Edit tour

Windows Analysis Report
random.exe

Overview

General Information

Sample name:	random.exe
Analysis ID:	1665561
MD5:	55c6ac234aca077957813b6a5b94a805
SHA1:	96be80f44a36f24d32819e29af1ebdc1aca9a536
SHA256:	682121d8c7160e46c3c4bc595fdab0346ad08895b95c39f97c3afa8cd7922f8e
Tags:	exeuser-abuse_ch
Infos:

Detection

Credential Flusher

Score:	76
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Credential Flusher

Binary is likely a compiled AutoIt script file

Found API chain indicative of sandbox detection

Joe Sandbox ML detected suspicious sample

Connects to many different domains

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

OS version to string mapping found (often used in BOTs)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

random.exe (PID: 7416 cmdline: "C:\Users\user\Desktop\random.exe" MD5: 55C6AC234ACA077957813B6A5B94A805)

taskkill.exe (PID: 7564 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7700 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7768 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7828 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7892 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 7956 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7992 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8008 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7220 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2280 -parentBuildID 20230927232528 -prefsHandle 2224 -prefMapHandle 2216 -prefsLen 25358 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9a4cfab-7630-432a-b44e-2e0ea87c7258} 8008 "\\.\pipe\gecko-crash-server-pipe.8008" 22d99470310 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 1420 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4476 -parentBuildID 20230927232528 -prefsHandle 4072 -prefMapHandle 4572 -prefsLen 26308 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {60a1ac55-9c98-4e34-bd54-b295dd9a3424} 8008 "\\.\pipe\gecko-crash-server-pipe.8008" 22dab472d10 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8500 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5488 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5476 -prefMapHandle 5480 -prefsLen 33184 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5eb2eb8a-a779-4036-9ee2-0004eb96fe19} 8008 "\\.\pipe\gecko-crash-server-pipe.8008" 22d99472510 utility MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8744 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8760 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: random.exe PID: 7416	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: random.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: random.exe	Virustotal: Detection: 30%			Perma Link
Source: random.exe	ReversingLabs: Detection: 38%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 99.3%

Source: random.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.10:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.10:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.10:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.10:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.10:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.10:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.10:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.10:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.193.91:443 -> 192.168.2.10:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.10:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.10:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.10:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.10:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.10:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.10:49742 version: TLS 1.2

Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.15.dr
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.15.dr

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BBDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00BBDBBE
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B8C2A2 FindFirstFileExW,	0_2_00B8C2A2
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BC68EE FindFirstFileW,FindClose,	0_2_00BC68EE
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BC698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00BC698F
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BBD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00BBD076
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BBD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00BBD3A9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BC9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00BC9642
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BC979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00BC979D
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BC9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00BC9B2B
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BC5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00BC5C97

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 217MB

Source: unknown

Network traffic detected: DNS query count 33

Source: Joe Sandbox View	IP Address: 34.149.100.209 34.149.100.209
Source: Joe Sandbox View	IP Address: 34.49.51.44 34.49.51.44
Source: Joe Sandbox View	IP Address: 151.101.193.91 151.101.193.91
Source: Joe Sandbox View	IP Address: 34.160.144.191 34.160.144.191

Source: Joe Sandbox View

JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00BCCE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

0_2_00BCCE44

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKLast-Modified: Wed, 12 Mar 2025 04:19:28 GMTETag: 85430baed3398695717b0263807cf97cContent-Length: 453023Accept-Ranges: bytesX-Timestamp: 1741753167.65917Content-Type: application/zipX-Trans-Id: tx01b3942a3e444fe795adb-0067d453d3dfw1Cache-Control: public, max-age=64201Expires: Wed, 16 Apr 2025 08:55:16 GMTDate: Tue, 15 Apr 2025 15:05:15 GMTConnection: keep-aliveData Raw: 50 4b 03 04 14 00 00 00 08 00 cd 8d 62 4e d0 b9 df e8 52 e8 06 00 d0 97 0f 00 0f 00 00 00 67 6d 70 6f 70 65 6e 68 32 36 34 2e 64 6c 6c ec bd 0b 7c 14 45 b6 30 de 3d 99 84 49 98 a4 07 8c 18 31 c2 e8 ce ea 34 66 31 71 e3 9a 60 d4 e9 d0 93 f4 e0 04 c2 d3 80 88 71 a3 b9 a0 08 11 27 2b b8 10 08 93 68 2a 6d 7b d9 bb 7a d7 dd 6f 5f ff 7b 77 ef dd e7 c5 bd ee f2 d0 95 cc 24 92 07 28 24 41 21 c0 8a 11 7c 4c 18 81 00 42 26 41 32 ff 73 aa 7b 9e 04 44 64 f7 ff dd ff f7 f1 63 d2 55 d5 55 e7 d4 39 75 ce a9 53 a7 aa bb 4b 16 6c 60 12 18 86 d1 c3 2f 18 64 98 2d 8c fa cf c6 7c f9 bf 00 fc d2 26 be 9e c6 fc 39 f9 9d 9b b6 b0 ce 77 6e 9a b3 78 c9 d3 e6 aa 15 cb ff 69 c5 23 4f 9a 2b 1e 59 b6 6c b9 cb fc dd c7 cc 2b aa 97 99 97 2c 33 8b 33 66 9b 9f 5c fe e8 63 93 53 53 53 2c 1a 8c e9 d2 cf b7 a4 f0 fd fe d0 ef b1 92 cf 8f 4e a4 d7 d3 47 47 d1 eb 99 a3 ff 46 af 27 8f 26 d3 3a 27 fd 4b e0 5a 26 9c 3e 9a 40 af 67 8e de 4d af 9f 1f 4d d7 60 fc 13 fc 2a 84 fe a3 a3 e9 f5 14 bd ce 5a 52 b1 18 ef 85 fa 5e 6a 67 98 47 9f 4b 62 8e 6f 7e 76 61 a8 ac 9f b9 d9 3c 5a 97 c6 31 2e 23 c3 8c 4f a0 65 19 99 a3 19 c6 44 93 eb 58 fc 8b 69 1d c3 24 69 6d 42 57 c6 c3 51 26 be ba c1 04 b7 cb d9 50 a3 d0 e5 c2 bc 9a 2c 4d e4 98 2c a8 bd 3a 89 63 ac d1 cc 2d e5 98 0d 12 5c 9f e5 98 ce 1b e1 fa 2a c7 d4 01 8a ce 2d 69 cc 9c 4b 8c 49 f6 d6 34 86 61 a3 0a 36 18 99 2a dd c5 eb 4f 76 3d b6 d2 05 57 cb d3 46 b5 43 48 bb 3e b6 8e 99 61 ca 27 af 78 f4 11 d7 23 40 66 8d 8e c2 64 d6 c1 75 a5 31 a6 9e 0d fe 4f 56 ab 31 6f 7d 1b 09 84 0e 67 c2 35 90 16 5f cf 33 b9 4a ad 48 69 04 5a 99 69 70 4d e7 2e 84 b7 62 b9 5a 11 86 81 f9 25 dc 47 94 8b 46 aa f7 d8 d2 e5 15 0c e5 11 f2 8a d2 f2 f8 05 f5 0a 2f ce 89 ff 33 ff 71 9b d9 4a af c7 d0 f2 b6 f6 6f de 03 b3 25 f7 67 d9 4e d2 2a 91 7d 12 d9 29 c9 33 0d 4e 25 f1 21 b7 91 71 2a a9 0b e0 e2 eb b8 8b 81 b4 f1 5e 49 9e 6d 90 c8 7e 07 09 f8 36 dd 85 23 e9 7e 2b fb c1 87 17 85 41 d1 7f 12 49 5d 72 03 c7 e4 78 b4 e2 b9 2a 82 3c 49 59 6a c9 96 da ec cc 70 30 18 8c 60 53 ae 4d 40 14 45 f7 8f 66 ea 3d ae 3b 21 cf 40 1e b0 f8 be 0d 45 c4 bb 05 45 bb be a3 fa 9e ad 1b 20 e1 9b 9c 30 1a 6e da 03 12 f1 4a 64 c8 b7 1c 64 d2 7f fd d6 06 bc 75 4d ec 2d 94 71 49 c6 6c 52 8e 07 7a 9a 07 3d 7d a8 a5 72 83 44 e6 58 4c 5a a7 ac 92 f2 78 b6 24 97 04 7c 63 a1 31 d2 63 55 6b 4d e6 26 d6 51 6e 5d ac fe 61 5d 74 fd 68 fa a1 2a d4 b4 21 b9 36 20 37 80 e4 4a 64 af 44 76 4b 4a 22 57 67 64 2a 25 6e 99 07 d2 bf 77 ab e9 f6 4a 6e 69 fb 69 6e 6d 72 9b 40 4d 85 24 27 5a c7 73 8c 04 ec 18 23 29 25 bd c1 52 73 bd a7 3a 09 68 e9 f5 eb 80 14 52 9c 01 ad ef 5c 1f 81 74 b2 36 16 12 27 91 67 cc 95

Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip HTTP/1.1Host: ciscobinary.openh264.orgUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 0000000F.00000003.1462512292.0000022DAA396000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000F.00000003.1408987170.0000022DACDE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000F.00000003.1409416774.0000022DAC8D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000F.00000003.1445783511.0000022DAAECD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1473348000.0000022DA9C8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1448562348.0000022DAA6A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000F.00000003.1315415007.0000022DB1554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000F.00000003.1315415007.0000022DB1554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000F.00000003.1408987170.0000022DACDE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000F.00000003.1409416774.0000022DAC8D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000F.00000003.1466081932.0000022DA8CF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7D0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2460604387.000002667B60C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000F.00000003.1466081932.0000022DA8CF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7D0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2460604387.000002667B60C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000000F.00000003.1466081932.0000022DA8CF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7D0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2460604387.000002667B60C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000F.00000003.1448223929.0000022DAA8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: moz-extension://63b8d1fe-2818-4af4-9d2c-02d7e2688d62/injections/js/bug1842437-www.youtube.com-performance-now-precision.js equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000F.00000003.1432600198.0000022DB2959000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1445783511.0000022DAAECD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1406381203.0000022DB2959000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000F.00000003.1450095570.0000022DA95F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000F.00000003.1432600198.0000022DB2959000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1406381203.0000022DB2959000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com- equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000F.00000003.1473348000.0000022DA9C8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1449533424.0000022DA97AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1450095570.0000022DA95DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: mc.prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: shavar.prod.mozaws.net
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy.tombstone.experimenter.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: a19.dscg10.akamai.net

Source: firefox.exe, 0000000F.00000003.1474564952.0000022DA8F75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1448223929.0000022DAA8DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1409416774.0000022DAC8C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1438191605.0000022DAC8C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1459738743.0000022DAA8E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: firefox.exe, 0000000F.00000003.1472424165.0000022DAA3F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 0000000F.00000003.1472424165.0000022DAA3F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 0000000F.00000003.1472424165.0000022DAA3F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 0000000F.00000003.1472424165.0000022DAA3F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: firefox.exe, 0000000F.00000003.1481380846.0000022DA6AC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481380846.0000022DA6AD5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481668171.0000022DA6ACC000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.15.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: firefox.exe, 0000000F.00000003.1481380846.0000022DA6AC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481380846.0000022DA6AD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: firefox.exe, 0000000F.00000003.1481380846.0000022DA6AC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481380846.0000022DA6AD5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481668171.0000022DA6ACC000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.15.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: firefox.exe, 0000000F.00000003.1481380846.0000022DA6AC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: firefox.exe, 0000000F.00000003.1481380846.0000022DA6AC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481380846.0000022DA6AD5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481668171.0000022DA6ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: gmpopenh264.dll.tmp.15.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: firefox.exe, 0000000F.00000003.1481380846.0000022DA6AC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481380846.0000022DA6AD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: firefox.exe, 0000000F.00000003.1481380846.0000022DA6AC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481380846.0000022DA6AD5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481668171.0000022DA6ACC000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.15.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: firefox.exe, 0000000F.00000003.1481380846.0000022DA6AC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: firefox.exe, 0000000F.00000003.1481380846.0000022DA6AC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481380846.0000022DA6AD5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481668171.0000022DA6ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: firefox.exe, 0000000F.00000003.1481380846.0000022DA6AC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481380846.0000022DA6AD5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481668171.0000022DA6ACC000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.15.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: firefox.exe, 0000000F.00000003.1481380846.0000022DA6AC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481380846.0000022DA6AD5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481668171.0000022DA6ACC000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.15.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: firefox.exe, 0000000F.00000003.1481380846.0000022DA6AC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481380846.0000022DA6AD5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481668171.0000022DA6ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: gmpopenh264.dll.tmp.15.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: firefox.exe, 0000000F.00000003.1424924577.0000022DB16FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1453688735.0000022DACD1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000000F.00000003.1434057215.0000022DB166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 0000000F.00000003.1316374363.0000022DAB4A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1448167732.0000022DAAB22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000000F.00000003.1458419539.0000022DAABB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1437672371.0000022DACDE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1459639225.0000022DAAB11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1448167732.0000022DAAB22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000000F.00000003.1458419539.0000022DAABB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1459639225.0000022DAAB11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1448167732.0000022DAAB22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000000F.00000003.1431114121.0000022DB374D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1451365334.0000022DB376D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.comP
Source: firefox.exe, 0000000F.00000003.1449129088.0000022DA9BD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1449129088.0000022DA9B7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1456165862.0000018CA4691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 0000001A.00000002.1470797268.0000018CA4340000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 0000000F.00000003.1449129088.0000022DA9BD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1449129088.0000022DA9B7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1456165862.0000018CA4691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 0000001A.00000002.1470797268.0000018CA4340000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 0000001A.00000003.1465604639.0000018CA45A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1461190818.0000018CA45A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 0000001A.00000002.1471761609.0000018CA455F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times$
Source: firefox.exe, 0000001A.00000003.1465604639.0000018CA45A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1461190818.0000018CA45A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 0000001A.00000002.1471761609.0000018CA455F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 0000001A.00000003.1465604639.0000018CA45A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1461190818.0000018CA45A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 0000001A.00000002.1467950001.0000018C98C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/strings
Source: firefox.exe, 0000000F.00000003.1401551077.0000022DAA558000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1397634343.0000022DAA54E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1391905242.0000022DAA54D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1403619225.0000022DAA558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 0000000F.00000003.1462512292.0000022DAA3E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/
Source: firefox.exe, 0000000F.00000003.1442372490.0000022DAB8F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1436847956.0000022DB1193000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1316226576.0000022DAB4E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1468165781.0000022DAC7EC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1309891916.0000022DB1298000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1388042375.0000022DAAC55000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1309242370.0000022DB12A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1391400383.0000022DAA7B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1408987170.0000022DACDE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1269949773.0000022DA94FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1365429543.0000022DAA9AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1374595154.0000022DACBE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1261903579.0000022DA914F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1316226576.0000022DAB4D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1409416774.0000022DAC82E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1412813577.0000022DA94D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1419052947.0000022DA914F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363210111.0000022DAA2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1359141376.0000022DAA1E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363978887.0000022DAC3CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1448223929.0000022DAA8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 0000000F.00000003.1481380846.0000022DA6AC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481380846.0000022DA6AD5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481668171.0000022DA6ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: firefox.exe, 0000000F.00000003.1481380846.0000022DA6AC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481380846.0000022DA6AD5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481668171.0000022DA6ACC000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.15.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: firefox.exe, 0000000F.00000003.1481380846.0000022DA6AC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481380846.0000022DA6AD5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481668171.0000022DA6ACC000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.15.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: firefox.exe, 0000000F.00000003.1481380846.0000022DA6AC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: gmpopenh264.dll.tmp.15.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: firefox.exe, 0000000F.00000003.1408338489.0000022DB11AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 0000000F.00000003.1408338489.0000022DB11AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 0000000F.00000003.1408338489.0000022DB11AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: gmpopenh264.dll.tmp.15.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: gmpopenh264.dll.tmp.15.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: gmpopenh264.dll.tmp.15.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: firefox.exe, 0000000F.00000003.1481380846.0000022DA6AC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481380846.0000022DA6AD5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481668171.0000022DA6ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: gmpopenh264.dll.tmp.15.dr	String found in binary or memory: http://www.mozilla.com0
Source: firefox.exe, 0000000F.00000003.1472424165.0000022DAA3F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 0000000F.00000003.1465679597.0000022DA8E5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1444438764.0000022DAB598000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1450347633.0000022DA955A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1437672371.0000022DACDE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000000F.00000003.1444438764.0000022DAB598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulL0
Source: mozilla-temp-41.15.dr	String found in binary or memory: http://www.videolan.org/x264.html
Source: firefox.exe, 0000000F.00000003.1408338489.0000022DB11AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: firefox.exe, 0000000F.00000003.1408338489.0000022DB11AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000000F.00000003.1460482772.0000022DAA4D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: firefox.exe, 0000000F.00000003.1329905851.0000022DB16AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 0000000F.00000003.1474517368.0000022DA8FEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000000F.00000003.1435323319.0000022DB13B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1452926409.0000022DB13B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1425372596.0000022DB13B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 0000000F.00000003.1316374363.0000022DAB471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000000F.00000003.1466081932.0000022DA8CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000000F.00000003.1432600198.0000022DB2959000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1406381203.0000022DB2959000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/enhancer-for-youtube/
Source: firefox.exe, 0000000F.00000003.1432600198.0000022DB2959000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1406381203.0000022DB2959000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/facebook-container/
Source: firefox.exe, 0000000F.00000003.1432600198.0000022DB2959000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1406381203.0000022DB2959000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/reddit-enhancement-suite/
Source: firefox.exe, 0000000F.00000003.1432600198.0000022DB2959000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1406381203.0000022DB2959000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/to-google-translate/
Source: firefox.exe, 0000000F.00000003.1432600198.0000022DB2959000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1406381203.0000022DB2959000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/wikipedia-context-menu-search/
Source: firefox.exe, 0000000F.00000003.1473348000.0000022DA9C8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1449533424.0000022DA97AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1450095570.0000022DA95DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000000F.00000003.1452127612.0000022DB15E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000000F.00000003.1405863094.0000022DB29A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
Source: firefox.exe, 0000000F.00000003.1405863094.0000022DB29A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.adjust.com/a8bxj8j?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000000F.00000003.1459808735.0000022DAA893000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000000F.00000003.1451961664.0000022DB1627000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000000F.00000003.1448223929.0000022DAA8DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1409416774.0000022DAC8C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1435323319.0000022DB1343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1438191605.0000022DAC8C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1453051812.0000022DB1343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1425372596.0000022DB134B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1459738743.0000022DAA8E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: firefox.exe, 00000010.00000002.2460227436.000002B1BC1C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7DF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2463961928.000002667B803000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.15.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700
Source: firefox.exe, 00000010.00000002.2460227436.000002B1BC1C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7DF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2463961928.000002667B803000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.15.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700002.1&cta
Source: firefox.exe, 0000000F.00000003.1411559933.0000022DAC5CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000000F.00000003.1397634343.0000022DAA54E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1207993
Source: firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: firefox.exe, 0000000F.00000003.1403991415.0000022DAAC38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=840161
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000000F.00000003.1260479237.0000022DA9177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260004994.0000022DA911F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260145797.0000022DA913C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1259841912.0000022DA8F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260297563.0000022DA915A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000000F.00000003.1465528437.0000022DA8FEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1474517368.0000022DA8FEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 0000000F.00000003.1452926409.0000022DB13AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1425372596.0000022DB1393000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1435323319.0000022DB1393000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: firefox.exe, 00000010.00000002.2460227436.000002B1BC1C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7DF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2463961928.000002667B803000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.15.dr	String found in binary or memory: https://contile-images.services.mozilla.com/5b4DH7KHAf2n_mNaLjNi1-UAoKmM9rhqaA9w7FyznHo.10943.jpg
Source: firefox.exe, 00000010.00000002.2460227436.000002B1BC1C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7DF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2463961928.000002667B803000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.15.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000000F.00000003.1452836765.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1435323319.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1425372596.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 0000000F.00000003.1425372596.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 0000000F.00000003.1425372596.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000000F.00000003.1309967111.0000022DB124C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1416570611.0000022DB124E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1393656259.0000022DB124A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1478447992.0000022DB1244000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000000F.00000003.1465679597.0000022DA8E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://datastudio.google.com/embed/reporting/
Source: firefox.exe, 0000000F.00000003.1449129088.0000022DA9BD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1449129088.0000022DA9B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 0000000F.00000003.1449129088.0000022DA9B8C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1456165862.0000018CA46B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc
Source: firefox.exe, 0000001A.00000002.1470797268.0000018CA4340000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 0000000F.00000003.1449129088.0000022DA9B7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1456165862.0000018CA46A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1456165862.0000018CA46A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 0000001A.00000002.1470797268.0000018CA4340000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 0000001A.00000002.1470797268.0000018CA4340000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 0000000F.00000003.1449129088.0000022DA9BD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1449129088.0000022DA9B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 0000000F.00000003.1449129088.0000022DA9B8C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1456165862.0000018CA46A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureElementReleaseCaptureWarningElem
Source: firefox.exe, 0000001A.00000002.1470797268.0000018CA4340000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 0000000F.00000003.1449129088.0000022DA9BD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1449129088.0000022DA9B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 0000000F.00000003.1449129088.0000022DA9B8C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1456165862.0000018CA4691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#EncryptionPreventDefaultFromP
Source: firefox.exe, 0000001A.00000002.1470797268.0000018CA4340000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 0000000F.00000003.1449129088.0000022DA9BD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1449129088.0000022DA9B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 0000001A.00000003.1456165862.0000018CA4691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored
Source: firefox.exe, 0000001A.00000002.1470797268.0000018CA4340000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 0000000F.00000003.1365429543.0000022DAA9AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 0000000F.00000003.1309967111.0000022DB124C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1416570611.0000022DB124E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1393656259.0000022DB124A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1478447992.0000022DB1244000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000000F.00000003.1309967111.0000022DB124C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1416570611.0000022DB124E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1393656259.0000022DB124A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1478447992.0000022DB1244000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000000F.00000003.1309967111.0000022DB124C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1416570611.0000022DB124E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1393656259.0000022DB124A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1478447992.0000022DB1244000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000000F.00000003.1425210587.0000022DB15FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1447341980.0000022DAAB53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1390347112.0000022DAA9DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260479237.0000022DA9177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1365429543.0000022DAA9DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1458487043.0000022DAAB53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260004994.0000022DA911F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260145797.0000022DA913C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1259841912.0000022DA8F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1452127612.0000022DB15FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260297563.0000022DA915A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 0000000F.00000003.1262908853.0000022DA751D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1262063299.0000022DA7533000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1263223477.0000022DA7533000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000000F.00000003.1262908853.0000022DA751D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1262063299.0000022DA7533000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1263223477.0000022DA7533000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000000F.00000003.1449129088.0000022DA9B8C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1449129088.0000022DA9BD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1449129088.0000022DA9B7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1456165862.0000018CA46A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 0000001A.00000002.1470797268.0000018CA4340000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 0000000F.00000003.1431114121.0000022DB374D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1451240528.0000022DB378B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1466698106.0000022DB37EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1437761439.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7D12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2460604387.000002667B613000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000000F.00000003.1317533600.0000022DAA526000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 0000000F.00000003.1320060920.0000022DAA52B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1317533600.0000022DAA556000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1317533600.0000022DAA526000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000000F.00000003.1464169564.0000022DA9B3B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1473988667.0000022DA9B3B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.1470349066.0000018C9A6C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000000F.00000003.1449374104.0000022DA9AED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1452127612.0000022DB15FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com
Source: firefox.exe, 0000000F.00000003.1474564952.0000022DA8FD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/
Source: firefox.exe, 0000000F.00000003.1465679597.0000022DA8E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000000F.00000003.1431114121.0000022DB374D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1451240528.0000022DB378B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1466698106.0000022DB37EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1437761439.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7D12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2460604387.000002667B613000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000000F.00000003.1425372596.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7DC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2460604387.000002667B6C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000000F.00000003.1437761439.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1316374363.0000022DAB471000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7DC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2460604387.000002667B6C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1455175119.0000022DAB9A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7D2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2460604387.000002667B630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000000F.00000003.1452836765.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1435323319.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1425372596.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 0000000F.00000003.1452836765.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1435323319.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1425372596.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 0000000F.00000003.1452836765.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1435323319.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1425372596.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 0000000F.00000003.1452836765.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1435323319.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1425372596.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 0000000F.00000003.1452836765.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1435323319.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1425372596.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 0000000F.00000003.1452836765.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1435323319.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1425372596.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 0000000F.00000003.1452836765.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1435323319.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1425372596.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 0000000F.00000003.1316374363.0000022DAB471000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7DC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2460604387.000002667B6C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000000F.00000003.1437761439.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 0000000F.00000003.1452836765.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1435323319.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1425372596.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 0000000F.00000003.1425372596.0000022DB134B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000000F.00000003.1452836765.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1435323319.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1425372596.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 0000000F.00000003.1316374363.0000022DAB471000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7DC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2460604387.000002667B6C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000000F.00000003.1437761439.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 0000000F.00000003.1437761439.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 0000000F.00000003.1437761439.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000000F.00000003.1309967111.0000022DB124C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1416570611.0000022DB124E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1393656259.0000022DB124A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1478447992.0000022DB1244000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000000F.00000003.1379584339.0000022DB122B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1310617148.0000022DB1236000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1393656259.0000022DB122B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000000F.00000003.1379584339.0000022DB122B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1310617148.0000022DB1236000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1393656259.0000022DB122B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000000F.00000003.1309967111.0000022DB124C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1416570611.0000022DB124E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1393656259.0000022DB124A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1478447992.0000022DB1244000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000000F.00000003.1309967111.0000022DB124C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1416570611.0000022DB124E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1393656259.0000022DB124A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1478447992.0000022DB1244000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000000F.00000003.1260479237.0000022DA9177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260004994.0000022DA911F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260145797.0000022DA913C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1259841912.0000022DA8F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260297563.0000022DA915A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000000F.00000003.1437761439.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000000F.00000003.1433368284.0000022DB1D2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1369064438.0000022DAC48B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1424181089.0000022DB1D2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1416570611.0000022DB128E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1411406619.0000022DAC5E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1398116540.0000022DA94E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1406856112.0000022DB1D2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ib.absa.co.za/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000000F.00000003.1468476523.0000022DAC518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/oldsyncS
Source: firefox.exe, 0000000F.00000003.1448223929.0000022DAA8B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/relay
Source: firefox.exe, 0000000F.00000003.1468476523.0000022DAC518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/H
Source: firefox.exe, 0000000F.00000003.1468476523.0000022DAC518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/HCX
Source: firefox.exe, 0000000F.00000003.1468476523.0000022DAC518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryU
Source: firefox.exe, 0000000F.00000003.1468476523.0000022DAC518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryUFj
Source: firefox.exe, 0000000F.00000003.1425372596.0000022DB1393000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1453051812.0000022DB1393000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1435323319.0000022DB1393000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: prefs-1.js.15.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqrfQHr4pbW4ZbWfpbY7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000000F.00000003.1466037908.0000022DA8CF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000018.00000002.2460604387.000002667B6F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000000F.00000003.1465679597.0000022DA8E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/events/1/e1dbfc05-1490-4f39-86dc-0ea31
Source: firefox.exe, 0000000F.00000003.1462512292.0000022DAA3E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/messaging-system/1/a628252e-0bd8-44c4-
Source: firefox.exe, 0000000F.00000003.1459639225.0000022DAAB20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1472257274.0000022DAAB22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1448167732.0000022DAAB22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/messaging-system/1/ffc7ad80-9f7b-42ff-
Source: firefox.exe, 0000000F.00000003.1459738743.0000022DAA8E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/metrics/1/5fde293d-9298-4666-9ba1-7fdc
Source: firefox.exe, 0000000F.00000003.1459639225.0000022DAAB20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1472257274.0000022DAAB22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1448167732.0000022DAAB22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/messaging-system/undesired-events/1/0fc679d7-44f9-499b
Source: firefox.exe, 0000000F.00000003.1459639225.0000022DAAB20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1472257274.0000022DAAB22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1448167732.0000022DAAB22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/messaging-system/undesired-events/1/7c2b3167-7a16-4716
Source: firefox.exe, 0000000F.00000003.1437761439.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 0000000F.00000003.1309967111.0000022DB124C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1416570611.0000022DB124E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1393656259.0000022DB124A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1478447992.0000022DB1244000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000000F.00000003.1434254333.0000022DB165C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000000F.00000003.1309967111.0000022DB124C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1416570611.0000022DB124E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1393656259.0000022DB124A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1478447992.0000022DB1244000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000000F.00000003.1309967111.0000022DB124C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1416570611.0000022DB124E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1393656259.0000022DB124A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1478447992.0000022DB1244000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000000F.00000003.1309967111.0000022DB124C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1416570611.0000022DB124E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1393656259.0000022DB124A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1478447992.0000022DB1244000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000000F.00000003.1462512292.0000022DAA388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000000F.00000003.1472780549.0000022DAA375000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1442372490.0000022DAB8E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000000F.00000003.1442372490.0000022DAB8E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000000F.00000003.1465679597.0000022DA8E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lookerstudio.google.com/embed/reporting/
Source: firefox.exe, 0000000F.00000003.1262908853.0000022DA751D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1262063299.0000022DA7533000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1263223477.0000022DA7533000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000000F.00000003.1262908853.0000022DA751D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1262063299.0000022DA7533000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1263223477.0000022DA7533000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000000F.00000003.1262908853.0000022DA751D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1262063299.0000022DA7533000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1263223477.0000022DA7533000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000018.00000002.2460604387.000002667B68F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000010.00000002.2460227436.000002B1BC172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestabout
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000000F.00000003.1466358323.0000022DA8CD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000000F.00000003.1481380846.0000022DA6AC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org0/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000000F.00000003.1262908853.0000022DA751D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1262063299.0000022DA7533000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1263223477.0000022DA7533000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000000F.00000003.1262908853.0000022DA751D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1262063299.0000022DA7533000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1263223477.0000022DA7533000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000000F.00000003.1465679597.0000022DA8E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com/
Source: firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000000F.00000003.1448223929.0000022DAA8DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1459738743.0000022DAA8E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000000F.00000003.1409416774.0000022DAC8C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1438191605.0000022DAC8C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2&
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000000F.00000003.1462512292.0000022DAA3E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000000F.00000003.1409416774.0000022DAC8C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1438191605.0000022DAC8C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000000F.00000003.1409416774.0000022DAC8C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1438191605.0000022DAC8C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000000F.00000003.1466358323.0000022DA8CD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000000F.00000003.1260297563.0000022DA915A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000000F.00000003.1365429543.0000022DAA9AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000000F.00000003.1465982506.0000022DA8E2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000000F.00000003.1333273919.0000022DAAE6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434057215.0000022DB166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com
Source: firefox.exe, 0000000F.00000003.1333273919.0000022DAAE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000000F.00000003.1460482772.0000022DAA423000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1333273919.0000022DAAE6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1457924436.0000022DAAE71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000000F.00000003.1465921149.0000022DA8E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000000F.00000003.1450095570.0000022DA95DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000000F.00000003.1315415007.0000022DB1574000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1437460714.0000022DB114A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 0000000F.00000003.1472780549.0000022DAA362000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7D12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2460604387.000002667B613000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000000F.00000003.1472780549.0000022DAA362000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1425985661.0000022DB1320000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1435323319.0000022DB1320000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000000F.00000003.1452836765.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1435323319.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1425372596.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 0000000F.00000003.1452836765.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1435323319.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1425372596.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 0000000F.00000003.1437761439.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1453688735.0000022DACD1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7D9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2460604387.000002667B6F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000000F.00000003.1449533424.0000022DA97AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000000F.00000003.1473348000.0000022DA9C8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1449533424.0000022DA97AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1450095570.0000022DA95DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000000F.00000003.1466358323.0000022DA8CD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000000F.00000003.1443264445.0000022DAB84F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000000F.00000003.1411445181.0000022DAC5E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1440248796.0000022DAC5E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/firefox-relay-integration
Source: firefox.exe, 0000000F.00000003.1447341980.0000022DAAB43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1448223929.0000022DAA8DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1459639225.0000022DAAB20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1458487043.0000022DAAB43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1472257274.0000022DAAB22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1462512292.0000022DAA3E5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1449129088.0000022DA9BE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1448167732.0000022DAAB22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 0000000F.00000003.1460068761.0000022DAA6E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000000F.00000003.1449129088.0000022DA9B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 0000001A.00000003.1456165862.0000018CA4691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaPlatformDecoderNotFound
Source: firefox.exe, 0000001A.00000003.1456165862.0000018CA4691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaWMFNeeded
Source: firefox.exe, 0000001A.00000002.1470797268.0000018CA4340000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 0000001A.00000002.1470797268.0000018CA4340000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 0000000F.00000003.1380707255.0000022DAC664000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1426984949.0000022DAC685000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000000F.00000003.1431859054.0000022DB3705000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 0000000F.00000003.1433096915.0000022DB1DCE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1424181089.0000022DB1DBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: firefox.exe, 0000000F.00000003.1460068761.0000022DAA6E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.njy8xaI_aUJp
Source: firefox.exe, 0000000F.00000003.1309967111.0000022DB124C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1416570611.0000022DB124E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1393656259.0000022DB124A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1478447992.0000022DB1244000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001A.00000002.1470797268.0000018CA4340000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001A.00000002.1470797268.0000018CA4340000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001A.00000002.1470797268.0000018CA4340000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001A.00000002.1470797268.0000018CA4340000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000000F.00000003.1466081932.0000022DA8CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000000F.00000003.1315415007.0000022DB1554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000000F.00000003.1437761439.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1408839256.0000022DB1165000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000000F.00000003.1309967111.0000022DB124C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1416570611.0000022DB124E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1393656259.0000022DB124A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1478447992.0000022DB1244000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 0000000F.00000003.1452127612.0000022DB15E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: firefox.exe, 00000010.00000002.2460227436.000002B1BC1C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7DF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2463961928.000002667B803000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.15.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15e498ec2b39921665a1fbc954bff40a8106629178eadc64
Source: firefox.exe, 0000000F.00000003.1329905851.0000022DB168C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260297563.0000022DA915A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1448167732.0000022DAAB22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 0000000F.00000003.1452127612.0000022DB15E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000000F.00000003.1315415007.0000022DB1554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000000F.00000003.1452127612.0000022DB15E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: firefox.exe, 0000000F.00000003.1315415007.0000022DB1554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 0000000F.00000003.1481380846.0000022DA6AC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481380846.0000022DA6AD5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1481668171.0000022DA6ACC000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.15.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: firefox.exe, 0000000F.00000003.1315415007.0000022DB1554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: firefox.exe, 0000000F.00000003.1329905851.0000022DB168C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000000F.00000003.1453051812.0000022DB136C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 0000000F.00000003.1408987170.0000022DACDE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1313795693.0000022DB1455000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1310272068.0000022DB12EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000000F.00000003.1409416774.0000022DAC8D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1259841912.0000022DA8F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260297563.0000022DA915A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: firefox.exe, 0000000F.00000003.1408987170.0000022DACDE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1390347112.0000022DAA9DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260479237.0000022DA9177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1450347633.0000022DA95A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1365429543.0000022DAA9DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1464632590.0000022DA95A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260004994.0000022DA911F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260145797.0000022DA913C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1259841912.0000022DA8F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260297563.0000022DA915A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000000F.00000003.1329905851.0000022DB16AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000000F.00000003.1452127612.0000022DB15E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000000F.00000003.1452127612.0000022DB15E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000000F.00000003.1452127612.0000022DB15E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 00000010.00000002.2460227436.000002B1BC1C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7DF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2463961928.000002667B803000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.15.dr	String found in binary or memory: https://www.marriott.com/default.mi?utm_source=admarketplace&utm_medium=cpc&utm_campaign=Marriott_Pr
Source: firefox.exe, 0000000F.00000003.1459639225.0000022DAAB20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1472257274.0000022DAAB22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1448167732.0000022DAAB22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mobilesuica.com/
Source: firefox.exe, 0000000F.00000003.1425372596.0000022DB138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1408987170.0000022DACDA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1426070011.0000022DB11F9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1425372596.0000022DB1391000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1437761439.0000022DACDA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000000F.00000003.1452127612.0000022DB15F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: firefox.exe, 0000000F.00000003.1433096915.0000022DB1DCE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1424181089.0000022DB1DBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: firefox.exe, 0000000F.00000003.1460068761.0000022DAA6E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.d-GHL1OW1fkT
Source: firefox.exe, 0000000F.00000003.1320060920.0000022DAA52B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1317533600.0000022DAA556000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1317533600.0000022DAA526000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 0000000F.00000003.1451495650.0000022DB29A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1405863094.0000022DB29A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/anything/?
Source: firefox.exe, 0000000F.00000003.1433096915.0000022DB1DCE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1424181089.0000022DB1DBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: firefox.exe, 0000000F.00000003.1460068761.0000022DAA6E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.sYEKgG4Or0s6
Source: firefox.exe, 0000000F.00000003.1411445181.0000022DAC5E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1440248796.0000022DAC5E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/about/legal/terms/subscription-services/
Source: firefox.exe, 0000000F.00000003.1462512292.0000022DAA39B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1424181089.0000022DB1DBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1465679597.0000022DA8E5E000.00000004.00000800.00020000.00000000.sdmp, targeting.snapshot.json.tmp.15.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: firefox.exe, 0000000F.00000003.1440473940.0000022DAC596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1329905851.0000022DB1690000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1460068761.0000022DAA6E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: firefox.exe, 0000000F.00000003.1411445181.0000022DAC5E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1440248796.0000022DAC5E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/subscription-services/
Source: firefox.exe, 0000000F.00000003.1460068761.0000022DAA6E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000000F.00000003.1451495650.0000022DB29A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1405863094.0000022DB29A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-mod
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 0000000F.00000003.1433096915.0000022DB1DCE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon-196x196.2af054fea211.png
Source: firefox.exe, 0000000F.00000003.1433096915.0000022DB1DCE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon.d25d81d39065.icox
Source: firefox.exe, 00000016.00000002.2461033736.0000021DA7DC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2460604387.000002667B6F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000000F.00000003.1452836765.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1435323319.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1425372596.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000000F.00000003.1452836765.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1435323319.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1425372596.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: firefox.exe, 0000000F.00000003.1440473940.0000022DAC596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1460068761.0000022DAA6E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 0000000F.00000003.1442372490.0000022DAB8F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000000F.00000003.1437460714.0000022DB116B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1408839256.0000022DB1165000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000000F.00000003.1448562348.0000022DAA6A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/
Source: firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 0000000F.00000003.1409416774.0000022DAC8D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7D0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2460604387.000002667B60C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000000F.00000003.1437460714.0000022DB116B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1408839256.0000022DB1165000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000000F.00000003.1449129088.0000022DA9BD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1449129088.0000022DA9B7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1456165862.0000018CA4691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 0000001A.00000002.1470797268.0000018CA4340000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 0000000F.00000003.1444288716.0000022DAB5E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1383063854.0000022DAA952000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1464632590.0000022DA95A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1394472947.0000022DAA95A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000000F.00000003.1316374363.0000022DAB471000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1453606881.0000022DACDF5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1437672371.0000022DACDE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1316374363.0000022DAB4A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: recovery.jsonlz4.tmp.15.dr	String found in binary or memory: https://youtube.com/account?=
Source: firefox.exe, 00000018.00000002.2457248482.000002667B2F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/chal
Source: firefox.exe, 00000018.00000002.2458068342.000002667B30A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2457248482.000002667B2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000000D.00000002.1239171762.000001CE744BA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000002.1254310981.0000020A20D97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000010.00000002.2463143199.000002B1BC254000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2458953876.000002B1BBEB0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2459357426.0000021DA7C84000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2455841307.0000021DA7970000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2458068342.000002667B300000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2457248482.000002667B2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 00000016.00000002.2455841307.0000021DA7970000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdh
Source: firefox.exe, 0000000F.00000003.1459738743.0000022DAA8E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdr
Source: firefox.exe, 00000010.00000002.2463143199.000002B1BC250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/chals

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.10:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.10:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.10:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.10:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.10:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.10:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.10:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.10:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.193.91:443 -> 192.168.2.10:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.10:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.10:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.10:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.10:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.10:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.10:49742 version: TLS 1.2

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00BCEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00BCEAFF

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00BCED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00BCED6A

Source: C:\Users\user\Desktop\random.exe

0_2_00BCEAFF

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00BBAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00BBAA57

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00BE9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00BE9576

System Summary

Binary is likely a compiled AutoIt script file

Source: random.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: random.exe, 00000000.00000000.1192247573.0000000000C12000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_2fead68b-2
Source: random.exe, 00000000.00000000.1192247573.0000000000C12000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_239442bf-b
Source: random.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_7f7d3ac0-b
Source: random.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_15d74d1b-2

Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 22_2_0000021DA7CC2377 NtQuerySystemInformation,		22_2_0000021DA7CC2377
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 22_2_0000021DA7CE3532 NtQuerySystemInformation,		22_2_0000021DA7CE3532

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00BBD5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00BBD5EB

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00BB1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00BB1201

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00BBE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00BBE8F6

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B58060	0_2_00B58060
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BC2046	0_2_00BC2046
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BB8298	0_2_00BB8298
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B8E4FF	0_2_00B8E4FF
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B8676B	0_2_00B8676B
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BE4873	0_2_00BE4873
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B7CAA0	0_2_00B7CAA0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B5CAF0	0_2_00B5CAF0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B6CC39	0_2_00B6CC39
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B86DD9	0_2_00B86DD9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B591C0	0_2_00B591C0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B6B119	0_2_00B6B119
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B71394	0_2_00B71394
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B71706	0_2_00B71706
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B7781B	0_2_00B7781B
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B719B0	0_2_00B719B0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B57920	0_2_00B57920
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B6997D	0_2_00B6997D
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B77A4A	0_2_00B77A4A
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B77CA7	0_2_00B77CA7
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B71C77	0_2_00B71C77
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B89EEE	0_2_00B89EEE
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BDBE44	0_2_00BDBE44
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B71F32	0_2_00B71F32
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 22_2_0000021DA7CC2377	22_2_0000021DA7CC2377
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 22_2_0000021DA7CE3532	22_2_0000021DA7CE3532
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 22_2_0000021DA7CE3C5C	22_2_0000021DA7CE3C5C
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 22_2_0000021DA7CE3572	22_2_0000021DA7CE3572

Source: C:\Users\user\Desktop\random.exe	Code function: String function: 00B59CB3 appears 31 times
Source: C:\Users\user\Desktop\random.exe	Code function: String function: 00B70A30 appears 46 times
Source: C:\Users\user\Desktop\random.exe	Code function: String function: 00B6F9F2 appears 40 times

Source: random.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal76.troj.evad.winEXE@37/39@68/14

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00BC37B5 GetLastError,FormatMessageW,

0_2_00BC37B5

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BB10BF AdjustTokenPrivileges,CloseHandle,		0_2_00BB10BF
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BB16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00BB16C3

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00BC51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00BC51CD

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00BBD4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00BBD4DC

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00BC648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00BC648E

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00B542A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00B542A2

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File created: C:\Users\user\AppData\Local\Mozilla\Firefox\SkeletonUILock-c388d246

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7708:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7572:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7836:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7776:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7900:120:WilError_03

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File created: C:\Users\user\AppData\Local\Temp\firefox

Jump to behavior

Source: random.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: firefox.exe, 0000000F.00000003.1468476523.0000022DAC518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE timestamp BETWEEN date(:dateFrom) AND date(:dateTo);
Source: firefox.exe, 0000000F.00000003.1468476523.0000022DAC518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE events (id INTEGER PRIMARY KEY, type INTEGER NOT NULL, count INTEGER NOT NULL, timestamp DATE );
Source: firefox.exe, 0000000F.00000003.1468476523.0000022DAC518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INSERT INTO events (type, count, timestamp) VALUES (:type, 1, date(:date));
Source: firefox.exe, 0000000F.00000003.1468476523.0000022DAC518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;
Source: firefox.exe, 0000000F.00000003.1474564952.0000022DA8F75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;
Source: firefox.exe, 0000000F.00000003.1468476523.0000022DAC518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;Fy6
Source: firefox.exe, 0000000F.00000003.1468476523.0000022DAC518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE events SET count = count + 1 WHERE id = :id;-
Source: firefox.exe, 0000000F.00000003.1468476523.0000022DAC518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9'
Source: firefox.exe, 0000000F.00000003.1468476523.0000022DAC518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9
Source: firefox.exe, 0000000F.00000003.1468476523.0000022DAC518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE type = :type AND timestamp = date(:date);

Source: random.exe	Virustotal: Detection: 30%
Source: random.exe	ReversingLabs: Detection: 38%

Source: unknown	Process created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2280 -parentBuildID 20230927232528 -prefsHandle 2224 -prefMapHandle 2216 -prefsLen 25358 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9a4cfab-7630-432a-b44e-2e0ea87c7258} 8008 "\\.\pipe\gecko-crash-server-pipe.8008" 22d99470310 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4476 -parentBuildID 20230927232528 -prefsHandle 4072 -prefMapHandle 4572 -prefsLen 26308 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {60a1ac55-9c98-4e34-bd54-b295dd9a3424} 8008 "\\.\pipe\gecko-crash-server-pipe.8008" 22dab472d10 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5488 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5476 -prefMapHandle 5480 -prefsLen 33184 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5eb2eb8a-a779-4036-9ee2-0004eb96fe19} 8008 "\\.\pipe\gecko-crash-server-pipe.8008" 22d99472510 utility
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2280 -parentBuildID 20230927232528 -prefsHandle 2224 -prefMapHandle 2216 -prefsLen 25358 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9a4cfab-7630-432a-b44e-2e0ea87c7258} 8008 "\\.\pipe\gecko-crash-server-pipe.8008" 22d99470310 socket	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4476 -parentBuildID 20230927232528 -prefsHandle 4072 -prefMapHandle 4572 -prefsLen 26308 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {60a1ac55-9c98-4e34-bd54-b295dd9a3424} 8008 "\\.\pipe\gecko-crash-server-pipe.8008" 22dab472d10 rdd	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5488 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5476 -prefMapHandle 5480 -prefsLen 33184 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5eb2eb8a-a779-4036-9ee2-0004eb96fe19} 8008 "\\.\pipe\gecko-crash-server-pipe.8008" 22d99472510 utility	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\installs.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: random.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.15.dr
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.15.dr

Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00B542DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00B542DE

Source: gmpopenh264.dll.tmp.15.dr

Static PE information: section name: .rodata

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00B70A76 push ecx; ret

0_2_00B70A89

Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)			Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B6F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00B6F98E
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BE1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00BE1C41

Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\random.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-97424

Source: C:\Program Files\Mozilla Firefox\firefox.exe

Code function: 22_2_0000021DA7CC2377 rdtsc

22_2_0000021DA7CC2377

Source: C:\Users\user\Desktop\random.exe

API coverage: 3.8 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BBDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00BBDBBE
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B8C2A2 FindFirstFileExW,	0_2_00B8C2A2
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BC68EE FindFirstFileW,FindClose,	0_2_00BC68EE
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BC698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00BC698F
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BBD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00BBD076
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BBD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00BBD3A9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BC9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00BC9642
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BC979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00BC979D
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BC9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00BC9B2B
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BC5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00BC5C97

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00B542DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00B542DE

Source: firefox.exe, 0000001A.00000002.1469205072.0000018C9A555000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllh9.
Source: firefox.exe, 00000016.00000002.2464677481.0000021DA8350000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllz
Source: firefox.exe, 00000016.00000002.2464677481.0000021DA8350000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWz
Source: firefox.exe, 00000016.00000002.2464677481.0000021DA8350000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW[
Source: firefox.exe, 0000001A.00000002.1469205072.0000018C9A555000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWa1
Source: firefox.exe, 00000010.00000002.2465459358.000002B1BC740000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllN
Source: random.exe, 00000000.00000003.1279096012.000000000137C000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1279533962.0000000001382000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281591847.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2465459358.000002B1BC740000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2458953876.000002B1BBEBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2464677481.0000021DA8350000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2455841307.0000021DA797A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2458068342.000002667B30A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.1469205072.0000018C9A555000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 00000010.00000002.2463626579.000002B1BC31B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1456165862.0000018CA4691000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: firefox.exe, 00000010.00000002.2465459358.000002B1BC740000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllI
Source: firefox.exe, 0000001A.00000002.1469205072.0000018C9A555000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllS55
Source: firefox.exe, 0000001A.00000002.1469205072.0000018C9A510000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0AV
Source: firefox.exe, 0000001A.00000002.1469205072.0000018C9A555000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll79
Source: firefox.exe, 00000010.00000002.2465459358.000002B1BC740000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.1469205072.0000018C9A555000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\random.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

Code function: 22_2_0000021DA7CC2377 rdtsc

22_2_0000021DA7CC2377

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00BCEAA2 BlockInput,

0_2_00BCEAA2

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00B82622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00B82622

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00B542DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00B542DE

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00B74CE8 mov eax, dword ptr fs:[00000030h]

0_2_00B74CE8

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00BB0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00BB0B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B82622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00B82622
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B7083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00B7083F
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B709D5 SetUnhandledExceptionFilter,	0_2_00B709D5
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00B70C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00B70C21

Source: C:\Users\user\Desktop\random.exe

0_2_00BB1201

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00B92BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00B92BA5

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00BBB226 SendInput,keybd_event,

0_2_00BBB226

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00BD22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_00BD22DA

Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior

Source: unknown

Process created: C:\Program Files\Mozilla Firefox\firefox.exe "c:\program files\mozilla firefox\firefox.exe" --moz_log sync,prependheader,timestamp,append,maxsize:1,dump:5 --moz_log_file c:\programdata\mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046b0af4a39cb\backgroundupdate.moz_log --backgroundtask backgroundupdate

Source: C:\Users\user\Desktop\random.exe

0_2_00BB0B62

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00BB1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00BB1663

Source: random.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: random.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00B70698 cpuid

0_2_00B70698

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00BAD21C GetLocalTime,

0_2_00BAD21C

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00BAD27A GetUserNameW,

0_2_00BAD27A

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00B8B952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_00B8B952

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00B542DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00B542DE

Stealing of Sensitive Information

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: random.exe PID: 7416, type: MEMORYSTR

Source: random.exe	Binary or memory string: WIN_81
Source: random.exe	Binary or memory string: WIN_XP
Source: random.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: random.exe	Binary or memory string: WIN_XPe
Source: random.exe	Binary or memory string: WIN_VISTA
Source: random.exe	Binary or memory string: WIN_7
Source: random.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: random.exe PID: 7416, type: MEMORYSTR

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BD1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00BD1204
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00BD1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00BD1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	2 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	Logon Script (Windows)	1 Extra Window Memory Injection	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	1 DLL Side-Loading	NTDS	16 System Information Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 Extra Window Memory Injection	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Process Injection	1 Masquerading	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	2 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
random.exe	31%	Virustotal		Browse
random.exe	39%	ReversingLabs	Win32.Malware.Heuristic
random.exe	100%	Avira	TR/ATRAPS.Gen
SAMPLE	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://detectportal.firefox.comP	0%	Avira URL Cloud	safe
https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	23.215.0.132	true	false	high
star-mini.c10r.facebook.com	157.240.229.35	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
twitter.com	172.66.0.227	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
shavar.prod.mozaws.net	52.36.50.141	true	false	high
services.addons.mozilla.org	151.101.193.91	true	false	high
dyna.wikimedia.org	208.80.154.224	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
contile.services.mozilla.com	34.36.137.203	true	false	high
youtube.com	172.217.215.136	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
a19.dscg10.akamai.net	23.47.204.51	true	false	high
youtube-ui.l.google.com	64.233.176.190	true	false	high
mc.prod.ads.prod.webservices.mozgcp.net	34.36.137.203	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
reddit.map.fastly.net	151.101.193.140	true	false	high
ipv4only.arpa	192.0.0.170	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
normandy.tombstone.experimenter.prod.webservices.mozgcp.net	34.49.51.44	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
www.reddit.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
normandy.cdn.mozilla.net	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 0000000F.00000003.1437761439.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1316374363.0000022DAB471000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7DC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2460604387.000002667B6C4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://detectportal.firefox.com/	firefox.exe, 0000000F.00000003.1434057215.0000022DB166C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://datastudio.google.com/embed/reporting/	firefox.exe, 0000000F.00000003.1465679597.0000022DA8E5E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.mozilla.com0	gmpopenh264.dll.tmp.15.dr	false		high
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	firefox.exe, 0000000F.00000003.1309967111.0000022DB124C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1416570611.0000022DB124E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1393656259.0000022DB124A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1478447992.0000022DB1244000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000018.00000002.2460604387.000002667B68F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.leboncoin.fr/	firefox.exe, 0000000F.00000003.1452127612.0000022DB15E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15D1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 0000000F.00000003.1472780549.0000022DAA362000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1425985661.0000022DB1320000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1435323319.0000022DB1320000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/5b4DH7KHAf2n_mNaLjNi1-UAoKmM9rhqaA9w7FyznHo.10943.jpg	firefox.exe, 00000010.00000002.2460227436.000002B1BC1C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7DF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2463961928.000002667B803000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.15.dr	false		high
https://screenshots.firefox.com	firefox.exe, 0000000F.00000003.1466358323.0000022DA8CD2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://shavar.services.mozilla.com	firefox.exe, 0000000F.00000003.1333273919.0000022DAAE6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434057215.0000022DB166C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://completion.amazon.com/search/complete?q=	firefox.exe, 0000000F.00000003.1260479237.0000022DA9177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260004994.0000022DA911F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260145797.0000022DA913C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1259841912.0000022DA8F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260297563.0000022DA915A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000000F.00000003.1473348000.0000022DA9C8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1449533424.0000022DA97AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1450095570.0000022DA95DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://identity.mozilla.com/ids/ecosystem_telemetryU	firefox.exe, 0000000F.00000003.1468476523.0000022DAC518000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700	firefox.exe, 00000010.00000002.2460227436.000002B1BC1C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7DF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2463961928.000002667B803000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.15.dr	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/breach-details/	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://github.com/w3c/csswg-drafts/issues/4650	firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 0000000F.00000003.1449129088.0000022DA9BD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1449129088.0000022DA9B7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1456165862.0000018CA4691000.00000004.00000800.00020000.00000000.sdmp	false		high
https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()	firefox.exe, 0000001A.00000002.1470797268.0000018CA4340000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000000F.00000003.1329905851.0000022DB168C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260297563.0000022DA915A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1448167732.0000022DAAB22000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.msn.com	firefox.exe, 0000000F.00000003.1442372490.0000022DAB8F5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 0000000F.00000003.1260479237.0000022DA9177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260004994.0000022DA911F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260145797.0000022DA913C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1259841912.0000022DA8F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1260297563.0000022DA915A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/addon/	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700002.1&cta	firefox.exe, 00000010.00000002.2460227436.000002B1BC1C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7DF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2463961928.000002667B803000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.15.dr	false		high
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	firefox.exe, 0000001A.00000002.1470797268.0000018CA4340000.00000002.08000000.00040000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
http://exslt.org/sets	firefox.exe, 0000001A.00000003.1465604639.0000018CA45A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1461190818.0000018CA45A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://youtube.com/	firefox.exe, 0000000F.00000003.1316374363.0000022DAB471000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1453606881.0000022DACDF5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1437672371.0000022DACDE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1316374363.0000022DAB4A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht	firefox.exe, 0000000F.00000003.1405863094.0000022DB29A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 0000000F.00000003.1449129088.0000022DA9BD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1449129088.0000022DA9B7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://api.accounts.firefox.com/v1	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
http://exslt.org/common	firefox.exe, 0000001A.00000003.1465604639.0000018CA45A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1461190818.0000018CA45A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	firefox.exe, 0000001A.00000002.1470797268.0000018CA4340000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/	firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15D1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc	firefox.exe, 0000000F.00000003.1449129088.0000022DA9B8C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1456165862.0000018CA46B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.youtube.com/	firefox.exe, 0000000F.00000003.1409416774.0000022DAC8D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7D0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2460604387.000002667B60C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://MD8.mozilla.org/1/m	firefox.exe, 0000000F.00000003.1460482772.0000022DAA4D4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bbc.co.uk/	firefox.exe, 0000000F.00000003.1452127612.0000022DB15E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15D1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/firefox/addon/to-google-translate/	firefox.exe, 0000000F.00000003.1432600198.0000022DB2959000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1406381203.0000022DB2959000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000000F.00000003.1425372596.0000022DB13BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7DC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2460604387.000002667B6C4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:	firefox.exe, 0000000F.00000003.1474564952.0000022DA8F75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1448223929.0000022DAA8DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1409416774.0000022DAC8C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1438191605.0000022DAC8C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1459738743.0000022DAA8E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 0000000F.00000003.1365429543.0000022DAA9AD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 0000000F.00000003.1411559933.0000022DAC5CC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
http://detectportal.firefox.comP	firefox.exe, 0000000F.00000003.1431114121.0000022DB374D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1451365334.0000022DB376D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000000F.00000003.1449533424.0000022DA97AF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://youtube.com/account?=	recovery.jsonlz4.tmp.15.dr	false		high
https://shavar.services.mozilla.com/	firefox.exe, 0000000F.00000003.1333273919.0000022DAAE6E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	firefox.exe, 0000000F.00000003.1449129088.0000022DA9B7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1456165862.0000018CA46A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1456165862.0000018CA46A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 0000000F.00000003.1472780549.0000022DAA362000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2461033736.0000021DA7D12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2460604387.000002667B613000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 0000000F.00000003.1452127612.0000022DB15E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1434424869.0000022DB15D1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://exslt.org/strings	firefox.exe, 0000001A.00000002.1467950001.0000018C98C0A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggestabout	firefox.exe, 00000010.00000002.2460227436.000002B1BC172000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 0000000F.00000003.1408987170.0000022DACDAF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://a9.com/-/spec/opensearch/1.0/	firefox.exe, 0000000F.00000003.1472424165.0000022DAA3F3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/user/dashboard	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.njy8xaI_aUJp	firefox.exe, 0000000F.00000003.1460068761.0000022DAA6E6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/about	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
http://mozilla.org/MPL/2.0/.	firefox.exe, 0000000F.00000003.1442372490.0000022DAB8F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1436847956.0000022DB1193000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1316226576.0000022DAB4E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1468165781.0000022DAC7EC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1309891916.0000022DB1298000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1388042375.0000022DAAC55000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1309242370.0000022DB12A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1391400383.0000022DAA7B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1408987170.0000022DACDE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1269949773.0000022DA94FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1365429543.0000022DAA9AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1374595154.0000022DACBE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1261903579.0000022DA914F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1316226576.0000022DAB4D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1409416774.0000022DAC82E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1412813577.0000022DA94D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1419052947.0000022DA914F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363210111.0000022DAA2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1359141376.0000022DAA1E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1363978887.0000022DAC3CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1448223929.0000022DAA8DD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com	firefox.exe, 0000000F.00000003.1442372490.0000022DAB8E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://coverage.mozilla.org	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	firefox.exe, 0000001A.00000002.1470797268.0000018CA4340000.00000002.08000000.00040000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	gmpopenh264.dll.tmp.15.dr	false		high
https://www.zhihu.com/	firefox.exe, 0000000F.00000003.1437460714.0000022DB116B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1315415007.0000022DB15B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1408839256.0000022DB1165000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	firefox.exe, 0000000F.00000003.1408338489.0000022DB11AF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	firefox.exe, 0000000F.00000003.1408338489.0000022DB11AF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqrfQHr4pbW4ZbWfpbY7ReNxR3UIG8zInwYIFIVs9eYi	prefs-1.js.15.dr	false		high
http://a9.com/-/spec/opensearch/1.1/	firefox.exe, 0000000F.00000003.1472424165.0000022DAA3F3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 0000000F.00000003.1309967111.0000022DB124C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1416570611.0000022DB124E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1393656259.0000022DB124A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1478447992.0000022DB1244000.00000004.00000800.00020000.00000000.sdmp	false		high
https://blocked.cdn.mozilla.net/	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored	firefox.exe, 0000001A.00000003.1456165862.0000018CA4691000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2019-09/schema	firefox.exe, 0000000F.00000003.1434254333.0000022DB165C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://developer.mozilla.org/en/docs/DOM:element.addEventListener	firefox.exe, 0000000F.00000003.1449129088.0000022DA9BD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1449129088.0000022DA9B7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1456165862.0000018CA4691000.00000004.00000800.00020000.00000000.sdmp	false		high
http://exslt.org/dates-and-times$	firefox.exe, 0000001A.00000002.1471761609.0000018CA455F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://outlook.live.com/default.aspx?rru=compose&to=%s	firefox.exe, 0000000F.00000003.1262908853.0000022DA751D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1262063299.0000022DA7533000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1263223477.0000022DA7533000.00000004.00000800.00020000.00000000.sdmp	false		high
https://identity.mozilla.com/apps/relay	firefox.exe, 0000000F.00000003.1448223929.0000022DAA8B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mozilla.cloudflare-dns.com/dns-query	firefox.exe, 00000010.00000002.2462929140.000002B1BC200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2458643774.0000021DA7C30000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2460010721.000002667B450000.00000002.10000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	firefox.exe, 0000000F.00000003.1431859054.0000022DB3705000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000000F.00000003.1262908853.0000022DA751D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1262063299.0000022DA7533000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1263223477.0000022DA7533000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/firefox/addon/reddit-enhancement-suite/	firefox.exe, 0000000F.00000003.1432600198.0000022DB2959000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000003.1406381203.0000022DB2959000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.215.136	youtube.com	United States	15169	GOOGLEUS	false
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.107.243.93	push.services.mozilla.com	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.49.51.44	normandy.tombstone.experimenter.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
151.101.193.91	services.addons.mozilla.org	United States	54113	FASTLYUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.36.137.203	contile.services.mozilla.com	United States	2686	ATGS-MMD-ASUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
52.36.50.141	shavar.prod.mozaws.net	United States	16509	AMAZON-02US	false
23.47.204.51	a19.dscg10.akamai.net	United States	20940	AKAMAI-ASN1EU	false
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1665561
Start date and time:	2025-04-15 17:03:27 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	random.exe
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@37/39@68/14
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 96% Number of executed functions: 49 Number of non-executed functions: 294
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 74.125.21.101, 74.125.21.100, 74.125.21.139, 74.125.21.113, 74.125.21.102, 74.125.21.138, 108.177.122.95, 172.253.124.95, 173.194.219.139, 173.194.219.100, 173.194.219.102, 173.194.219.113, 173.194.219.138, 173.194.219.101, 23.76.34.6, 172.202.163.200
Excluded domains from analysis (whitelisted): fs.microsoft.com, ciscobinary.openh264.org, redirector.gvt1.com, slscr.update.microsoft.com, incoming.telemetry.mozilla.org, ctldl.windowsupdate.com, safebrowsing.googleapis.com, aus5.mozilla.org, c.pki.goog, location.services.mozilla.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:04:56	API Interceptor	1x Sleep call for process: firefox.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
34.49.51.44	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	3oKlYkFDuK.exe	Get hash	malicious	Credential Flusher	Browse
	3oKlYkFDuK.exe	Get hash	malicious	Credential Flusher	Browse
151.101.193.91	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	https://complianz.com/agreements/pccf9k/portal/new	Get hash	malicious	Unknown	Browse
	https://themobilemasters.com.au	Get hash	malicious	Unknown	Browse
	https://themobilemasters.com.au	Get hash	malicious	Unknown	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	3oKlYkFDuK.exe	Get hash	malicious	Credential Flusher	Browse
	letter2481-fitocosmetic.pdf	Get hash	malicious	HTMLPhisher	Browse
	f_171038 (2)	Get hash	malicious	Unknown	Browse
	94cwUzad99.exe	Get hash	malicious	Credential Flusher	Browse
	94cwUzad99.exe	Get hash	malicious	Credential Flusher	Browse
34.149.100.209	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	3oKlYkFDuK.exe	Get hash	malicious	Credential Flusher	Browse
34.36.137.203	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse
34.160.144.191	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	3oKlYkFDuK.exe	Get hash	malicious	Credential Flusher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
twitter.com	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse	172.66.0.227
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse	172.66.0.227
	https://arc.ht/	Get hash	malicious	Unknown	Browse	162.159.140.229
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	162.159.140.229
example.org	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse	23.215.0.132
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse	23.215.0.132
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	23.215.0.132
	random.exe	Get hash	malicious	Credential Flusher	Browse	96.7.128.192
	random.exe	Get hash	malicious	Credential Flusher	Browse	23.215.0.133
	random.exe	Get hash	malicious	Credential Flusher	Browse	23.215.0.132
	random.exe	Get hash	malicious	Credential Flusher	Browse	96.7.128.186
	random.exe	Get hash	malicious	Credential Flusher	Browse	96.7.128.186
	random.exe	Get hash	malicious	Credential Flusher	Browse	23.215.0.133
	3oKlYkFDuK.exe	Get hash	malicious	Credential Flusher	Browse	96.7.128.186
shavar.prod.mozaws.net	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse	52.37.232.247
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse	44.230.225.207
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	35.80.139.126
	random.exe	Get hash	malicious	Credential Flusher	Browse	34.211.178.107
	random.exe	Get hash	malicious	Credential Flusher	Browse	34.211.178.107
	random.exe	Get hash	malicious	Credential Flusher	Browse	35.81.123.48
	random.exe	Get hash	malicious	Credential Flusher	Browse	54.71.198.234
	random.exe	Get hash	malicious	Credential Flusher	Browse	34.211.178.107
	random.exe	Get hash	malicious	Credential Flusher	Browse	35.81.123.48
	3oKlYkFDuK.exe	Get hash	malicious	Credential Flusher	Browse	34.211.178.107
star-mini.c10r.facebook.com	https://compliancetracking.cfainstitute.org/amc-form?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImU5OGFkMTQzLWM0YzEtNDIwYi05OWQ4LTRlODM2ZmFiNjQ4NyIsIm5iZiI6MTc0NDY2NTI5OSwiZXhwIjoxNzQ1MjcwMDk5LCJpYXQiOjE3NDQ2NjUyOTksImlzcyI6Imh0dHBzOi8vc3RhbmRhcmRzY29tcGxpYW5jZXRyYWNraW5nYXBpLmNmYWluc3RpdHV0ZS5vcmcvIn0.l4SBJnn8huVpuJVgzl7oq2riSJ7NbE6i7-Sgdch3E3s	Get hash	malicious	Unknown	Browse	31.13.65.36
	http://universityorthony.com	Get hash	malicious	Unknown	Browse	31.13.88.35
	https://149.154.157.69/+CSCOE+/logon.html?q=BzFdUyAIO1l2Dy4KJSEyQRNXAiweJ0gIHjI%3D	Get hash	malicious	Unknown	Browse	157.240.229.35
	https://we.tl/t-IBThwlthXD?trk=dw_recover_expired_transfer&utm_campaign=dw_recover_expired_transfer&utm_medium=email&utm_source=wt_sendgrid&utm_template=pre_deletion_72hrs_email	Get hash	malicious	Unknown	Browse	157.240.229.35
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse	157.240.229.35
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse	31.13.88.35
	6499151747.pdf	Get hash	malicious	Unknown	Browse	57.144.132.1
	QuarantineMessage.zip	Get hash	malicious	HTMLPhisher	Browse	31.13.65.36
	https://webshuaw.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	57.144.162.1
	https://tn.dtrkr.com/clicks/html/f7f3bc54-3b40-5909-9d88-40bb36aec0be/703e7811-846d-5692-8893-6a20182f0f3c/ab3334d2-8ad0-5099-886a-1ee09ba18f05?urlChildId=3168b557-98fe-5577-b9ab-369782ae95a1&templateId=5d115dfc-e81d-46d4-b569-1726b7798919#user_email=sample@domain.com&fname=Nice&lname=Try	Get hash	malicious	Unknown	Browse	31.13.88.35

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	https://compliancetracking.cfainstitute.org/amc-form?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImU5OGFkMTQzLWM0YzEtNDIwYi05OWQ4LTRlODM2ZmFiNjQ4NyIsIm5iZiI6MTc0NDY2NTI5OSwiZXhwIjoxNzQ1MjcwMDk5LCJpYXQiOjE3NDQ2NjUyOTksImlzcyI6Imh0dHBzOi8vc3RhbmRhcmRzY29tcGxpYW5jZXRyYWNraW5nYXBpLmNmYWluc3RpdHV0ZS5vcmcvIn0.l4SBJnn8huVpuJVgzl7oq2riSJ7NbE6i7-Sgdch3E3s	Get hash	malicious	Unknown	Browse	151.101.129.229
	https://bjcgghbjchdgbfbghdgghbjchdgbfbggbfbg.sharefile.eu/share/view/sce3352de88ff40309b639a23a0046fb1	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	151.101.1.55
	SecuriteInfo.com.FileRepMalware.28465.14529.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	SecuriteInfo.com.FileRepMalware.28465.14529.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	http://universityorthony.com	Get hash	malicious	Unknown	Browse	151.101.66.132
	html.html	Get hash	malicious	HTMLPhisher	Browse	151.101.129.229
	Complete via DocuSign_ #Dailycer_Doc. Signature required 4_14_2025.eml	Get hash	malicious	HTMLPhisher	Browse	151.101.2.59
	https://ad.doubleclick.net/clk;265186560;90846275;t;pc=%255BTPAS_ID%255D?//ezipossolution.com/jsent.pk/js/?brenda.linton@martinmlp.com	Get hash	malicious	HTMLPhisher	Browse	151.101.2.132
	https://url.de.m.mimecastprotect.com/s/woPuCPj0KAcKxPVkWHzf5cxVN9d?domain=campaign-statistics.com	Get hash	malicious	HTMLPhisher	Browse	151.101.193.229
	https://campaign-statistics.com/link_click/b4Z6O2-Vv6KGnO-3eiq15/3b7f6a01a70ab8eaf5ab4d4058e199c0	Get hash	malicious	HTMLPhisher	Browse	151.101.193.229
ATGS-MMD-ASUS	https://compliancetracking.cfainstitute.org/amc-form?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImU5OGFkMTQzLWM0YzEtNDIwYi05OWQ4LTRlODM2ZmFiNjQ4NyIsIm5iZiI6MTc0NDY2NTI5OSwiZXhwIjoxNzQ1MjcwMDk5LCJpYXQiOjE3NDQ2NjUyOTksImlzcyI6Imh0dHBzOi8vc3RhbmRhcmRzY29tcGxpYW5jZXRyYWNraW5nYXBpLmNmYWluc3RpdHV0ZS5vcmcvIn0.l4SBJnn8huVpuJVgzl7oq2riSJ7NbE6i7-Sgdch3E3s	Get hash	malicious	Unknown	Browse	34.54.30.30
	https://149.154.157.69/+CSCOE+/logon.html?q=BzFdUyAIO1l2Dy4KJSEyQRNXAiweJ0gIHjI%3D	Get hash	malicious	Unknown	Browse	34.54.30.30
	xd.mips.elf	Get hash	malicious	Mirai	Browse	34.11.196.178
	xd.i686.elf	Get hash	malicious	Mirai	Browse	57.25.76.85
	xd.arm5.elf	Get hash	malicious	Mirai	Browse	57.5.138.238
	xd.m68k.elf	Get hash	malicious	Mirai	Browse	48.178.122.91
	xd.sh4.elf	Get hash	malicious	Mirai	Browse	48.44.139.73
	xd.x86.elf	Get hash	malicious	Mirai	Browse	32.166.166.29
	xd.arm.elf	Get hash	malicious	Mirai	Browse	51.24.191.84
	xd.spc.elf	Get hash	malicious	Mirai	Browse	34.148.37.201
ATGS-MMD-ASUS	https://compliancetracking.cfainstitute.org/amc-form?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImU5OGFkMTQzLWM0YzEtNDIwYi05OWQ4LTRlODM2ZmFiNjQ4NyIsIm5iZiI6MTc0NDY2NTI5OSwiZXhwIjoxNzQ1MjcwMDk5LCJpYXQiOjE3NDQ2NjUyOTksImlzcyI6Imh0dHBzOi8vc3RhbmRhcmRzY29tcGxpYW5jZXRyYWNraW5nYXBpLmNmYWluc3RpdHV0ZS5vcmcvIn0.l4SBJnn8huVpuJVgzl7oq2riSJ7NbE6i7-Sgdch3E3s	Get hash	malicious	Unknown	Browse	34.54.30.30
	https://149.154.157.69/+CSCOE+/logon.html?q=BzFdUyAIO1l2Dy4KJSEyQRNXAiweJ0gIHjI%3D	Get hash	malicious	Unknown	Browse	34.54.30.30
	xd.mips.elf	Get hash	malicious	Mirai	Browse	34.11.196.178
	xd.i686.elf	Get hash	malicious	Mirai	Browse	57.25.76.85
	xd.arm5.elf	Get hash	malicious	Mirai	Browse	57.5.138.238
	xd.m68k.elf	Get hash	malicious	Mirai	Browse	48.178.122.91
	xd.sh4.elf	Get hash	malicious	Mirai	Browse	48.44.139.73
	xd.x86.elf	Get hash	malicious	Mirai	Browse	32.166.166.29
	xd.arm.elf	Get hash	malicious	Mirai	Browse	51.24.191.84
	xd.spc.elf	Get hash	malicious	Mirai	Browse	34.148.37.201
ATGS-MMD-ASUS	https://compliancetracking.cfainstitute.org/amc-form?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImU5OGFkMTQzLWM0YzEtNDIwYi05OWQ4LTRlODM2ZmFiNjQ4NyIsIm5iZiI6MTc0NDY2NTI5OSwiZXhwIjoxNzQ1MjcwMDk5LCJpYXQiOjE3NDQ2NjUyOTksImlzcyI6Imh0dHBzOi8vc3RhbmRhcmRzY29tcGxpYW5jZXRyYWNraW5nYXBpLmNmYWluc3RpdHV0ZS5vcmcvIn0.l4SBJnn8huVpuJVgzl7oq2riSJ7NbE6i7-Sgdch3E3s	Get hash	malicious	Unknown	Browse	34.54.30.30
	https://149.154.157.69/+CSCOE+/logon.html?q=BzFdUyAIO1l2Dy4KJSEyQRNXAiweJ0gIHjI%3D	Get hash	malicious	Unknown	Browse	34.54.30.30
	xd.mips.elf	Get hash	malicious	Mirai	Browse	34.11.196.178
	xd.i686.elf	Get hash	malicious	Mirai	Browse	57.25.76.85
	xd.arm5.elf	Get hash	malicious	Mirai	Browse	57.5.138.238
	xd.m68k.elf	Get hash	malicious	Mirai	Browse	48.178.122.91
	xd.sh4.elf	Get hash	malicious	Mirai	Browse	48.44.139.73
	xd.x86.elf	Get hash	malicious	Mirai	Browse	32.166.166.29
	xd.arm.elf	Get hash	malicious	Mirai	Browse	51.24.191.84
	xd.spc.elf	Get hash	malicious	Mirai	Browse	34.148.37.201

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fb0aa01abe9d8e4037eb3473ca6e2dca	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	random.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	3oKlYkFDuK.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	3oKlYkFDuK.exe	Get hash	malicious	Credential Flusher	Browse
	3oKlYkFDuK.exe	Get hash	malicious	Credential Flusher	Browse
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	3oKlYkFDuK.exe	Get hash	malicious	Credential Flusher	Browse
	3oKlYkFDuK.exe	Get hash	malicious	Credential Flusher	Browse

Created / dropped Files

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_18974034-3c87-4e84-b804-09987acda08c.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7946
Entropy (8bit):	5.178562090732605
Encrypted:	false
SSDEEP:	192:cMMXWQDtbhbVbTbfbRbObtbyEl7n7rtJA6unSrDtTkdyS+:ctntNhnzFSJbro1nSrDhkdyT
MD5:	2B2BC70E198E3EF2B163D8877D99C0E0
SHA1:	FD18AA884F8E5D1E33BD53DC9432964AE8B52109
SHA-256:	2B225B4D33189968CD2A254B3BA2191ED782CD2B83662E86E4F07C87CFA0DE66
SHA-512:	7F3F8C46E898C14E72843400A3603C82EADC401A66C537A3C68AE8B4389261DC23431F88A579877EE60B10903AF4AA845D25DEE9E026580564874DF918559944
Malicious:	false
Preview:	{"type":"uninstall","id":"18974034-3c87-4e84-b804-09987acda08c","creationDate":"2025-04-15T16:12:50.587Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"c52d5856-ece5-494f-aabd-86188f9ce2c7","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_18974034-3c87-4e84-b804-09987acda08c.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7946
Entropy (8bit):	5.178562090732605
Encrypted:	false
SSDEEP:	192:cMMXWQDtbhbVbTbfbRbObtbyEl7n7rtJA6unSrDtTkdyS+:ctntNhnzFSJbro1nSrDhkdyT
MD5:	2B2BC70E198E3EF2B163D8877D99C0E0
SHA1:	FD18AA884F8E5D1E33BD53DC9432964AE8B52109
SHA-256:	2B225B4D33189968CD2A254B3BA2191ED782CD2B83662E86E4F07C87CFA0DE66
SHA-512:	7F3F8C46E898C14E72843400A3603C82EADC401A66C537A3C68AE8B4389261DC23431F88A579877EE60B10903AF4AA845D25DEE9E026580564874DF918559944
Malicious:	false
Preview:	{"type":"uninstall","id":"18974034-3c87-4e84-b804-09987acda08c","creationDate":"2025-04-15T16:12:50.587Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"c52d5856-ece5-494f-aabd-86188f9ce2c7","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	591
Entropy (8bit):	5.07724378946446
Encrypted:	false
SSDEEP:	12:teokWVfa9ofSbgs94t+Sbgs6M3vUSbgs94t+Sbgs6xQXGYD:sokWVyCfSbgsmsSbgsd3vUSbgsmsSbgk
MD5:	523D2DF8CF67839A9A3F12AEFF346962
SHA1:	67D5338472145E93EC680CD936A0D5373EDCC7C6
SHA-256:	03A886DB6BC57FB2AA97CC73C163831F6579D7EE6F91352E7C011AD9B2EA458A
SHA-512:	204EEC7AEFB42FECE200AE6E87AD1240CEABB807937C816C0517C0DFC3A770E7739058A47391BF3EE96CA38E13607764B3207D64B7989907CF656A5A8B4AE76D
Malicious:	false
Preview:	..***....2025-04-15 15:05:01.665000 UTC - [(null) 8760: Main Thread]: I/Logger Opening log..2025-04-15 15:05:02.120000 UTC - [Parent 8760: Main Thread]: D/Dump [Backstage.Dump] console.error: BackgroundUpdate: ..2025-04-15 15:05:02.120000 UTC - [Parent 8760: Main Thread]: D/Dump [Backstage.Dump] runBackgroundTask: backgroundupdate..2025-04-15 15:05:02.120000 UTC - [Parent 8760: Main Thread]: D/Dump [Backstage.Dump] console.error: BackgroundUpdate: ..2025-04-15 15:05:02.120000 UTC - [Parent 8760: Main Thread]: D/Dump [Backstage.Dump] runBackgroundTask: another instance is running..

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\tmpaddon

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	453023
Entropy (8bit):	7.997718157581587
Encrypted:	true
SSDEEP:	12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5:	85430BAED3398695717B0263807CF97C
SHA1:	FFFBEE923CEA216F50FCE5D54219A188A5100F41
SHA-256:	A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
SHA-512:	06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
Malicious:	false
Preview:	PK.........bN...R..........gmpopenh264.dll..\|.E.0.=..I.....1....4f1q.`.........q.....'+....hm{.z..o_.{w........$..($A!...\|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....\|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`............ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\...........-i.K.I..4.a..6.....Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N..}..).3.N%.!..q........^I.m..~...6.#.~+.....A...I]r...x...<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..\|c.1.cUkM.&.Qn]..a]t.h...!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:\|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\9rlxi5te.MozillaBackgroundTask-308046B0AF4A39CB-backgroundupdate\compatibility.ini

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Windows WIN.INI
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.391255133360986
Encrypted:	false
SSDEEP:	3:tZAQUsjcmktYWwktUp/UNE2aT/P4WX1rDZjrEFwHQ3ZjrEFwslyy:JWtYWXtUp8babN1rDVEFycVEFL
MD5:	3FB561547A46AF02D6B00F86DC370634
SHA1:	914867E4C763611B441835A3FC0082359FBF7277
SHA-256:	5393F0E8D90EE6A26EAC13B81B83EDC0637487B3E427175021D7EC4CDE8E34A7
SHA-512:	0E05486A6B6AD65D3A95FCFE46BE6687DD47E311374F11DE89F9CFB8C301951D6BFE43FA24851A3E759B6F8AF69A5F593568FB61F576AB52941F6B2B6EE54BC8
Malicious:	false
Preview:	[Compatibility]..LastVersion=118.0.1_20230927232528/20230927232528..LastOSABI=WINNT_x86_64-msvc..LastPlatformDir=C:\Program Files\Mozilla Firefox..LastAppDir=C:\Program Files\Mozilla Firefox\browser..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\9rlxi5te.MozillaBackgroundTask-308046B0AF4A39CB-backgroundupdate\prefs.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	484
Entropy (8bit):	4.934017531231027
Encrypted:	false
SSDEEP:	12:j8sGCS2XKHYX6UlTSU9Mylau1yIV6YRNCL4MwR6VLzy:XnKH66UZ9Blz1zV61LhG
MD5:	75026529A723A96215EECFFA3F652D75
SHA1:	AE0F338FDDF46096431DBFD37E2D919D81D48862
SHA-256:	ECDCF27B5194ADF28F14783F0768B4172989749E19F3B3DEF25EC1344F7E9571
SHA-512:	FDBEFBB2672BB0E8B0DC1DACDF1D361879F96EE84DAE832062BB77EF8F732DB5B6BA2E0194D2227BF9AF338BAEEB7BE55F9992795DAE4B35C2ACB46ADC4A04A3
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("browser.launcherProcess.enabled", true);..user_pref("toolkit.startup.last_success", 1744729501);..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\ExperimentStoreData.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4419
Entropy (8bit):	4.935817622384989
Encrypted:	false
SSDEEP:	96:gjziNFS+O2PUFzOdwNIOd8jvYRGrL418P:gjziNFS+OyUxOdwiOd8jTL418P
MD5:	9A6BB128977D9D8211F3884F8E3269EB
SHA1:	5A8EC55A729DCE58ED8E1154FDED919B93992E5F
SHA-256:	6D9406245A210C4369EA19BBC8A210D7120BF1FD84386A842178EEE5FDC51726
SHA-512:	48DB6CD300186EC70EDBF5C60714F796393EAC6C88EA04C788857EA13768FCF1A27D97BEA9756E2CC79E1B9C77DB89BC1DBF9204A1340222594FCF4BD3B36447
Malicious:	false
Preview:	{"bookmarks-toolbar-default-on":{"slug":"bookmarks-toolbar-default-on","branch":{"slug":"treatment-a","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"enableBookmarksToolbar":"always"},"enabled":true,"featureId":"bookmarks"}]},"active":true,"enrollmentId":"22cb469c-1a0f-4c4f-8465-adc25b4d990d","experimentType":"nimbus","source":"rs-loader","userFacingName":"Bookmarks Toolbar Default On","userFacingDescription":"An experiment that turns the bookmarks toolbar on by default.","lastSeen":"2023-10-05T09:51:32.910Z","featureIds":["bookmarks"],"prefs":[{"name":"browser.toolbars.bookmarks.visibility","branch":"user","featureId":"bookmarks","variable":"enableBookmarksToolbar","originalValue":null}],"isRollout":false},"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\ExperimentStoreData.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4419
Entropy (8bit):	4.935817622384989
Encrypted:	false
SSDEEP:	96:gjziNFS+O2PUFzOdwNIOd8jvYRGrL418P:gjziNFS+OyUxOdwiOd8jTL418P
MD5:	9A6BB128977D9D8211F3884F8E3269EB
SHA1:	5A8EC55A729DCE58ED8E1154FDED919B93992E5F
SHA-256:	6D9406245A210C4369EA19BBC8A210D7120BF1FD84386A842178EEE5FDC51726
SHA-512:	48DB6CD300186EC70EDBF5C60714F796393EAC6C88EA04C788857EA13768FCF1A27D97BEA9756E2CC79E1B9C77DB89BC1DBF9204A1340222594FCF4BD3B36447
Malicious:	false
Preview:	{"bookmarks-toolbar-default-on":{"slug":"bookmarks-toolbar-default-on","branch":{"slug":"treatment-a","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"enableBookmarksToolbar":"always"},"enabled":true,"featureId":"bookmarks"}]},"active":true,"enrollmentId":"22cb469c-1a0f-4c4f-8465-adc25b4d990d","experimentType":"nimbus","source":"rs-loader","userFacingName":"Bookmarks Toolbar Default On","userFacingDescription":"An experiment that turns the bookmarks toolbar on by default.","lastSeen":"2023-10-05T09:51:32.910Z","featureIds":["bookmarks"],"prefs":[{"name":"browser.toolbars.bookmarks.visibility","branch":"user","featureId":"bookmarks","variable":"enableBookmarksToolbar","originalValue":null}],"isRollout":false},"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\addonStartup.json.lz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 23432 bytes
Category:	dropped
Size (bytes):	5321
Entropy (8bit):	6.616950216416023
Encrypted:	false
SSDEEP:	96:V2YbKsKNU2xWrp327tGmD4wBON6h6cHaJVJuZMd0JGkkrw2Xb:VTx2x2t0FDJ4NpwZMd0EJwq
MD5:	E1518C2B2784D504C84C175662D1EF14
SHA1:	A3F4A3BD1C7F48BF4743BB3D1D3FED577D64D83B
SHA-256:	C807EF41D3523DFDB6CFC7CE39802775C41D527EE6E392251ED722C8AA53E89C
SHA-512:	37A02E4A3082DF419A0D7A8D48DC2997347B6F7D79142D0097D6B4B3FFE7AD646EF4C0B0E8D7171C871A163A25913F5F71E11467037290C980428ED9B1FC1B7D
Malicious:	false
Preview:	mozLz40..[....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\addonStartup.json.lz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 23432 bytes
Category:	dropped
Size (bytes):	5321
Entropy (8bit):	6.616950216416023
Encrypted:	false
SSDEEP:	96:V2YbKsKNU2xWrp327tGmD4wBON6h6cHaJVJuZMd0JGkkrw2Xb:VTx2x2t0FDJ4NpwZMd0EJwq
MD5:	E1518C2B2784D504C84C175662D1EF14
SHA1:	A3F4A3BD1C7F48BF4743BB3D1D3FED577D64D83B
SHA-256:	C807EF41D3523DFDB6CFC7CE39802775C41D527EE6E392251ED722C8AA53E89C
SHA-512:	37A02E4A3082DF419A0D7A8D48DC2997347B6F7D79142D0097D6B4B3FFE7AD646EF4C0B0E8D7171C871A163A25913F5F71E11467037290C980428ED9B1FC1B7D
Malicious:	false
Preview:	mozLz40..[....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\addons.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\addons.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\content-prefs.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.04905141882491872
Encrypted:	false
SSDEEP:	24:DLSvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DKwae+QtMImelekKDa5
MD5:	8736A542C5564A922C47B19D9CC5E0F2
SHA1:	CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A
SHA-256:	97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
SHA-512:	99777325893DC7A95FD49B2DA18D32D65F97CC7A8E482D78EDC32F63245457FA5A52750800C074D552D20B6A215604161FDC88763D93C76A8703470C3064196B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\crashes\store.json.mozlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\crashes\store.json.mozlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\extensions.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.188139169100479
Encrypted:	false
SSDEEP:	768:Y8I4ovfnXg4p6z4d4fv4A4RYhvMM4lV4PX4P45I464x:366vM0
MD5:	83BB625BB55A7C6258C8A955E9355247
SHA1:	F471A0899DA8F9D1891FE84EEE57F49A483BD354
SHA-256:	43EDDA472C6BF4E1D8930DE16766D904D45CFAB872BE0EFD34A97C9A7FF6C2F1
SHA-512:	5DFB70D3E2766CC995FA5376BDC80695240F110D50796264F94DC8F4BBD57C284062DDC5B175F77BE81F10E3222132A77E4A904E44A358F1CFBADD5DBFD14B9E
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{00c60170-fd9d-4229-8c0b-f2fb3c217cc3}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\extensions.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.188139169100479
Encrypted:	false
SSDEEP:	768:Y8I4ovfnXg4p6z4d4fv4A4RYhvMM4lV4PX4P45I464x:366vM0
MD5:	83BB625BB55A7C6258C8A955E9355247
SHA1:	F471A0899DA8F9D1891FE84EEE57F49A483BD354
SHA-256:	43EDDA472C6BF4E1D8930DE16766D904D45CFAB872BE0EFD34A97C9A7FF6C2F1
SHA-512:	5DFB70D3E2766CC995FA5376BDC80695240F110D50796264F94DC8F4BBD57C284062DDC5B175F77BE81F10E3222132A77E4A904E44A358F1CFBADD5DBFD14B9E
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{00c60170-fd9d-4229-8c0b-f2fb3c217cc3}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Q3M4ZKzjxb.exe, Detection: malicious, Browse Filename: Q3M4ZKzjxb.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: 3oKlYkFDuK.exe, Detection: malicious, Browse Filename: 3oKlYkFDuK.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Q3M4ZKzjxb.exe, Detection: malicious, Browse Filename: Q3M4ZKzjxb.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: 3oKlYkFDuK.exe, Detection: malicious, Browse Filename: 3oKlYkFDuK.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\permissions.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.07332220847014906
Encrypted:	false
SSDEEP:	12:DBl/A0OWla0mwPxRymgObsCVR45wcYR4fmnsCVR4zki:DLhesh7Owd4+ji
MD5:	05CE2793E6213F4404DA02DEEDEB6E7B
SHA1:	52E97CA42E07D972B06336517E0E7BB4FDC743D4
SHA-256:	AFCAB321D62F2A3042C8410970597BD81B79BFE5D3679DEBD8FA851AD23D4C55
SHA-512:	A59595E874D5B22FA73FE18CBD8E9AF8177BB3DB46A8495FBDFD322F8E2BE201370D98CC99F12A725BA08AE7F90BA043E9E65F3E1EA5C69B3DD2E04561985250
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......~s..F~s........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.035577876577226504
Encrypted:	false
SSDEEP:	3:GtlstFCHen6YYelIltlstFCHen6YYe/D89//alEl:GtWtA+n6feGtWtA+n6fe789XuM
MD5:	8DB4DC68709D432B0566E956E269C0BE
SHA1:	DF53466E740E2060BDA6823A0FD6CABED1160BAF
SHA-256:	DDB4800C605441BB485F47C58A8E3CEA6B559D8689DD8AF03DE3A8D3A0766B0F
SHA-512:	F6B73C8868FB2DBD08589489AB58687135855545349FDDE38EC8BB5AB9E073DED493FB40AB649AC4096425AB7F441F0C1688968F76C99E39C729A3666DA010D5
Malicious:	false
Preview:	..-.....................U.e...`B;.0z...;E\......-.....................U.e...`B;.0z...;E\............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	32824
Entropy (8bit):	0.03989725522705737
Encrypted:	false
SSDEEP:	3:Ol1gSEwPCulfnyLAI37l8rEXsxdwhml8XW3R2:KuSE6Cu1yfl8dMhm93w
MD5:	87B491B5D77228B5C0FA200E2E0A9AEB
SHA1:	A6D1160CCBA885994AFF16963D198E74CA434177
SHA-256:	89253216166679609025F33F676AF034E0BC73C791EF32A082D43972B84F59AC
SHA-512:	29F466A9169120576A51181AEF727E4094D5172EE378278FAA26A7D3040B718BAF60ED726B85C003A7A335A9B080B855F4D3DFBB826A60D2CF6C23C769CF8379
Malicious:	false
Preview:	7....-..........B;.0z....>Uj..t........B;.0z...e.U`...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1808), with CRLF line terminators
Category:	modified
Size (bytes):	14237
Entropy (8bit):	5.4635084131818346
Encrypted:	false
SSDEEP:	192:ynBRNZ3YbBp6tR1+PaXr6/x8lWWz9/3/7Y45RHNBw8s+KSl:Kee1C/xnm9lPwj0
MD5:	8BFD28BD8EDE749B951B0FE0000914DA
SHA1:	8627617E8F2AFC85A5ADE68B7DEE48C97499A60E
SHA-256:	FDD92C4C4631783F8E237C371460D3F57200A970870CF911E1CBCA3DB5DAE223
SHA-512:	89C2E99486006327F3636469BDE7034F25FE9295FD299D1A79361C2CC15A67F57CA97655ED19CD535D870715D6B94368E4CDD839DD608F1415EDACECAEE2BADA
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "ecedec8f-7097-47fc-a9e3-d74f0c8e2503");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.lastInstalledTaskVersion", 3);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1744733540);..user_pref("app.update.lastUpdateTime.background-update-timer", 1744733540);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1744733540);..user

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1808), with CRLF line terminators
Category:	dropped
Size (bytes):	14237
Entropy (8bit):	5.4635084131818346
Encrypted:	false
SSDEEP:	192:ynBRNZ3YbBp6tR1+PaXr6/x8lWWz9/3/7Y45RHNBw8s+KSl:Kee1C/xnm9lPwj0
MD5:	8BFD28BD8EDE749B951B0FE0000914DA
SHA1:	8627617E8F2AFC85A5ADE68B7DEE48C97499A60E
SHA-256:	FDD92C4C4631783F8E237C371460D3F57200A970870CF911E1CBCA3DB5DAE223
SHA-512:	89C2E99486006327F3636469BDE7034F25FE9295FD299D1A79361C2CC15A67F57CA97655ED19CD535D870715D6B94368E4CDD839DD608F1415EDACECAEE2BADA
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "ecedec8f-7097-47fc-a9e3-d74f0c8e2503");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.lastInstalledTaskVersion", 3);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1744733540);..user_pref("app.update.lastUpdateTime.background-update-timer", 1744733540);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1744733540);..user

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\protections.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.04062825861060003
Encrypted:	false
SSDEEP:	3:lSGBl/l/zl9l/AltllPltlnKollzvulJOlzALRWemFxu7TuRjBFbrl58lcV+wgn8:ltBl/lqN1K4BEJYqWvLue3FMOrMZ0l
MD5:	60C09456D6362C6FBED48C69AA342C3C
SHA1:	58B6E22DAA48C75958B429F662DEC1C011AE74D3
SHA-256:	FE1A432A2CD096B7EEA870D46D07F5197E34B4D10666E6E1C357FAA3F2FE2389
SHA-512:	936DBC887276EF07732783B50EAFE450A8598B0492B8F6C838B337EF3E8A6EA595E7C7A2FA4B3E881887FAAE2D207B953A4C65ED8C964D93118E00D3E03882BD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\sessionstore-backups\recovery.baklz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1569
Entropy (8bit):	6.354780007445996
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSHqLXnIgz/pnxQwRlszT5sKe5CF3eHVxs7Tzamhuj3IOuSEUm0WB06:GUpOxYq1nR6M+3eryTz4YrSuN
MD5:	C772ED139BC3DC990D0C59B9ACE8D1C9
SHA1:	2D2A82FCC839D0412F5526E943C3B08339249B0F
SHA-256:	E8EDE304AA6D8F5C03ED38E3FA09539E5DB41098E8AABEFB1F1695084A16C39C
SHA-512:	22A1B8DA28D9AC174087A6FEA22F5438AF8C465013756EA18A73941EEFF2F6C4E29CA332BB3A6B55DF061E1530601704A36A3915F6B6EAC5EF4F7516A5C4362A
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{0df33425-beff-41cd-8b2d-5dfa4120238b}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1744733546781,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...5dc5b86d-caf2-49c1-9e3a-a746c93976bc","zD..1...Wm..l........j..:....1":{..mUpdate...startTim..A0993...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu....93e1b9c34761ff8e8daa914c9d20b354e9b09a60c2e61...1388b36b843ead3e","pa..p"/","na..a"taarI\|.Recure...,`.Donly..fexpiry...20687,"originA...."fir

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1569
Entropy (8bit):	6.354780007445996
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSHqLXnIgz/pnxQwRlszT5sKe5CF3eHVxs7Tzamhuj3IOuSEUm0WB06:GUpOxYq1nR6M+3eryTz4YrSuN
MD5:	C772ED139BC3DC990D0C59B9ACE8D1C9
SHA1:	2D2A82FCC839D0412F5526E943C3B08339249B0F
SHA-256:	E8EDE304AA6D8F5C03ED38E3FA09539E5DB41098E8AABEFB1F1695084A16C39C
SHA-512:	22A1B8DA28D9AC174087A6FEA22F5438AF8C465013756EA18A73941EEFF2F6C4E29CA332BB3A6B55DF061E1530601704A36A3915F6B6EAC5EF4F7516A5C4362A
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{0df33425-beff-41cd-8b2d-5dfa4120238b}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1744733546781,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...5dc5b86d-caf2-49c1-9e3a-a746c93976bc","zD..1...Wm..l........j..:....1":{..mUpdate...startTim..A0993...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu....93e1b9c34761ff8e8daa914c9d20b354e9b09a60c2e61...1388b36b843ead3e","pa..p"/","na..a"taarI\|.Recure...,`.Donly..fexpiry...20687,"originA...."fir

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1569
Entropy (8bit):	6.354780007445996
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSHqLXnIgz/pnxQwRlszT5sKe5CF3eHVxs7Tzamhuj3IOuSEUm0WB06:GUpOxYq1nR6M+3eryTz4YrSuN
MD5:	C772ED139BC3DC990D0C59B9ACE8D1C9
SHA1:	2D2A82FCC839D0412F5526E943C3B08339249B0F
SHA-256:	E8EDE304AA6D8F5C03ED38E3FA09539E5DB41098E8AABEFB1F1695084A16C39C
SHA-512:	22A1B8DA28D9AC174087A6FEA22F5438AF8C465013756EA18A73941EEFF2F6C4E29CA332BB3A6B55DF061E1530601704A36A3915F6B6EAC5EF4F7516A5C4362A
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{0df33425-beff-41cd-8b2d-5dfa4120238b}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1744733546781,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...5dc5b86d-caf2-49c1-9e3a-a746c93976bc","zD..1...Wm..l........j..:....1":{..mUpdate...startTim..A0993...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu....93e1b9c34761ff8e8daa914c9d20b354e9b09a60c2e61...1388b36b843ead3e","pa..p"/","na..a"taarI\|.Recure...,`.Donly..fexpiry...20687,"originA...."fir

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.0836444556178684
Encrypted:	false
SSDEEP:	24:JBwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jnEUo9LXtR+JdkOnohYsl
MD5:	8B40B1534FF0F4B533AF767EB5639A05
SHA1:	63EDB539EA39AD09D701A36B535C4C087AE08CC9
SHA-256:	AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B
SHA-512:	54AF707698CED33C206B1B193DA414D630901762E88E37E99885A50D4D5F8DDC28367C9B401DFE251CF0552B4FA446EE28F78A97C9096AFB0F2898BFBB673B53
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\targeting.snapshot.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	5.029569654360387
Encrypted:	false
SSDEEP:	96:yc1NTEr5V/F/4U2zzcbvbw6KkOrc2Rn27:pTEr5VN/4U2z1phRe
MD5:	13021B2F8A5A4A1155C04805CBE43489
SHA1:	24FB1753EB06C572C7468BFF4EBDA5D077F6F838
SHA-256:	5B08CA98E305D351D6A46E701ABE36B8EEAC8F6DC8DA07EDA4D028B36278B767
SHA-512:	90D540FDE00FC087B7232BA4E443429C4717BC033F5343E71342FEED4A8271C062B79C6912A7FDA4EE0997EF2F90B8833A00EAEE6E9321285DB60346ED50727F
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2025-04-15T16:12:10.952Z","profileAgeCreated":1696499488915,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\targeting.snapshot.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	5.029569654360387
Encrypted:	false
SSDEEP:	96:yc1NTEr5V/F/4U2zzcbvbw6KkOrc2Rn27:pTEr5VN/4U2z1phRe
MD5:	13021B2F8A5A4A1155C04805CBE43489
SHA1:	24FB1753EB06C572C7468BFF4EBDA5D077F6F838
SHA-256:	5B08CA98E305D351D6A46E701ABE36B8EEAC8F6DC8DA07EDA4D028B36278B767
SHA-512:	90D540FDE00FC087B7232BA4E443429C4717BC033F5343E71342FEED4A8271C062B79C6912A7FDA4EE0997EF2F90B8833A00EAEE6E9321285DB60346ED50727F
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2025-04-15T16:12:10.952Z","profileAgeCreated":1696499488915,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\installs.ini

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.99320489765512
Encrypted:	false
SSDEEP:	3:plqfnrYKa4TQL2DB3BGvbr:raUJeQLkTGvv
MD5:	9E233E8DDDA69C8E764EC96F552E9074
SHA1:	436063C492958891A5D8AE7E5AE55C9C002FEE07
SHA-256:	15C3A4F09DEA715654D4C28F693CFE06FE8C86D35D203FD9E342E13C69D636FF
SHA-512:	A94626301457B09DC675A6B1EC77C68ACBB045CA5D85389E41BA689555BA5E36AE0235279EDFAF69374A62CCB57C745CCD1A25B5B8EA5C1605340CE3CB7184DC
Malicious:	false
Preview:	[308046B0AF4A39CB]..Default=Profiles/091tobv5.default-release..Locked=1....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Generic INItialization configuration [Profile1]
Category:	dropped
Size (bytes):	456
Entropy (8bit):	5.197919099503913
Encrypted:	false
SSDEEP:	12:HuBJPoGvPO8uLMdIQfIRyMdI5PMETR5bWPWFvy:HuBCGvPOZLMdIQfVMdIH6OFvy
MD5:	9D4E4860E0C49B0F119D6FE87A08085A
SHA1:	1A265B66C001473B8BFEFEBED85405AB4DDA1300
SHA-256:	0BD4E95EE48CC60DFBD7131F91AE7B39CE629B2056DA0300579F653AF3752665
SHA-512:	E798F04F8B15E3C70443A16F173FBF2D94F1C4514FF91DFC18551A8B053C97B36391B1D43A870F35C9B73C6C9FA9BF162B7516204E0870D59E954663F1194A27
Malicious:	false
Preview:	[Install308046B0AF4A39CB]..Default=Profiles/091tobv5.default-release..Locked=1....[Profile1]..Name=default..IsRelative=1..Path=Profiles/dtbqpus9.default..Default=1....[Profile0]..Name=default-release..IsRelative=1..Path=Profiles/091tobv5.default-release....[General]..StartWithLastProfile=1..Version=2....[BackgroundTasksProfiles]..MozillaBackgroundTask-308046B0AF4A39CB-backgroundupdate=9rlxi5te.MozillaBackgroundTask-308046B0AF4A39CB-backgroundupdate....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.702601982110703
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	random.exe
File size:	970'240 bytes
MD5:	55c6ac234aca077957813b6a5b94a805
SHA1:	96be80f44a36f24d32819e29af1ebdc1aca9a536
SHA256:	682121d8c7160e46c3c4bc595fdab0346ad08895b95c39f97c3afa8cd7922f8e
SHA512:	c8e8852c9cc026597b77335ec6b818299b219e065e20d8e8532f6f848c37bd7f84b91c9c0e31cd811851a87743bf7f190c1cd36bfeea6d906c74731368f67937
SSDEEP:	24576:ZqDEvCTbMWu7rQYlBQcBiT6rprG8aZLP3IFp:ZTvC/MTQYxsWR7aZDI
TLSH:	BB259E0273D1C062FFAB92334B5AF6515BBC69260123E61F13A81D79BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67FE48C3 [Tue Apr 15 11:53:39 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F16ACDDD6A3h
jmp 00007F16ACDDCFAFh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F16ACDDD18Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F16ACDDD15Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F16ACDDFD4Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F16ACDDFD98h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F16ACDDFD81h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x162ec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xeb000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x162ec	0x16400	3dd73622acaad07dfea410490c0f664d	False	0.7012816011235955	data	7.17043751503611	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xeb000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd4718	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd4840	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4968	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c50	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d78	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5c20	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd64c8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd6a30	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8fd8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda080	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4e8	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xda538	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xda634	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdabc8	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb254	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb6e4	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbce0	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc33c	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc7a4	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc8fc	0xd46e	data			1.0004780993711155
RT_GROUP_ICON	0xe9d6c	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xe9de4	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xe9df8	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xe9e0c	0x14	data	English	Great Britain	1.25
RT_VERSION	0xe9e20	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xe9efc	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Version Infos

Description	Data
Translation	0x0809 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 15, 2025 17:04:45.783518076 CEST	49690	443	192.168.2.10	35.190.72.216
Apr 15, 2025 17:04:45.783549070 CEST	443	49690	35.190.72.216	192.168.2.10
Apr 15, 2025 17:04:45.789155960 CEST	49690	443	192.168.2.10	35.190.72.216
Apr 15, 2025 17:04:45.815983057 CEST	49690	443	192.168.2.10	35.190.72.216
Apr 15, 2025 17:04:45.815998077 CEST	443	49690	35.190.72.216	192.168.2.10
Apr 15, 2025 17:04:46.042537928 CEST	443	49690	35.190.72.216	192.168.2.10
Apr 15, 2025 17:04:46.043200970 CEST	49690	443	192.168.2.10	35.190.72.216
Apr 15, 2025 17:04:46.158615112 CEST	49690	443	192.168.2.10	35.190.72.216
Apr 15, 2025 17:04:46.158648968 CEST	443	49690	35.190.72.216	192.168.2.10
Apr 15, 2025 17:04:46.158664942 CEST	49690	443	192.168.2.10	35.190.72.216
Apr 15, 2025 17:04:46.158951044 CEST	443	49690	35.190.72.216	192.168.2.10
Apr 15, 2025 17:04:46.159079075 CEST	49691	443	192.168.2.10	35.190.72.216
Apr 15, 2025 17:04:46.159128904 CEST	443	49691	35.190.72.216	192.168.2.10
Apr 15, 2025 17:04:46.160434961 CEST	49691	443	192.168.2.10	35.190.72.216
Apr 15, 2025 17:04:46.160494089 CEST	49690	443	192.168.2.10	35.190.72.216
Apr 15, 2025 17:04:46.162272930 CEST	49691	443	192.168.2.10	35.190.72.216
Apr 15, 2025 17:04:46.162302017 CEST	443	49691	35.190.72.216	192.168.2.10
Apr 15, 2025 17:04:46.382181883 CEST	443	49691	35.190.72.216	192.168.2.10
Apr 15, 2025 17:04:46.383085966 CEST	49691	443	192.168.2.10	35.190.72.216
Apr 15, 2025 17:04:46.463078022 CEST	49691	443	192.168.2.10	35.190.72.216
Apr 15, 2025 17:04:46.463103056 CEST	443	49691	35.190.72.216	192.168.2.10
Apr 15, 2025 17:04:46.463170052 CEST	49691	443	192.168.2.10	35.190.72.216
Apr 15, 2025 17:04:46.463452101 CEST	443	49691	35.190.72.216	192.168.2.10
Apr 15, 2025 17:04:46.463763952 CEST	49691	443	192.168.2.10	35.190.72.216
Apr 15, 2025 17:04:49.503633976 CEST	49692	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:49.585340023 CEST	49693	443	192.168.2.10	172.217.215.136
Apr 15, 2025 17:04:49.585386038 CEST	443	49693	172.217.215.136	192.168.2.10
Apr 15, 2025 17:04:49.585604906 CEST	49694	443	192.168.2.10	172.217.215.136
Apr 15, 2025 17:04:49.585642099 CEST	443	49694	172.217.215.136	192.168.2.10
Apr 15, 2025 17:04:49.587526083 CEST	49693	443	192.168.2.10	172.217.215.136
Apr 15, 2025 17:04:49.587713957 CEST	49694	443	192.168.2.10	172.217.215.136
Apr 15, 2025 17:04:49.589167118 CEST	49693	443	192.168.2.10	172.217.215.136
Apr 15, 2025 17:04:49.589181900 CEST	443	49693	172.217.215.136	192.168.2.10
Apr 15, 2025 17:04:49.590682983 CEST	49694	443	192.168.2.10	172.217.215.136
Apr 15, 2025 17:04:49.590698957 CEST	443	49694	172.217.215.136	192.168.2.10
Apr 15, 2025 17:04:49.609975100 CEST	80	49692	34.107.221.82	192.168.2.10
Apr 15, 2025 17:04:49.610049009 CEST	49692	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:49.610245943 CEST	49692	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:49.718175888 CEST	80	49692	34.107.221.82	192.168.2.10
Apr 15, 2025 17:04:49.719284058 CEST	80	49692	34.107.221.82	192.168.2.10
Apr 15, 2025 17:04:49.785077095 CEST	49692	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:49.813004017 CEST	443	49694	172.217.215.136	192.168.2.10
Apr 15, 2025 17:04:49.813410997 CEST	49694	443	192.168.2.10	172.217.215.136
Apr 15, 2025 17:04:49.813528061 CEST	443	49693	172.217.215.136	192.168.2.10
Apr 15, 2025 17:04:49.814065933 CEST	443	49694	172.217.215.136	192.168.2.10
Apr 15, 2025 17:04:49.814342022 CEST	49694	443	192.168.2.10	172.217.215.136
Apr 15, 2025 17:04:49.814347029 CEST	49693	443	192.168.2.10	172.217.215.136
Apr 15, 2025 17:04:49.814565897 CEST	443	49693	172.217.215.136	192.168.2.10
Apr 15, 2025 17:04:49.814698935 CEST	49693	443	192.168.2.10	172.217.215.136
Apr 15, 2025 17:04:49.820384026 CEST	49693	443	192.168.2.10	172.217.215.136
Apr 15, 2025 17:04:49.820393085 CEST	443	49693	172.217.215.136	192.168.2.10
Apr 15, 2025 17:04:49.820707083 CEST	49693	443	192.168.2.10	172.217.215.136
Apr 15, 2025 17:04:49.820729017 CEST	443	49693	172.217.215.136	192.168.2.10
Apr 15, 2025 17:04:49.820836067 CEST	49693	443	192.168.2.10	172.217.215.136
Apr 15, 2025 17:04:49.823323011 CEST	49694	443	192.168.2.10	172.217.215.136
Apr 15, 2025 17:04:49.823348045 CEST	443	49694	172.217.215.136	192.168.2.10
Apr 15, 2025 17:04:49.823380947 CEST	49694	443	192.168.2.10	172.217.215.136
Apr 15, 2025 17:04:49.823605061 CEST	443	49694	172.217.215.136	192.168.2.10
Apr 15, 2025 17:04:49.823834896 CEST	49694	443	192.168.2.10	172.217.215.136
Apr 15, 2025 17:04:50.167793036 CEST	49695	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:50.167833090 CEST	443	49695	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:50.168025017 CEST	49695	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:50.169497967 CEST	49695	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:50.169511080 CEST	443	49695	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:50.348767996 CEST	49696	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:04:50.348813057 CEST	443	49696	35.244.181.201	192.168.2.10
Apr 15, 2025 17:04:50.349143982 CEST	49696	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:04:50.349865913 CEST	49697	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:50.350017071 CEST	49696	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:04:50.350029945 CEST	443	49696	35.244.181.201	192.168.2.10
Apr 15, 2025 17:04:50.350575924 CEST	49698	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:50.350584984 CEST	443	49698	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:50.352277994 CEST	49698	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:50.354665995 CEST	49698	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:50.354685068 CEST	443	49698	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:50.396086931 CEST	443	49695	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:50.396758080 CEST	49695	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:50.412009954 CEST	49695	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:50.412024021 CEST	443	49695	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:50.412111998 CEST	49695	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:50.412415981 CEST	443	49695	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:50.412689924 CEST	49695	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:50.456188917 CEST	80	49697	34.107.221.82	192.168.2.10
Apr 15, 2025 17:04:50.456269026 CEST	49697	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:50.456562996 CEST	49697	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:50.508366108 CEST	49692	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:50.562822104 CEST	80	49697	34.107.221.82	192.168.2.10
Apr 15, 2025 17:04:50.564526081 CEST	80	49697	34.107.221.82	192.168.2.10
Apr 15, 2025 17:04:50.573004007 CEST	443	49696	35.244.181.201	192.168.2.10
Apr 15, 2025 17:04:50.573282003 CEST	49696	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:04:50.576076984 CEST	49696	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:04:50.576085091 CEST	443	49696	35.244.181.201	192.168.2.10
Apr 15, 2025 17:04:50.576407909 CEST	443	49696	35.244.181.201	192.168.2.10
Apr 15, 2025 17:04:50.578613997 CEST	49696	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:04:50.578623056 CEST	443	49698	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:50.578757048 CEST	49696	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:04:50.578821898 CEST	443	49696	35.244.181.201	192.168.2.10
Apr 15, 2025 17:04:50.578830957 CEST	49698	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:50.579981089 CEST	49696	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:04:50.582931995 CEST	49698	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:50.582937002 CEST	443	49698	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:50.583026886 CEST	49698	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:50.583098888 CEST	443	49698	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:50.583405018 CEST	49699	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:50.583446980 CEST	443	49699	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:50.583522081 CEST	49698	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:50.583744049 CEST	49699	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:50.585015059 CEST	49699	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:50.585036039 CEST	443	49699	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:50.616055012 CEST	80	49692	34.107.221.82	192.168.2.10
Apr 15, 2025 17:04:50.616223097 CEST	49700	443	192.168.2.10	34.160.144.191
Apr 15, 2025 17:04:50.616272926 CEST	443	49700	34.160.144.191	192.168.2.10
Apr 15, 2025 17:04:50.616641998 CEST	49700	443	192.168.2.10	34.160.144.191
Apr 15, 2025 17:04:50.616957903 CEST	49700	443	192.168.2.10	34.160.144.191
Apr 15, 2025 17:04:50.616981983 CEST	443	49700	34.160.144.191	192.168.2.10
Apr 15, 2025 17:04:50.618794918 CEST	49697	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:50.665653944 CEST	49692	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:50.688410997 CEST	49692	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:50.688450098 CEST	49697	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:50.736741066 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:50.736969948 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:50.794678926 CEST	80	49692	34.107.221.82	192.168.2.10
Apr 15, 2025 17:04:50.794971943 CEST	80	49697	34.107.221.82	192.168.2.10
Apr 15, 2025 17:04:50.798803091 CEST	49692	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:50.798837900 CEST	49697	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:50.812056065 CEST	443	49699	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:50.816353083 CEST	443	49699	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:50.819425106 CEST	49699	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:50.839766979 CEST	443	49700	34.160.144.191	192.168.2.10
Apr 15, 2025 17:04:50.842930079 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:04:50.843206882 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:04:50.844270945 CEST	443	49700	34.160.144.191	192.168.2.10
Apr 15, 2025 17:04:50.850665092 CEST	49700	443	192.168.2.10	34.160.144.191
Apr 15, 2025 17:04:50.850723982 CEST	49700	443	192.168.2.10	34.160.144.191
Apr 15, 2025 17:04:50.850833893 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:50.850835085 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:50.853801966 CEST	49700	443	192.168.2.10	34.160.144.191
Apr 15, 2025 17:04:50.853811026 CEST	443	49700	34.160.144.191	192.168.2.10
Apr 15, 2025 17:04:50.853892088 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:50.854024887 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:50.854073048 CEST	443	49700	34.160.144.191	192.168.2.10
Apr 15, 2025 17:04:50.854759932 CEST	49699	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:50.854773998 CEST	443	49699	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:50.854835987 CEST	49699	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:50.855345011 CEST	443	49699	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:50.857132912 CEST	49700	443	192.168.2.10	34.160.144.191
Apr 15, 2025 17:04:50.857132912 CEST	49700	443	192.168.2.10	34.160.144.191
Apr 15, 2025 17:04:50.857291937 CEST	443	49700	34.160.144.191	192.168.2.10
Apr 15, 2025 17:04:50.857490063 CEST	49703	443	192.168.2.10	34.160.144.191
Apr 15, 2025 17:04:50.857542992 CEST	443	49703	34.160.144.191	192.168.2.10
Apr 15, 2025 17:04:50.864269018 CEST	443	49700	34.160.144.191	192.168.2.10
Apr 15, 2025 17:04:50.882878065 CEST	49699	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:50.882884026 CEST	49700	443	192.168.2.10	34.160.144.191
Apr 15, 2025 17:04:50.882911921 CEST	49700	443	192.168.2.10	34.160.144.191
Apr 15, 2025 17:04:50.882955074 CEST	49703	443	192.168.2.10	34.160.144.191
Apr 15, 2025 17:04:50.883140087 CEST	49703	443	192.168.2.10	34.160.144.191
Apr 15, 2025 17:04:50.883162022 CEST	443	49703	34.160.144.191	192.168.2.10
Apr 15, 2025 17:04:50.884141922 CEST	49700	443	192.168.2.10	34.160.144.191
Apr 15, 2025 17:04:50.960319042 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:04:50.960349083 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:04:50.961940050 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:04:50.963073969 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:04:51.004244089 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:51.004276037 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:51.229677916 CEST	49704	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:51.229729891 CEST	443	49704	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:51.229768038 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:51.233526945 CEST	49704	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:51.234971046 CEST	49704	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:51.234986067 CEST	443	49704	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:51.291781902 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:51.336992979 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:04:51.382371902 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:51.399435043 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:04:51.403951883 CEST	49705	443	192.168.2.10	52.36.50.141
Apr 15, 2025 17:04:51.403981924 CEST	443	49705	52.36.50.141	192.168.2.10
Apr 15, 2025 17:04:51.404215097 CEST	49705	443	192.168.2.10	52.36.50.141
Apr 15, 2025 17:04:51.405884027 CEST	49705	443	192.168.2.10	52.36.50.141
Apr 15, 2025 17:04:51.405898094 CEST	443	49705	52.36.50.141	192.168.2.10
Apr 15, 2025 17:04:51.410028934 CEST	443	49703	34.160.144.191	192.168.2.10
Apr 15, 2025 17:04:51.410048008 CEST	443	49703	34.160.144.191	192.168.2.10
Apr 15, 2025 17:04:51.410160065 CEST	49703	443	192.168.2.10	34.160.144.191
Apr 15, 2025 17:04:51.416271925 CEST	49703	443	192.168.2.10	34.160.144.191
Apr 15, 2025 17:04:51.416295052 CEST	443	49703	34.160.144.191	192.168.2.10
Apr 15, 2025 17:04:51.416718006 CEST	443	49703	34.160.144.191	192.168.2.10
Apr 15, 2025 17:04:51.419172049 CEST	49703	443	192.168.2.10	34.160.144.191
Apr 15, 2025 17:04:51.419243097 CEST	49703	443	192.168.2.10	34.160.144.191
Apr 15, 2025 17:04:51.419374943 CEST	443	49703	34.160.144.191	192.168.2.10
Apr 15, 2025 17:04:51.419482946 CEST	49703	443	192.168.2.10	34.160.144.191
Apr 15, 2025 17:04:51.451350927 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:51.455249071 CEST	443	49704	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:51.460635900 CEST	49704	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:51.465024948 CEST	49704	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:51.465033054 CEST	443	49704	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:51.465133905 CEST	49704	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:51.465190887 CEST	443	49704	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:51.465578079 CEST	49704	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:51.465603113 CEST	49706	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:51.465641022 CEST	443	49706	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:51.465827942 CEST	49706	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:51.467292070 CEST	49706	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:51.467304945 CEST	443	49706	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:51.685842991 CEST	443	49706	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:51.692271948 CEST	443	49706	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:51.698940039 CEST	49706	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:51.932715893 CEST	443	49705	52.36.50.141	192.168.2.10
Apr 15, 2025 17:04:51.944281101 CEST	443	49705	52.36.50.141	192.168.2.10
Apr 15, 2025 17:04:51.944346905 CEST	49705	443	192.168.2.10	52.36.50.141
Apr 15, 2025 17:04:51.944819927 CEST	49705	443	192.168.2.10	52.36.50.141
Apr 15, 2025 17:04:52.016990900 CEST	49706	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:52.017020941 CEST	443	49706	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:52.017105103 CEST	49706	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:52.017236948 CEST	49705	443	192.168.2.10	52.36.50.141
Apr 15, 2025 17:04:52.017236948 CEST	49705	443	192.168.2.10	52.36.50.141
Apr 15, 2025 17:04:52.017265081 CEST	443	49705	52.36.50.141	192.168.2.10
Apr 15, 2025 17:04:52.017296076 CEST	443	49706	34.36.137.203	192.168.2.10
Apr 15, 2025 17:04:52.017543077 CEST	49706	443	192.168.2.10	34.36.137.203
Apr 15, 2025 17:04:52.017862082 CEST	443	49705	52.36.50.141	192.168.2.10
Apr 15, 2025 17:04:52.018168926 CEST	49705	443	192.168.2.10	52.36.50.141
Apr 15, 2025 17:04:52.307024002 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:52.414623976 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:04:52.472973108 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:52.595007896 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:52.702495098 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:04:52.750144005 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:54.415056944 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:54.522558928 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:04:54.566031933 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:04:59.934695005 CEST	49712	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:04:59.934735060 CEST	443	49712	34.120.208.123	192.168.2.10
Apr 15, 2025 17:04:59.934977055 CEST	49712	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:04:59.936527967 CEST	49712	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:04:59.936553001 CEST	443	49712	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:00.161076069 CEST	443	49712	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:00.161154032 CEST	49712	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:00.166500092 CEST	49712	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:00.166507959 CEST	443	49712	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:00.166604996 CEST	49712	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:00.166656017 CEST	443	49712	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:00.166753054 CEST	49712	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:00.240995884 CEST	49713	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:00.241040945 CEST	443	49713	34.107.243.93	192.168.2.10
Apr 15, 2025 17:05:00.252492905 CEST	49713	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:00.256635904 CEST	49713	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:00.256653070 CEST	443	49713	34.107.243.93	192.168.2.10
Apr 15, 2025 17:05:00.303708076 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:00.411467075 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:00.475255966 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:00.476752996 CEST	49714	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:00.476768017 CEST	443	49714	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:00.480428934 CEST	443	49713	34.107.243.93	192.168.2.10
Apr 15, 2025 17:05:00.480444908 CEST	443	49713	34.107.243.93	192.168.2.10
Apr 15, 2025 17:05:00.483025074 CEST	49714	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:00.483143091 CEST	49713	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:00.486536026 CEST	49714	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:00.486551046 CEST	443	49714	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:00.488950968 CEST	49713	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:00.488955021 CEST	443	49713	34.107.243.93	192.168.2.10
Apr 15, 2025 17:05:00.489017963 CEST	49713	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:00.489123106 CEST	443	49713	34.107.243.93	192.168.2.10
Apr 15, 2025 17:05:00.490787029 CEST	49713	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:00.495018005 CEST	49715	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:00.495053053 CEST	443	49715	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:00.501214981 CEST	49715	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:00.506741047 CEST	49715	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:00.506757975 CEST	443	49715	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:00.708295107 CEST	443	49714	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:00.708374977 CEST	49714	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:00.712640047 CEST	49714	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:00.712656975 CEST	443	49714	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:00.712764978 CEST	49714	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:00.712815046 CEST	443	49714	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:00.712943077 CEST	49714	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:00.715704918 CEST	49716	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:00.715740919 CEST	443	49716	34.149.100.209	192.168.2.10
Apr 15, 2025 17:05:00.715848923 CEST	49716	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:00.717741013 CEST	49716	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:00.717751980 CEST	443	49716	34.149.100.209	192.168.2.10
Apr 15, 2025 17:05:00.725087881 CEST	443	49715	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:00.725177050 CEST	49715	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:00.728118896 CEST	49715	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:00.728131056 CEST	443	49715	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:00.728378057 CEST	443	49715	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:00.730839968 CEST	49715	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:00.730941057 CEST	49715	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:00.730974913 CEST	443	49715	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:00.731121063 CEST	49715	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:00.752763033 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:00.754663944 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:00.860440969 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:00.862617970 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:00.907597065 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:00.907664061 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:00.910659075 CEST	49717	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:00.910711050 CEST	443	49717	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:00.912834883 CEST	49717	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:00.941479921 CEST	443	49716	34.149.100.209	192.168.2.10
Apr 15, 2025 17:05:00.941673040 CEST	49716	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:01.339860916 CEST	49717	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:01.339885950 CEST	443	49717	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:01.342370033 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:01.344450951 CEST	49716	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:01.344468117 CEST	443	49716	34.149.100.209	192.168.2.10
Apr 15, 2025 17:05:01.344556093 CEST	49716	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:01.344696999 CEST	443	49716	34.149.100.209	192.168.2.10
Apr 15, 2025 17:05:01.344913006 CEST	49718	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:01.344947100 CEST	443	49718	34.149.100.209	192.168.2.10
Apr 15, 2025 17:05:01.346002102 CEST	49716	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:01.346041918 CEST	49718	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:01.347480059 CEST	49718	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:01.347501040 CEST	443	49718	34.149.100.209	192.168.2.10
Apr 15, 2025 17:05:01.449912071 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:01.509501934 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:01.558634043 CEST	443	49717	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:01.559103966 CEST	49717	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:01.563271999 CEST	49717	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:01.563278913 CEST	443	49717	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:01.563323021 CEST	49717	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:01.563424110 CEST	443	49717	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:01.566458941 CEST	49717	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:01.566565037 CEST	443	49718	34.149.100.209	192.168.2.10
Apr 15, 2025 17:05:01.567167997 CEST	49718	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:01.571460009 CEST	49718	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:01.571482897 CEST	443	49718	34.149.100.209	192.168.2.10
Apr 15, 2025 17:05:01.571552992 CEST	49718	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:01.571660995 CEST	443	49718	34.149.100.209	192.168.2.10
Apr 15, 2025 17:05:01.572926998 CEST	49718	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:01.576281071 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:01.591901064 CEST	49719	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:01.591969967 CEST	443	49719	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:01.594136953 CEST	49719	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:01.594486952 CEST	49719	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:01.594506025 CEST	443	49719	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:01.595015049 CEST	49720	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:01.595055103 CEST	443	49720	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:01.602267027 CEST	49720	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:01.602473021 CEST	49720	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:01.602493048 CEST	443	49720	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:01.618884087 CEST	49721	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:01.618938923 CEST	443	49721	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:01.621208906 CEST	49721	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:01.622631073 CEST	49721	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:01.622648954 CEST	443	49721	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:01.683767080 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:01.741488934 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:01.754702091 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:01.814146996 CEST	443	49719	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:01.814237118 CEST	49719	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:01.822005033 CEST	443	49720	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:01.822024107 CEST	443	49720	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:01.822074890 CEST	49720	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:01.848973989 CEST	443	49721	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:01.849070072 CEST	49721	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:01.861926079 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:01.910607100 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:03.720654011 CEST	49719	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:03.720693111 CEST	443	49719	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:03.721036911 CEST	443	49719	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:03.785285950 CEST	49719	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:05.301783085 CEST	49720	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:05.301800013 CEST	443	49720	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:05.302261114 CEST	443	49720	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:05.310837984 CEST	49719	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:05.310913086 CEST	49719	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:05.311530113 CEST	49720	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:05.311609030 CEST	49720	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:05.311913967 CEST	443	49719	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:05.311949968 CEST	443	49720	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:05.314024925 CEST	49721	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:05.314045906 CEST	443	49721	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:05.314106941 CEST	49721	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:05.314348936 CEST	443	49721	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:05.318586111 CEST	49719	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:05.318614006 CEST	49721	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:05.318619013 CEST	49720	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:06.136274099 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:06.244076967 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:06.292548895 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:06.844857931 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:06.877619982 CEST	49724	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:06.877656937 CEST	443	49724	34.107.243.93	192.168.2.10
Apr 15, 2025 17:05:06.880276918 CEST	49724	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:06.881794930 CEST	49724	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:06.881809950 CEST	443	49724	34.107.243.93	192.168.2.10
Apr 15, 2025 17:05:06.886080027 CEST	49725	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:06.886102915 CEST	443	49725	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:06.886765003 CEST	49725	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:06.888078928 CEST	49725	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:06.888092995 CEST	443	49725	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:06.951986074 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:06.994529963 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:07.099687099 CEST	443	49724	34.107.243.93	192.168.2.10
Apr 15, 2025 17:05:07.103095055 CEST	49724	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:07.108881950 CEST	49724	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:07.108895063 CEST	443	49724	34.107.243.93	192.168.2.10
Apr 15, 2025 17:05:07.108944893 CEST	49724	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:07.109105110 CEST	443	49724	34.107.243.93	192.168.2.10
Apr 15, 2025 17:05:07.110445023 CEST	49724	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:07.112885952 CEST	443	49725	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:07.113200903 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:07.114428043 CEST	49725	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:07.119857073 CEST	49725	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:07.119868994 CEST	443	49725	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:07.119955063 CEST	49725	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:07.120106936 CEST	443	49725	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:07.125315905 CEST	49726	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:07.125365019 CEST	443	49726	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:07.126064062 CEST	49725	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:07.126100063 CEST	49726	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:07.128110886 CEST	49726	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:07.128124952 CEST	443	49726	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:07.220684052 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:07.226685047 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:07.273247004 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:07.334506035 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:07.348412037 CEST	443	49726	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:07.348490953 CEST	49726	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:07.354032993 CEST	49726	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:07.354042053 CEST	443	49726	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:07.354159117 CEST	49726	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:07.354218006 CEST	443	49726	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:07.355484962 CEST	49726	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:07.357381105 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:07.380831957 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:07.464838982 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:07.468607903 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:07.511607885 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:07.575865030 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:07.627532959 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:14.489945889 CEST	49727	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:14.489991903 CEST	443	49727	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:14.491993904 CEST	49727	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:14.492178917 CEST	49727	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:14.492191076 CEST	443	49727	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:14.512124062 CEST	49728	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:14.512166977 CEST	443	49728	34.149.100.209	192.168.2.10
Apr 15, 2025 17:05:14.512695074 CEST	49728	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:14.512789965 CEST	49728	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:14.512799025 CEST	443	49728	34.149.100.209	192.168.2.10
Apr 15, 2025 17:05:14.517256021 CEST	49729	443	192.168.2.10	35.190.72.216
Apr 15, 2025 17:05:14.517287016 CEST	443	49729	35.190.72.216	192.168.2.10
Apr 15, 2025 17:05:14.519342899 CEST	49729	443	192.168.2.10	35.190.72.216
Apr 15, 2025 17:05:14.520642042 CEST	49729	443	192.168.2.10	35.190.72.216
Apr 15, 2025 17:05:14.520649910 CEST	443	49729	35.190.72.216	192.168.2.10
Apr 15, 2025 17:05:14.622107029 CEST	49730	443	192.168.2.10	151.101.193.91
Apr 15, 2025 17:05:14.622164965 CEST	443	49730	151.101.193.91	192.168.2.10
Apr 15, 2025 17:05:14.622426033 CEST	49730	443	192.168.2.10	151.101.193.91
Apr 15, 2025 17:05:14.622592926 CEST	49730	443	192.168.2.10	151.101.193.91
Apr 15, 2025 17:05:14.622603893 CEST	443	49730	151.101.193.91	192.168.2.10
Apr 15, 2025 17:05:14.633868933 CEST	49731	443	192.168.2.10	34.49.51.44
Apr 15, 2025 17:05:14.633903027 CEST	443	49731	34.49.51.44	192.168.2.10
Apr 15, 2025 17:05:14.634135008 CEST	49731	443	192.168.2.10	34.49.51.44
Apr 15, 2025 17:05:14.635572910 CEST	49731	443	192.168.2.10	34.49.51.44
Apr 15, 2025 17:05:14.635586023 CEST	443	49731	34.49.51.44	192.168.2.10
Apr 15, 2025 17:05:14.710602045 CEST	443	49727	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:14.710689068 CEST	49727	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:14.714071035 CEST	49727	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:14.714080095 CEST	443	49727	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:14.714342117 CEST	443	49727	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:14.717252016 CEST	49727	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:14.717346907 CEST	49727	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:14.717427015 CEST	443	49727	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:14.717658997 CEST	49727	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:14.721942902 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:14.738814116 CEST	443	49728	34.149.100.209	192.168.2.10
Apr 15, 2025 17:05:14.738900900 CEST	49728	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:14.739192963 CEST	443	49729	35.190.72.216	192.168.2.10
Apr 15, 2025 17:05:14.739617109 CEST	49729	443	192.168.2.10	35.190.72.216
Apr 15, 2025 17:05:14.741996050 CEST	49728	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:14.742003918 CEST	443	49728	34.149.100.209	192.168.2.10
Apr 15, 2025 17:05:14.742804050 CEST	443	49728	34.149.100.209	192.168.2.10
Apr 15, 2025 17:05:14.747263908 CEST	49728	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:14.747359037 CEST	49728	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:14.747426987 CEST	443	49728	34.149.100.209	192.168.2.10
Apr 15, 2025 17:05:14.747534037 CEST	49729	443	192.168.2.10	35.190.72.216
Apr 15, 2025 17:05:14.747534037 CEST	49729	443	192.168.2.10	35.190.72.216
Apr 15, 2025 17:05:14.747559071 CEST	443	49729	35.190.72.216	192.168.2.10
Apr 15, 2025 17:05:14.747725010 CEST	443	49729	35.190.72.216	192.168.2.10
Apr 15, 2025 17:05:14.747752905 CEST	49728	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:14.748881102 CEST	49729	443	192.168.2.10	35.190.72.216
Apr 15, 2025 17:05:14.829416037 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:14.832469940 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:14.842776060 CEST	443	49730	151.101.193.91	192.168.2.10
Apr 15, 2025 17:05:14.842853069 CEST	49730	443	192.168.2.10	151.101.193.91
Apr 15, 2025 17:05:14.846065998 CEST	49730	443	192.168.2.10	151.101.193.91
Apr 15, 2025 17:05:14.846081972 CEST	443	49730	151.101.193.91	192.168.2.10
Apr 15, 2025 17:05:14.846313953 CEST	443	49730	151.101.193.91	192.168.2.10
Apr 15, 2025 17:05:14.848794937 CEST	49730	443	192.168.2.10	151.101.193.91
Apr 15, 2025 17:05:14.848858118 CEST	49730	443	192.168.2.10	151.101.193.91
Apr 15, 2025 17:05:14.848923922 CEST	443	49730	151.101.193.91	192.168.2.10
Apr 15, 2025 17:05:14.849009991 CEST	49730	443	192.168.2.10	151.101.193.91
Apr 15, 2025 17:05:14.857409000 CEST	49732	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:14.857456923 CEST	443	49732	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:14.859457970 CEST	49733	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:14.859486103 CEST	49732	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:14.859493017 CEST	443	49733	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:14.859595060 CEST	49733	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:14.859618902 CEST	49732	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:14.859642982 CEST	443	49732	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:14.859731913 CEST	49733	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:14.859745979 CEST	443	49733	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:14.861465931 CEST	49734	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:14.861485004 CEST	443	49734	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:14.862876892 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:14.863171101 CEST	49734	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:14.863279104 CEST	49734	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:14.863293886 CEST	443	49734	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:14.868068933 CEST	443	49731	34.49.51.44	192.168.2.10
Apr 15, 2025 17:05:14.872282982 CEST	443	49731	34.49.51.44	192.168.2.10
Apr 15, 2025 17:05:14.880635977 CEST	49731	443	192.168.2.10	34.49.51.44
Apr 15, 2025 17:05:14.884229898 CEST	49731	443	192.168.2.10	34.49.51.44
Apr 15, 2025 17:05:14.884237051 CEST	443	49731	34.49.51.44	192.168.2.10
Apr 15, 2025 17:05:14.884330988 CEST	49731	443	192.168.2.10	34.49.51.44
Apr 15, 2025 17:05:14.884820938 CEST	443	49731	34.49.51.44	192.168.2.10
Apr 15, 2025 17:05:14.885025978 CEST	49731	443	192.168.2.10	34.49.51.44
Apr 15, 2025 17:05:14.899324894 CEST	49735	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:14.899379969 CEST	443	49735	34.149.100.209	192.168.2.10
Apr 15, 2025 17:05:14.899985075 CEST	49735	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:14.900134087 CEST	49735	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:14.900146961 CEST	443	49735	34.149.100.209	192.168.2.10
Apr 15, 2025 17:05:14.939909935 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:14.970527887 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:14.973387003 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:15.018466949 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:15.077974081 CEST	443	49732	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:15.078142881 CEST	49732	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:15.080734015 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:15.081100941 CEST	49732	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:15.081113100 CEST	443	49732	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:15.081372976 CEST	443	49732	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:15.081948996 CEST	443	49734	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:15.082873106 CEST	49734	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:15.084548950 CEST	443	49733	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:15.085220098 CEST	49734	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:15.085227013 CEST	443	49734	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:15.085481882 CEST	49733	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:15.085647106 CEST	443	49734	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:15.088052034 CEST	49733	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:15.088057995 CEST	443	49733	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:15.088365078 CEST	443	49733	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:15.088563919 CEST	49732	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:15.088643074 CEST	49732	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:15.088721991 CEST	443	49732	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:15.092211962 CEST	49734	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:15.092281103 CEST	49734	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:15.092412949 CEST	443	49734	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:15.092705011 CEST	49733	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:15.092705011 CEST	49733	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:15.092870951 CEST	443	49733	35.244.181.201	192.168.2.10
Apr 15, 2025 17:05:15.095942020 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:15.096647978 CEST	49732	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:15.096678972 CEST	49734	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:15.096683025 CEST	49733	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:15.096683025 CEST	49733	443	192.168.2.10	35.244.181.201
Apr 15, 2025 17:05:15.118522882 CEST	443	49735	34.149.100.209	192.168.2.10
Apr 15, 2025 17:05:15.118598938 CEST	49735	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:15.121395111 CEST	49735	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:15.121406078 CEST	443	49735	34.149.100.209	192.168.2.10
Apr 15, 2025 17:05:15.121637106 CEST	443	49735	34.149.100.209	192.168.2.10
Apr 15, 2025 17:05:15.123415947 CEST	49735	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:15.123491049 CEST	49735	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:15.123542070 CEST	443	49735	34.149.100.209	192.168.2.10
Apr 15, 2025 17:05:15.124128103 CEST	49735	443	192.168.2.10	34.149.100.209
Apr 15, 2025 17:05:15.134392023 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:15.203382969 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:15.206345081 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:15.208383083 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.250317097 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:15.313637018 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:15.313919067 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.314157963 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.314414024 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.366215944 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:15.421344995 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.422379017 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.422394991 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.422460079 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.423187017 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.423201084 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.423722029 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.424822092 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.424868107 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.425306082 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.426444054 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.426456928 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.426677942 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.428107023 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.428183079 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.428267956 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.429723978 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.429739952 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.429783106 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.431339979 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.431353092 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.431454897 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.433002949 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.433017015 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.434402943 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.434602022 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.434653044 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.434851885 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.436224937 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.436240911 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.436433077 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.437885046 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.437897921 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.437979937 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.439544916 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.439560890 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.440274954 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.441173077 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.441184998 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.441350937 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.442800999 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.442812920 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.442879915 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.444427013 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.444443941 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.444489002 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.446048021 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.446063042 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.446307898 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.447735071 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.447748899 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.447838068 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.449345112 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.449358940 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.449417114 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.450963974 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.450978041 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.451042891 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.452620983 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.452641010 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.452740908 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.454211950 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.454231024 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.454441071 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.455868959 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.455883980 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.455957890 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.457462072 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.457496881 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.457691908 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.528084040 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.528103113 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.528271914 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.528821945 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.528837919 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.528934002 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.530473948 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.530489922 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.530565977 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.532110929 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.532126904 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.532273054 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.533708096 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.533724070 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.533906937 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.535377979 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.535393953 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.535510063 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.537003040 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.537019968 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.537242889 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.538614988 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.538629055 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.538707018 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.542138100 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.542159081 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.542311907 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.542320967 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.542327881 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.542390108 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.543751955 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.543778896 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.544015884 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.545461893 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.545478106 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.545605898 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.547149897 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.547163963 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.547290087 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.548413038 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.548434019 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.548620939 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.550024986 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.550040007 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.550189972 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.551680088 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.551696062 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.551815033 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.553333998 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.553349972 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.553483963 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.554965973 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.554981947 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.555078983 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.556617975 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.556632996 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.556727886 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.558217049 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.558233023 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.558429003 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.559892893 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.559909105 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.560030937 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.561459064 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.561475039 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.561620951 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.563085079 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.563126087 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.563206911 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.564779043 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.564794064 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.564865112 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.566374063 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.566389084 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.566436052 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.568085909 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.568099976 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.568274021 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.569641113 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.569663048 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.569788933 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.571278095 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.571291924 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.571410894 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.572922945 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.572937012 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.573025942 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.576585054 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.576601028 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.576736927 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.576755047 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.576769114 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.576867104 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.578507900 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.578521013 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.578574896 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.580265999 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.580281019 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.580380917 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.581468105 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.581480980 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.581536055 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.583117962 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.583132029 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.583213091 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.584846020 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.584862947 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.584944963 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.586523056 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.586544991 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.586863995 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.588149071 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.588175058 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.588280916 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.589265108 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.589426041 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.589546919 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.590971947 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.590991974 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.591097116 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.592499971 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.592514992 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.592621088 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.594110012 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.594146013 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.594316959 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.595736980 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.595771074 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.595897913 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.600230932 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.600246906 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.600260973 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.600275040 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.600297928 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.600445032 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.601219893 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.601233959 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.601336002 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.634365082 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.634382010 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.634526014 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.635023117 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.635039091 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.635200024 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.636606932 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.636620998 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.636818886 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.638412952 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.638427019 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.638505936 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.639977932 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.639998913 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.640043020 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.641218901 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.641232014 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.641350985 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.642878056 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.642891884 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.643089056 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.644526005 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.644540071 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.644706011 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.645632982 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.645781040 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.645837069 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.647376060 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.647392035 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.647481918 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.649125099 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.649138927 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.649205923 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.650230885 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.650245905 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.650290966 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.651920080 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.651935101 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.652975082 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.652990103 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.654433012 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.654640913 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.654655933 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.654786110 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.656318903 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.656493902 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.656985044 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.658013105 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.658142090 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.658271074 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.659241915 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.659255028 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.659429073 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.660907030 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.660918951 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.661155939 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.661798954 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.661813974 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.662053108 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.663306952 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.663326979 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.663459063 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.664802074 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.664818048 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.665169954 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.666299105 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.666312933 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.666616917 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.667748928 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.667762995 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.667906046 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.669233084 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.669248104 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.670763016 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.670774937 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.672183990 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.672199011 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.673449039 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.673671961 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.673691988 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.673760891 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.675182104 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.675204992 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.675288916 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.676698923 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.676718950 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.676800966 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.678143024 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.678157091 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.678211927 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.679626942 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.679641962 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.679734945 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.681126118 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.681139946 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.681291103 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.682468891 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.682482004 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.682671070 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.683912992 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.683927059 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.683990955 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.685337067 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.685350895 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.685403109 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.686655045 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.686677933 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.686800957 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.688015938 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.688034058 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.688193083 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.689277887 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.689302921 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.689363956 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.690623045 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.690639019 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.690790892 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.691917896 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.691931009 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.692138910 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.693159103 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.693171978 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.693366051 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.694382906 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.694402933 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.694577932 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.695616961 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.695631027 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.695713997 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.696826935 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.696841002 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.697038889 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.698045969 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.698060989 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.698153019 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.699218035 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.699229956 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.699276924 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.700397015 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.700411081 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.700478077 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.701550961 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.701565981 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.701606989 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.702750921 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.702764988 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.702893019 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.703849077 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.703862906 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.703902960 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.704971075 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.704983950 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.705108881 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.706079960 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.706094980 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.706171036 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.707201958 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.707215071 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.707407951 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.708357096 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.708370924 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.708846092 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.709450960 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.709465981 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.709916115 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.710550070 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.710563898 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.710671902 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.711635113 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.711648941 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.712034941 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.712764025 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.712778091 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.713100910 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.713840961 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.713855982 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.714173079 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.714936972 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.714951038 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.715262890 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.716027021 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.716041088 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.716273069 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.717083931 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.717097998 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.717184067 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.718179941 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.718194008 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.718280077 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.719269991 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.719284058 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.719367027 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.720359087 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.720395088 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.720463037 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.721470118 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.721484900 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.721539021 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.722567081 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.722579002 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.722671986 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.723674059 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.723687887 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.723789930 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.724756956 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.724771023 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.725070953 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.725869894 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.725883961 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.726036072 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.726980925 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.726996899 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.727092028 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.728012085 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.728025913 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.728117943 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.729156971 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.729170084 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.729320049 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.730226994 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.730240107 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.730293036 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.731323004 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.731336117 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.731470108 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.732433081 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.732445955 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.732512951 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.733486891 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.733501911 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.733602047 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.734632015 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.734647036 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.734756947 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.735688925 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.735702038 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.735805988 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.736816883 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.736833096 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.737848997 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.737884998 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.738970041 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.738986015 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.740060091 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.740082026 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.741175890 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.741192102 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.742263079 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.742275953 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.743050098 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.743065119 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.743880033 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.743894100 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.744666100 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.744679928 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.745454073 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.745476007 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.745728016 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.745882988 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.745949030 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.746258020 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.746277094 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.746543884 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.747029066 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.747046947 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.747610092 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.747797012 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.747812986 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.748627901 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.748641968 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.748848915 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.749038935 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.749420881 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.749434948 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.749531031 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.750221968 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.750235081 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.750427008 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.751024961 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.751039028 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.751173019 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:15.751806021 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.751821041 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:15.752243996 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:17.668591022 CEST	49737	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:17.668632984 CEST	443	49737	34.107.243.93	192.168.2.10
Apr 15, 2025 17:05:17.669071913 CEST	49737	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:17.670624018 CEST	49737	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:17.670641899 CEST	443	49737	34.107.243.93	192.168.2.10
Apr 15, 2025 17:05:17.888546944 CEST	443	49737	34.107.243.93	192.168.2.10
Apr 15, 2025 17:05:17.888668060 CEST	49737	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:17.892735004 CEST	49737	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:17.892746925 CEST	443	49737	34.107.243.93	192.168.2.10
Apr 15, 2025 17:05:17.892875910 CEST	49737	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:17.892995119 CEST	443	49737	34.107.243.93	192.168.2.10
Apr 15, 2025 17:05:17.893837929 CEST	49737	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:17.895833015 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:18.003763914 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:18.007189035 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:18.058495998 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:18.115220070 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:18.158721924 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:23.670202971 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:23.777719021 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:23.781568050 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:23.821949005 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:23.888914108 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:23.944412947 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:25.766192913 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:25.871817112 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:33.789500952 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:33.895870924 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:33.905354023 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:34.012762070 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:35.879723072 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:35.985346079 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:37.922811031 CEST	49740	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:37.922848940 CEST	443	49740	34.107.243.93	192.168.2.10
Apr 15, 2025 17:05:37.923186064 CEST	49740	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:37.924654961 CEST	49740	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:37.924666882 CEST	443	49740	34.107.243.93	192.168.2.10
Apr 15, 2025 17:05:38.144186974 CEST	443	49740	34.107.243.93	192.168.2.10
Apr 15, 2025 17:05:38.144341946 CEST	49740	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:38.148442984 CEST	49740	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:38.148448944 CEST	443	49740	34.107.243.93	192.168.2.10
Apr 15, 2025 17:05:38.148545027 CEST	49740	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:38.148591995 CEST	443	49740	34.107.243.93	192.168.2.10
Apr 15, 2025 17:05:38.149624109 CEST	49740	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:05:38.152287960 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:38.258611917 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:38.260010004 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:38.262833118 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:38.302447081 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:38.369025946 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:38.370292902 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:38.434076071 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:44.919753075 CEST	49741	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:44.919800997 CEST	443	49741	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:44.921468019 CEST	49741	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:44.921633959 CEST	49741	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:44.921642065 CEST	443	49741	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:44.934233904 CEST	49742	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:44.934264898 CEST	443	49742	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:44.935252905 CEST	49742	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:44.935352087 CEST	49742	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:44.935360909 CEST	443	49742	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:45.143027067 CEST	443	49741	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:45.143486977 CEST	49741	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:45.146682024 CEST	49741	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:45.146689892 CEST	443	49741	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:45.146931887 CEST	443	49741	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:45.149825096 CEST	49741	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:45.149936914 CEST	49741	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:45.149974108 CEST	443	49741	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:45.150129080 CEST	49741	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:45.161456108 CEST	443	49742	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:45.161552906 CEST	49742	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:45.164644003 CEST	49742	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:45.164653063 CEST	443	49742	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:45.164912939 CEST	443	49742	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:45.167471886 CEST	49742	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:45.167577982 CEST	49742	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:45.167757988 CEST	443	49742	34.120.208.123	192.168.2.10
Apr 15, 2025 17:05:45.167809010 CEST	49742	443	192.168.2.10	34.120.208.123
Apr 15, 2025 17:05:45.176636934 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:45.284300089 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:45.313406944 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:45.338395119 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:45.420809984 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:45.469727039 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:45.986816883 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:46.092488050 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:05:55.293720007 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:55.400928974 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:55.425196886 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:05:55.531451941 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:05:56.096134901 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:05:56.201858044 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:06:05.408046007 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:06:05.514393091 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:06:05.539486885 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:06:05.645694971 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:06:06.210520983 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:06:06.316546917 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:06:15.520733118 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:06:15.627151966 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:06:15.652266026 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:06:15.759902954 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:06:16.323163986 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:06:16.428972006 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:06:18.503173113 CEST	49744	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:06:18.503220081 CEST	443	49744	34.107.243.93	192.168.2.10
Apr 15, 2025 17:06:18.503552914 CEST	49744	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:06:18.505234957 CEST	49744	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:06:18.505249977 CEST	443	49744	34.107.243.93	192.168.2.10
Apr 15, 2025 17:06:18.724637985 CEST	443	49744	34.107.243.93	192.168.2.10
Apr 15, 2025 17:06:18.724776983 CEST	49744	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:06:18.730287075 CEST	49744	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:06:18.730300903 CEST	443	49744	34.107.243.93	192.168.2.10
Apr 15, 2025 17:06:18.730398893 CEST	49744	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:06:18.730474949 CEST	443	49744	34.107.243.93	192.168.2.10
Apr 15, 2025 17:06:18.730717897 CEST	49744	443	192.168.2.10	34.107.243.93
Apr 15, 2025 17:06:18.733180046 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:06:18.839593887 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:06:18.841008902 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:06:18.845172882 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:06:18.893124104 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:06:18.951809883 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:06:18.952760935 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:06:18.993390083 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:06:26.452522039 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:06:26.558166981 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:06:28.844305992 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:06:28.951679945 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:06:28.960213900 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:06:29.066656113 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:06:36.566432953 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:06:36.672174931 CEST	80	49736	23.47.204.51	192.168.2.10
Apr 15, 2025 17:06:38.972079992 CEST	49702	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:06:39.072319031 CEST	49701	80	192.168.2.10	34.107.221.82
Apr 15, 2025 17:06:39.078774929 CEST	80	49702	34.107.221.82	192.168.2.10
Apr 15, 2025 17:06:39.178590059 CEST	80	49701	34.107.221.82	192.168.2.10
Apr 15, 2025 17:06:46.677417994 CEST	49736	80	192.168.2.10	23.47.204.51
Apr 15, 2025 17:06:46.783102989 CEST	80	49736	23.47.204.51	192.168.2.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 15, 2025 17:04:45.827357054 CEST	51234	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:45.934993982 CEST	53	51234	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:45.967004061 CEST	64364	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:46.074769974 CEST	53	64364	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:48.892862082 CEST	49765	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:49.000597954 CEST	53	49765	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:49.005084038 CEST	61832	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:49.111912966 CEST	53	61832	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:49.121170998 CEST	61756	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:49.228037119 CEST	53	61756	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:49.477257013 CEST	55836	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:49.584197044 CEST	53	55836	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:49.586209059 CEST	52202	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:49.718198061 CEST	53	52202	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:49.726361990 CEST	58133	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:49.833149910 CEST	53	58133	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:50.053370953 CEST	58791	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:50.053581953 CEST	60351	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:50.059662104 CEST	52555	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:50.117161989 CEST	51834	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:50.120171070 CEST	61068	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:50.160198927 CEST	53	58791	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:50.160310984 CEST	53	60351	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:50.166543961 CEST	53	52555	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:50.167927980 CEST	49342	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:50.224378109 CEST	53	51834	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:50.226804018 CEST	53	61068	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:50.275875092 CEST	53	49342	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:50.276706934 CEST	63460	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:50.350016117 CEST	59190	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:50.354676008 CEST	49615	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:50.383559942 CEST	53	63460	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:50.456633091 CEST	53	59190	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:50.457742929 CEST	64477	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:50.462986946 CEST	53	49615	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:50.463777065 CEST	60213	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:50.507978916 CEST	56408	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:50.564502954 CEST	53	64477	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:50.570513964 CEST	53	60213	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:50.615210056 CEST	53	56408	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:50.616466045 CEST	56907	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:50.722902060 CEST	53	56907	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:50.724245071 CEST	63112	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:50.831957102 CEST	53	63112	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:51.294209957 CEST	60627	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:51.402910948 CEST	53	60627	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:51.404215097 CEST	51546	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:51.514834881 CEST	53	51546	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:51.516221046 CEST	52639	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:51.626935005 CEST	53	52639	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:54.348998070 CEST	57174	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:54.456850052 CEST	53	57174	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:54.480704069 CEST	57530	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:54.589051008 CEST	53	57530	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:54.598351002 CEST	55187	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:54.706698895 CEST	53	55187	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:58.255352974 CEST	53991	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:58.363394022 CEST	53	53991	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:58.365303040 CEST	53806	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:58.472749949 CEST	53	53806	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:58.473885059 CEST	56275	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:04:58.580202103 CEST	53	56275	1.1.1.1	192.168.2.10
Apr 15, 2025 17:04:59.934906960 CEST	62801	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:00.041857958 CEST	53	62801	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:00.050201893 CEST	63524	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:00.156600952 CEST	53	63524	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:00.605829954 CEST	59000	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:00.714142084 CEST	53	59000	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:00.715780020 CEST	62869	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:00.822523117 CEST	53	62869	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:00.823690891 CEST	57286	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:00.930653095 CEST	53	57286	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:06.837229967 CEST	65418	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:06.876982927 CEST	62333	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:06.944366932 CEST	53	65418	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:06.988063097 CEST	53	62333	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:06.989432096 CEST	49696	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:07.095887899 CEST	53	49696	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:08.198928118 CEST	64523	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:08.198967934 CEST	54408	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:08.199460030 CEST	59955	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:08.305291891 CEST	53	64523	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:08.305418015 CEST	53	54408	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:08.308248997 CEST	54214	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:08.308473110 CEST	57741	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:08.308579922 CEST	53	59955	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:08.309303999 CEST	58498	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:08.415426970 CEST	53	54214	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:08.415811062 CEST	53	57741	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:08.416071892 CEST	55196	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:08.416532040 CEST	49339	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:08.417429924 CEST	53	58498	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:08.417867899 CEST	63805	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:08.522663116 CEST	53	55196	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:08.523508072 CEST	64558	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:08.523576975 CEST	53	49339	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:08.524275064 CEST	53939	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:08.525563002 CEST	53	63805	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:08.631117105 CEST	53	64558	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:08.631463051 CEST	53	53939	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:08.631925106 CEST	61217	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:08.632494926 CEST	51682	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:08.738470078 CEST	53	61217	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:08.739193916 CEST	61391	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:08.739401102 CEST	53	51682	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:08.739872932 CEST	51031	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:08.845588923 CEST	53	61391	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:08.847244978 CEST	53	51031	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:14.511326075 CEST	57648	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:14.524600029 CEST	57282	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:14.619371891 CEST	53	57648	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:14.622364998 CEST	51842	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:14.632622957 CEST	53	57282	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:14.634056091 CEST	50276	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:14.730812073 CEST	53	51842	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:14.731538057 CEST	55669	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:14.741621971 CEST	53	50276	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:14.742306948 CEST	64604	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:14.839437008 CEST	53	55669	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:14.849430084 CEST	53	64604	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:15.208765984 CEST	54335	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:15.317888021 CEST	53	54335	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:15.318533897 CEST	63565	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:15.429780006 CEST	53	63565	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:17.668984890 CEST	58189	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:17.776936054 CEST	53	58189	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:37.923109055 CEST	57267	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:38.029777050 CEST	53	57267	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:45.028605938 CEST	62510	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:45.135787964 CEST	53	62510	1.1.1.1	192.168.2.10
Apr 15, 2025 17:05:45.177942038 CEST	54822	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:05:45.284451008 CEST	53	54822	1.1.1.1	192.168.2.10
Apr 15, 2025 17:06:18.394579887 CEST	51178	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:06:18.501887083 CEST	53	51178	1.1.1.1	192.168.2.10
Apr 15, 2025 17:06:18.503370047 CEST	59946	53	192.168.2.10	1.1.1.1
Apr 15, 2025 17:06:18.619330883 CEST	53	59946	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 15, 2025 17:04:45.827357054 CEST	192.168.2.10	1.1.1.1	0xefb2	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:45.967004061 CEST	192.168.2.10	1.1.1.1	0x6e0b	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Apr 15, 2025 17:04:48.892862082 CEST	192.168.2.10	1.1.1.1	0x83e1	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:49.005084038 CEST	192.168.2.10	1.1.1.1	0xde0b	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:49.121170998 CEST	192.168.2.10	1.1.1.1	0x4f93	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Apr 15, 2025 17:04:49.477257013 CEST	192.168.2.10	1.1.1.1	0x5827	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:49.586209059 CEST	192.168.2.10	1.1.1.1	0x8ffb	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:49.726361990 CEST	192.168.2.10	1.1.1.1	0x934a	Standard query (0)	youtube.com	28	IN (0x0001)	false
Apr 15, 2025 17:04:50.053370953 CEST	192.168.2.10	1.1.1.1	0x841b	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.053581953 CEST	192.168.2.10	1.1.1.1	0xf94e	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.059662104 CEST	192.168.2.10	1.1.1.1	0x7ee2	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.117161989 CEST	192.168.2.10	1.1.1.1	0x50f9	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.120171070 CEST	192.168.2.10	1.1.1.1	0xbd0b	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.167927980 CEST	192.168.2.10	1.1.1.1	0xcf9b	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.276706934 CEST	192.168.2.10	1.1.1.1	0xc3c3	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Apr 15, 2025 17:04:50.350016117 CEST	192.168.2.10	1.1.1.1	0x18b9	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.354676008 CEST	192.168.2.10	1.1.1.1	0x7b17	Standard query (0)	mc.prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.457742929 CEST	192.168.2.10	1.1.1.1	0x47d1	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Apr 15, 2025 17:04:50.463777065 CEST	192.168.2.10	1.1.1.1	0xf182	Standard query (0)	mc.prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Apr 15, 2025 17:04:50.507978916 CEST	192.168.2.10	1.1.1.1	0xfcdd	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.616466045 CEST	192.168.2.10	1.1.1.1	0x6d40	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.724245071 CEST	192.168.2.10	1.1.1.1	0xdbd4	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Apr 15, 2025 17:04:51.294209957 CEST	192.168.2.10	1.1.1.1	0xdebb	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:51.404215097 CEST	192.168.2.10	1.1.1.1	0x3621	Standard query (0)	shavar.prod.mozaws.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:51.516221046 CEST	192.168.2.10	1.1.1.1	0x49d9	Standard query (0)	shavar.prod.mozaws.net	28	IN (0x0001)	false
Apr 15, 2025 17:04:54.348998070 CEST	192.168.2.10	1.1.1.1	0x164c	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:54.480704069 CEST	192.168.2.10	1.1.1.1	0xa42e	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:54.598351002 CEST	192.168.2.10	1.1.1.1	0x69bf	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Apr 15, 2025 17:04:58.255352974 CEST	192.168.2.10	1.1.1.1	0x789e	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:58.365303040 CEST	192.168.2.10	1.1.1.1	0xdd1f	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:58.473885059 CEST	192.168.2.10	1.1.1.1	0x3a24	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Apr 15, 2025 17:04:59.934906960 CEST	192.168.2.10	1.1.1.1	0xc0d0	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:00.050201893 CEST	192.168.2.10	1.1.1.1	0xa1b3	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Apr 15, 2025 17:05:00.605829954 CEST	192.168.2.10	1.1.1.1	0x2239	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:00.715780020 CEST	192.168.2.10	1.1.1.1	0x160d	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:00.823690891 CEST	192.168.2.10	1.1.1.1	0xd0e3	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Apr 15, 2025 17:05:06.837229967 CEST	192.168.2.10	1.1.1.1	0xd905	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Apr 15, 2025 17:05:06.876982927 CEST	192.168.2.10	1.1.1.1	0xb36f	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:06.989432096 CEST	192.168.2.10	1.1.1.1	0x2c26	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Apr 15, 2025 17:05:08.198928118 CEST	192.168.2.10	1.1.1.1	0x725f	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.198967934 CEST	192.168.2.10	1.1.1.1	0xdec5	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.199460030 CEST	192.168.2.10	1.1.1.1	0xcd7f	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.308248997 CEST	192.168.2.10	1.1.1.1	0x5bc0	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.308473110 CEST	192.168.2.10	1.1.1.1	0x3945	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.309303999 CEST	192.168.2.10	1.1.1.1	0x61a	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.416071892 CEST	192.168.2.10	1.1.1.1	0x7c00	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Apr 15, 2025 17:05:08.416532040 CEST	192.168.2.10	1.1.1.1	0x8888	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Apr 15, 2025 17:05:08.417867899 CEST	192.168.2.10	1.1.1.1	0xd953	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Apr 15, 2025 17:05:08.523508072 CEST	192.168.2.10	1.1.1.1	0xabc0	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.524275064 CEST	192.168.2.10	1.1.1.1	0x3041	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.631925106 CEST	192.168.2.10	1.1.1.1	0x253c	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.632494926 CEST	192.168.2.10	1.1.1.1	0x8d44	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.739193916 CEST	192.168.2.10	1.1.1.1	0xee82	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Apr 15, 2025 17:05:08.739872932 CEST	192.168.2.10	1.1.1.1	0x684c	Standard query (0)	twitter.com	28	IN (0x0001)	false
Apr 15, 2025 17:05:14.511326075 CEST	192.168.2.10	1.1.1.1	0x4b91	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:14.524600029 CEST	192.168.2.10	1.1.1.1	0xc196	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:14.622364998 CEST	192.168.2.10	1.1.1.1	0x782e	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:14.634056091 CEST	192.168.2.10	1.1.1.1	0xada4	Standard query (0)	normandy.tombstone.experimenter.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:14.731538057 CEST	192.168.2.10	1.1.1.1	0xe21c	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Apr 15, 2025 17:05:14.742306948 CEST	192.168.2.10	1.1.1.1	0xb5e0	Standard query (0)	normandy.tombstone.experimenter.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Apr 15, 2025 17:05:15.208765984 CEST	192.168.2.10	1.1.1.1	0x2730	Standard query (0)	a19.dscg10.akamai.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:15.318533897 CEST	192.168.2.10	1.1.1.1	0x2d75	Standard query (0)	a19.dscg10.akamai.net	28	IN (0x0001)	false
Apr 15, 2025 17:05:17.668984890 CEST	192.168.2.10	1.1.1.1	0x1a65	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Apr 15, 2025 17:05:37.923109055 CEST	192.168.2.10	1.1.1.1	0x1135	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Apr 15, 2025 17:05:45.028605938 CEST	192.168.2.10	1.1.1.1	0xca09	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Apr 15, 2025 17:05:45.177942038 CEST	192.168.2.10	1.1.1.1	0xd22d	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:06:18.394579887 CEST	192.168.2.10	1.1.1.1	0x2564	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:06:18.503370047 CEST	192.168.2.10	1.1.1.1	0x6387	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 15, 2025 17:04:45.780477047 CEST	1.1.1.1	192.168.2.10	0x367f	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:45.934993982 CEST	1.1.1.1	192.168.2.10	0xefb2	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:49.000597954 CEST	1.1.1.1	192.168.2.10	0x83e1	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:04:49.000597954 CEST	1.1.1.1	192.168.2.10	0x83e1	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:04:49.000597954 CEST	1.1.1.1	192.168.2.10	0x83e1	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:49.111912966 CEST	1.1.1.1	192.168.2.10	0xde0b	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:49.228037119 CEST	1.1.1.1	192.168.2.10	0x4f93	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Apr 15, 2025 17:04:49.584197044 CEST	1.1.1.1	192.168.2.10	0x5827	No error (0)	youtube.com		172.217.215.136	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:49.584197044 CEST	1.1.1.1	192.168.2.10	0x5827	No error (0)	youtube.com		172.217.215.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:49.584197044 CEST	1.1.1.1	192.168.2.10	0x5827	No error (0)	youtube.com		172.217.215.190	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:49.584197044 CEST	1.1.1.1	192.168.2.10	0x5827	No error (0)	youtube.com		172.217.215.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:49.718198061 CEST	1.1.1.1	192.168.2.10	0x8ffb	No error (0)	youtube.com		108.177.122.136	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:49.718198061 CEST	1.1.1.1	192.168.2.10	0x8ffb	No error (0)	youtube.com		108.177.122.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:49.718198061 CEST	1.1.1.1	192.168.2.10	0x8ffb	No error (0)	youtube.com		108.177.122.190	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:49.718198061 CEST	1.1.1.1	192.168.2.10	0x8ffb	No error (0)	youtube.com		108.177.122.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:49.833149910 CEST	1.1.1.1	192.168.2.10	0x934a	No error (0)	youtube.com			28	IN (0x0001)	false
Apr 15, 2025 17:04:49.833149910 CEST	1.1.1.1	192.168.2.10	0x934a	No error (0)	youtube.com			28	IN (0x0001)	false
Apr 15, 2025 17:04:49.833149910 CEST	1.1.1.1	192.168.2.10	0x934a	No error (0)	youtube.com			28	IN (0x0001)	false
Apr 15, 2025 17:04:49.833149910 CEST	1.1.1.1	192.168.2.10	0x934a	No error (0)	youtube.com			28	IN (0x0001)	false
Apr 15, 2025 17:04:50.160198927 CEST	1.1.1.1	192.168.2.10	0x841b	No error (0)	example.org		23.215.0.132	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.160198927 CEST	1.1.1.1	192.168.2.10	0x841b	No error (0)	example.org		96.7.128.192	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.160198927 CEST	1.1.1.1	192.168.2.10	0x841b	No error (0)	example.org		23.215.0.133	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.160198927 CEST	1.1.1.1	192.168.2.10	0x841b	No error (0)	example.org		96.7.128.186	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.160310984 CEST	1.1.1.1	192.168.2.10	0xf94e	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.160310984 CEST	1.1.1.1	192.168.2.10	0xf94e	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.166543961 CEST	1.1.1.1	192.168.2.10	0x7ee2	No error (0)	contile.services.mozilla.com		34.36.137.203	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.205702066 CEST	1.1.1.1	192.168.2.10	0xcd8d	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:04:50.205702066 CEST	1.1.1.1	192.168.2.10	0xcd8d	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.224378109 CEST	1.1.1.1	192.168.2.10	0x50f9	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:04:50.224378109 CEST	1.1.1.1	192.168.2.10	0x50f9	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:04:50.224378109 CEST	1.1.1.1	192.168.2.10	0x50f9	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.226804018 CEST	1.1.1.1	192.168.2.10	0xbd0b	No error (0)	spocs.getpocket.com	mc.prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:04:50.226804018 CEST	1.1.1.1	192.168.2.10	0xbd0b	No error (0)	mc.prod.ads.prod.webservices.mozgcp.net		34.36.137.203	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.275875092 CEST	1.1.1.1	192.168.2.10	0xcf9b	No error (0)	contile.services.mozilla.com		34.36.137.203	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.456633091 CEST	1.1.1.1	192.168.2.10	0x18b9	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.462986946 CEST	1.1.1.1	192.168.2.10	0x7b17	No error (0)	mc.prod.ads.prod.webservices.mozgcp.net		34.36.137.203	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.564502954 CEST	1.1.1.1	192.168.2.10	0x47d1	No error (0)	prod.balrog.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Apr 15, 2025 17:04:50.615210056 CEST	1.1.1.1	192.168.2.10	0xfcdd	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:04:50.615210056 CEST	1.1.1.1	192.168.2.10	0xfcdd	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:04:50.615210056 CEST	1.1.1.1	192.168.2.10	0xfcdd	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.722902060 CEST	1.1.1.1	192.168.2.10	0x6d40	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:50.831957102 CEST	1.1.1.1	192.168.2.10	0xdbd4	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Apr 15, 2025 17:04:51.402910948 CEST	1.1.1.1	192.168.2.10	0xdebb	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:04:51.402910948 CEST	1.1.1.1	192.168.2.10	0xdebb	No error (0)	shavar.prod.mozaws.net		52.36.50.141	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:51.402910948 CEST	1.1.1.1	192.168.2.10	0xdebb	No error (0)	shavar.prod.mozaws.net		44.230.225.207	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:51.402910948 CEST	1.1.1.1	192.168.2.10	0xdebb	No error (0)	shavar.prod.mozaws.net		52.37.232.247	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:51.514834881 CEST	1.1.1.1	192.168.2.10	0x3621	No error (0)	shavar.prod.mozaws.net		52.37.232.247	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:51.514834881 CEST	1.1.1.1	192.168.2.10	0x3621	No error (0)	shavar.prod.mozaws.net		44.230.225.207	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:51.514834881 CEST	1.1.1.1	192.168.2.10	0x3621	No error (0)	shavar.prod.mozaws.net		52.36.50.141	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:54.456850052 CEST	1.1.1.1	192.168.2.10	0x164c	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:04:54.456850052 CEST	1.1.1.1	192.168.2.10	0x164c	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:04:54.456850052 CEST	1.1.1.1	192.168.2.10	0x164c	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:54.589051008 CEST	1.1.1.1	192.168.2.10	0xa42e	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:58.363394022 CEST	1.1.1.1	192.168.2.10	0x789e	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:58.472749949 CEST	1.1.1.1	192.168.2.10	0xdd1f	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:04:59.933604956 CEST	1.1.1.1	192.168.2.10	0xba34	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:00.041857958 CEST	1.1.1.1	192.168.2.10	0xc0d0	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:00.451035976 CEST	1.1.1.1	192.168.2.10	0x60b1	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:00.493336916 CEST	1.1.1.1	192.168.2.10	0xa697	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:05:00.493336916 CEST	1.1.1.1	192.168.2.10	0xa697	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:00.714142084 CEST	1.1.1.1	192.168.2.10	0x2239	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:05:00.714142084 CEST	1.1.1.1	192.168.2.10	0x2239	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:00.822523117 CEST	1.1.1.1	192.168.2.10	0x160d	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:00.930653095 CEST	1.1.1.1	192.168.2.10	0xd0e3	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Apr 15, 2025 17:05:06.988063097 CEST	1.1.1.1	192.168.2.10	0xb36f	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.305291891 CEST	1.1.1.1	192.168.2.10	0x725f	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:05:08.305291891 CEST	1.1.1.1	192.168.2.10	0x725f	No error (0)	star-mini.c10r.facebook.com		157.240.229.35	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.305418015 CEST	1.1.1.1	192.168.2.10	0xdec5	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:05:08.305418015 CEST	1.1.1.1	192.168.2.10	0xdec5	No error (0)	youtube-ui.l.google.com		64.233.176.190	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.305418015 CEST	1.1.1.1	192.168.2.10	0xdec5	No error (0)	youtube-ui.l.google.com		142.251.15.136	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.305418015 CEST	1.1.1.1	192.168.2.10	0xdec5	No error (0)	youtube-ui.l.google.com		108.177.122.136	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.305418015 CEST	1.1.1.1	192.168.2.10	0xdec5	No error (0)	youtube-ui.l.google.com		108.177.122.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.305418015 CEST	1.1.1.1	192.168.2.10	0xdec5	No error (0)	youtube-ui.l.google.com		108.177.122.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.305418015 CEST	1.1.1.1	192.168.2.10	0xdec5	No error (0)	youtube-ui.l.google.com		74.125.138.190	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.305418015 CEST	1.1.1.1	192.168.2.10	0xdec5	No error (0)	youtube-ui.l.google.com		74.125.21.190	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.305418015 CEST	1.1.1.1	192.168.2.10	0xdec5	No error (0)	youtube-ui.l.google.com		142.251.15.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.305418015 CEST	1.1.1.1	192.168.2.10	0xdec5	No error (0)	youtube-ui.l.google.com		142.251.15.190	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.305418015 CEST	1.1.1.1	192.168.2.10	0xdec5	No error (0)	youtube-ui.l.google.com		74.125.138.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.305418015 CEST	1.1.1.1	192.168.2.10	0xdec5	No error (0)	youtube-ui.l.google.com		108.177.122.190	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.305418015 CEST	1.1.1.1	192.168.2.10	0xdec5	No error (0)	youtube-ui.l.google.com		74.125.138.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.305418015 CEST	1.1.1.1	192.168.2.10	0xdec5	No error (0)	youtube-ui.l.google.com		172.217.215.136	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.305418015 CEST	1.1.1.1	192.168.2.10	0xdec5	No error (0)	youtube-ui.l.google.com		64.233.176.136	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.305418015 CEST	1.1.1.1	192.168.2.10	0xdec5	No error (0)	youtube-ui.l.google.com		142.251.15.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.305418015 CEST	1.1.1.1	192.168.2.10	0xdec5	No error (0)	youtube-ui.l.google.com		74.125.138.136	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.308579922 CEST	1.1.1.1	192.168.2.10	0xcd7f	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:05:08.308579922 CEST	1.1.1.1	192.168.2.10	0xcd7f	No error (0)	dyna.wikimedia.org		208.80.154.224	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.415426970 CEST	1.1.1.1	192.168.2.10	0x5bc0	No error (0)	star-mini.c10r.facebook.com		31.13.65.36	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.415811062 CEST	1.1.1.1	192.168.2.10	0x3945	No error (0)	youtube-ui.l.google.com		74.125.136.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.415811062 CEST	1.1.1.1	192.168.2.10	0x3945	No error (0)	youtube-ui.l.google.com		108.177.122.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.415811062 CEST	1.1.1.1	192.168.2.10	0x3945	No error (0)	youtube-ui.l.google.com		142.251.15.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.415811062 CEST	1.1.1.1	192.168.2.10	0x3945	No error (0)	youtube-ui.l.google.com		108.177.122.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.415811062 CEST	1.1.1.1	192.168.2.10	0x3945	No error (0)	youtube-ui.l.google.com		172.217.215.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.415811062 CEST	1.1.1.1	192.168.2.10	0x3945	No error (0)	youtube-ui.l.google.com		142.250.9.136	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.415811062 CEST	1.1.1.1	192.168.2.10	0x3945	No error (0)	youtube-ui.l.google.com		108.177.122.136	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.415811062 CEST	1.1.1.1	192.168.2.10	0x3945	No error (0)	youtube-ui.l.google.com		142.251.15.136	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.415811062 CEST	1.1.1.1	192.168.2.10	0x3945	No error (0)	youtube-ui.l.google.com		172.217.215.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.415811062 CEST	1.1.1.1	192.168.2.10	0x3945	No error (0)	youtube-ui.l.google.com		142.250.9.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.415811062 CEST	1.1.1.1	192.168.2.10	0x3945	No error (0)	youtube-ui.l.google.com		108.177.122.190	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.415811062 CEST	1.1.1.1	192.168.2.10	0x3945	No error (0)	youtube-ui.l.google.com		142.250.9.190	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.415811062 CEST	1.1.1.1	192.168.2.10	0x3945	No error (0)	youtube-ui.l.google.com		142.250.9.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.415811062 CEST	1.1.1.1	192.168.2.10	0x3945	No error (0)	youtube-ui.l.google.com		172.217.215.190	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.415811062 CEST	1.1.1.1	192.168.2.10	0x3945	No error (0)	youtube-ui.l.google.com		142.251.15.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.415811062 CEST	1.1.1.1	192.168.2.10	0x3945	No error (0)	youtube-ui.l.google.com		172.217.215.136	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.417429924 CEST	1.1.1.1	192.168.2.10	0x61a	No error (0)	dyna.wikimedia.org		208.80.154.224	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.522663116 CEST	1.1.1.1	192.168.2.10	0x7c00	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Apr 15, 2025 17:05:08.523576975 CEST	1.1.1.1	192.168.2.10	0x8888	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Apr 15, 2025 17:05:08.523576975 CEST	1.1.1.1	192.168.2.10	0x8888	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Apr 15, 2025 17:05:08.523576975 CEST	1.1.1.1	192.168.2.10	0x8888	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Apr 15, 2025 17:05:08.523576975 CEST	1.1.1.1	192.168.2.10	0x8888	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Apr 15, 2025 17:05:08.525563002 CEST	1.1.1.1	192.168.2.10	0xd953	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Apr 15, 2025 17:05:08.631117105 CEST	1.1.1.1	192.168.2.10	0xabc0	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:05:08.631117105 CEST	1.1.1.1	192.168.2.10	0xabc0	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.631117105 CEST	1.1.1.1	192.168.2.10	0xabc0	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.631117105 CEST	1.1.1.1	192.168.2.10	0xabc0	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.631117105 CEST	1.1.1.1	192.168.2.10	0xabc0	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.631463051 CEST	1.1.1.1	192.168.2.10	0x3041	No error (0)	twitter.com		172.66.0.227	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.738470078 CEST	1.1.1.1	192.168.2.10	0x253c	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.738470078 CEST	1.1.1.1	192.168.2.10	0x253c	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.738470078 CEST	1.1.1.1	192.168.2.10	0x253c	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.738470078 CEST	1.1.1.1	192.168.2.10	0x253c	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.739401102 CEST	1.1.1.1	192.168.2.10	0x8d44	No error (0)	twitter.com		162.159.140.229	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:08.739401102 CEST	1.1.1.1	192.168.2.10	0x8d44	No error (0)	twitter.com		172.66.0.227	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:14.619371891 CEST	1.1.1.1	192.168.2.10	0x4b91	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:14.619371891 CEST	1.1.1.1	192.168.2.10	0x4b91	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:14.619371891 CEST	1.1.1.1	192.168.2.10	0x4b91	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:14.619371891 CEST	1.1.1.1	192.168.2.10	0x4b91	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:14.632622957 CEST	1.1.1.1	192.168.2.10	0xc196	No error (0)	normandy.cdn.mozilla.net	normandy.tombstone.experimenter.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:05:14.632622957 CEST	1.1.1.1	192.168.2.10	0xc196	No error (0)	normandy.tombstone.experimenter.prod.webservices.mozgcp.net		34.49.51.44	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:14.730812073 CEST	1.1.1.1	192.168.2.10	0x782e	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:14.730812073 CEST	1.1.1.1	192.168.2.10	0x782e	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:14.730812073 CEST	1.1.1.1	192.168.2.10	0x782e	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:14.730812073 CEST	1.1.1.1	192.168.2.10	0x782e	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:14.741621971 CEST	1.1.1.1	192.168.2.10	0xada4	No error (0)	normandy.tombstone.experimenter.prod.webservices.mozgcp.net		34.49.51.44	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:14.839437008 CEST	1.1.1.1	192.168.2.10	0xe21c	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Apr 15, 2025 17:05:14.839437008 CEST	1.1.1.1	192.168.2.10	0xe21c	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Apr 15, 2025 17:05:14.839437008 CEST	1.1.1.1	192.168.2.10	0xe21c	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Apr 15, 2025 17:05:14.839437008 CEST	1.1.1.1	192.168.2.10	0xe21c	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Apr 15, 2025 17:05:15.206682920 CEST	1.1.1.1	192.168.2.10	0x1a81	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:05:15.206682920 CEST	1.1.1.1	192.168.2.10	0x1a81	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:05:15.206682920 CEST	1.1.1.1	192.168.2.10	0x1a81	No error (0)	a17.rackcdn.com.mdc.edgesuite.net	a19.dscg10.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:05:15.206682920 CEST	1.1.1.1	192.168.2.10	0x1a81	No error (0)	a19.dscg10.akamai.net		23.47.204.51	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:15.206682920 CEST	1.1.1.1	192.168.2.10	0x1a81	No error (0)	a19.dscg10.akamai.net		23.47.204.64	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:15.317888021 CEST	1.1.1.1	192.168.2.10	0x2730	No error (0)	a19.dscg10.akamai.net		23.47.204.64	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:15.317888021 CEST	1.1.1.1	192.168.2.10	0x2730	No error (0)	a19.dscg10.akamai.net		23.47.204.51	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:15.429780006 CEST	1.1.1.1	192.168.2.10	0x2d75	No error (0)	a19.dscg10.akamai.net			28	IN (0x0001)	false
Apr 15, 2025 17:05:15.429780006 CEST	1.1.1.1	192.168.2.10	0x2d75	No error (0)	a19.dscg10.akamai.net			28	IN (0x0001)	false
Apr 15, 2025 17:05:45.027050972 CEST	1.1.1.1	192.168.2.10	0x276	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:05:45.284451008 CEST	1.1.1.1	192.168.2.10	0xd22d	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:05:45.284451008 CEST	1.1.1.1	192.168.2.10	0xd22d	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:05:45.284451008 CEST	1.1.1.1	192.168.2.10	0xd22d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:06:18.501887083 CEST	1.1.1.1	192.168.2.10	0x2564	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

detectportal.firefox.com

ciscobinary.openh264.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49692	34.107.221.82	80	8008	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2025 17:04:49.610245943 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:04:49.719284058 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82145 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:04:50.508366108 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:04:50.616055012 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82146 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49697	34.107.221.82	80	8008	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2025 17:04:50.456562996 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:04:50.564526081 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82219 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49701	34.107.221.82	80	8008	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2025 17:04:50.853892088 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:04:50.963073969 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82219 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:04:51.229768038 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:04:51.336992979 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82220 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:04:52.307024002 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:04:52.414623976 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82221 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:04:54.415056944 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:04:54.522558928 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82223 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:05:00.752763033 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:05:00.860440969 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82229 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:05:01.342370033 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:05:01.449912071 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82230 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:05:01.754702091 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:05:01.861926079 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82230 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:05:06.844857931 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:05:06.951986074 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82235 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:05:07.226685047 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:05:07.334506035 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82236 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:05:07.468607903 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:05:07.575865030 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82236 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:05:14.832469940 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:05:14.939909935 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82243 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:05:14.973387003 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:05:15.080734015 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82244 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:05:15.206345081 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:05:15.313637018 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82244 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:05:18.007189035 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:05:18.115220070 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82247 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:05:23.781568050 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:05:23.888914108 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82252 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:05:33.905354023 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:05:38.262833118 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:05:38.370292902 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82267 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:05:45.313406944 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:05:45.420809984 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82274 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:05:55.425196886 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:06:05.539486885 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:06:15.652266026 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:06:18.845172882 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:06:18.952760935 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82307 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:06:28.960213900 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:06:39.072319031 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49702	34.107.221.82	80	8008	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2025 17:04:50.854024887 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:04:50.961940050 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82146 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:04:51.291781902 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:04:51.399435043 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82147 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:04:52.595007896 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:04:52.702495098 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82148 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:05:00.303708076 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:05:00.411467075 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82156 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:05:00.754663944 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:05:00.862617970 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82156 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:05:01.576281071 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:05:01.683767080 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82157 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:05:06.136274099 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:05:06.244076967 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82162 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:05:07.113200903 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:05:07.220684052 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82163 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:05:07.357381105 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:05:07.464838982 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82163 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:05:14.721942902 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:05:14.829416037 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82170 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:05:14.862876892 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:05:14.970527887 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82170 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:05:15.095942020 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:05:15.203382969 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82171 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:05:17.895833015 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:05:18.003763914 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82173 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:05:23.670202971 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:05:23.777719021 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82179 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:05:33.789500952 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:05:38.152287960 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:05:38.260010004 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82194 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:05:45.176636934 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:05:45.284300089 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82201 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:05:55.293720007 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:06:05.408046007 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:06:15.520733118 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:06:18.733180046 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:06:18.841008902 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82234 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:06:28.844305992 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:06:38.972079992 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49736	23.47.204.51	80	8008	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2025 17:05:15.314414024 CEST	305	OUT	GET /openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip HTTP/1.1 Host: ciscobinary.openh264.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive
Apr 15, 2025 17:05:15.422379017 CEST	1358	IN	HTTP/1.1 200 OK Last-Modified: Wed, 12 Mar 2025 04:19:28 GMT ETag: 85430baed3398695717b0263807cf97c Content-Length: 453023 Accept-Ranges: bytes X-Timestamp: 1741753167.65917 Content-Type: application/zip X-Trans-Id: tx01b3942a3e444fe795adb-0067d453d3dfw1 Cache-Control: public, max-age=64201 Expires: Wed, 16 Apr 2025 08:55:16 GMT Date: Tue, 15 Apr 2025 15:05:15 GMT Connection: keep-alive Data Raw: 50 4b 03 04 14 00 00 00 08 00 cd 8d 62 4e d0 b9 df e8 52 e8 06 00 d0 97 0f 00 0f 00 00 00 67 6d 70 6f 70 65 6e 68 32 36 34 2e 64 6c 6c ec bd 0b 7c 14 45 b6 30 de 3d 99 84 49 98 a4 07 8c 18 31 c2 e8 ce ea 34 66 31 71 e3 9a 60 d4 e9 d0 93 f4 e0 04 c2 d3 80 88 71 a3 b9 a0 08 11 27 2b b8 10 08 93 68 2a 6d 7b d9 bb 7a d7 dd 6f 5f ff 7b 77 ef dd e7 c5 bd ee f2 d0 95 cc 24 92 07 28 24 41 21 c0 8a 11 7c 4c 18 81 00 42 26 41 32 ff 73 aa 7b 9e 04 44 64 f7 ff dd ff f7 f1 63 d2 55 d5 55 e7 d4 39 75 ce a9 53 a7 aa bb 4b 16 6c 60 12 18 86 d1 c3 2f 18 64 98 2d 8c fa cf c6 7c f9 bf 00 fc d2 26 be 9e c6 fc 39 f9 9d 9b b6 b0 ce 77 6e 9a b3 78 c9 d3 e6 aa 15 cb ff 69 c5 23 4f 9a 2b 1e 59 b6 6c b9 cb fc dd c7 cc 2b aa 97 99 97 2c 33 8b 33 66 9b 9f 5c fe e8 63 93 53 53 53 2c 1a 8c e9 d2 cf b7 a4 f0 fd fe d0 ef b1 92 cf 8f 4e a4 d7 d3 47 47 d1 eb 99 a3 ff 46 af 27 8f 26 d3 3a 27 fd 4b e0 5a 26 9c 3e 9a 40 af 67 8e de 4d af 9f 1f 4d d7 60 fc 13 fc 2a 84 fe a3 a3 e9 f5 14 bd ce 5a 52 b1 18 ef 85 fa 5e 6a 67 98 47 9f 4b 62 [TRUNCATED] Data Ascii: PKbNRgmpopenh264.dll\|E0=I14f1q`q'+hm{zo_{w$($A!\|LB&A2s{DdcUU9uSKl`/d-\|&9wnxi#O+Yl+,33f\cSSS,NGGF'&:'KZ&>@gMM`ZR^jgGKbo~va<Z1.#OeDXi$imBWQ&P,M,:c-\-iKI4a6Ov=WFCH>a'x#@fdu1OV1o}g5_3JHiZipM.bZ%GF/3qJo%gN})3N%!q^Im~6#~+AI]rx<IYjp0`SM@Ef=;!@EE 0nJdduM-qIlRz=}rDXLZx$\|c1cUkM&Qn]a]th!6 7JdDvKJ"Wgd*%nwJniinmr@M$'Zs#)%Rs:hR\t6'gUj+Fcr:\|!KWY17,r>N3RY_\IrDNJdM k&V-
Apr 15, 2025 17:05:15.422394991 CEST	1358	IN	Data Raw: 96 9a fc 7a 9a 25 01 e0 8e 2d 96 99 dc 44 11 c0 69 fc 04 26 99 81 9d 36 df 83 e6 d1 0c 37 ba 32 54 29 fe 3e b0 1b 30 da fb 25 d2 26 c9 b6 95 92 3b 60 5a 01 63 90 2c 29 a5 ac 54 3b 84 6a bf e2 06 49 7e 0a f0 79 03 12 7f 52 72 0f 9a 9f 9e 26 b9 3d Data Ascii: z%-Di&672T)>0%&;`Zc,)T;jI~yRr&=V4C\|-h(*dIUkq9[dvl4Mtb.o\|o'J_:G Z,C0.a._9}-mOy9sC0/a?wJWxekb
Apr 15, 2025 17:05:15.423187017 CEST	1358	IN	Data Raw: e4 fb 0b b5 66 76 ec 61 29 f5 e2 47 90 5f 10 ca c7 4b a1 17 fd be 3d 67 54 13 97 1d bf 1a 0a f9 3b 73 43 1e cf 2b b1 1e 8f 09 c9 29 21 bb 1c e4 3d 07 d9 ed bb 3d 91 96 1a 54 f3 5a 42 c7 e2 36 7d c8 8b 88 9a 9e 1f ce 93 e4 6a 83 43 b6 33 4e d2 a7 Data Ascii: fva)G_K=gT;sC+)!==TZB6}jC3NZtSnp$KUl'}U IN~\+PU^Kt:u*;I/l`%s^9pD<No\|&zc%Z}ne2!-~;15Dcx%1<`v
Apr 15, 2025 17:05:15.423201084 CEST	1358	IN	Data Raw: 3f c5 f9 a3 91 f9 d4 a6 51 75 95 84 30 34 34 d1 be c0 25 e7 7b 1a 04 f7 bd e8 4b 09 ef 29 85 44 76 e4 f9 df 86 a3 ee 00 d9 b8 8a aa 13 52 f9 cb c2 ef fb 8f a4 4b f9 27 36 df 73 5f 72 bf f2 4b ee 17 25 85 fd 9b 2f f5 5f 57 3c 11 f2 5f ad 5f dd 7f Data Ascii: ?Qu044%{K)DvRK'6s_rK%/_W<__?JsCZrw:DHVK#gz)/1R88):g>ySgnX-P16E)XA!^8>9"Z[Q&%>+xFz^XCWr_-j&(C
Apr 15, 2025 17:05:15.424822092 CEST	1358	IN	Data Raw: 41 4d 6d c3 e7 1d cc 76 b2 cb 49 da 24 b2 93 ee 1d dc b1 15 a7 08 df 1f 0f a0 b9 ab d2 f6 0e 3e 2d d7 34 b2 0c b5 d2 2c 92 2a 6b 78 cf 40 9b d6 a5 0a 01 3c 77 c1 20 ca 82 d5 89 1b b5 f2 4c 50 16 af 23 f8 61 94 fd 8b 3d 1d b9 35 3b 1d f5 9f 62 02 Data Ascii: AMmvI$>-4,kx@<w LP#a=5;byI bIj+pB1\X%]"^\no%S<ov\|2z_gOg/n}{6{ED$Y'1ZHBFi0(CgMQ%E\|O<?x(s#Gt
Apr 15, 2025 17:05:15.424868107 CEST	1358	IN	Data Raw: 0a df c6 d3 7a e4 0c d6 a9 0d 22 d1 22 48 9a 85 5b ff 53 6a 9c 80 1a 0f 0c 88 57 1b 90 76 5f d6 4e e0 a4 b2 f8 56 87 fb e3 5e 07 b1 07 fa 08 35 ca 9f 3a f9 01 29 ff dc d3 77 20 7c fe 03 27 f9 50 22 43 f8 ac 47 c1 d1 14 c6 a1 e8 33 91 49 50 c7 c1 Data Ascii: z""H[SjWv_NV^5:)w \|'P"CG3IPHg{JG-3;{^"tH<G>J@91Bu-q8 oXXP\|?G_}!=q%gNRip'$qHFOcVM@*;^8x{~/
Apr 15, 2025 17:05:15.426444054 CEST	1358	IN	Data Raw: a2 d7 dd 16 94 94 c4 19 d8 34 41 bf 45 70 b7 b3 a4 47 e4 3d 35 46 11 39 96 7c 06 89 29 43 ba 05 be 07 06 14 0a bf 3a 25 5b 54 4a bc 7b 7a 07 3a 6f ea 87 c6 da 70 79 60 b8 72 3c ea da 22 fe b8 5d d8 3f c6 75 9e 83 ec e0 36 3d 35 1e 7c 27 d5 47 4e Data Ascii: 4AEpG=5F9\|)C:%[TJ{z:opy`r<"]?u6=5\|'GN^m{\|\rVdS^`n_aL:)oh:\|d`M8i0AEj8@>8F?#X8^ZuEM&oz:ena,lG}?#AIX=
Apr 15, 2025 17:05:15.426456928 CEST	1358	IN	Data Raw: 6a 83 c8 4f 81 2b da 1d cd 50 c5 1e e1 27 27 6e 57 d9 c9 02 8a 04 fd 56 f0 c1 54 2c d4 e5 ff 44 a4 3b 9a fe 05 11 8c e7 68 a4 f5 f4 57 8c b4 46 05 f5 45 ba 95 19 5e ee e0 aa 04 48 4e 8f 27 f9 a9 fb 35 92 7b 60 8e 47 92 f7 63 07 7a ae 26 c9 69 f7 Data Ascii: jO+P''nWVT,D;hWFE^HN'5{`Gcz&iGHF,$0^-C6bKi#[(FjiE%~":\d5cZThW[4{:l(It><*fzJW{h0(OJ:nf<7
Apr 15, 2025 17:05:15.428107023 CEST	1358	IN	Data Raw: 71 4c af db d4 5e 2f cc a7 5b 85 3f a0 47 9e 50 17 b8 17 1f 4d 08 45 97 93 77 62 af 13 d8 50 5f bf b6 25 a1 e6 ab ef 37 1a f1 02 ef c5 90 0a 3d 16 76 85 f2 de 11 67 12 81 ed fe 79 a1 ce b6 7f fd ce ee 8c 51 5d 10 d3 a2 64 b7 47 15 53 a6 de 83 62 Data Ascii: qL^/[?GPMEwbP_%7=vgyQ]dGSbI,n8g7`r/GP.&TL1(x@x}\d:>oiYfP.TJD~qRz.zm1^c{0osDHtai#>WD'ywR>~
Apr 15, 2025 17:05:15.428183079 CEST	1358	IN	Data Raw: a8 c7 a3 c0 5c e9 61 c4 0d 23 3f 10 a1 7d e7 c2 41 76 48 72 e2 7d 3f 8a bc c2 1b 8f ed 73 db a6 dd c2 9e 5c 69 72 0f e6 6e 41 9d 02 c8 52 45 3b d8 17 fc 9e d8 ac 74 23 7e 1f 33 93 e5 b6 cd ba 95 3d b5 92 73 0f 85 6a 35 4b af d0 6f c3 2a d7 3e 09 Data Ascii: \a#?}AvHr}?s\irnARE;t#~3=sj5Ko*>mzi;k^.).K6ijHQn&pe1tYw,rvv81~V\s)D7{~o)L`!@]X9VuR^:+:-@;)]m+Ud{@
Apr 15, 2025 17:05:15.429723978 CEST	1358	IN	Data Raw: ab 10 41 97 45 34 8f 1a 32 18 09 56 a4 ae 5a 48 d3 2e c6 d3 fb 41 da 40 19 6e a7 f7 eb 0f ba 1e a3 7d c3 de 40 77 8d b8 62 64 24 b6 8f f6 3a 84 5a 22 a7 25 d9 05 bd 1d 07 35 ce 87 6b 2c 8c ea dc 38 45 4f 9b 2a 7a 1b 78 b0 17 de 96 b4 a5 25 8a f8 Data Ascii: AE42VZH.A@n}@wbd$:Z"%5k,8EO*zx%`]x)AAC;x/SslU80njn.oG]}}0Z78&{cv"X,picHcS'(!(%]bCLS 2?Aqbkd

Target ID:	0
Start time:	11:04:36
Start date:	15/04/2025
Path:	C:\Users\user\Desktop\random.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\random.exe"
Imagebase:	0xb50000
File size:	970'240 bytes
MD5 hash:	55C6AC234ACA077957813B6A5B94A805
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:04:37
Start date:	15/04/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x830000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:04:37
Start date:	15/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff60c8c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:04:39
Start date:	15/04/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x830000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:04:39
Start date:	15/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff60c8c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:04:40
Start date:	15/04/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x830000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:04:40
Start date:	15/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff60c8c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:04:40
Start date:	15/04/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x830000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:04:40
Start date:	15/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff60c8c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:04:40
Start date:	15/04/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x830000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:04:40
Start date:	15/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff60c8c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:04:40
Start date:	15/04/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff77fbd0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:04:41
Start date:	15/04/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff77fbd0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:04:41
Start date:	15/04/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff77fbd0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	11:04:42
Start date:	15/04/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2280 -parentBuildID 20230927232528 -prefsHandle 2224 -prefMapHandle 2216 -prefsLen 25358 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9a4cfab-7630-432a-b44e-2e0ea87c7258} 8008 "\\.\pipe\gecko-crash-server-pipe.8008" 22d99470310 socket
Imagebase:	0x7ff77fbd0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	11:04:46
Start date:	15/04/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4476 -parentBuildID 20230927232528 -prefsHandle 4072 -prefMapHandle 4572 -prefsLen 26308 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {60a1ac55-9c98-4e34-bd54-b295dd9a3424} 8008 "\\.\pipe\gecko-crash-server-pipe.8008" 22dab472d10 rdd
Imagebase:	0x7ff77fbd0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	11:04:58
Start date:	15/04/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5488 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5476 -prefMapHandle 5480 -prefsLen 33184 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5eb2eb8a-a779-4036-9ee2-0004eb96fe19} 8008 "\\.\pipe\gecko-crash-server-pipe.8008" 22d99472510 utility
Imagebase:	0x7ff77fbd0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	11:05:01
Start date:	15/04/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
Imagebase:	0x7ff77fbd0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	11:05:01
Start date:	15/04/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
Imagebase:	0x7ff77fbd0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report random.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_18974034-3c87-4e84-b804-09987acda08c.json (copy)

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_18974034-3c87-4e84-b804-09987acda08c.json.tmp

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

C:\Users\user\AppData\Local\Temp\tmpaddon

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\9rlxi5te.MozillaBackgroundTask-308046B0AF4A39CB-backgroundupdate\compatibility.ini

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\9rlxi5te.MozillaBackgroundTask-308046B0AF4A39CB-backgroundupdate\prefs.js

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\ExperimentStoreData.json (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\ExperimentStoreData.json.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\addonStartup.json.lz4 (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\addonStartup.json.lz4.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\addons.json (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\addons.json.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\content-prefs.sqlite

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\crashes\store.json.mozlz4 (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\crashes\store.json.mozlz4.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\extensions.json (copy)

Windows Analysis Report
random.exe