 CET	192.168.2.7	1.1.1.1	0x6cf0	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Feb 24, 2025 18:44:43.524832010 CET	192.168.2.7	1.1.1.1	0xa073	Standard query (0)	twitter.com	28	IN (0x0001)	false
Feb 24, 2025 18:44:44.515942097 CET	192.168.2.7	1.1.1.1	0x98b8	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Feb 24, 2025 18:44:49.932693005 CET	192.168.2.7	1.1.1.1	0xd4b9	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:49.961167097 CET	192.168.2.7	1.1.1.1	0x50d8	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:49.976105928 CET	192.168.2.7	1.1.1.1	0x93b5	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:49.980083942 CET	192.168.2.7	1.1.1.1	0x117	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Feb 24, 2025 18:44:49.996099949 CET	192.168.2.7	1.1.1.1	0x7ff0	Standard query (0)	normandy.tombstone.experimenter.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:50.065037012 CET	192.168.2.7	1.1.1.1	0x1495	Standard query (0)	normandy.tombstone.experimenter.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Feb 24, 2025 18:44:50.380244970 CET	192.168.2.7	1.1.1.1	0x1ab3	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:50.980616093 CET	192.168.2.7	1.1.1.1	0xbb4	Standard query (0)	a19.dscg10.akamai.net	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:50.991077900 CET	192.168.2.7	1.1.1.1	0x47d0	Standard query (0)	a19.dscg10.akamai.net	28	IN (0x0001)	false
Feb 24, 2025 18:44:54.203032970 CET	192.168.2.7	1.1.1.1	0x49a0	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Feb 24, 2025 18:45:14.864268064 CET	192.168.2.7	1.1.1.1	0x30bd	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:45:14.873296022 CET	192.168.2.7	1.1.1.1	0x2fad	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Feb 24, 2025 18:45:20.167519093 CET	192.168.2.7	1.1.1.1	0x5d	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Feb 24, 2025 18:45:55.368372917 CET	192.168.2.7	1.1.1.1	0xdc23	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:45:55.377264977 CET	192.168.2.7	1.1.1.1	0x5ccd	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Feb 24, 2025 18:45:55.891067982 CET	192.168.2.7	1.1.1.1	0xc785	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 24, 2025 18:44:23.274557114 CET	1.1.1.1	192.168.2.7	0x2cab	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:23.274557114 CET	1.1.1.1	192.168.2.7	0x2cab	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:23.274557114 CET	1.1.1.1	192.168.2.7	0x2cab	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.275294065 CET	1.1.1.1	192.168.2.7	0x3ef5	No error (0)	youtube.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.275403023 CET	1.1.1.1	192.168.2.7	0x6003	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.287448883 CET	1.1.1.1	192.168.2.7	0x95b1	No error (0)	youtube.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.288080931 CET	1.1.1.1	192.168.2.7	0x61ae	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.291706085 CET	1.1.1.1	192.168.2.7	0xd3ef	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.302855015 CET	1.1.1.1	192.168.2.7	0x84d5	No error (0)	youtube.com			28	IN (0x0001)	false
Feb 24, 2025 18:44:23.303504944 CET	1.1.1.1	192.168.2.7	0x4f09	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Feb 24, 2025 18:44:23.880963087 CET	1.1.1.1	192.168.2.7	0xff03	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.883797884 CET	1.1.1.1	192.168.2.7	0x6244	No error (0)	example.org		23.215.0.133	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.883797884 CET	1.1.1.1	192.168.2.7	0x6244	No error (0)	example.org		23.215.0.132	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.883797884 CET	1.1.1.1	192.168.2.7	0x6244	No error (0)	example.org		96.7.128.186	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.883797884 CET	1.1.1.1	192.168.2.7	0x6244	No error (0)	example.org		96.7.128.192	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.889039040 CET	1.1.1.1	192.168.2.7	0xb7a3	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.889039040 CET	1.1.1.1	192.168.2.7	0xb7a3	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.892116070 CET	1.1.1.1	192.168.2.7	0xe710	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.925689936 CET	1.1.1.1	192.168.2.7	0x28dd	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:23.925689936 CET	1.1.1.1	192.168.2.7	0x28dd	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:23.943558931 CET	1.1.1.1	192.168.2.7	0x9832	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:24.276567936 CET	1.1.1.1	192.168.2.7	0x97b5	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:24.276567936 CET	1.1.1.1	192.168.2.7	0x97b5	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:24.276567936 CET	1.1.1.1	192.168.2.7	0x97b5	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:24.305965900 CET	1.1.1.1	192.168.2.7	0xa9e3	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:24.305965900 CET	1.1.1.1	192.168.2.7	0xa9e3	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:24.334278107 CET	1.1.1.1	192.168.2.7	0x3f8d	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:24.358534098 CET	1.1.1.1	192.168.2.7	0xde98	No error (0)	prod.balrog.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Feb 24, 2025 18:44:24.484150887 CET	1.1.1.1	192.168.2.7	0x6763	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:24.484150887 CET	1.1.1.1	192.168.2.7	0x6763	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:24.484150887 CET	1.1.1.1	192.168.2.7	0x6763	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:24.493438005 CET	1.1.1.1	192.168.2.7	0x761c	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:24.501457930 CET	1.1.1.1	192.168.2.7	0xd9a3	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Feb 24, 2025 18:44:25.295697927 CET	1.1.1.1	192.168.2.7	0x9889	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:25.295697927 CET	1.1.1.1	192.168.2.7	0x9889	No error (0)	shavar.prod.mozaws.net		52.26.30.181	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:25.295697927 CET	1.1.1.1	192.168.2.7	0x9889	No error (0)	shavar.prod.mozaws.net		35.165.160.211	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:25.295697927 CET	1.1.1.1	192.168.2.7	0x9889	No error (0)	shavar.prod.mozaws.net		44.231.111.180	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:25.304392099 CET	1.1.1.1	192.168.2.7	0x9d21	No error (0)	shavar.prod.mozaws.net		35.165.160.211	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:25.304392099 CET	1.1.1.1	192.168.2.7	0x9d21	No error (0)	shavar.prod.mozaws.net		44.231.111.180	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:25.304392099 CET	1.1.1.1	192.168.2.7	0x9d21	No error (0)	shavar.prod.mozaws.net		52.26.30.181	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:29.491235971 CET	1.1.1.1	192.168.2.7	0x4d38	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:29.491235971 CET	1.1.1.1	192.168.2.7	0x4d38	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:29.491235971 CET	1.1.1.1	192.168.2.7	0x4d38	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:29.505517960 CET	1.1.1.1	192.168.2.7	0xa655	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:35.195524931 CET	1.1.1.1	192.168.2.7	0x269f	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:35.206337929 CET	1.1.1.1	192.168.2.7	0x45b5	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:36.077169895 CET	1.1.1.1	192.168.2.7	0x9994	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:36.107702971 CET	1.1.1.1	192.168.2.7	0xa0db	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:36.157844067 CET	1.1.1.1	192.168.2.7	0x6250	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:36.157844067 CET	1.1.1.1	192.168.2.7	0x6250	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:36.438663960 CET	1.1.1.1	192.168.2.7	0x62bc	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:36.438663960 CET	1.1.1.1	192.168.2.7	0x62bc	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:36.448226929 CET	1.1.1.1	192.168.2.7	0x7306	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:36.467020988 CET	1.1.1.1	192.168.2.7	0x4641	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Feb 24, 2025 18:44:36.757181883 CET	1.1.1.1	192.168.2.7	0xb128	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.484739065 CET	1.1.1.1	192.168.2.7	0x44ee	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:43.484739065 CET	1.1.1.1	192.168.2.7	0x44ee	No error (0)	star-mini.c10r.facebook.com		157.240.253.35	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.484992027 CET	1.1.1.1	192.168.2.7	0x20c0	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:43.484992027 CET	1.1.1.1	192.168.2.7	0x20c0	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.484992027 CET	1.1.1.1	192.168.2.7	0x20c0	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.484992027 CET	1.1.1.1	192.168.2.7	0x20c0	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.484992027 CET	1.1.1.1	192.168.2.7	0x20c0	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.484992027 CET	1.1.1.1	192.168.2.7	0x20c0	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.484992027 CET	1.1.1.1	192.168.2.7	0x20c0	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.484992027 CET	1.1.1.1	192.168.2.7	0x20c0	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.484992027 CET	1.1.1.1	192.168.2.7	0x20c0	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.484992027 CET	1.1.1.1	192.168.2.7	0x20c0	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.484992027 CET	1.1.1.1	192.168.2.7	0x20c0	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.484992027 CET	1.1.1.1	192.168.2.7	0x20c0	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.484992027 CET	1.1.1.1	192.168.2.7	0x20c0	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.484992027 CET	1.1.1.1	192.168.2.7	0x20c0	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.484992027 CET	1.1.1.1	192.168.2.7	0x20c0	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.484992027 CET	1.1.1.1	192.168.2.7	0x20c0	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.484992027 CET	1.1.1.1	192.168.2.7	0x20c0	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.486017942 CET	1.1.1.1	192.168.2.7	0xa0aa	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:43.486017942 CET	1.1.1.1	192.168.2.7	0xa0aa	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.499521971 CET	1.1.1.1	192.168.2.7	0x441a	No error (0)	star-mini.c10r.facebook.com		157.240.0.35	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.500042915 CET	1.1.1.1	192.168.2.7	0x831a	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.500042915 CET	1.1.1.1	192.168.2.7	0x831a	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.500042915 CET	1.1.1.1	192.168.2.7	0x831a	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.500042915 CET	1.1.1.1	192.168.2.7	0x831a	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.500042915 CET	1.1.1.1	192.168.2.7	0x831a	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.500042915 CET	1.1.1.1	192.168.2.7	0x831a	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.500042915 CET	1.1.1.1	192.168.2.7	0x831a	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.500042915 CET	1.1.1.1	192.168.2.7	0x831a	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.500042915 CET	1.1.1.1	192.168.2.7	0x831a	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.500042915 CET	1.1.1.1	192.168.2.7	0x831a	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.500042915 CET	1.1.1.1	192.168.2.7	0x831a	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.500042915 CET	1.1.1.1	192.168.2.7	0x831a	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.500042915 CET	1.1.1.1	192.168.2.7	0x831a	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.500042915 CET	1.1.1.1	192.168.2.7	0x831a	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.500042915 CET	1.1.1.1	192.168.2.7	0x831a	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.500042915 CET	1.1.1.1	192.168.2.7	0x831a	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.500432968 CET	1.1.1.1	192.168.2.7	0xd82d	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.507399082 CET	1.1.1.1	192.168.2.7	0x362d	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Feb 24, 2025 18:44:43.507678986 CET	1.1.1.1	192.168.2.7	0xd689	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Feb 24, 2025 18:44:43.507678986 CET	1.1.1.1	192.168.2.7	0xd689	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Feb 24, 2025 18:44:43.507678986 CET	1.1.1.1	192.168.2.7	0xd689	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Feb 24, 2025 18:44:43.507678986 CET	1.1.1.1	192.168.2.7	0xd689	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Feb 24, 2025 18:44:43.509651899 CET	1.1.1.1	192.168.2.7	0x14cc	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Feb 24, 2025 18:44:43.515759945 CET	1.1.1.1	192.168.2.7	0x54f8	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:43.515759945 CET	1.1.1.1	192.168.2.7	0x54f8	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.515759945 CET	1.1.1.1	192.168.2.7	0x54f8	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.515759945 CET	1.1.1.1	192.168.2.7	0x54f8	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.515759945 CET	1.1.1.1	192.168.2.7	0x54f8	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.516109943 CET	1.1.1.1	192.168.2.7	0xdc61	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.524292946 CET	1.1.1.1	192.168.2.7	0x6410	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.524292946 CET	1.1.1.1	192.168.2.7	0x6410	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.524292946 CET	1.1.1.1	192.168.2.7	0x6410	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.524292946 CET	1.1.1.1	192.168.2.7	0x6410	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:43.524404049 CET	1.1.1.1	192.168.2.7	0xcbe7	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:49.942199945 CET	1.1.1.1	192.168.2.7	0xd4b9	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:49.942199945 CET	1.1.1.1	192.168.2.7	0xd4b9	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:49.942199945 CET	1.1.1.1	192.168.2.7	0xd4b9	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:49.942199945 CET	1.1.1.1	192.168.2.7	0xd4b9	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:49.969575882 CET	1.1.1.1	192.168.2.7	0x50d8	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:49.969575882 CET	1.1.1.1	192.168.2.7	0x50d8	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:49.969575882 CET	1.1.1.1	192.168.2.7	0x50d8	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:49.969575882 CET	1.1.1.1	192.168.2.7	0x50d8	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:49.986177921 CET	1.1.1.1	192.168.2.7	0x93b5	No error (0)	normandy.cdn.mozilla.net	normandy.tombstone.experimenter.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:49.986177921 CET	1.1.1.1	192.168.2.7	0x93b5	No error (0)	normandy.tombstone.experimenter.prod.webservices.mozgcp.net		34.49.51.44	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:49.989765882 CET	1.1.1.1	192.168.2.7	0x117	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Feb 24, 2025 18:44:49.989765882 CET	1.1.1.1	192.168.2.7	0x117	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Feb 24, 2025 18:44:49.989765882 CET	1.1.1.1	192.168.2.7	0x117	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Feb 24, 2025 18:44:49.989765882 CET	1.1.1.1	192.168.2.7	0x117	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Feb 24, 2025 18:44:50.006661892 CET	1.1.1.1	192.168.2.7	0x7ff0	No error (0)	normandy.tombstone.experimenter.prod.webservices.mozgcp.net		34.49.51.44	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:50.387806892 CET	1.1.1.1	192.168.2.7	0x1ab3	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:50.387806892 CET	1.1.1.1	192.168.2.7	0x1ab3	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:50.387806892 CET	1.1.1.1	192.168.2.7	0x1ab3	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:50.469571114 CET	1.1.1.1	192.168.2.7	0x768b	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:50.469571114 CET	1.1.1.1	192.168.2.7	0x768b	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:50.979331017 CET	1.1.1.1	192.168.2.7	0xc442	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:50.979331017 CET	1.1.1.1	192.168.2.7	0xc442	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:50.979331017 CET	1.1.1.1	192.168.2.7	0xc442	No error (0)	a17.rackcdn.com.mdc.edgesuite.net	a19.dscg10.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:44:50.979331017 CET	1.1.1.1	192.168.2.7	0xc442	No error (0)	a19.dscg10.akamai.net		2.22.61.59	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:50.979331017 CET	1.1.1.1	192.168.2.7	0xc442	No error (0)	a19.dscg10.akamai.net		2.22.61.56	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:50.990283966 CET	1.1.1.1	192.168.2.7	0xbb4	No error (0)	a19.dscg10.akamai.net		2.22.61.59	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:50.990283966 CET	1.1.1.1	192.168.2.7	0xbb4	No error (0)	a19.dscg10.akamai.net		2.22.61.56	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:44:50.999902964 CET	1.1.1.1	192.168.2.7	0x47d0	No error (0)	a19.dscg10.akamai.net			28	IN (0x0001)	false
Feb 24, 2025 18:44:50.999902964 CET	1.1.1.1	192.168.2.7	0x47d0	No error (0)	a19.dscg10.akamai.net			28	IN (0x0001)	false
Feb 24, 2025 18:45:14.872009039 CET	1.1.1.1	192.168.2.7	0x30bd	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:45:55.375956059 CET	1.1.1.1	192.168.2.7	0xdc23	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Feb 24, 2025 18:45:55.898638010 CET	1.1.1.1	192.168.2.7	0xc785	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:45:55.898638010 CET	1.1.1.1	192.168.2.7	0xc785	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 24, 2025 18:45:55.898638010 CET	1.1.1.1	192.168.2.7	0xc785	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

detectportal.firefox.com

ciscobinary.openh264.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49737	34.107.221.82	80	8188	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Feb 24, 2025 18:44:23.317194939 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 24, 2025 18:44:23.765065908 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 05:28:45 GMT Age: 44138 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49750	34.107.221.82	80	8188	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Feb 24, 2025 18:44:24.287175894 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:44:24.750807047 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 24 Feb 2025 04:21:08 GMT Age: 48196 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49751	34.107.221.82	80	8188	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Feb 24, 2025 18:44:24.325877905 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 24, 2025 18:44:24.782305002 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46333 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49764	34.107.221.82	80	8188	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Feb 24, 2025 18:44:25.459603071 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:44:25.935364008 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:17 GMT Age: 46328 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 24, 2025 18:44:29.591097116 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:44:29.689068079 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:17 GMT Age: 46332 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 24, 2025 18:44:30.423531055 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:44:30.520021915 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:17 GMT Age: 46333 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 24, 2025 18:44:36.068547964 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:44:36.165281057 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:17 GMT Age: 46339 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 24, 2025 18:44:36.585844040 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:44:36.684640884 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:17 GMT Age: 46339 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 24, 2025 18:44:36.854108095 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:44:36.959153891 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:17 GMT Age: 46339 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 24, 2025 18:44:39.586447001 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:44:39.712045908 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:17 GMT Age: 46342 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 24, 2025 18:44:41.707338095 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:44:41.805227041 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:17 GMT Age: 46344 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 24, 2025 18:44:44.080014944 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:44:44.177166939 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:17 GMT Age: 46347 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 24, 2025 18:44:44.609496117 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:44:44.707075119 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:17 GMT Age: 46347 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 24, 2025 18:44:45.106075048 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:44:45.203042984 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:17 GMT Age: 46348 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 24, 2025 18:44:45.611172915 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:44:45.708264112 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:17 GMT Age: 46348 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 24, 2025 18:44:46.111735106 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:44:46.208534002 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:17 GMT Age: 46349 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 24, 2025 18:44:50.508618116 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:44:50.605293036 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:17 GMT Age: 46353 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 24, 2025 18:44:50.632584095 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:44:50.729336023 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:17 GMT Age: 46353 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 24, 2025 18:44:51.069175005 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:44:51.165889025 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:17 GMT Age: 46354 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 24, 2025 18:44:54.823343039 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:44:54.920780897 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:17 GMT Age: 46357 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 24, 2025 18:45:04.931133032 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 24, 2025 18:45:14.944503069 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 24, 2025 18:45:15.469063044 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:45:15.778116941 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:45:16.379937887 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:45:16.597985029 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:17 GMT Age: 46379 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 24, 2025 18:45:20.798165083 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:45:20.894640923 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:17 GMT Age: 46383 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 24, 2025 18:45:21.583672047 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:45:21.682657957 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:17 GMT Age: 46384 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 24, 2025 18:45:31.694557905 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 24, 2025 18:45:41.702960968 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 24, 2025 18:45:51.714835882 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 24, 2025 18:45:55.999063015 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Feb 24, 2025 18:45:56.098500967 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:17 GMT Age: 46419 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Feb 24, 2025 18:46:06.111299992 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 24, 2025 18:46:16.118056059 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49767	34.107.221.82	80	8188	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Feb 24, 2025 18:44:25.682554007 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 24, 2025 18:44:26.155710936 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46335 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:44:29.591701984 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 24, 2025 18:44:29.695410967 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46338 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:44:35.570954084 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 24, 2025 18:44:35.671255112 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46344 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:44:36.069761038 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 24, 2025 18:44:36.171350002 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46345 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:44:36.749105930 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 24, 2025 18:44:36.849734068 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46345 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:44:37.301151037 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 24, 2025 18:44:37.401381016 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46346 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:44:40.892013073 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 24, 2025 18:44:41.033049107 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46349 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:44:43.972464085 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 24, 2025 18:44:44.076662064 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46353 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:44:44.502288103 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 24, 2025 18:44:44.603140116 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46353 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:44:44.995807886 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 24, 2025 18:44:45.096544981 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46354 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:44:45.506453991 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 24, 2025 18:44:45.608556986 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46354 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:44:46.007075071 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 24, 2025 18:44:46.107516050 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46355 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:44:50.380155087 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 24, 2025 18:44:50.503927946 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46359 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:44:50.528875113 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 24, 2025 18:44:50.629232883 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46359 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:44:50.965214014 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 24, 2025 18:44:51.065661907 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46360 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:44:54.711988926 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 24, 2025 18:44:54.812313080 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46363 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:45:04.815232038 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 24, 2025 18:45:14.822093010 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 24, 2025 18:45:15.365362883 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 24, 2025 18:45:15.465650082 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46384 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:45:16.504563093 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46384 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:45:16.505028963 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46384 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:45:16.505625010 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46384 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:45:20.639681101 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 24, 2025 18:45:20.740222931 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46389 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:45:21.305110931 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 24, 2025 18:45:21.407211065 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46390 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:45:31.409169912 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 24, 2025 18:45:41.424181938 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 24, 2025 18:45:51.451703072 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 24, 2025 18:45:55.890522003 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Feb 24, 2025 18:45:55.991065979 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 24 Feb 2025 04:52:11 GMT Age: 46424 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Feb 24, 2025 18:46:05.995563030 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 24, 2025 18:46:16.005089998 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49956	2.22.61.59	80	8188	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Feb 24, 2025 18:44:50.985662937 CET	305	OUT	GET /openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip HTTP/1.1 Host: ciscobinary.openh264.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive
Feb 24, 2025 18:44:51.588255882 CET	1236	IN	HTTP/1.1 200 OK Last-Modified: Fri, 07 Feb 2025 06:55:57 GMT ETag: 85430baed3398695717b0263807cf97c Content-Length: 453023 Accept-Ranges: bytes X-Timestamp: 1738911356.44453 Content-Type: application/zip X-Trans-Id: txf36a3cdb14a04fca91417-0067a71e89dfw1 Cache-Control: public, max-age=163835 Expires: Wed, 26 Feb 2025 15:15:26 GMT Date: Mon, 24 Feb 2025 17:44:51 GMT Connection: keep-alive Data Raw: 50 4b 03 04 14 00 00 00 08 00 cd 8d 62 4e d0 b9 df e8 52 e8 06 00 d0 97 0f 00 0f 00 00 00 67 6d 70 6f 70 65 6e 68 32 36 34 2e 64 6c 6c ec bd 0b 7c 14 45 b6 30 de 3d 99 84 49 98 a4 07 8c 18 31 c2 e8 ce ea 34 66 31 71 e3 9a 60 d4 e9 d0 93 f4 e0 04 c2 d3 80 88 71 a3 b9 a0 08 11 27 2b b8 10 08 93 68 2a 6d 7b d9 bb 7a d7 dd 6f 5f ff 7b 77 ef dd e7 c5 bd ee f2 d0 95 cc 24 92 07 28 24 41 21 c0 8a 11 7c 4c 18 81 00 42 26 41 32 ff 73 aa 7b 9e 04 44 64 f7 ff dd ff f7 f1 63 d2 55 d5 55 e7 d4 39 75 ce a9 53 a7 aa bb 4b 16 6c 60 12 18 86 d1 c3 2f 18 64 98 2d 8c fa cf c6 7c f9 bf 00 fc d2 26 be 9e c6 fc 39 f9 9d 9b b6 b0 ce 77 6e 9a b3 78 c9 d3 e6 aa 15 cb ff 69 c5 23 4f 9a 2b 1e 59 b6 6c b9 cb fc dd c7 cc 2b aa 97 99 97 2c 33 8b 33 66 9b 9f 5c fe e8 63 93 53 53 53 2c 1a 8c e9 d2 cf b7 a4 f0 fd fe d0 ef b1 92 cf 8f 4e a4 d7 d3 47 47 d1 eb 99 a3 ff 46 af 27 8f 26 d3 3a 27 fd 4b e0 5a 26 9c 3e 9a 40 af 67 8e de 4d af 9f 1f 4d d7 60 fc 13 fc 2a 84 fe a3 a3 e9 f5 14 bd ce 5a 52 b1 18 ef 85 fa 5e 6a 67 98 47 9f 4b 62 [TRUNCATED] Data Ascii: PKbNRgmpopenh264.dll\|E0=I14f1q`q'+hm{zo_{w$($A!\|LB&A2s{DdcUU9uSKl`/d-\|&9wnxi#O+Yl+,33f\cSSS,NGGF'&:'KZ&>@gMM`ZR^jgGKbo~va<Z1.#OeDXi$imBWQ&P,M,:c-\-iKI4a6Ov=WFCH>a'x#@fdu1OV1o}g5_3JHiZipM.bZ%GF/3qJo%gN})3N%!q^Im~6#~+AI]rx<IYjp0`SM@Ef=;!@EE 0nJdduM-qIlRz=}rDXLZx$\|c1cUkM&Qn]a]th!6 7JdDvKJ"Wgd*%nwJniinmr@M$'Zs#)%
Feb 24, 2025 18:44:51.588272095 CET	224	IN	Data Raw: bd c1 52 73 bd a7 3a 09 68 e9 f5 eb 80 14 52 9c 01 ad ef 5c 1f 81 74 b2 36 16 12 27 91 67 cc 95 dc 09 0f a4 8b f3 f0 8f 55 6a 2b 46 bd 63 72 3a 7c 07 a7 21 9f 8a 4b e1 57 c6 59 13 b3 a0 31 37 a6 b8 aa ad b8 02 2c f5 8a b6 e2 72 f1 b1 8a e5 ad c5 Data Ascii: Rs:hR\t6'gUj+Fcr:\|!KWY17,r>N3RY_\IrDNJdM k&V-z%-Di&672T)>0%&;`Zc,)T;jI~yRr&=V4C\|-h(*
Feb 24, 2025 18:44:51.588284016 CET	1236	IN	Data Raw: 06 64 49 55 6b 71 39 03 cc 5b bd 1e c5 ad 18 08 99 01 64 76 b8 80 d1 6c b0 34 03 07 d7 8c dd f7 4d 74 62 ff 2e 6f 7c 6f 8f 1a 95 27 9e bb e8 f8 4a 19 5f 3a be 0f d5 47 20 8d a9 bf c4 f8 5a db 8a f3 10 2c a6 a1 43 c5 a5 da 30 7f 2e d1 61 2e 83 5f Data Ascii: dIUkq9[dvl4Mtb.o\|o'J_:G Z,C0.a._9}-mOy9sC0/a?wJWxekb!.b-iE,.rtRbEc>2`<)mD+< A*Py(L"InI%eHL`
Feb 24, 2025 18:44:51.588295937 CET	224	IN	Data Raw: 27 82 06 a5 3a a8 f8 40 7f 56 1a a4 36 9b ea 9c 12 f0 c4 14 c9 e4 fb 0b b5 66 76 ec 61 29 f5 e2 47 90 5f 10 ca c7 4b a1 17 fd be 3d 67 54 13 97 1d bf 1a 0a f9 3b 73 43 1e cf 2b b1 1e 8f 09 c9 29 21 bb 1c e4 3d 07 d9 ed bb 3d 91 96 1a 54 f3 5a 42 Data Ascii: ':@V6fva)G_K=gT;sC+)!==TZB6}jC3NZtSnp$KUl'}U IN~\+PU^Kt:u*;I/l`%s^9pD<No\|&zc%Z}n
Feb 24, 2025 18:44:51.589582920 CET	1236	IN	Data Raw: 65 e2 0d ce 32 21 19 aa db 2d d7 98 d0 d6 7e 3b ca d6 1a a8 31 35 44 db da 9b c0 63 78 25 ec 31 3c a4 ce da e1 9a 60 76 3f 50 67 39 d5 2d 33 f9 3b a3 fc 87 b9 21 0f 42 0a 7b 10 2a 72 31 84 fc a6 4b 22 af ce f4 a7 46 a3 4a 8d 41 85 e3 2f c5 74 2b Data Ascii: e2!-~;15Dcx%1<`v?Pg9-3;!B{r1K"FJA/t+j72~coyFG1lARYJoiwDJ+ujuDHYl(deTeIzG`TNjhb[NjHT$S.vRh(5;\|3ph{v::
Feb 24, 2025 18:44:51.589596033 CET	1236	IN	Data Raw: 7f b5 c6 f8 af a3 3f bd 4a fe eb 73 89 97 f6 df 2a 13 43 f4 c5 5a 8a 72 8e 77 c1 3a 1f dd fd 44 dd e9 b4 48 8c b5 02 56 b1 09 ab 0c 8d f3 4b 9d f2 23 12 67 7a 2a cf 29 2f 31 01 cd d9 52 38 38 29 cf b4 3a 15 97 c5 86 fb 02 67 3e 87 79 53 9e 67 6e Data Ascii: ?JsCZrw:DHVK#gz)/1R88):g>ySgnX-P16E)XA!^8>9"Z[Q&%>+xFz^XCWr_-j&(CFSHy+IOJ}Oqc$FZz+a yj$j'8+e
Feb 24, 2025 18:44:51.589612007 CET	448	IN	Data Raw: 62 59 a1 3a 30 da 1f c7 46 38 f7 c6 ae b7 e7 c5 9f 5d a8 36 5f d5 9d 87 6c ad 47 1b 46 c6 e7 3b 33 98 32 52 3c 2a 7c ff bd 41 4d 6d c3 e7 1d cc 76 b2 cb 49 da 24 b2 93 ee 1d dc b1 15 a7 08 df 1f 0f a0 b9 ab d2 f6 0e 3e 2d d7 34 b2 0c b5 d2 2c 92 Data Ascii: bY:0F8]6_lGF;32R<\|AMmvI$>-4,kx@<w LP#a=5;byI bIj+pB1\X*%]"^\no%S<ov\|2z_gOg/n}{6{ED$Y'1ZHBF
Feb 24, 2025 18:44:51.592184067 CET	1236	IN	Data Raw: 5d a9 21 56 d8 03 7a ff 68 27 e9 2b 01 43 fe 1e e8 be 9d f4 df af a4 af 13 dc ab df cd 66 6a 36 39 14 e3 bb 20 48 d9 0e 79 f5 bb 79 0e 79 ce bb b6 9c b3 95 1b e4 82 cd c8 cf 42 b6 60 1d f8 84 06 59 ff aa db f3 05 d1 49 f2 2a 83 54 a1 df cc b6 48 Data Ascii: ]!Vzh'+Cfj69 HyyyB`YITHl3X)uugr#p<I0}UhQAg4o\|B%[XG!\(r7KGfKWj4n&(\Lrb>/rsj\|~j
Feb 24, 2025 18:44:51.592195034 CET	224	IN	Data Raw: 0e 58 3d bd ec 65 3b 48 7b e8 78 63 24 de 92 1d 7e be 44 d6 a9 15 9b d7 6d ab c2 5d 24 ae 6e 3d fc 6d e8 52 b2 92 dd db 75 a2 fc a2 0b f7 d0 f2 df 71 99 c9 52 3c d7 9b 78 ff 2c b4 b8 6a 9c cf f7 c4 1f 92 19 f2 5f 58 45 4e 02 55 af 5e a0 41 71 cd Data Ascii: X=e;H{xc$~Dm]$n=mRuqR<x,j_XENU^Aq+95d>wszknfoj{>#_D]}$gzm"b]{5>I? aT=t_sPQFM{_>6!
Feb 24, 2025 18:44:51.595366955 CET	1236	IN	Data Raw: 6b 46 89 84 26 d4 1b 39 c7 88 8f 1a 55 35 f0 44 fb d3 b7 0c e8 b8 40 df f3 dc af 63 83 20 57 97 8c 0b 3b b2 d7 fd 3a 82 81 fc 20 ea 31 d8 4a 72 0a 74 dc f7 18 4c 69 ee 9a 4c 86 7b f1 43 ec 90 b2 28 0f 1f b3 ba b3 e6 81 54 d0 be 7b 3e 99 81 4f 07 Data Ascii: kF&9U5D@c W;: 1JrtLiL{C(T{>OU\|MW'\|sznz{e13d;0qkf#8kGVQYc.']X[o7DS0@:TeJ-HW~Cpli6Teu9y
Feb 24, 2025 18:44:51.596395016 CET	1236	IN	Data Raw: 97 51 f3 fa 2a 9a 57 80 64 07 48 95 68 0f 8f 50 37 a3 ef bf 42 94 1d 87 b2 e3 74 19 4a 1d 2a a4 2c e7 2b 52 86 00 05 3a 51 40 7f fd 0f ec 39 22 00 5c 9f 6a b7 7b be a2 dd 7e 23 64 b7 63 01 43 f7 ed 64 02 aa 52 c1 2c ee c5 57 61 11 a8 ff 63 c1 ad Data Ascii: QWdHhP7BtJ,+R:Q@9"\j{~#dcCdR,WacJI[hz'C\|kN?!z,#\|+XxL6}W3mr@(\|Hdp'#HdsT])g/P/s~!?R

Target ID:	0
Start time:	12:44:11
Start date:	24/02/2025
Path:	C:\Users\user\Desktop\random.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\random.exe"
Imagebase:	0xf60000
File size:	968'704 bytes
MD5 hash:	E9A8537A4EFBA5386C2A5ADF0355EB4B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:44:12
Start date:	24/02/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xe50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:44:12
Start date:	24/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:44:15
Start date:	24/02/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xe50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:44:15
Start date:	24/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:44:15
Start date:	24/02/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xe50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:44:15
Start date:	24/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x880000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:44:15
Start date:	24/02/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xe50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:44:16
Start date:	24/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:44:16
Start date:	24/02/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xe50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:44:16
Start date:	24/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:44:16
Start date:	24/02/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff722870000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:44:16
Start date:	24/02/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff722870000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:44:16
Start date:	24/02/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff722870000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	12:44:18
Start date:	24/02/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2264 -parentBuildID 20230927232528 -prefsHandle 2200 -prefMapHandle 2196 -prefsLen 25302 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba4e4ef8-aac1-4118-8c5a-3b35755e30c3} 8188 "\\.\pipe\gecko-crash-server-pipe.8188" 1aceca6e910 socket
Imagebase:	0x7ff722870000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	12:44:21
Start date:	24/02/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3960 -parentBuildID 20230927232528 -prefsHandle 3984 -prefMapHandle 3980 -prefsLen 26317 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {53f9218a-6893-4da7-89c2-5475210359ad} 8188 "\\.\pipe\gecko-crash-server-pipe.8188" 1acfecbc510 rdd
Imagebase:	0x7ff7b4ee0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	14:25:12
Start date:	24/02/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5144 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5148 -prefMapHandle 5136 -prefsLen 33202 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e2b3a79-822c-48e8-ad97-04fffcc6b6de} 8188 "\\.\pipe\gecko-crash-server-pipe.8188" 1acfec1e910 utility
Imagebase:	0x7ff722870000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report random.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_8b049b38-8205-479a-893f-35896fdca8f2.json (copy)

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_8b049b38-8205-479a-893f-35896fdca8f2.json.tmp

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

C:\Users\user\AppData\Local\Temp\tmpaddon

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\ExperimentStoreData.json (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\ExperimentStoreData.json.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addonStartup.json.lz4 (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addonStartup.json.lz4.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addons.json (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addons.json.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\content-prefs.sqlite

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\store.json.mozlz4 (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\store.json.mozlz4.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\extensions.json (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\extensions.json.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite-shm

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

Windows Analysis Report
random.exe