Edit tour

Windows Analysis Report
random.exe

Overview

General Information

Sample name:	random.exe
Analysis ID:	1665561
MD5:	55c6ac234aca077957813b6a5b94a805
SHA1:	96be80f44a36f24d32819e29af1ebdc1aca9a536
SHA256:	682121d8c7160e46c3c4bc595fdab0346ad08895b95c39f97c3afa8cd7922f8e
Tags:	exeuser-abuse_ch
Infos:

Detection

Credential Flusher

Score:	76
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Credential Flusher

Binary is likely a compiled AutoIt script file

Found API chain indicative of sandbox detection

Joe Sandbox ML detected suspicious sample

Connects to many different domains

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

OS version to string mapping found (often used in BOTs)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

random.exe (PID: 8036 cmdline: "C:\Users\user\Desktop\random.exe" MD5: 55C6AC234ACA077957813B6A5B94A805)

taskkill.exe (PID: 2424 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7572 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3036 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8132 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7304 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 7796 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 4480 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3308 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 1988 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2188 -parentBuildID 20230927232528 -prefsHandle 2136 -prefMapHandle 2128 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bf562db-b021-4f69-861d-d0c8b4628b56} 3308 "\\.\pipe\gecko-crash-server-pipe.3308" 2a5ea96f110 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8828 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3904 -parentBuildID 20230927232528 -prefsHandle 3932 -prefMapHandle 3792 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {64025ebd-91c0-456e-aab9-fa0b6e3c6798} 3308 "\\.\pipe\gecko-crash-server-pipe.3308" 2a5fcee2410 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8384 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5224 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5228 -prefMapHandle 2992 -prefsLen 33119 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cf9bd39-8f88-4f62-8978-d6e0767493a5} 3308 "\\.\pipe\gecko-crash-server-pipe.3308" 2a5fa9a6d10 utility MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8876 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 5940 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: random.exe PID: 8036	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: random.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: random.exe	Virustotal: Detection: 30%			Perma Link
Source: random.exe	ReversingLabs: Detection: 38%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 97.9%

Source: random.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.91:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49746 version: TLS 1.2

Source:	Binary string: webauthn.pdb source: firefox.exe, 00000012.00000003.1555664374.000002A5FEC01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.18.dr
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.18.dr
Source:	Binary string: webauthn.pdbGCTL source: firefox.exe, 00000012.00000003.1555664374.000002A5FEC01000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_0071DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	3_2_0071DBBE
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006EC2A2 FindFirstFileExW,	3_2_006EC2A2
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_007268EE FindFirstFileW,FindClose,	3_2_007268EE
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_0072698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	3_2_0072698F
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_0071D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_0071D076
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_0071D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_0071D3A9
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_00729642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_00729642
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_0072979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_0072979D
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_00729B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	3_2_00729B2B
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_00725C97 FindFirstFileW,FindNextFileW,FindClose,	3_2_00725C97

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 250MB

Source: unknown

Network traffic detected: DNS query count 33

Source: Joe Sandbox View	IP Address: 151.101.1.91 151.101.1.91
Source: Joe Sandbox View	IP Address: 34.149.100.209 34.149.100.209
Source: Joe Sandbox View	IP Address: 34.49.51.44 34.49.51.44
Source: Joe Sandbox View	IP Address: 34.160.144.191 34.160.144.191

Source: Joe Sandbox View

JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_0072CE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

3_2_0072CE44

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKLast-Modified: Wed, 12 Mar 2025 04:19:28 GMTETag: 85430baed3398695717b0263807cf97cContent-Length: 453023Accept-Ranges: bytesX-Timestamp: 1741753167.65917Content-Type: application/zipX-Trans-Id: tx01b3942a3e444fe795adb-0067d453d3dfw1Cache-Control: public, max-age=63720Expires: Wed, 16 Apr 2025 08:55:15 GMTDate: Tue, 15 Apr 2025 15:13:15 GMTConnection: keep-aliveData Raw: 50 4b 03 04 14 00 00 00 08 00 cd 8d 62 4e d0 b9 df e8 52 e8 06 00 d0 97 0f 00 0f 00 00 00 67 6d 70 6f 70 65 6e 68 32 36 34 2e 64 6c 6c ec bd 0b 7c 14 45 b6 30 de 3d 99 84 49 98 a4 07 8c 18 31 c2 e8 ce ea 34 66 31 71 e3 9a 60 d4 e9 d0 93 f4 e0 04 c2 d3 80 88 71 a3 b9 a0 08 11 27 2b b8 10 08 93 68 2a 6d 7b d9 bb 7a d7 dd 6f 5f ff 7b 77 ef dd e7 c5 bd ee f2 d0 95 cc 24 92 07 28 24 41 21 c0 8a 11 7c 4c 18 81 00 42 26 41 32 ff 73 aa 7b 9e 04 44 64 f7 ff dd ff f7 f1 63 d2 55 d5 55 e7 d4 39 75 ce a9 53 a7 aa bb 4b 16 6c 60 12 18 86 d1 c3 2f 18 64 98 2d 8c fa cf c6 7c f9 bf 00 fc d2 26 be 9e c6 fc 39 f9 9d 9b b6 b0 ce 77 6e 9a b3 78 c9 d3 e6 aa 15 cb ff 69 c5 23 4f 9a 2b 1e 59 b6 6c b9 cb fc dd c7 cc 2b aa 97 99 97 2c 33 8b 33 66 9b 9f 5c fe e8 63 93 53 53 53 2c 1a 8c e9 d2 cf b7 a4 f0 fd fe d0 ef b1 92 cf 8f 4e a4 d7 d3 47 47 d1 eb 99 a3 ff 46 af 27 8f 26 d3 3a 27 fd 4b e0 5a 26 9c 3e 9a 40 af 67 8e de 4d af 9f 1f 4d d7 60 fc 13 fc 2a 84 fe a3 a3 e9 f5 14 bd ce 5a 52 b1 18 ef 85 fa 5e 6a 67 98 47 9f 4b 62 8e 6f 7e 76 61 a8 ac 9f b9 d9 3c 5a 97 c6 31 2e 23 c3 8c 4f a0 65 19 99 a3 19 c6 44 93 eb 58 fc 8b 69 1d c3 24 69 6d 42 57 c6 c3 51 26 be ba c1 04 b7 cb d9 50 a3 d0 e5 c2 bc 9a 2c 4d e4 98 2c a8 bd 3a 89 63 ac d1 cc 2d e5 98 0d 12 5c 9f e5 98 ce 1b e1 fa 2a c7 d4 01 8a ce 2d 69 cc 9c 4b 8c 49 f6 d6 34 86 61 a3 0a 36 18 99 2a dd c5 eb 4f 76 3d b6 d2 05 57 cb d3 46 b5 43 48 bb 3e b6 8e 99 61 ca 27 af 78 f4 11 d7 23 40 66 8d 8e c2 64 d6 c1 75 a5 31 a6 9e 0d fe 4f 56 ab 31 6f 7d 1b 09 84 0e 67 c2 35 90 16 5f cf 33 b9 4a ad 48 69 04 5a 99 69 70 4d e7 2e 84 b7 62 b9 5a 11 86 81 f9 25 dc 47 94 8b 46 aa f7 d8 d2 e5 15 0c e5 11 f2 8a d2 f2 f8 05 f5 0a 2f ce 89 ff 33 ff 71 9b d9 4a af c7 d0 f2 b6 f6 6f de 03 b3 25 f7 67 d9 4e d2 2a 91 7d 12 d9 29 c9 33 0d 4e 25 f1 21 b7 91 71 2a a9 0b e0 e2 eb b8 8b 81 b4 f1 5e 49 9e 6d 90 c8 7e 07 09 f8 36 dd 85 23 e9 7e 2b fb c1 87 17 85 41 d1 7f 12 49 5d 72 03 c7 e4 78 b4 e2 b9 2a 82 3c 49 59 6a c9 96 da ec cc 70 30 18 8c 60 53 ae 4d 40 14 45 f7 8f 66 ea 3d ae 3b 21 cf 40 1e b0 f8 be 0d 45 c4 bb 05 45 bb be a3 fa 9e ad 1b 20 e1 9b 9c 30 1a 6e da 03 12 f1 4a 64 c8 b7 1c 64 d2 7f fd d6 06 bc 75 4d ec 2d 94 71 49 c6 6c 52 8e 07 7a 9a 07 3d 7d a8 a5 72 83 44 e6 58 4c 5a a7 ac 92 f2 78 b6 24 97 04 7c 63 a1 31 d2 63 55 6b 4d e6 26 d6 51 6e 5d ac fe 61 5d 74 fd 68 fa a1 2a d4 b4 21 b9 36 20 37 80 e4 4a 64 af 44 76 4b 4a 22 57 67 64 2a 25 6e 99 07 d2 bf 77 ab e9 f6 4a 6e 69 fb 69 6e 6d 72 9b 40 4d 85 24 27 5a c7 73 8c 04 ec 18 23 29 25 bd c1 52 73 bd a7 3a 09 68 e9 f5 eb 80 14 52 9c 01 ad ef 5c 1f 81 74 b2 36 16 12 27 91 67 cc 95

Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip HTTP/1.1Host: ciscobinary.openh264.orgUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 00000012.00000003.1457913405.000002A5FB323000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1493786625.000002A6038C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.1546636525.000002A6086A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.1394288393.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1406998880.000002A6077FD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1415095574.000002A6077FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.1394288393.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1406998880.000002A6077FD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1415095574.000002A6077FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000003.1546636525.000002A6086A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.1547958226.000002A607675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394288393.000002A607677000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1534971733.000002A607675000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.1547958226.000002A607675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394288393.000002A607677000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1534971733.000002A607675000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000003.1394288393.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1406998880.000002A6077FD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1415095574.000002A6077FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.1394288393.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1406998880.000002A6077FD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1415095574.000002A6077FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3146905609.000001D1D280A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3147464709.000002809280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3146905609.000001D1D280A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3147464709.000002809280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3146905609.000001D1D280A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3147464709.000002809280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000003.1546636525.000002A6086A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1545630590.000002A609388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.1571657533.000002A5FA18F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1555897595.000002A5FA18F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000003.1545630590.000002A609388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com- equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000003.1573456059.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1572295549.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576742940.000002A5FA17D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.youtube.coma equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: mc.prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: shavar.prod.mozaws.net
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy.tombstone.experimenter.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: a19.dscg10.akamai.net

Source: firefox.exe, 00000012.00000003.1539201560.000002A6023A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1522869551.000002A6023A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1532320550.000002A6023A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394997551.000002A6023A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: firefox.exe, 00000012.00000003.1522698239.000002A6028F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 00000012.00000003.1522698239.000002A6028F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 00000012.00000003.1522698239.000002A6028F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 00000012.00000003.1522698239.000002A6028F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: firefox.exe, 00000012.00000003.1576601001.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576742940.000002A5FA17D000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: firefox.exe, 00000012.00000003.1582596709.000002A5FA1BF000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576601001.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576742940.000002A5FA17D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: firefox.exe, 00000012.00000003.1580302842.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1556662158.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576601001.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1573456059.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1572295549.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576742940.000002A5FA17D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1573331285.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1580213014.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: firefox.exe, 00000012.00000003.1576601001.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: firefox.exe, 00000012.00000003.1580302842.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1556662158.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576601001.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1573456059.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1572295549.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576742940.000002A5FA17D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1573331285.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1580213014.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: firefox.exe, 00000012.00000003.1356858568.000002A5FA8C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1455803989.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1469015256.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1458065839.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 00000012.00000003.1556662158.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1572295549.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: firefox.exe, 00000012.00000003.1580302842.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1556662158.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1573456059.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1572295549.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576742940.000002A5FA17D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1573331285.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1580213014.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsov
Source: gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: firefox.exe, 00000012.00000003.1579430225.000002A5FA18F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1581600054.000002A5FA18F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digice
Source: firefox.exe, 00000012.00000003.1582596709.000002A5FA1BF000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576601001.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576742940.000002A5FA17D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: firefox.exe, 00000012.00000003.1580302842.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1556662158.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576601001.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1573456059.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1572295549.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576742940.000002A5FA17D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1573331285.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1580213014.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: firefox.exe, 00000012.00000003.1576601001.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: firefox.exe, 00000012.00000003.1580302842.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1556662158.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576601001.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1573456059.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1572295549.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576742940.000002A5FA17D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1573331285.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1580213014.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: firefox.exe, 00000012.00000003.1580302842.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1556662158.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576601001.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1573456059.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1572295549.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576742940.000002A5FA17D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1573331285.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1580213014.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: firefox.exe, 00000012.00000003.1576601001.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576742940.000002A5FA17D000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: firefox.exe, 00000012.00000003.1580302842.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1556662158.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576601001.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1573456059.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1572295549.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576742940.000002A5FA17D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1573331285.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1580213014.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: firefox.exe, 00000012.00000003.1536460509.000002A603A8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1542201750.000002A5FDE7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1529540321.000002A60778F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1559891214.000002A603A8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1546444389.000002A609314000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1548296596.000002A60762D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1558805163.000002A606913000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000012.00000003.1551225044.000002A5FD33F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1557875590.000002A6076F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1539201560.000002A6023EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000012.00000003.1535926305.000002A60763E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000012.00000003.1570171542.000002A5FC0F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1570894738.000002A5FC0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000018.00000003.1554326719.0000026CBA98D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000018.00000002.1572800145.0000026CBB080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 00000018.00000003.1554326719.0000026CBA98D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000018.00000002.1572800145.0000026CBB080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 00000018.00000002.1570781614.0000026CBA830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000018.00000003.1563169464.0000026CBA862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 00000018.00000002.1570781614.0000026CBA830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000018.00000003.1563169464.0000026CBA862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 00000018.00000002.1570781614.0000026CBA830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 00000018.00000002.1568104419.0000026CAF00A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/strings
Source: firefox.exe, 00000012.00000003.1513908497.000002A607F7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1406639893.000002A607F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 00000012.00000003.1513908497.000002A607F7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1406639893.000002A607F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 00000012.00000003.1513908497.000002A607F7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1406639893.000002A607F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#-
Source: firefox.exe, 00000012.00000003.1513908497.000002A607F7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1406639893.000002A607F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 00000012.00000003.1551225044.000002A5FD38A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1413847565.000002A5FC3E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1356392939.000002A5FB93F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1413847565.000002A5FC384000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1507001384.000002A5FA466000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1417205369.000002A5FC36D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1518830330.000002A5FB95B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1545099213.000002A5FDDF6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1496306445.000002A5FC37D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1575377818.000002A5FA462000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1551225044.000002A5FD39B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1357086577.000002A5FAF77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1417205369.000002A5FC343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1356096534.000002A5FB956000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1506030581.000002A5FC368000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1411357732.000002A6037CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1479452873.000002A602B56000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1582410138.000002A5FC377000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1470251135.000002A602B5B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1464810344.000002A5FC157000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1515545241.000002A5FBFE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 00000012.00000003.1580302842.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1556662158.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576601001.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1573456059.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1572295549.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576742940.000002A5FA17D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1573331285.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1580213014.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: firefox.exe, 00000012.00000003.1582596709.000002A5FA1BF000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576601001.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576742940.000002A5FA17D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1580213014.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: firefox.exe, 00000012.00000003.1580302842.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1556662158.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576601001.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1573456059.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1572295549.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576742940.000002A5FA17D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1573331285.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1580213014.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: firefox.exe, 00000012.00000003.1576601001.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: firefox.exe, 00000012.00000003.1356858568.000002A5FA8C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1455803989.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1469015256.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1458065839.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: firefox.exe, 00000012.00000003.1356858568.000002A5FA8C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1455803989.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1469015256.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1458065839.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000012.00000003.1580302842.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1556662158.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576601001.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1573456059.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1572295549.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576742940.000002A5FA17D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1573331285.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1580213014.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: firefox.exe, 00000012.00000003.1356858568.000002A5FA8C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1455803989.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1469015256.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1458065839.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://www.mozilla.com0
Source: firefox.exe, 00000012.00000003.1561947576.000002A60255D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 00000012.00000003.1522698239.000002A6028F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 00000012.00000003.1533941221.000002A602361000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394997551.000002A602361000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394997551.000002A6023A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1565774549.000002A5FD059000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1393469123.000002A5FD0D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1523735421.000002A602361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000012.00000003.1393469123.000002A5FD0D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: mozilla-temp-41.18.dr	String found in binary or memory: http://www.videolan.org/x264.html
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000012.00000003.1348096843.000002A5FA41D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1348810633.000002A5FA460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1347916598.000002A5FA900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1348475873.000002A5FA43E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1348994197.000002A5FA481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000012.00000003.1567426834.000002A5FCF89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000012.00000003.1538053009.000002A6028B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000012.00000003.1545630590.000002A609388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/enhancer-for-youtube/
Source: firefox.exe, 00000012.00000003.1545630590.000002A609388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/facebook-container/
Source: firefox.exe, 00000012.00000003.1545630590.000002A609388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/reddit-enhancement-suite/
Source: firefox.exe, 00000012.00000003.1545630590.000002A609388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/to-google-translate/
Source: firefox.exe, 00000012.00000003.1545630590.000002A609388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/wikipedia-context-menu-search/
Source: firefox.exe, 00000012.00000003.1514341461.000002A6046DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads-us.rd.linksynergy.com/as.php
Source: firefox.exe, 00000012.00000003.1548404425.000002A607627000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 00000012.00000003.1394288393.000002A6076F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1557577039.000002A60773F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000012.00000003.1393956110.000002A607777000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000012.00000003.1560798276.000002A602890000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1567847917.000002A5FCE70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1548489714.000002A60288A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1538805838.000002A60288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: firefox.exe, 00000013.00000002.3147600241.000001E96E4E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3146905609.000001D1D28E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3149721848.0000028092906000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.18.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: firefox.exe, 00000013.00000002.3147600241.000001E96E4E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3146905609.000001D1D28E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3149721848.0000028092906000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.18.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: firefox.exe, 00000012.00000003.1545630590.000002A609388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000012.00000003.1457839024.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1457551416.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1189266
Source: firefox.exe, 00000012.00000003.1457839024.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1457551416.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1193802
Source: firefox.exe, 00000012.00000003.1457839024.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1457551416.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1207993
Source: firefox.exe, 00000012.00000003.1457839024.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1457551416.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1266220
Source: firefox.exe, 00000012.00000003.1457839024.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1457551416.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1283601
Source: firefox.exe, 00000012.00000003.1457839024.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1457551416.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1678448
Source: firefox.exe, 00000012.00000003.1498040072.000002A603712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1694699#c21
Source: firefox.exe, 00000012.00000003.1457839024.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1457551416.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=792480
Source: firefox.exe, 00000012.00000003.1457839024.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1457551416.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=809550
Source: firefox.exe, 00000012.00000003.1457839024.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1457551416.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=840161
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000012.00000003.1348096843.000002A5FA41D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1348810633.000002A5FA460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1347916598.000002A5FA900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1348475873.000002A5FA43E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1348994197.000002A5FA481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000012.00000003.1407235559.000002A607785000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 00000012.00000003.1415095574.000002A6077FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/
Source: firefox.exe, 00000012.00000003.1567426834.000002A5FCFC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: firefox.exe, 00000013.00000002.3147600241.000001E96E4E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3146905609.000001D1D28E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3149721848.0000028092906000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.18.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000013.00000002.3147600241.000001E96E4E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3146905609.000001D1D28E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3149721848.0000028092906000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.18.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: firefox.exe, 00000012.00000003.1393956110.000002A607777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1534971733.000002A607699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 00000012.00000003.1534971733.000002A607699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 00000012.00000003.1534971733.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1547909331.000002A60776B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 00000012.00000003.1470251135.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1479452873.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1581366452.000002A602B76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000012.00000003.1457913405.000002A5FB323000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1493786625.000002A6038C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1546729045.000002A60866E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1503002316.000002A5FA571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://datastudio.google.com/embed/reporting/
Source: firefox.exe, 00000018.00000003.1554326719.0000026CBA9A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc
Source: firefox.exe, 00000018.00000002.1572800145.0000026CBB080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 00000018.00000003.1554326719.0000026CBA9A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000018.00000002.1572800145.0000026CBB080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 00000018.00000002.1572800145.0000026CBB080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 00000018.00000003.1554326719.0000026CBA9AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureWebExtensionUncheckedLastErr
Source: firefox.exe, 00000018.00000003.1554326719.0000026CBA9A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureElementReleaseCaptureWarningElem
Source: firefox.exe, 00000018.00000002.1572800145.0000026CBB080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 00000018.00000003.1554326719.0000026CBA98D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#EncryptionPreventDefaultFromP
Source: firefox.exe, 00000018.00000002.1572800145.0000026CBB080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 00000018.00000003.1554326719.0000026CBA98D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored
Source: firefox.exe, 00000018.00000002.1572800145.0000026CBB080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 00000012.00000003.1496306445.000002A5FC37D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1582410138.000002A5FC377000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 00000012.00000003.1470251135.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1479452873.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1581366452.000002A602B76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 00000012.00000003.1470251135.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1479452873.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1581366452.000002A602B76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 00000012.00000003.1470251135.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1479452873.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1581366452.000002A602B76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 00000012.00000003.1415095574.000002A6077FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 00000012.00000003.1356858568.000002A5FA8C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1455803989.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1469015256.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1458065839.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1476620432.000002A5FA765000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1525053634.000002A5FA773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000012.00000003.1476620432.000002A5FA765000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1525053634.000002A5FA773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000018.00000003.1554326719.0000026CBA9AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/SelectOptionsLengthAssignmentW
Source: firefox.exe, 00000018.00000002.1572800145.0000026CBB080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 00000016.00000002.3147464709.0000028092813000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000012.00000003.1397431217.000002A6080E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1396076339.000002A6080F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000018.00000002.1572568200.0000026CBB050000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 00000012.00000003.1514341461.000002A6046E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1559437004.000002A6046E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000016.00000002.3147464709.0000028092813000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000016.00000002.3147464709.00000280928C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000016.00000002.3147464709.00000280928C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000012.00000003.1560646588.000002A602AB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3146905609.000001D1D282F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3147464709.0000028092830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000012.00000003.1547958226.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1558376993.000002A6076AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394288393.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1534971733.000002A607699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 00000012.00000003.1547958226.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1558376993.000002A6076AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394288393.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1534971733.000002A607699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 00000012.00000003.1547958226.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1558376993.000002A6076AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394288393.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1534971733.000002A607699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 00000012.00000003.1547958226.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1558376993.000002A6076AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394288393.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1534971733.000002A607699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 00000012.00000003.1547958226.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1558376993.000002A6076AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394288393.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1534971733.000002A607699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 00000012.00000003.1547958226.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1558376993.000002A6076AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394288393.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1534971733.000002A607699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 00000012.00000003.1547958226.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1558376993.000002A6076AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394288393.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1534971733.000002A607699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 00000016.00000002.3147464709.00000280928C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000012.00000003.1560646588.000002A602AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 00000012.00000003.1547958226.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1558376993.000002A6076AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394288393.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1534971733.000002A607699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 00000012.00000003.1394288393.000002A607677000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000012.00000003.1547958226.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1558376993.000002A6076AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394288393.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1534971733.000002A607699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 00000016.00000002.3147464709.00000280928C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000012.00000003.1560646588.000002A602AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 00000012.00000003.1560646588.000002A602AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 00000012.00000003.1560646588.000002A602AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 00000012.00000003.1470251135.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1479452873.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1581366452.000002A602B76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 00000012.00000003.1479452873.000002A602B56000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1581486658.000002A602B57000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1470251135.000002A602B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 00000012.00000003.1479452873.000002A602B56000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1581486658.000002A602B57000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1470251135.000002A602B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 00000012.00000003.1470251135.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1479452873.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1581366452.000002A602B76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 00000012.00000003.1470251135.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1479452873.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1581366452.000002A602B76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 00000012.00000003.1348096843.000002A5FA41D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1348810633.000002A5FA460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1347916598.000002A5FA900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1348475873.000002A5FA43E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000012.00000003.1549037813.000002A5FE7A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: firefox.exe, 00000012.00000003.1560646588.000002A602AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000012.00000003.1457913405.000002A5FB323000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1536460509.000002A603A9D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1503614399.000002A5F7B9A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1455089262.000002A6038C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1458015932.000002A5FB327000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ib.absa.co.za/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000012.00000003.1513420265.000002A6093AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/oldsyncS
Source: firefox.exe, 00000012.00000003.1514341461.000002A6046ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1559370428.000002A6046F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/relay
Source: firefox.exe, 00000012.00000003.1513420265.000002A6093AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/H
Source: firefox.exe, 00000012.00000003.1513420265.000002A6093AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/HCX
Source: firefox.exe, 00000012.00000003.1513420265.000002A6093AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryU
Source: firefox.exe, 00000012.00000003.1513420265.000002A6093AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryUFj
Source: firefox.exe, 00000012.00000003.1547958226.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394288393.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1534971733.000002A607699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: prefs-1.js.18.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000012.00000003.1513712993.000002A607FF3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1547250090.000002A607FF3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000012.00000003.1558805163.000002A606955000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3146905609.000001D1D28E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3147464709.00000280928F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000012.00000003.1546578682.000002A6086B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/events/1/bfa80d28-e181-4dec-9c60-5f58d
Source: firefox.exe, 00000012.00000003.1570894738.000002A5FC0AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/newtab/1/43bb9a55-74a2-452e-8233-6899a
Source: firefox.exe, 00000016.00000002.3147464709.00000280928F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submith
Source: firefox.exe, 00000012.00000003.1560646588.000002A602AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 00000012.00000003.1470251135.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1479452873.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1581366452.000002A602B76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000012.00000003.1394687864.000002A607652000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1534971733.000002A60764D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 00000012.00000003.1513908497.000002A607F7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1406639893.000002A607F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema.
Source: firefox.exe, 00000012.00000003.1513908497.000002A607F7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1406639893.000002A607F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema./
Source: firefox.exe, 00000012.00000003.1513908497.000002A607F7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1406639893.000002A607F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/
Source: firefox.exe, 00000012.00000003.1513908497.000002A607F7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1406639893.000002A607F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/=
Source: firefox.exe, 00000012.00000003.1470251135.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1479452873.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1581366452.000002A602B76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 00000012.00000003.1470251135.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1479452873.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1581366452.000002A602B76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 00000012.00000003.1470251135.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1479452873.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1581366452.000002A602B76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000012.00000003.1552249386.000002A5FD31C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000012.00000003.1567426834.000002A5FCF89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000012.00000003.1567426834.000002A5FCF89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000012.00000003.1457913405.000002A5FB323000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1493786625.000002A6038C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1546729045.000002A60866E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1503002316.000002A5FA571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lookerstudio.google.com/embed/reporting/
Source: firefox.exe, 00000012.00000003.1476620432.000002A5FA765000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1525053634.000002A5FA773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000012.00000003.1356858568.000002A5FA8C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1455803989.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1469015256.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1458065839.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1476620432.000002A5FA765000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1525053634.000002A5FA773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000012.00000003.1356858568.000002A5FA8C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1455803989.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1469015256.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1458065839.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1476620432.000002A5FA765000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1525053634.000002A5FA773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000014.00000002.3146905609.000001D1D2886000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3147464709.000002809288E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000012.00000003.1576601001.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1579430225.000002A5FA18F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576742940.000002A5FA17D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1582596709.000002A5FA18F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1581600054.000002A5FA18F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org0/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 00000012.00000003.1476620432.000002A5FA765000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1525053634.000002A5FA773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000012.00000003.1356858568.000002A5FA8C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1455803989.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1469015256.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1458065839.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1476620432.000002A5FA765000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1525053634.000002A5FA773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000012.00000003.1546138807.000002A609337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com/
Source: firefox.exe, 00000012.00000003.1560646588.000002A602AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000012.00000003.1539201560.000002A6023A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1522869551.000002A6023A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1532320550.000002A6023A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2&
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000012.00000003.1531745466.000002A602C72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1522333348.000002A602C72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000012.00000003.1531745466.000002A602C72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1522333348.000002A602C72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000012.00000003.1348475873.000002A5FA43E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000012.00000003.1496306445.000002A5FC37D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1582410138.000002A5FC377000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000012.00000003.1570367450.000002A5FC0D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000012.00000003.1513712993.000002A607FF3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1547250090.000002A607FF3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1406639893.000002A607FF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000012.00000003.1557507263.000002A607744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000012.00000003.1407817547.000002A5FC0DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000012.00000003.1407817547.000002A5FC0DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000012.00000003.1394288393.000002A607677000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1557577039.000002A60773F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 00000012.00000003.1393956110.000002A607777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3146905609.000001D1D2812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3147464709.0000028092813000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000016.00000002.3147464709.0000028092813000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/Error:
Source: firefox.exe, 00000012.00000003.1393956110.000002A607777000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000012.00000003.1547958226.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1558376993.000002A6076AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394288393.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1534971733.000002A607699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 00000012.00000003.1547958226.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1558376993.000002A6076AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394288393.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1534971733.000002A607699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 00000012.00000003.1560646588.000002A602AB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1530288450.000002A60697C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1520348740.000002A60697C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3146905609.000001D1D28BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3147464709.00000280928F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: places.sqlite-wal.18.dr	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000012.00000003.1570830913.000002A5FC0B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000012.00000003.1536055399.000002A6046B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/firefox-relay-integration
Source: firefox.exe, 00000012.00000003.1407512635.000002A5FC268000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 00000012.00000003.1512862218.000002A609467000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.18.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000018.00000003.1554326719.0000026CBA98D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaPlatformDecoderNotFound
Source: firefox.exe, 00000018.00000003.1554326719.0000026CBA98D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaWMFNeeded
Source: firefox.exe, 00000018.00000002.1572800145.0000026CBB080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 00000018.00000002.1572800145.0000026CBB080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 00000012.00000003.1480378546.000002A5FDFBD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1471662938.000002A5FDFBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 00000012.00000003.1562468073.000002A5FD3B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1551135323.000002A5FD3A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: places.sqlite-wal.18.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.
Source: firefox.exe, 00000012.00000003.1512862218.000002A609467000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: firefox.exe, 00000012.00000003.1470251135.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1479452873.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1581366452.000002A602B76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000018.00000002.1572800145.0000026CBB080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000018.00000002.1572800145.0000026CBB080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000018.00000002.1572800145.0000026CBB080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000018.00000002.1572800145.0000026CBB080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000012.00000003.1406639893.000002A607F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 00000012.00000003.1560646588.000002A602AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1548404425.000002A607627000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000012.00000003.1470251135.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1479452873.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1581366452.000002A602B76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 00000012.00000003.1557186053.000002A60774D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000012.00000003.1557186053.000002A60774D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 00000012.00000003.1548404425.000002A607627000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 00000012.00000003.1415095574.000002A6077FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: firefox.exe, 00000013.00000002.3147600241.000001E96E4E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3146905609.000001D1D28E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3149721848.0000028092906000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.18.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: firefox.exe, 00000012.00000003.1415095574.000002A6077FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000012.00000003.1557186053.000002A60774D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 00000012.00000003.1557186053.000002A60774D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1548404425.000002A607627000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 00000012.00000003.1547958226.000002A607675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394288393.000002A607677000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1534971733.000002A607675000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 00000012.00000003.1548404425.000002A607627000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: firefox.exe, 00000013.00000002.3147600241.000001E96E4E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3146905609.000001D1D28E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3149721848.0000028092906000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.18.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: firefox.exe, 00000012.00000003.1547958226.000002A607675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394288393.000002A607677000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1534971733.000002A607675000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 00000012.00000003.1580302842.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1556662158.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576601001.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1573456059.000002A5FA17C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1572295549.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1576742940.000002A5FA17D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1573331285.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1580213014.000002A5FA167000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.18.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: firefox.exe, 00000012.00000003.1547958226.000002A607675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394288393.000002A607677000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1534971733.000002A607675000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 00000012.00000003.1557186053.000002A60774D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: firefox.exe, 00000012.00000003.1394725004.000002A60764F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 00000012.00000003.1521373397.000002A603D55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 00000012.00000003.1394725004.000002A60764F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 00000012.00000003.1394863824.000002A60763F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1348475873.000002A5FA43E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1348994197.000002A5FA481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: firefox.exe, 00000012.00000003.1394725004.000002A60764F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCEC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1548404425.000002A607627000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1548404425.000002A607627000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 00000012.00000003.1548404425.000002A607627000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 00000012.00000003.1570830913.000002A5FC0B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mobilesuica.com/
Source: firefox.exe, 00000012.00000003.1558805163.000002A606911000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1547909331.000002A60776B000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.18.dr	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: places.sqlite-wal.18.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.
Source: firefox.exe, 00000012.00000003.1512862218.000002A609467000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: firefox.exe, 00000012.00000003.1397431217.000002A6080E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1396076339.000002A6080F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: places.sqlite-wal.18.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.
Source: firefox.exe, 00000012.00000003.1512862218.000002A609467000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: firefox.exe, 00000012.00000003.1536055399.000002A6046B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/about/legal/terms/subscription-services/
Source: targeting.snapshot.json.tmp.18.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: firefox.exe, 00000012.00000003.1512862218.000002A609467000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.18.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: firefox.exe, 00000012.00000003.1536055399.000002A6046B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/subscription-services/
Source: firefox.exe, 00000012.00000003.1512862218.000002A609467000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.18.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 00000012.00000003.1512862218.000002A609467000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.18.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: firefox.exe, 00000013.00000002.3147600241.000001E96E4C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3146905609.000001D1D28CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3147464709.00000280928F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000012.00000003.1547958226.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1558376993.000002A6076AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394288393.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1534971733.000002A607699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000014.00000002.3146905609.000001D1D28CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/DL
Source: firefox.exe, 00000012.00000003.1547958226.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1558376993.000002A6076AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394288393.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1534971733.000002A607699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: firefox.exe, 00000012.00000003.1512862218.000002A609467000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.18.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000012.00000003.1567426834.000002A5FCF89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000012.00000003.1557186053.000002A60774D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 00000012.00000003.1415095574.000002A6077FD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1548404425.000002A607627000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000012.00000003.1546636525.000002A6086A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1457592301.000002A5FB329000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1493786625.000002A6038C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/
Source: firefox.exe, 00000012.00000003.1557186053.000002A60774D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 00000012.00000003.1406639893.000002A607F68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3146905609.000001D1D280A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3147464709.000002809280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000018.00000003.1554326719.0000026CBA98D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 00000018.00000002.1572800145.0000026CBB080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 00000012.00000003.1553094833.000002A5FD0E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1548296596.000002A60762D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000012.00000003.1542201750.000002A5FDE76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1522698239.000002A6028FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1537931551.000002A6028FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: recovery.jsonlz4.tmp.18.dr	String found in binary or memory: https://youtube.com/account?=
Source: firefox.exe, 00000016.00000002.3145190571.0000028092470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.co
Source: firefox.exe, 00000013.00000002.3147234489.000001E96E3C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.co0nX
Source: firefox.exe, 00000012.00000003.1406639893.000002A607F68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3146051203.000001E96E150000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3146051203.000001E96E15A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3147234489.000001E96E3C4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3145220083.000001D1D2560000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3145220083.000001D1D256A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3144662270.000001D1D2544000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3145190571.0000028092474000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3145635273.000002809248A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3145635273.0000028092480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000010.00000002.1335261311.00000171C4DCA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.1341893695.000001AFD8A97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000013.00000002.3146051203.000001E96E150000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3147234489.000001E96E3C4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3145220083.000001D1D2560000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3144662270.000001D1D2544000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3145190571.0000028092474000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3145635273.0000028092480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 00000012.00000003.1393469123.000002A5FD0E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdp
Source: firefox.exe, 00000014.00000002.3144662270.000001D1D2540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.cou

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.91:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49746 version: TLS 1.2

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_0072EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

3_2_0072EAFF

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_0072ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

3_2_0072ED6A

Source: C:\Users\user\Desktop\random.exe

3_2_0072EAFF

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_0071AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

3_2_0071AA57

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_00749576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

3_2_00749576

System Summary

Binary is likely a compiled AutoIt script file

Source: random.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: random.exe, 00000003.00000002.1370230251.0000000000772000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_075d6c0c-7
Source: random.exe, 00000003.00000002.1370230251.0000000000772000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_dc985832-2
Source: random.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_7e0b06f6-5
Source: random.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_38859c4f-0

Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 20_2_000001D1D2D82377 NtQuerySystemInformation,		20_2_000001D1D2D82377
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 20_2_000001D1D2DA3E72 NtQuerySystemInformation,		20_2_000001D1D2DA3E72

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_0071D5EB: CreateFileW,DeviceIoControl,CloseHandle,

3_2_0071D5EB

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_00711201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

3_2_00711201

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_0071E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

3_2_0071E8F6

Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006BBF40	3_2_006BBF40
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006B8060	3_2_006B8060
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_00722046	3_2_00722046
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_00718298	3_2_00718298
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006EE4FF	3_2_006EE4FF
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006E676B	3_2_006E676B
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_00744873	3_2_00744873
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006BCAF0	3_2_006BCAF0
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006DCAA0	3_2_006DCAA0
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006CCC39	3_2_006CCC39
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006E6DD9	3_2_006E6DD9
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006CB119	3_2_006CB119
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006B91C0	3_2_006B91C0
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006D1394	3_2_006D1394
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006D1706	3_2_006D1706
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006D781B	3_2_006D781B
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006C997D	3_2_006C997D
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006B7920	3_2_006B7920
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006D19B0	3_2_006D19B0
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006D7A4A	3_2_006D7A4A
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006D1C77	3_2_006D1C77
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006D7CA7	3_2_006D7CA7
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_0073BE44	3_2_0073BE44
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006E9EEE	3_2_006E9EEE
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006D1F32	3_2_006D1F32
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 20_2_000001D1D2D82377	20_2_000001D1D2D82377
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 20_2_000001D1D2DA3E72	20_2_000001D1D2DA3E72
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 20_2_000001D1D2DA459C	20_2_000001D1D2DA459C
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 20_2_000001D1D2DA3EB2	20_2_000001D1D2DA3EB2

Source: C:\Users\user\Desktop\random.exe	Code function: String function: 006D0A30 appears 46 times
Source: C:\Users\user\Desktop\random.exe	Code function: String function: 006CF9F2 appears 40 times
Source: C:\Users\user\Desktop\random.exe	Code function: String function: 006B9CB3 appears 31 times

Source: random.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal76.troj.evad.winEXE@37/48@78/14

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_007237B5 GetLastError,FormatMessageW,

3_2_007237B5

Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_007110BF AdjustTokenPrivileges,CloseHandle,		3_2_007110BF
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_007116C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		3_2_007116C3

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_007251CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

3_2_007251CD

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_0071D4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

3_2_0071D4DC

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_0072648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

3_2_0072648E

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_006B42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

3_2_006B42A2

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File created: C:\Users\user\AppData\Local\Mozilla\Firefox\SkeletonUILock-c388d246

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6372:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6012:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7476:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3536:120:WilError_03

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File created: C:\Users\user\AppData\Local\Temp\firefox

Jump to behavior

Source: random.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: firefox.exe, 00000012.00000003.1513311046.000002A6093C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1568323288.000002A5FC2A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1519717576.000002A6093C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE timestamp BETWEEN date(:dateFrom) AND date(:dateTo);
Source: firefox.exe, 00000012.00000003.1513311046.000002A6093C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1519717576.000002A6093C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE events (id INTEGER PRIMARY KEY, type INTEGER NOT NULL, count INTEGER NOT NULL, timestamp DATE );
Source: firefox.exe, 00000012.00000003.1513311046.000002A6093C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1519717576.000002A6093C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INSERT INTO events (type, count, timestamp) VALUES (:type, 1, date(:date));
Source: firefox.exe, 00000012.00000003.1513311046.000002A6093C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1519717576.000002A6093C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;
Source: firefox.exe, 00000012.00000003.1513311046.000002A6093C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1519717576.000002A6093C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;Fy6
Source: firefox.exe, 00000012.00000003.1513311046.000002A6093C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1519717576.000002A6093C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE events SET count = count + 1 WHERE id = :id;-
Source: firefox.exe, 00000012.00000003.1513311046.000002A6093C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1519717576.000002A6093C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9'
Source: firefox.exe, 00000012.00000003.1513311046.000002A6093C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1519717576.000002A6093C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9
Source: firefox.exe, 00000012.00000003.1513311046.000002A6093C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1519717576.000002A6093C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE type = :type AND timestamp = date(:date);

Source: random.exe	Virustotal: Detection: 30%
Source: random.exe	ReversingLabs: Detection: 38%

Source: unknown	Process created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2188 -parentBuildID 20230927232528 -prefsHandle 2136 -prefMapHandle 2128 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bf562db-b021-4f69-861d-d0c8b4628b56} 3308 "\\.\pipe\gecko-crash-server-pipe.3308" 2a5ea96f110 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3904 -parentBuildID 20230927232528 -prefsHandle 3932 -prefMapHandle 3792 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {64025ebd-91c0-456e-aab9-fa0b6e3c6798} 3308 "\\.\pipe\gecko-crash-server-pipe.3308" 2a5fcee2410 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5224 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5228 -prefMapHandle 2992 -prefsLen 33119 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cf9bd39-8f88-4f62-8978-d6e0767493a5} 3308 "\\.\pipe\gecko-crash-server-pipe.3308" 2a5fa9a6d10 utility
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2188 -parentBuildID 20230927232528 -prefsHandle 2136 -prefMapHandle 2128 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bf562db-b021-4f69-861d-d0c8b4628b56} 3308 "\\.\pipe\gecko-crash-server-pipe.3308" 2a5ea96f110 socket	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3904 -parentBuildID 20230927232528 -prefsHandle 3932 -prefMapHandle 3792 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {64025ebd-91c0-456e-aab9-fa0b6e3c6798} 3308 "\\.\pipe\gecko-crash-server-pipe.3308" 2a5fcee2410 rdd	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5224 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5228 -prefMapHandle 2992 -prefsLen 33119 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cf9bd39-8f88-4f62-8978-d6e0767493a5} 3308 "\\.\pipe\gecko-crash-server-pipe.3308" 2a5fa9a6d10 utility	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\installs.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: random.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: random.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: webauthn.pdb source: firefox.exe, 00000012.00000003.1555664374.000002A5FEC01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.18.dr
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.18.dr
Source:	Binary string: webauthn.pdbGCTL source: firefox.exe, 00000012.00000003.1555664374.000002A5FEC01000.00000004.00000020.00020000.00000000.sdmp

Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: random.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_006B42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

3_2_006B42DE

Source: gmpopenh264.dll.tmp.18.dr

Static PE information: section name: .rodata

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_006D0A76 push ecx; ret

3_2_006D0A89

Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp			Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)			Jump to dropped file

Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006CF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		3_2_006CF98E
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_00741C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		3_2_00741C41

Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\random.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_3-96880

Source: C:\Program Files\Mozilla Firefox\firefox.exe

Code function: 20_2_000001D1D2D82377 rdtsc

20_2_000001D1D2D82377

Source: C:\Users\user\Desktop\random.exe

API coverage: 4.1 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_0071DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	3_2_0071DBBE
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006EC2A2 FindFirstFileExW,	3_2_006EC2A2
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_007268EE FindFirstFileW,FindClose,	3_2_007268EE
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_0072698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	3_2_0072698F
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_0071D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_0071D076
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_0071D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_0071D3A9
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_00729642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_00729642
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_0072979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_0072979D
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_00729B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	3_2_00729B2B
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_00725C97 FindFirstFileW,FindNextFileW,FindClose,	3_2_00725C97

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_006B42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

3_2_006B42DE

Source: firefox.exe, 00000018.00000002.1569605746.0000026CB0D23000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlltz
Source: random.exe, 00000003.00000003.1290360751.0000000001268000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000003.00000003.1286049877.0000000001268000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000003.00000003.1291306063.0000000001268000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000003.00000003.1365537918.0000000001268000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000003.00000002.1371966438.0000000001269000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000003.00000003.1364666395.0000000001268000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000003.00000003.1368380092.0000000001268000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000003.00000003.1290044776.0000000001268000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWyi
Source: firefox.exe, 00000013.00000002.3150464836.000001E96E612000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllf
Source: firefox.exe, 00000013.00000002.3150464836.000001E96E600000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3145220083.000001D1D256A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3149892255.000001D1D2DE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3145635273.000002809248A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.1569605746.0000026CB0D16000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 00000013.00000002.3149809687.000001E96E51C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.1554326719.0000026CBA98D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: firefox.exe, 00000014.00000002.3149892255.000001D1D2DE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllre
Source: firefox.exe, 00000013.00000002.3146051203.000001E96E15A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: firefox.exe, 00000016.00000002.3146726718.0000028092510000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 00000018.00000002.1569605746.0000026CB0CF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: random.exe, 00000003.00000003.1284849267.000000000108B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3150464836.000001E96E612000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3149892255.000001D1D2DE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\random.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

Code function: 20_2_000001D1D2D82377 rdtsc

20_2_000001D1D2D82377

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_0072EAA2 BlockInput,

3_2_0072EAA2

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_006E2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_006E2622

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_006B42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

3_2_006B42DE

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_006D4CE8 mov eax, dword ptr fs:[00000030h]

3_2_006D4CE8

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_00710B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

3_2_00710B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006E2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_006E2622
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006D083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_006D083F
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006D09D5 SetUnhandledExceptionFilter,	3_2_006D09D5
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_006D0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_006D0C21

Source: C:\Users\user\Desktop\random.exe

3_2_00711201

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_006F2BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

3_2_006F2BA5

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_0071B226 SendInput,keybd_event,

3_2_0071B226

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_007322DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

3_2_007322DA

Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior

Source: unknown

Process created: C:\Program Files\Mozilla Firefox\firefox.exe "c:\program files\mozilla firefox\firefox.exe" --moz_log sync,prependheader,timestamp,append,maxsize:1,dump:5 --moz_log_file c:\programdata\mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046b0af4a39cb\backgroundupdate.moz_log --backgroundtask backgroundupdate

Source: C:\Users\user\Desktop\random.exe

3_2_00710B62

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_00711663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

3_2_00711663

Source: random.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: random.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_006D0698 cpuid

3_2_006D0698

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_0070D21C GetLocalTime,

3_2_0070D21C

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_0070D27A GetUserNameW,

3_2_0070D27A

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_006EB952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

3_2_006EB952

Source: C:\Users\user\Desktop\random.exe

Code function: 3_2_006B42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

3_2_006B42DE

Stealing of Sensitive Information

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: random.exe PID: 8036, type: MEMORYSTR

Source: random.exe	Binary or memory string: WIN_81
Source: random.exe	Binary or memory string: WIN_XP
Source: random.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: random.exe	Binary or memory string: WIN_XPe
Source: random.exe	Binary or memory string: WIN_VISTA
Source: random.exe	Binary or memory string: WIN_7
Source: random.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: random.exe PID: 8036, type: MEMORYSTR

Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_00731204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		3_2_00731204
Source: C:\Users\user\Desktop\random.exe	Code function: 3_2_00731806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		3_2_00731806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	2 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	Logon Script (Windows)	1 Extra Window Memory Injection	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	1 DLL Side-Loading	NTDS	16 System Information Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 Extra Window Memory Injection	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Process Injection	1 Masquerading	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	2 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
random.exe	31%	Virustotal		Browse
random.exe	39%	ReversingLabs	Win32.Malware.Heuristic
random.exe	100%	Avira	TR/ATRAPS.Gen
SAMPLE	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()	0%	Avira URL Cloud	safe
http://crl3.digice	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	23.215.0.132	true	false	high
star-mini.c10r.facebook.com	31.13.88.35	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
twitter.com	162.159.140.229	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
shavar.prod.mozaws.net	52.36.50.141	true	false	high
services.addons.mozilla.org	151.101.1.91	true	false	high
dyna.wikimedia.org	208.80.154.224	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
contile.services.mozilla.com	34.36.137.203	true	false	high
youtube.com	74.125.136.93	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
a19.dscg10.akamai.net	23.47.204.64	true	false	high
youtube-ui.l.google.com	108.177.122.190	true	false	high
mc.prod.ads.prod.webservices.mozgcp.net	34.36.137.203	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
reddit.map.fastly.net	151.101.1.140	true	false	high
ipv4only.arpa	192.0.0.171	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
normandy.tombstone.experimenter.prod.webservices.mozgcp.net	34.49.51.44	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
www.reddit.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
normandy.cdn.mozilla.net	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 00000016.00000002.3147464709.00000280928C3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://datastudio.google.com/embed/reporting/	firefox.exe, 00000012.00000003.1457913405.000002A5FB323000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1493786625.000002A6038C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1546729045.000002A60866E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1503002316.000002A5FA571000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.mozilla.com0	gmpopenh264.dll.tmp.18.dr	false		high
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	firefox.exe, 00000012.00000003.1470251135.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1479452873.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1581366452.000002A602B76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	firefox.exe, 00000013.00000002.3147600241.000001E96E4E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3146905609.000001D1D28E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3149721848.0000028092906000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.18.dr	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000014.00000002.3146905609.000001D1D2886000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3147464709.000002809288E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2019-09/schema.	firefox.exe, 00000012.00000003.1513908497.000002A607F7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1406639893.000002A607F68000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.leboncoin.fr/	firefox.exe, 00000012.00000003.1548404425.000002A607627000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 00000012.00000003.1393956110.000002A607777000.00000004.00000800.00020000.00000000.sdmp	false		high
https://shavar.services.mozilla.com	firefox.exe, 00000012.00000003.1513712993.000002A607FF3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1547250090.000002A607FF3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1406639893.000002A607FF3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://completion.amazon.com/search/complete?q=	firefox.exe, 00000012.00000003.1348096843.000002A5FA41D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1348810633.000002A5FA460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1347916598.000002A5FA900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1348475873.000002A5FA43E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1348994197.000002A5FA481000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://identity.mozilla.com/ids/ecosystem_telemetryU	firefox.exe, 00000012.00000003.1513420265.000002A6093AF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/breach-details/	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 00000018.00000003.1554326719.0000026CBA98D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()	firefox.exe, 00000018.00000002.1572800145.0000026CBB080000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000012.00000003.1415095574.000002A6077FD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.msn.com	firefox.exe, 00000012.00000003.1567426834.000002A5FCF89000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 00000012.00000003.1348096843.000002A5FA41D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1348810633.000002A5FA460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1347916598.000002A5FA900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1348475873.000002A5FA43E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/addon/	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	firefox.exe, 00000018.00000002.1572800145.0000026CBB080000.00000002.08000000.00040000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
http://exslt.org/sets	firefox.exe, 00000018.00000002.1570781614.0000026CBA830000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://youtube.com/	firefox.exe, 00000012.00000003.1542201750.000002A5FDE76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1522698239.000002A6028FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1537931551.000002A6028FE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://content-signature-2.cdn.mozilla.net/	firefox.exe, 00000012.00000003.1415095574.000002A6077FD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2020-12/schema/=	firefox.exe, 00000012.00000003.1513908497.000002A607F7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1406639893.000002A607F68000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://api.accounts.firefox.com/v1	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
http://exslt.org/common	firefox.exe, 00000018.00000002.1570781614.0000026CBA830000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ok.ru/	firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	firefox.exe, 00000018.00000002.1572800145.0000026CBB080000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/	firefox.exe, 00000012.00000003.1415095574.000002A6077FD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc	firefox.exe, 00000018.00000003.1554326719.0000026CBA9A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
http://exslt.org/dates-and-times	firefox.exe, 00000018.00000003.1563169464.0000026CBA862000.00000004.00000800.00020000.00000000.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 00000012.00000003.1356858568.000002A5FA8C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1455803989.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1469015256.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1458065839.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	firefox.exe, 00000012.00000003.1406639893.000002A607F68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3146905609.000001D1D280A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3147464709.000002809280C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1283601	firefox.exe, 00000012.00000003.1457839024.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1457551416.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.bbc.co.uk/	firefox.exe, 00000012.00000003.1548404425.000002A607627000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/firefox/addon/to-google-translate/	firefox.exe, 00000012.00000003.1545630590.000002A609388000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000016.00000002.3147464709.00000280928C3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:	firefox.exe, 00000012.00000003.1539201560.000002A6023A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1522869551.000002A6023A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1532320550.000002A6023A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1394997551.000002A6023A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1266220	firefox.exe, 00000012.00000003.1457839024.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1457551416.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 00000012.00000003.1496306445.000002A5FC37D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1582410138.000002A5FC377000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 00000012.00000003.1545630590.000002A609388000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://youtube.com/account?=	recovery.jsonlz4.tmp.18.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	firefox.exe, 00000012.00000003.1512862218.000002A609467000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	firefox.exe, 00000013.00000002.3147600241.000001E96E4E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3146905609.000001D1D28E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3149721848.0000028092906000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.18.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	firefox.exe, 00000013.00000002.3147600241.000001E96E4E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3146905609.000001D1D28E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3149721848.0000028092906000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.18.dr	false		high
http://crl3.digice	firefox.exe, 00000012.00000003.1579430225.000002A5FA18F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1581600054.000002A5FA18F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	firefox.exe, 00000018.00000003.1554326719.0000026CBA9A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 00000012.00000003.1393956110.000002A607777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3146905609.000001D1D2812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3147464709.0000028092813000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1548404425.000002A607627000.00000004.00000800.00020000.00000000.sdmp	false		high
https://youtube.com/account?=https://accounts.google.co	firefox.exe, 00000016.00000002.3145190571.0000028092470000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.	places.sqlite-wal.18.dr	false		high
https://youtube.com/account?=https://accounts.google.co0nX	firefox.exe, 00000013.00000002.3147234489.000001E96E3C0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://exslt.org/strings	firefox.exe, 00000018.00000002.1568104419.0000026CAF00A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
http://a9.com/-/spec/opensearch/1.0/	firefox.exe, 00000012.00000003.1522698239.000002A6028F0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	prefs-1.js.18.dr	false		high
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/user/dashboard	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/about	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
http://mozilla.org/MPL/2.0/.	firefox.exe, 00000012.00000003.1551225044.000002A5FD38A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1413847565.000002A5FC3E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1356392939.000002A5FB93F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1413847565.000002A5FC384000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1507001384.000002A5FA466000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1417205369.000002A5FC36D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1518830330.000002A5FB95B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1545099213.000002A5FDDF6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1496306445.000002A5FC37D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1575377818.000002A5FA462000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1551225044.000002A5FD39B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1357086577.000002A5FAF77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1417205369.000002A5FC343000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1356096534.000002A5FB956000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1506030581.000002A5FC368000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1411357732.000002A6037CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1479452873.000002A602B56000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1582410138.000002A5FC377000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1470251135.000002A602B5B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1464810344.000002A5FC157000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1515545241.000002A5FBFE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.bellmedia.c	firefox.exe, 00000012.00000003.1567426834.000002A5FCF89000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com	firefox.exe, 00000012.00000003.1567426834.000002A5FCF89000.00000004.00000800.00020000.00000000.sdmp	false		high
https://coverage.mozilla.org	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	firefox.exe, 00000018.00000002.1572800145.0000026CBB080000.00000002.08000000.00040000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	gmpopenh264.dll.tmp.18.dr	false		high
https://www.zhihu.com/	firefox.exe, 00000012.00000003.1567847917.000002A5FCE8F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://a9.com/-/spec/opensearch/1.1/	firefox.exe, 00000012.00000003.1522698239.000002A6028F0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 00000012.00000003.1470251135.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1479452873.000002A602B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1581366452.000002A602B76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://blocked.cdn.mozilla.net/	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored	firefox.exe, 00000018.00000003.1554326719.0000026CBA98D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2019-09/schema	firefox.exe, 00000012.00000003.1394687864.000002A607652000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1534971733.000002A60764D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://developer.mozilla.org/en/docs/DOM:element.addEventListener	firefox.exe, 00000018.00000003.1554326719.0000026CBA98D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://outlook.live.com/default.aspx?rru=compose&to=%s	firefox.exe, 00000012.00000003.1476620432.000002A5FA765000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1525053634.000002A5FA773000.00000004.00000800.00020000.00000000.sdmp	false		high
https://identity.mozilla.com/apps/relay	firefox.exe, 00000012.00000003.1514341461.000002A6046ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1559370428.000002A6046F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mozilla.cloudflare-dns.com/dns-query	firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	firefox.exe, 00000012.00000003.1562468073.000002A5FD3B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1551135323.000002A5FD3A7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1678448	firefox.exe, 00000012.00000003.1457839024.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1457551416.000002A5FB32E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 00000012.00000003.1356858568.000002A5FA8C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1455803989.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1469015256.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1458065839.000002A5FA8EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1476620432.000002A5FA765000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1525053634.000002A5FA773000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/firefox/addon/reddit-enhancement-suite/	firefox.exe, 00000012.00000003.1545630590.000002A609388000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 00000012.00000003.1534971733.000002A607699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.1547909331.000002A60776B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3147085323.000001E96E300000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3146315161.000001D1D26A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3146846711.0000028092610000.00000002.10000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
151.101.1.91	services.addons.mozilla.org	United States	54113	FASTLYUS	false
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.107.243.93	push.services.mozilla.com	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.49.51.44	normandy.tombstone.experimenter.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.36.137.203	contile.services.mozilla.com	United States	2686	ATGS-MMD-ASUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
52.36.50.141	shavar.prod.mozaws.net	United States	16509	AMAZON-02US	false
74.125.136.93	youtube.com	United States	15169	GOOGLEUS	false
23.47.204.64	a19.dscg10.akamai.net	United States	20940	AKAMAI-ASN1EU	false
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1665561
Start date and time:	2025-04-15 17:11:46 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	random.exe
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@37/48@78/14
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 96% Number of executed functions: 50 Number of non-executed functions: 296
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.76.34.6, 142.250.9.102, 142.250.9.113, 142.250.9.101, 142.250.9.139, 142.250.9.138, 142.250.9.100, 74.125.21.95, 74.125.138.95, 74.125.21.113, 74.125.21.100, 74.125.21.138, 74.125.21.139, 74.125.21.102, 74.125.21.101, 4.245.163.56
Excluded domains from analysis (whitelisted): fs.microsoft.com, ciscobinary.openh264.org, slscr.update.microsoft.com, incoming.telemetry.mozilla.org, ctldl.windowsupdate.com, aus5.mozilla.org, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, fe3cr.delivery.mp.microsoft.com, c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com, ax-ring.msedge.net, redirector.gvt1.com, safebrowsing.googleapis.com, prod.fs.microsoft.com.akadns.net, c.pki.goog, location.services.mozilla.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
34.49.51.44	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	3oKlYkFDuK.exe	Get hash	malicious	Credential Flusher	Browse
151.101.1.91	https://themobilemasters.com.au	Get hash	malicious	Unknown	Browse
	https://themobilemasters.com.au	Get hash	malicious	Unknown	Browse
	http://nsubddse.proacteye.com/rd/4EaTnI6331JzCB727gwacifhvrr249LTLITTNGHRGELJP571410HIPC41923S12?NRpaAYQBQEaiWcfZy-iDxOnKpwTM-vPqDpt	Get hash	malicious	Unknown	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	3oKlYkFDuK.exe	Get hash	malicious	Credential Flusher	Browse
	-Lysisfinancial_Executives_Schedule 6cLKF4B .svg	Get hash	malicious	HTMLPhisher	Browse
	letter2481-fitocosmetic.pdf	Get hash	malicious	HTMLPhisher	Browse
	letter2481-fitocosmetic.pdf	Get hash	malicious	HTMLPhisher	Browse
	http://alliancemachine.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	EFT Remittance_(Bobd)CQDM.htm	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
34.149.100.209	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
34.36.137.203	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse
34.160.144.191	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
star-mini.c10r.facebook.com	https://compliancetracking.cfainstitute.org/amc-form?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImU5OGFkMTQzLWM0YzEtNDIwYi05OWQ4LTRlODM2ZmFiNjQ4NyIsIm5iZiI6MTc0NDY2NTI5OSwiZXhwIjoxNzQ1MjcwMDk5LCJpYXQiOjE3NDQ2NjUyOTksImlzcyI6Imh0dHBzOi8vc3RhbmRhcmRzY29tcGxpYW5jZXRyYWNraW5nYXBpLmNmYWluc3RpdHV0ZS5vcmcvIn0.l4SBJnn8huVpuJVgzl7oq2riSJ7NbE6i7-Sgdch3E3s	Get hash	malicious	Unknown	Browse	31.13.65.36
	http://universityorthony.com	Get hash	malicious	Unknown	Browse	31.13.88.35
	https://149.154.157.69/+CSCOE+/logon.html?q=BzFdUyAIO1l2Dy4KJSEyQRNXAiweJ0gIHjI%3D	Get hash	malicious	Unknown	Browse	157.240.229.35
	https://we.tl/t-IBThwlthXD?trk=dw_recover_expired_transfer&utm_campaign=dw_recover_expired_transfer&utm_medium=email&utm_source=wt_sendgrid&utm_template=pre_deletion_72hrs_email	Get hash	malicious	Unknown	Browse	157.240.229.35
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse	157.240.229.35
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse	31.13.88.35
	6499151747.pdf	Get hash	malicious	Unknown	Browse	57.144.132.1
	QuarantineMessage.zip	Get hash	malicious	HTMLPhisher	Browse	31.13.65.36
	https://webshuaw.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	57.144.162.1
twitter.com	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse	172.66.0.227
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse	172.66.0.227
	https://arc.ht/	Get hash	malicious	Unknown	Browse	162.159.140.229
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	162.159.140.229
example.org	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse	23.215.0.132
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse	23.215.0.132
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	23.215.0.132
	random.exe	Get hash	malicious	Credential Flusher	Browse	96.7.128.192
	random.exe	Get hash	malicious	Credential Flusher	Browse	23.215.0.133
	random.exe	Get hash	malicious	Credential Flusher	Browse	23.215.0.132
	random.exe	Get hash	malicious	Credential Flusher	Browse	96.7.128.186
	random.exe	Get hash	malicious	Credential Flusher	Browse	96.7.128.186
	random.exe	Get hash	malicious	Credential Flusher	Browse	23.215.0.133

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	https://app.any.run/tasks/73c453d2-b4e8-4d61-94da-f398f08adabb	Get hash	malicious	Unknown	Browse	151.101.1.229
	https://compliancetracking.cfainstitute.org/amc-form?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImU5OGFkMTQzLWM0YzEtNDIwYi05OWQ4LTRlODM2ZmFiNjQ4NyIsIm5iZiI6MTc0NDY2NTI5OSwiZXhwIjoxNzQ1MjcwMDk5LCJpYXQiOjE3NDQ2NjUyOTksImlzcyI6Imh0dHBzOi8vc3RhbmRhcmRzY29tcGxpYW5jZXRyYWNraW5nYXBpLmNmYWluc3RpdHV0ZS5vcmcvIn0.l4SBJnn8huVpuJVgzl7oq2riSJ7NbE6i7-Sgdch3E3s	Get hash	malicious	Unknown	Browse	151.101.129.229
	https://bjcgghbjchdgbfbghdgghbjchdgbfbggbfbg.sharefile.eu/share/view/sce3352de88ff40309b639a23a0046fb1	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	151.101.1.55
	SecuriteInfo.com.FileRepMalware.28465.14529.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	SecuriteInfo.com.FileRepMalware.28465.14529.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	http://universityorthony.com	Get hash	malicious	Unknown	Browse	151.101.66.132
	html.html	Get hash	malicious	HTMLPhisher	Browse	151.101.129.229
	Complete via DocuSign_ #Dailycer_Doc. Signature required 4_14_2025.eml	Get hash	malicious	HTMLPhisher	Browse	151.101.2.59
	https://ad.doubleclick.net/clk;265186560;90846275;t;pc=%255BTPAS_ID%255D?//ezipossolution.com/jsent.pk/js/?brenda.linton@martinmlp.com	Get hash	malicious	HTMLPhisher	Browse	151.101.2.132
ATGS-MMD-ASUS	https://compliancetracking.cfainstitute.org/amc-form?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImU5OGFkMTQzLWM0YzEtNDIwYi05OWQ4LTRlODM2ZmFiNjQ4NyIsIm5iZiI6MTc0NDY2NTI5OSwiZXhwIjoxNzQ1MjcwMDk5LCJpYXQiOjE3NDQ2NjUyOTksImlzcyI6Imh0dHBzOi8vc3RhbmRhcmRzY29tcGxpYW5jZXRyYWNraW5nYXBpLmNmYWluc3RpdHV0ZS5vcmcvIn0.l4SBJnn8huVpuJVgzl7oq2riSJ7NbE6i7-Sgdch3E3s	Get hash	malicious	Unknown	Browse	34.54.30.30
	https://149.154.157.69/+CSCOE+/logon.html?q=BzFdUyAIO1l2Dy4KJSEyQRNXAiweJ0gIHjI%3D	Get hash	malicious	Unknown	Browse	34.54.30.30
	xd.mips.elf	Get hash	malicious	Mirai	Browse	34.11.196.178
	xd.i686.elf	Get hash	malicious	Mirai	Browse	57.25.76.85
	xd.arm5.elf	Get hash	malicious	Mirai	Browse	57.5.138.238
	xd.m68k.elf	Get hash	malicious	Mirai	Browse	48.178.122.91
	xd.sh4.elf	Get hash	malicious	Mirai	Browse	48.44.139.73
	xd.x86.elf	Get hash	malicious	Mirai	Browse	32.166.166.29
	xd.arm.elf	Get hash	malicious	Mirai	Browse	51.24.191.84
ATGS-MMD-ASUS	https://compliancetracking.cfainstitute.org/amc-form?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImU5OGFkMTQzLWM0YzEtNDIwYi05OWQ4LTRlODM2ZmFiNjQ4NyIsIm5iZiI6MTc0NDY2NTI5OSwiZXhwIjoxNzQ1MjcwMDk5LCJpYXQiOjE3NDQ2NjUyOTksImlzcyI6Imh0dHBzOi8vc3RhbmRhcmRzY29tcGxpYW5jZXRyYWNraW5nYXBpLmNmYWluc3RpdHV0ZS5vcmcvIn0.l4SBJnn8huVpuJVgzl7oq2riSJ7NbE6i7-Sgdch3E3s	Get hash	malicious	Unknown	Browse	34.54.30.30
	https://149.154.157.69/+CSCOE+/logon.html?q=BzFdUyAIO1l2Dy4KJSEyQRNXAiweJ0gIHjI%3D	Get hash	malicious	Unknown	Browse	34.54.30.30
	xd.mips.elf	Get hash	malicious	Mirai	Browse	34.11.196.178
	xd.i686.elf	Get hash	malicious	Mirai	Browse	57.25.76.85
	xd.arm5.elf	Get hash	malicious	Mirai	Browse	57.5.138.238
	xd.m68k.elf	Get hash	malicious	Mirai	Browse	48.178.122.91
	xd.sh4.elf	Get hash	malicious	Mirai	Browse	48.44.139.73
	xd.x86.elf	Get hash	malicious	Mirai	Browse	32.166.166.29
	xd.arm.elf	Get hash	malicious	Mirai	Browse	51.24.191.84

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fb0aa01abe9d8e4037eb3473ca6e2dca	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	random.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	random.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	random.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	random.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	random.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	random.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	3oKlYkFDuK.exe	Get hash	malicious	Credential Flusher	Browse
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	Q3M4ZKzjxb.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	random.exe	Get hash	malicious	Credential Flusher	Browse
	3oKlYkFDuK.exe	Get hash	malicious	Credential Flusher	Browse

Created / dropped Files

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_9885f803-13ff-420e-aa11-c00010e71f31.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7813
Entropy (8bit):	5.1711085098447045
Encrypted:	false
SSDEEP:	192:Z7KMXzP4tbhbVbTbfbRbObtbyEl7nor+JA6wnSrDtTkd/SE:1PUtNhnzFSJIrdjnSrDhkd/N
MD5:	D182A4F9F745DA1489C6C49EA9436856
SHA1:	0FFD35F23636693AED89D9D3807DC979DD8F36A0
SHA-256:	79EFCA04B498C2A33CD8CF2FF8507A4C608B0CDBE01A5D119ACD9B3B1B56084D
SHA-512:	FD1DB7FB9C6CC011F1289FBD1BED40590FFE54063EA6AD3FF437D58B50AF8DB2FB347E0CCF10A22D07CF4DD6D97971C3DD63B5FE618EB386D506B571658ACE79
Malicious:	false
Preview:	{"type":"uninstall","id":"9885f803-13ff-420e-aa11-c00010e71f31","creationDate":"2025-04-15T16:35:10.837Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"1fca7bd2-7b44-4c45-b0ea-e0486850ce95","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_9885f803-13ff-420e-aa11-c00010e71f31.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7813
Entropy (8bit):	5.1711085098447045
Encrypted:	false
SSDEEP:	192:Z7KMXzP4tbhbVbTbfbRbObtbyEl7nor+JA6wnSrDtTkd/SE:1PUtNhnzFSJIrdjnSrDhkd/N
MD5:	D182A4F9F745DA1489C6C49EA9436856
SHA1:	0FFD35F23636693AED89D9D3807DC979DD8F36A0
SHA-256:	79EFCA04B498C2A33CD8CF2FF8507A4C608B0CDBE01A5D119ACD9B3B1B56084D
SHA-512:	FD1DB7FB9C6CC011F1289FBD1BED40590FFE54063EA6AD3FF437D58B50AF8DB2FB347E0CCF10A22D07CF4DD6D97971C3DD63B5FE618EB386D506B571658ACE79
Malicious:	false
Preview:	{"type":"uninstall","id":"9885f803-13ff-420e-aa11-c00010e71f31","creationDate":"2025-04-15T16:35:10.837Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"1fca7bd2-7b44-4c45-b0ea-e0486850ce95","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	591
Entropy (8bit):	5.095887685854789
Encrypted:	false
SSDEEP:	12:t4ek49oK9VEb1s94td9VEb1s6M3vHS1s94tdS1s6xQXGYD:Fk4Cxb1smcb1sd3vy1sm61shGU
MD5:	D6394B02DF427C8A034D8C6A10C63DBF
SHA1:	85AF6D28874714C88545EEF0804BB90E7506B239
SHA-256:	B34D008B75337EFB61A1DAFC5FD609D8CDAA3321FC0BB18DFE7D0ACAFC766442
SHA-512:	190AD725D84C0A9600E3AFE09AEDA8AC508196B27389D68E7F83D8F63776F02DA24FAA77D0B84C41FF748D80C5161AD0DC24C6ECCF12B0F9DB73A72BF15E166B
Malicious:	false
Preview:	..***....2025-04-15 15:13:02.421000 UTC - [(null) 5940: Main Thread]: I/Logger Opening log..2025-04-15 15:13:03.370000 UTC - [Parent 5940: Main Thread]: D/Dump [Backstage.Dump] console.error: BackgroundUpdate: ..2025-04-15 15:13:03.370000 UTC - [Parent 5940: Main Thread]: D/Dump [Backstage.Dump] runBackgroundTask: backgroundupdate..2025-04-15 15:13:03.455000 UTC - [Parent 5940: Main Thread]: D/Dump [Backstage.Dump] console.error: BackgroundUpdate: ..2025-04-15 15:13:03.455000 UTC - [Parent 5940: Main Thread]: D/Dump [Backstage.Dump] runBackgroundTask: another instance is running..

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\jumpListCache\pV+3TL7Nu3EP5juvr_gPjg==.ico

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	MS Windows icon resource - 1 icon, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 24 bits/pixel
Category:	modified
Size (bytes):	490
Entropy (8bit):	7.246483341090937
Encrypted:	false
SSDEEP:	12:l8v/7J2T+gwjz+vdzLSMO9mj253UT3BcHXhJo:82CgwS//O91iT3BUXh6
MD5:	BD9751DFFFEFFA2154CC5913489ED58C
SHA1:	1C9230053C45CA44883103A6ACFDF49AC53ABF45
SHA-256:	834C4F18E96CFDAA395246183DE76032F1B77886764CEEBE52F6A146FA4D4C3B
SHA-512:	01072F60F4B2489BB84639A6179A82A3EA90A31C1AD61D30EF27800C3114DB5E45662583E1C0B5382F51635DC14372EFC71DCD069999D6B21A5D256C70697790
Malicious:	false
Preview:	.......................PNG........IHDR................a....IDAT8O...1P......p....d1.....v)......p.nXM.t.H.(.......B$..}_G.{.......:uN...=......s\|.$...`0.....dl6.>>>p.\.v;z.......F.a:.2..D.V.....V..n...g.z.X..C...v.......=.H..d..P...i.."...X,.B...h...xyy.V....I$..J%r....6....Z-:...P..J..........\|>'...P.\&.....l6....N5...Z.x<.....h.z..'@...L&.F..'.Jq<...m6.OOO.....$..r:.......v..V..ze.\.p.R..t.Z.....r...B...3.B..0...TE".p8.D0..`2.D.j...h..n...wF...........#......O....IEND.B`.

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\tmpaddon

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	453023
Entropy (8bit):	7.997718157581587
Encrypted:	true
SSDEEP:	12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5:	85430BAED3398695717B0263807CF97C
SHA1:	FFFBEE923CEA216F50FCE5D54219A188A5100F41
SHA-256:	A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
SHA-512:	06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
Malicious:	false
Preview:	PK.........bN...R..........gmpopenh264.dll..\|.E.0.=..I.....1....4f1q.`.........q.....'+....hm{.z..o_.{w........$..($A!...\|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....\|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`............ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\...........-i.K.I..4.a..6.....Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N..}..).3.N%.!..q........^I.m..~...6.#.~+.....A...I]r...x...<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..\|c.1.cUkM.&.Qn]..a]t.h...!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:\|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2KFZ1YA7SAB0TC6PSPTU.temp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	5488
Entropy (8bit):	3.3277088827322876
Encrypted:	false
SSDEEP:	24:Shdf7dAcTIUx2dWoM150LN8zmsydf7dAcswM+bpoqdWoM150LFX1RgmsEdf7dAcu:adCNUgdwRzUdCz6BdwHCdCzadwl1
MD5:	A686348E9677EEAF3A99224687F404C9
SHA1:	63976D45EFEAEC8F141614A544C4902A431D5E45
SHA-256:	D49C3B4FAA0F1DE1FDA17D2F0D63D26C7B601F7AAEC6A7962D6F6003BA7DBAF2
SHA-512:	A78E71C5FCDF40695A21938EE62212D64F388F655106CB5B651FE5A2ADB666D331A678C7BB66FBFF604B2376EB9FD3C95CD8FB05FF2F718823A4D0EA77F27F72
Malicious:	false
Preview:	...................................FL..................F.@.. ...p.......................S...........................P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Z.y....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1.....CW.X..MOZILL~1..P......CW}W.Z.y............................>.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.....b.2..S..<W,. .firefox.exe.H......CW}W.Z.y..............................f.i.r.e.f.o.x...e.x.e.......[...............-.......Z...........c..c.....C:\Program Files\Mozilla Firefox\firefox.exe....O.p.e.n. .a. .n.e.w. .b.r.o.w.s.e.r. .t.a.b.....-.n.e.w.-.t.a.b. .a.b.o.u.t.:.b.l.a.n.k.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.\.f.i.r.e.f.o.x...e.x.e.........%ProgramFiles%\Mozilla Firefox\firefox.exe................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\40371339ad31a7e6.customDestinations-ms (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	5488
Entropy (8bit):	3.3277088827322876
Encrypted:	false
SSDEEP:	24:Shdf7dAcTIUx2dWoM150LN8zmsydf7dAcswM+bpoqdWoM150LFX1RgmsEdf7dAcu:adCNUgdwRzUdCz6BdwHCdCzadwl1
MD5:	A686348E9677EEAF3A99224687F404C9
SHA1:	63976D45EFEAEC8F141614A544C4902A431D5E45
SHA-256:	D49C3B4FAA0F1DE1FDA17D2F0D63D26C7B601F7AAEC6A7962D6F6003BA7DBAF2
SHA-512:	A78E71C5FCDF40695A21938EE62212D64F388F655106CB5B651FE5A2ADB666D331A678C7BB66FBFF604B2376EB9FD3C95CD8FB05FF2F718823A4D0EA77F27F72
Malicious:	false
Preview:	...................................FL..................F.@.. ...p.......................S...........................P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Z.y....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1.....CW.X..MOZILL~1..P......CW}W.Z.y............................>.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.....b.2..S..<W,. .firefox.exe.H......CW}W.Z.y..............................f.i.r.e.f.o.x...e.x.e.......[...............-.......Z...........c..c.....C:\Program Files\Mozilla Firefox\firefox.exe....O.p.e.n. .a. .n.e.w. .b.r.o.w.s.e.r. .t.a.b.....-.n.e.w.-.t.a.b. .a.b.o.u.t.:.b.l.a.n.k.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.\.f.i.r.e.f.o.x...e.x.e.........%ProgramFiles%\Mozilla Firefox\firefox.exe................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	5488
Entropy (8bit):	3.3277088827322876
Encrypted:	false
SSDEEP:	24:Shdf7dAcTIUx2dWoM150LN8zmsydf7dAcswM+bpoqdWoM150LFX1RgmsEdf7dAcu:adCNUgdwRzUdCz6BdwHCdCzadwl1
MD5:	A686348E9677EEAF3A99224687F404C9
SHA1:	63976D45EFEAEC8F141614A544C4902A431D5E45
SHA-256:	D49C3B4FAA0F1DE1FDA17D2F0D63D26C7B601F7AAEC6A7962D6F6003BA7DBAF2
SHA-512:	A78E71C5FCDF40695A21938EE62212D64F388F655106CB5B651FE5A2ADB666D331A678C7BB66FBFF604B2376EB9FD3C95CD8FB05FF2F718823A4D0EA77F27F72
Malicious:	false
Preview:	...................................FL..................F.@.. ...p.......................S...........................P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Z.y....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1.....CW.X..MOZILL~1..P......CW}W.Z.y............................>.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.....b.2..S..<W,. .firefox.exe.H......CW}W.Z.y..............................f.i.r.e.f.o.x...e.x.e.......[...............-.......Z...........c..c.....C:\Program Files\Mozilla Firefox\firefox.exe....O.p.e.n. .a. .n.e.w. .b.r.o.w.s.e.r. .t.a.b.....-.n.e.w.-.t.a.b. .a.b.o.u.t.:.b.l.a.n.k.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.\.f.i.r.e.f.o.x...e.x.e.........%ProgramFiles%\Mozilla Firefox\firefox.exe................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\A2OZ3FX79SMOWPEHK9KZ.temp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	5488
Entropy (8bit):	3.3277088827322876
Encrypted:	false
SSDEEP:	24:Shdf7dAcTIUx2dWoM150LN8zmsydf7dAcswM+bpoqdWoM150LFX1RgmsEdf7dAcu:adCNUgdwRzUdCz6BdwHCdCzadwl1
MD5:	A686348E9677EEAF3A99224687F404C9
SHA1:	63976D45EFEAEC8F141614A544C4902A431D5E45
SHA-256:	D49C3B4FAA0F1DE1FDA17D2F0D63D26C7B601F7AAEC6A7962D6F6003BA7DBAF2
SHA-512:	A78E71C5FCDF40695A21938EE62212D64F388F655106CB5B651FE5A2ADB666D331A678C7BB66FBFF604B2376EB9FD3C95CD8FB05FF2F718823A4D0EA77F27F72
Malicious:	false
Preview:	...................................FL..................F.@.. ...p.......................S...........................P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Z.y....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1.....CW.X..MOZILL~1..P......CW}W.Z.y............................>.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.....b.2..S..<W,. .firefox.exe.H......CW}W.Z.y..............................f.i.r.e.f.o.x...e.x.e.......[...............-.......Z...........c..c.....C:\Program Files\Mozilla Firefox\firefox.exe....O.p.e.n. .a. .n.e.w. .b.r.o.w.s.e.r. .t.a.b.....-.n.e.w.-.t.a.b. .a.b.o.u.t.:.b.l.a.n.k.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.\.f.i.r.e.f.o.x...e.x.e.........%ProgramFiles%\Mozilla Firefox\firefox.exe................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\syjwmoxm.MozillaBackgroundTask-308046B0AF4A39CB-backgroundupdate\compatibility.ini

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Windows WIN.INI
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.391255133360986
Encrypted:	false
SSDEEP:	3:tZAQUsjcmktYWwktUp/UNE2aT/P4WX1rDZjrEFwHQ3ZjrEFwslyy:JWtYWXtUp8babN1rDVEFycVEFL
MD5:	3FB561547A46AF02D6B00F86DC370634
SHA1:	914867E4C763611B441835A3FC0082359FBF7277
SHA-256:	5393F0E8D90EE6A26EAC13B81B83EDC0637487B3E427175021D7EC4CDE8E34A7
SHA-512:	0E05486A6B6AD65D3A95FCFE46BE6687DD47E311374F11DE89F9CFB8C301951D6BFE43FA24851A3E759B6F8AF69A5F593568FB61F576AB52941F6B2B6EE54BC8
Malicious:	false
Preview:	[Compatibility]..LastVersion=118.0.1_20230927232528/20230927232528..LastOSABI=WINNT_x86_64-msvc..LastPlatformDir=C:\Program Files\Mozilla Firefox..LastAppDir=C:\Program Files\Mozilla Firefox\browser..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\syjwmoxm.MozillaBackgroundTask-308046B0AF4A39CB-backgroundupdate\prefs.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	484
Entropy (8bit):	4.9298852998260685
Encrypted:	false
SSDEEP:	12:j8sGCS2XKHYX6UlTSU9Mylau1yIV6YRNCL4MwR6VLR:XnKH66UZ9Blz1zV61LhR
MD5:	7A4F0DF57B5339946326F2633494C57E
SHA1:	B700471A5D8C39F031EA6DD7BE2BDFD72FCB1A0B
SHA-256:	353D9B2C2ADDD06FCCD54FE21E27FABECBD458364D4F43B8990E5FB2892EB9AE
SHA-512:	E9D07A631A168F2144205825A00C3EDA1297F37B69EEE668002EBF8B5A83A99D13A478305353AEAFAA502E9406476241C066AC822D4E6F06BCAC9AC11F0C6D48
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("browser.launcherProcess.enabled", true);..user_pref("toolkit.startup.last_success", 1744729982);..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.921467041646676
Encrypted:	false
SSDEEP:	48:YnSwkmrOVPUFRbOdwNIOdoWLEWLtkDZuwpx5FBvipA6kb92the6LuhakNyZr9jxE:8S+OVPUFRbOdwNIOdYpjvY1Q6Lp18P
MD5:	8388781F8A5A7F55ADC0098C3EE195C4
SHA1:	1D5DE5C869DB214F8EBA65FDFA28DE817069AE23
SHA-256:	A7EF936450EF45D57087CE68F13E387C8F9F095A719293AA20A68F6E9FBFB6BB
SHA-512:	C1A0F279FED8BF1FE3F92D203FB61CB25CA203F696E8775E0FED8BB6756F3A5B5E5AC090E475DB0FD5BF4088A9755022AD552947DE82202D8778FC498EE225F4
Malicious:	false
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"3ba649bc-be47-4b92-8762-21cab57bda3b","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-04T13:40:33.697Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.921467041646676
Encrypted:	false
SSDEEP:	48:YnSwkmrOVPUFRbOdwNIOdoWLEWLtkDZuwpx5FBvipA6kb92the6LuhakNyZr9jxE:8S+OVPUFRbOdwNIOdYpjvY1Q6Lp18P
MD5:	8388781F8A5A7F55ADC0098C3EE195C4
SHA1:	1D5DE5C869DB214F8EBA65FDFA28DE817069AE23
SHA-256:	A7EF936450EF45D57087CE68F13E387C8F9F095A719293AA20A68F6E9FBFB6BB
SHA-512:	C1A0F279FED8BF1FE3F92D203FB61CB25CA203F696E8775E0FED8BB6756F3A5B5E5AC090E475DB0FD5BF4088A9755022AD552947DE82202D8778FC498EE225F4
Malicious:	false
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"3ba649bc-be47-4b92-8762-21cab57bda3b","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-04T13:40:33.697Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 22422 bytes
Category:	dropped
Size (bytes):	5308
Entropy (8bit):	6.599374203470186
Encrypted:	false
SSDEEP:	96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMg6Uhm:zTx2x2t0FDJ4NpkuvjdeplTMohm
MD5:	EB56C2F4DA9435F3D5574161F414CD17
SHA1:	74A8FC3EC0559740FD9D835B638354985E2DEAB6
SHA-256:	394E803D5FF8E156DFA7D15E96B51A683F4624A1BCF88EAA532399AC2C9B0966
SHA-512:	DF90568D191C757392FB85BDDA5333C7FE7E3BB370C5DE8C50DD810B938D732E39B5608FB4494CAADAE99E1601989FDFC0FEBDCF70F27FFE581F904170A81E0F
Malicious:	false
Preview:	mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 22422 bytes
Category:	dropped
Size (bytes):	5308
Entropy (8bit):	6.599374203470186
Encrypted:	false
SSDEEP:	96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMg6Uhm:zTx2x2t0FDJ4NpkuvjdeplTMohm
MD5:	EB56C2F4DA9435F3D5574161F414CD17
SHA1:	74A8FC3EC0559740FD9D835B638354985E2DEAB6
SHA-256:	394E803D5FF8E156DFA7D15E96B51A683F4624A1BCF88EAA532399AC2C9B0966
SHA-512:	DF90568D191C757392FB85BDDA5333C7FE7E3BB370C5DE8C50DD810B938D732E39B5608FB4494CAADAE99E1601989FDFC0FEBDCF70F27FFE581F904170A81E0F
Malicious:	false
Preview:	mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.04905141882491872
Encrypted:	false
SSDEEP:	24:DLSvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DKwae+QtMImelekKDa5
MD5:	8736A542C5564A922C47B19D9CC5E0F2
SHA1:	CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A
SHA-256:	97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
SHA-512:	99777325893DC7A95FD49B2DA18D32D65F97CC7A8E482D78EDC32F63245457FA5A52750800C074D552D20B6A215604161FDC88763D93C76A8703470C3064196B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\store.json.mozlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\store.json.mozlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.1867463390487
Encrypted:	false
SSDEEP:	768:JI4avfWX94O6L4x4ME454N4ohvM4T4Pia4T4I4t54U:JI4KvG
MD5:	98875950B62B398FFE70C0A8D0998017
SHA1:	CFCFFF938402E53D341FE392E25D2E6C557E548F
SHA-256:	1B445C7E12712026D4E663426527CE58FD221D2E26545AEA699E67D60F16E7F0
SHA-512:	728FF6FF915A45B44D720F41F9545F41F1BF5FB218D58073BD27DB19145D2225488988BE80FB0F712922D7B661E1A64448E3F71F09A1480B6F20BD2480888ABF
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{7a5650ac-9a89-4807-a040-9f0832bf39a9}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.1867463390487
Encrypted:	false
SSDEEP:	768:JI4avfWX94O6L4x4ME454N4ohvM4T4Pia4T4I4t54U:JI4KvG
MD5:	98875950B62B398FFE70C0A8D0998017
SHA1:	CFCFFF938402E53D341FE392E25D2E6C557E548F
SHA-256:	1B445C7E12712026D4E663426527CE58FD221D2E26545AEA699E67D60F16E7F0
SHA-512:	728FF6FF915A45B44D720F41F9545F41F1BF5FB218D58073BD27DB19145D2225488988BE80FB0F712922D7B661E1A64448E3F71F09A1480B6F20BD2480888ABF
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{7a5650ac-9a89-4807-a040-9f0832bf39a9}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Q3M4ZKzjxb.exe, Detection: malicious, Browse Filename: Q3M4ZKzjxb.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: 3oKlYkFDuK.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Q3M4ZKzjxb.exe, Detection: malicious, Browse Filename: Q3M4ZKzjxb.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: 3oKlYkFDuK.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.0733269325245793
Encrypted:	false
SSDEEP:	12:DBl/A0OWla0mwPxRymgObsCVR45wcYR4fmnsCVR4zki:DLhesh7Owd4+ji
MD5:	3506EFC4CA92DA5E90969D73CA0AF089
SHA1:	D96D535E486D50144BB94CD33EFD506C298A1F81
SHA-256:	937A3B17BDEEA5FDCB6825B3BDF7DB817598038244243EEA0A76B934032CE6DF
SHA-512:	CDA747359286DDF3F10BF0983773B3DC335802ABE1F5C8558AE939C4970A260A0BC373A4032F5CAD4F437D5B233621B6CE7C13353CAFF82980FB44EBE623140D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......~s..F~s........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.039339095644780435
Encrypted:	false
SSDEEP:	3:GHlhV2gc5XXJD0idlhV2gc5XXJD0X/ol8a9//Ylll4llqlyllel4lt:G7V2d15fhV2d15TL9XIwlio
MD5:	D63DA0345966ED3C29F00DE5A98B4325
SHA1:	A0256127F6F4D2478D8E74957EAD781B9DD87747
SHA-256:	89CB8216EF87F4F5BB510976FDBD90CDCF527C356DFA6E00B04459A11A48CC8F
SHA-512:	14E5ED4CC60E921B57ABB9DE9C69F86AEC4A90A6DA2C3929BAAFE6BCEE29E84F231EC9F36412F6F7C01241E699EC6D08E387793B0FEF922B2A86B0E7010F37E1
Malicious:	false
Preview:	..-........................L#z.o.....9.l&..$?.,...-........................L#z.o.....9.l&..$?.,.........................................................'...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	163992
Entropy (8bit):	0.1334648784109391
Encrypted:	false
SSDEEP:	24:KgfkXLxsZ+Fc2zxsMlCXsMzqCFZ7pCF6C5WUCuSCCQE/HaaKCc7RCGOxsaD2KwlX:LM9Qqc2VJCXs4qLWeJa1VyjuZk
MD5:	F40DDA81E01AAEE910B07A7A5046DFD6
SHA1:	175D5F65106F551B71AA863A41362AEC57326251
SHA-256:	72A10E7295CC24A15EC6BA82CD0D7E7C0581F2A3F45F46AE6053A9B2CB2098B4
SHA-512:	B70CA62F74FE8F7F11034DBAF8BA46F604E351C5B63972CB4C4724C7F798B2BA69CC924A95FD13026372B75A60C2665A96F902BD48FE008625F66256492E5892
Malicious:	false
Preview:	7....-...............9.l......y.............9.l.. .r...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	13252
Entropy (8bit):	5.4744256767176696
Encrypted:	false
SSDEEP:	192:DAHJ0FAtEnPOeRnLYbBp6YJ0aX+4N6SEXKV+OuNpI5RHWNBw8sbSl:1DeFJUtNXqHEwR0
MD5:	B92E59F3D4E1234D68D8C3B366E5A40F
SHA1:	D8825D9E5D42A9623CF01713BF0C97C7C8E83FA4
SHA-256:	5ACFDC25887A0A1DB38D7F49F7F8FDD9A49EC1F40EBA5757CF220BAE098E42F2
SHA-512:	0C9556534D93310ACDFAB6AB6F8A85EE444CA1C6D68E6AEAF2680776972F9021E88407A99CB35EB5AFEF17CF15E51508CD5A33C5B131B1AC7FC30DAC513B80FD
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.lastInstalledTaskVersion", 3);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1744734881);..user_pref("app.update.lastUpdateTime.background-update-timer", 1744734881);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1744734881);..user

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	13252
Entropy (8bit):	5.4744256767176696
Encrypted:	false
SSDEEP:	192:DAHJ0FAtEnPOeRnLYbBp6YJ0aX+4N6SEXKV+OuNpI5RHWNBw8sbSl:1DeFJUtNXqHEwR0
MD5:	B92E59F3D4E1234D68D8C3B366E5A40F
SHA1:	D8825D9E5D42A9623CF01713BF0C97C7C8E83FA4
SHA-256:	5ACFDC25887A0A1DB38D7F49F7F8FDD9A49EC1F40EBA5757CF220BAE098E42F2
SHA-512:	0C9556534D93310ACDFAB6AB6F8A85EE444CA1C6D68E6AEAF2680776972F9021E88407A99CB35EB5AFEF17CF15E51508CD5A33C5B131B1AC7FC30DAC513B80FD
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.lastInstalledTaskVersion", 3);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1744734881);..user_pref("app.update.lastUpdateTime.background-update-timer", 1744734881);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1744734881);..user

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.04062825861060003
Encrypted:	false
SSDEEP:	3:lSGBl/l/zl9l/AltllPltlnKollzvulJOlzALRWemFxu7TuRjBFbrl58lcV+wgn8:ltBl/lqN1K4BEJYqWvLue3FMOrMZ0l
MD5:	60C09456D6362C6FBED48C69AA342C3C
SHA1:	58B6E22DAA48C75958B429F662DEC1C011AE74D3
SHA-256:	FE1A432A2CD096B7EEA870D46D07F5197E34B4D10666E6E1C357FAA3F2FE2389
SHA-512:	936DBC887276EF07732783B50EAFE450A8598B0492B8F6C838B337EF3E8A6EA595E7C7A2FA4B3E881887FAAE2D207B953A4C65ED8C964D93118E00D3E03882BD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\0c52640a-8e7b-4436-b2ae-60007ad9e118 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	493
Entropy (8bit):	4.945226523935174
Encrypted:	false
SSDEEP:	12:YZFg0QRxPFC05IIVHlW8cOlZGV1AQIYzvZcyBuLZGAvxn:YhaPXISlCOlZGV1AQIWZcy6ZXvx
MD5:	350A972F946170FA4357AA6225034D42
SHA1:	D0366E58946BA0F966DCC262F0600D0B10DC7131
SHA-256:	F2B8E3E971DCFBA2D913C5192E2989DAFE8CB396707FA149A45883C6CFE92036
SHA-512:	E51B7066F823B56642783FB194BFE1E4954EA17E56484A5663E437A13DC02338230B99187155D7F95668B1E8017FC0609494305B138A8E33F8530C39C5A41DAB
Malicious:	false
Preview:	{"type":"health","id":"0c52640a-8e7b-4436-b2ae-60007ad9e118","creationDate":"2025-04-15T16:35:10.878Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"os":{"name":"WINNT","version":"10.0"},"reason":"immediate","sendFailure":{"eUnreachable":1}},"clientId":"1fca7bd2-7b44-4c45-b0ea-e0486850ce95"}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\0c52640a-8e7b-4436-b2ae-60007ad9e118.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	493
Entropy (8bit):	4.945226523935174
Encrypted:	false
SSDEEP:	12:YZFg0QRxPFC05IIVHlW8cOlZGV1AQIYzvZcyBuLZGAvxn:YhaPXISlCOlZGV1AQIWZcy6ZXvx
MD5:	350A972F946170FA4357AA6225034D42
SHA1:	D0366E58946BA0F966DCC262F0600D0B10DC7131
SHA-256:	F2B8E3E971DCFBA2D913C5192E2989DAFE8CB396707FA149A45883C6CFE92036
SHA-512:	E51B7066F823B56642783FB194BFE1E4954EA17E56484A5663E437A13DC02338230B99187155D7F95668B1E8017FC0609494305B138A8E33F8530C39C5A41DAB
Malicious:	false
Preview:	{"type":"health","id":"0c52640a-8e7b-4436-b2ae-60007ad9e118","creationDate":"2025-04-15T16:35:10.878Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"os":{"name":"WINNT","version":"10.0"},"reason":"immediate","sendFailure":{"eUnreachable":1}},"clientId":"1fca7bd2-7b44-4c45-b0ea-e0486850ce95"}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\recovery.baklz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5862 bytes
Category:	dropped
Size (bytes):	1605
Entropy (8bit):	6.362205696796752
Encrypted:	false
SSDEEP:	24:vkSUGlcAxSS1XLXnIrn/pnxQwRclZsWAaUHc5pGHYZxiMntdLWBc0l4oKqslpIVZ:cpOxXonRclZK8504ZxHneOA4lpIH
MD5:	E45DA05B23D4829A46E1A02392A68549
SHA1:	4018908C096B45A816BBBB172BA6304A49F394A7
SHA-256:	58AA77D293BB35C366EEB579C128DE7E2637EFC7715FEB5C69C114340A296E91
SHA-512:	A36ED27F3C1C6DC8A9D0F8468FF8F774643B4DE8CA82D6E7EDE39011A12EA0F16C5F52E6821654027756508B0580F6AB6AE64AB132243D87301701866746CF11
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":7,"docshellUU...D"{cf409b37-8cce-4f62-a448-e2e9b22c32f2}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":8,"persistK..+}],"lastAccessed":1744734885821,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2150633470....dth":1280,"height":1024,"screenX......Y..Aizem..."maximize......BeforeMin...&..workspace:...feabe72c-70fb-448e-b17d-2908167f4eb5","zE..1...Wn..m........k..;....1":{..jUpdate...2,"startTim..P49926...centCrash..B0},".....Dcook.. hod..."addons.mozilla.org","valu...Ab03116d8508741e1c0453eca6046028f71c7c2b904be5e0a0d4686709eb1764f","path":"/","na..a"taarI\|.Recure...,a.Donly..fexpiry...60978,"originA..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5862 bytes
Category:	dropped
Size (bytes):	1605
Entropy (8bit):	6.362205696796752
Encrypted:	false
SSDEEP:	24:vkSUGlcAxSS1XLXnIrn/pnxQwRclZsWAaUHc5pGHYZxiMntdLWBc0l4oKqslpIVZ:cpOxXonRclZK8504ZxHneOA4lpIH
MD5:	E45DA05B23D4829A46E1A02392A68549
SHA1:	4018908C096B45A816BBBB172BA6304A49F394A7
SHA-256:	58AA77D293BB35C366EEB579C128DE7E2637EFC7715FEB5C69C114340A296E91
SHA-512:	A36ED27F3C1C6DC8A9D0F8468FF8F774643B4DE8CA82D6E7EDE39011A12EA0F16C5F52E6821654027756508B0580F6AB6AE64AB132243D87301701866746CF11
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":7,"docshellUU...D"{cf409b37-8cce-4f62-a448-e2e9b22c32f2}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":8,"persistK..+}],"lastAccessed":1744734885821,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2150633470....dth":1280,"height":1024,"screenX......Y..Aizem..."maximize......BeforeMin...&..workspace:...feabe72c-70fb-448e-b17d-2908167f4eb5","zE..1...Wn..m........k..;....1":{..jUpdate...2,"startTim..P49926...centCrash..B0},".....Dcook.. hod..."addons.mozilla.org","valu...Ab03116d8508741e1c0453eca6046028f71c7c2b904be5e0a0d4686709eb1764f","path":"/","na..a"taarI\|.Recure...,a.Donly..fexpiry...60978,"originA..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5862 bytes
Category:	dropped
Size (bytes):	1605
Entropy (8bit):	6.362205696796752
Encrypted:	false
SSDEEP:	24:vkSUGlcAxSS1XLXnIrn/pnxQwRclZsWAaUHc5pGHYZxiMntdLWBc0l4oKqslpIVZ:cpOxXonRclZK8504ZxHneOA4lpIH
MD5:	E45DA05B23D4829A46E1A02392A68549
SHA1:	4018908C096B45A816BBBB172BA6304A49F394A7
SHA-256:	58AA77D293BB35C366EEB579C128DE7E2637EFC7715FEB5C69C114340A296E91
SHA-512:	A36ED27F3C1C6DC8A9D0F8468FF8F774643B4DE8CA82D6E7EDE39011A12EA0F16C5F52E6821654027756508B0580F6AB6AE64AB132243D87301701866746CF11
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":7,"docshellUU...D"{cf409b37-8cce-4f62-a448-e2e9b22c32f2}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":8,"persistK..+}],"lastAccessed":1744734885821,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2150633470....dth":1280,"height":1024,"screenX......Y..Aizem..."maximize......BeforeMin...&..workspace:...feabe72c-70fb-448e-b17d-2908167f4eb5","zE..1...Wn..m........k..;....1":{..jUpdate...2,"startTim..P49926...centCrash..B0},".....Dcook.. hod..."addons.mozilla.org","valu...Ab03116d8508741e1c0453eca6046028f71c7c2b904be5e0a0d4686709eb1764f","path":"/","na..a"taarI\|.Recure...,a.Donly..fexpiry...60978,"originA..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.0836444556178684
Encrypted:	false
SSDEEP:	24:JBwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jnEUo9LXtR+JdkOnohYsl
MD5:	8B40B1534FF0F4B533AF767EB5639A05
SHA1:	63EDB539EA39AD09D701A36B535C4C087AE08CC9
SHA-256:	AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B
SHA-512:	54AF707698CED33C206B1B193DA414D630901762E88E37E99885A50D4D5F8DDC28367C9B401DFE251CF0552B4FA446EE28F78A97C9096AFB0F2898BFBB673B53
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	5.0300441991518925
Encrypted:	false
SSDEEP:	96:ycQMTEr5/lLmI2Ac1zzcxvbw6Kkgrc2Rn27:bTEr5NX0z3DhRe
MD5:	33CCE8BFCFFC23C50BDC931D36D0D881
SHA1:	2BF6BFF655906C1EAE0778A12170F4E2B9EF2055
SHA-256:	DBEF15CAA56FAB9691C53730C69C2E213B7133733AA1DE389FB9DC7D44955CF6
SHA-512:	325346B5C5810DC240F05936E3DA6D26859CF9B43D96240786606661EED6E11E39BFE6BF972E04654DD83FFF4112297278F121ED0FD5D733CCBA89FF3C9AC0BE
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2025-04-15T16:34:28.082Z","profileAgeCreated":1696426830133,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	5.0300441991518925
Encrypted:	false
SSDEEP:	96:ycQMTEr5/lLmI2Ac1zzcxvbw6Kkgrc2Rn27:bTEr5NX0z3DhRe
MD5:	33CCE8BFCFFC23C50BDC931D36D0D881
SHA1:	2BF6BFF655906C1EAE0778A12170F4E2B9EF2055
SHA-256:	DBEF15CAA56FAB9691C53730C69C2E213B7133733AA1DE389FB9DC7D44955CF6
SHA-512:	325346B5C5810DC240F05936E3DA6D26859CF9B43D96240786606661EED6E11E39BFE6BF972E04654DD83FFF4112297278F121ED0FD5D733CCBA89FF3C9AC0BE
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2025-04-15T16:34:28.082Z","profileAgeCreated":1696426830133,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	138
Entropy (8bit):	4.508320854687134
Encrypted:	false
SSDEEP:	3:YGNDhK6c2us1pNGHfYS8dJ8KgfHVEBQulvhJBAuqRrHvN+M4fHhY:YGNTG/SJ8Kgf1Epv54rH0vHhY
MD5:	3D077488383DEAFEC70CCB166831D6F9
SHA1:	86CEAB4DE0AA8937A5AB50CE230C8F8335687B04
SHA-256:	D7AD2ADEBD1FD25B9A749DF2AF8E8FC4185CBBDDF321C07D07FD34C240FDE8CE
SHA-512:	C70A8F7D761DAFA78F38335B4714376C1348C7C781E3D6C98E93481A3469EE5E34D3AA10F4D78C1C48C8CB5C903677E8A74A733299150F8EB3996A64979FF51B
Malicious:	false
Preview:	{"chrome://browser/content/browser.xhtml":{"main-window":{"sizemode":"normal","screenX":"4","screenY":"4","width":"1164","height":"891"}}}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	138
Entropy (8bit):	4.508320854687134
Encrypted:	false
SSDEEP:	3:YGNDhK6c2us1pNGHfYS8dJ8KgfHVEBQulvhJBAuqRrHvN+M4fHhY:YGNTG/SJ8Kgf1Epv54rH0vHhY
MD5:	3D077488383DEAFEC70CCB166831D6F9
SHA1:	86CEAB4DE0AA8937A5AB50CE230C8F8335687B04
SHA-256:	D7AD2ADEBD1FD25B9A749DF2AF8E8FC4185CBBDDF321C07D07FD34C240FDE8CE
SHA-512:	C70A8F7D761DAFA78F38335B4714376C1348C7C781E3D6C98E93481A3469EE5E34D3AA10F4D78C1C48C8CB5C903677E8A74A733299150F8EB3996A64979FF51B
Malicious:	false
Preview:	{"chrome://browser/content/browser.xhtml":{"main-window":{"sizemode":"normal","screenX":"4","screenY":"4","width":"1164","height":"891"}}}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\installs.ini

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	75
Entropy (8bit):	5.019871564321786
Encrypted:	false
SSDEEP:	3:plqfnrYKdNgf3BGvbr:raUJJGvv
MD5:	B320DD987DFA158C4885F09680BC53F3
SHA1:	6A30A8024D72066A9FA44F9D66A6EBB4B7297B22
SHA-256:	90D0687C6EB2863BF1BC1BFF7629AAB7AC37A6F8D9F92B18C837E6AAFC041628
SHA-512:	5D4E0E5429C84E1888781274ABC282F5469CC9766298EB5E10E64B921447346FCF9B799C0679A752BB345985E6BFB185EE2AD9A26370CEFEAFD9D4534EBEF729
Malicious:	false
Preview:	[308046B0AF4A39CB]..Default=Profiles/v6zchhhv.default-release..Locked=1....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Generic INItialization configuration [Profile1]
Category:	dropped
Size (bytes):	456
Entropy (8bit):	5.2518254610458035
Encrypted:	false
SSDEEP:	12:HuBJJGvPO8uLMdI5t+HfIRyMdIZxETR5bWA6WFvy:HuBJJGvPOZLMdIP+HfVMdIZg6EFvy
MD5:	1772B0DE65715A88C0C95F48F29CE24E
SHA1:	954F760C8E287952406DFC7B7402900B08732BCA
SHA-256:	A62E4B3A99BC39A9500CA8BEB47D840D9D1046131DCCFF059F947D36C1D730BD
SHA-512:	D6EF08DFA572A86D825C269910FA04F01D9CAF05246F6B7F247131EB502AB974E6C65FCA908EEA441DE37A8164729E252B7832306B66746FB65D58B8F0DE8EED
Malicious:	false
Preview:	[Install308046B0AF4A39CB]..Default=Profiles/v6zchhhv.default-release..Locked=1....[Profile1]..Name=default..IsRelative=1..Path=Profiles/yiaxs5ej.default..Default=1....[Profile0]..Name=default-release..IsRelative=1..Path=Profiles/v6zchhhv.default-release....[General]..StartWithLastProfile=1..Version=2....[BackgroundTasksProfiles]..MozillaBackgroundTask-308046B0AF4A39CB-backgroundupdate=syjwmoxm.MozillaBackgroundTask-308046B0AF4A39CB-backgroundupdate....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.702601982110703
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	random.exe
File size:	970'240 bytes
MD5:	55c6ac234aca077957813b6a5b94a805
SHA1:	96be80f44a36f24d32819e29af1ebdc1aca9a536
SHA256:	682121d8c7160e46c3c4bc595fdab0346ad08895b95c39f97c3afa8cd7922f8e
SHA512:	c8e8852c9cc026597b77335ec6b818299b219e065e20d8e8532f6f848c37bd7f84b91c9c0e31cd811851a87743bf7f190c1cd36bfeea6d906c74731368f67937
SSDEEP:	24576:ZqDEvCTbMWu7rQYlBQcBiT6rprG8aZLP3IFp:ZTvC/MTQYxsWR7aZDI
TLSH:	BB259E0273D1C062FFAB92334B5AF6515BBC69260123E61F13A81D79BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67FE48C3 [Tue Apr 15 11:53:39 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F0E107DB4C3h
jmp 00007F0E107DADCFh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F0E107DAFADh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F0E107DAF7Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F0E107DDB6Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F0E107DDBB8h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F0E107DDBA1h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x162ec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xeb000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x162ec	0x16400	3dd73622acaad07dfea410490c0f664d	False	0.7012816011235955	data	7.17043751503611	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xeb000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd4718	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd4840	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4968	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c50	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d78	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5c20	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd64c8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd6a30	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8fd8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda080	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4e8	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xda538	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xda634	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdabc8	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb254	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb6e4	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbce0	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc33c	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc7a4	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc8fc	0xd46e	data			1.0004780993711155
RT_GROUP_ICON	0xe9d6c	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xe9de4	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xe9df8	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xe9e0c	0x14	data	English	Great Britain	1.25
RT_VERSION	0xe9e20	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xe9efc	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Version Infos

Description	Data
Translation	0x0809 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 15, 2025 17:12:45.963506937 CEST	49696	443	192.168.2.5	35.190.72.216
Apr 15, 2025 17:12:45.963550091 CEST	443	49696	35.190.72.216	192.168.2.5
Apr 15, 2025 17:12:45.963754892 CEST	49696	443	192.168.2.5	35.190.72.216
Apr 15, 2025 17:12:45.968115091 CEST	49696	443	192.168.2.5	35.190.72.216
Apr 15, 2025 17:12:45.968131065 CEST	443	49696	35.190.72.216	192.168.2.5
Apr 15, 2025 17:12:46.199676991 CEST	443	49696	35.190.72.216	192.168.2.5
Apr 15, 2025 17:12:46.204221010 CEST	49696	443	192.168.2.5	35.190.72.216
Apr 15, 2025 17:12:46.218430042 CEST	49696	443	192.168.2.5	35.190.72.216
Apr 15, 2025 17:12:46.218451023 CEST	443	49696	35.190.72.216	192.168.2.5
Apr 15, 2025 17:12:46.218556881 CEST	49696	443	192.168.2.5	35.190.72.216
Apr 15, 2025 17:12:46.218681097 CEST	443	49696	35.190.72.216	192.168.2.5
Apr 15, 2025 17:12:46.218767881 CEST	49696	443	192.168.2.5	35.190.72.216
Apr 15, 2025 17:12:48.141228914 CEST	49697	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:48.141277075 CEST	443	49697	74.125.136.93	192.168.2.5
Apr 15, 2025 17:12:48.146840096 CEST	49697	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:48.148406029 CEST	49697	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:48.148426056 CEST	443	49697	74.125.136.93	192.168.2.5
Apr 15, 2025 17:12:48.369715929 CEST	443	49697	74.125.136.93	192.168.2.5
Apr 15, 2025 17:12:48.369781971 CEST	49697	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:48.370433092 CEST	443	49697	74.125.136.93	192.168.2.5
Apr 15, 2025 17:12:48.370805025 CEST	49697	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:48.374772072 CEST	49697	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:48.374778986 CEST	443	49697	74.125.136.93	192.168.2.5
Apr 15, 2025 17:12:48.374799967 CEST	49697	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:48.374970913 CEST	443	49697	74.125.136.93	192.168.2.5
Apr 15, 2025 17:12:48.375077963 CEST	49697	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:48.469697952 CEST	49698	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:48.469748020 CEST	443	49698	74.125.136.93	192.168.2.5
Apr 15, 2025 17:12:48.474329948 CEST	49698	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:48.480961084 CEST	49698	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:48.480993986 CEST	443	49698	74.125.136.93	192.168.2.5
Apr 15, 2025 17:12:48.559956074 CEST	49699	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:48.666285992 CEST	80	49699	34.107.221.82	192.168.2.5
Apr 15, 2025 17:12:48.668452024 CEST	49699	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:48.668674946 CEST	49699	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:48.699420929 CEST	443	49698	74.125.136.93	192.168.2.5
Apr 15, 2025 17:12:48.699558973 CEST	49698	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:48.700145960 CEST	443	49698	74.125.136.93	192.168.2.5
Apr 15, 2025 17:12:48.700705051 CEST	49698	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:48.704263926 CEST	49698	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:48.704283953 CEST	443	49698	74.125.136.93	192.168.2.5
Apr 15, 2025 17:12:48.704397917 CEST	49698	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:48.704499006 CEST	443	49698	74.125.136.93	192.168.2.5
Apr 15, 2025 17:12:48.704598904 CEST	49698	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:48.704792023 CEST	49700	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:48.704821110 CEST	443	49700	74.125.136.93	192.168.2.5
Apr 15, 2025 17:12:48.704879045 CEST	49700	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:48.706275940 CEST	49700	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:48.706293106 CEST	443	49700	74.125.136.93	192.168.2.5
Apr 15, 2025 17:12:48.774892092 CEST	80	49699	34.107.221.82	192.168.2.5
Apr 15, 2025 17:12:48.776213884 CEST	80	49699	34.107.221.82	192.168.2.5
Apr 15, 2025 17:12:48.821214914 CEST	49701	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:48.821257114 CEST	443	49701	34.36.137.203	192.168.2.5
Apr 15, 2025 17:12:48.821602106 CEST	49701	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:48.823107004 CEST	49701	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:48.823127985 CEST	443	49701	34.36.137.203	192.168.2.5
Apr 15, 2025 17:12:48.842263937 CEST	49699	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:48.876578093 CEST	49702	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:12:48.876621962 CEST	443	49702	35.244.181.201	192.168.2.5
Apr 15, 2025 17:12:48.878923893 CEST	49702	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:12:48.879067898 CEST	49702	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:12:48.879095078 CEST	443	49702	35.244.181.201	192.168.2.5
Apr 15, 2025 17:12:48.924729109 CEST	443	49700	74.125.136.93	192.168.2.5
Apr 15, 2025 17:12:48.924844027 CEST	49700	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:48.925462008 CEST	443	49700	74.125.136.93	192.168.2.5
Apr 15, 2025 17:12:48.925518036 CEST	49700	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:49.052731991 CEST	443	49701	34.36.137.203	192.168.2.5
Apr 15, 2025 17:12:49.052792072 CEST	49701	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.096673965 CEST	49703	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.096708059 CEST	443	49703	34.36.137.203	192.168.2.5
Apr 15, 2025 17:12:49.101341009 CEST	49700	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:49.101362944 CEST	443	49700	74.125.136.93	192.168.2.5
Apr 15, 2025 17:12:49.101418018 CEST	49700	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:49.101522923 CEST	443	49700	74.125.136.93	192.168.2.5
Apr 15, 2025 17:12:49.102482080 CEST	443	49702	35.244.181.201	192.168.2.5
Apr 15, 2025 17:12:49.104710102 CEST	49701	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.104710102 CEST	49701	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.104723930 CEST	443	49701	34.36.137.203	192.168.2.5
Apr 15, 2025 17:12:49.104952097 CEST	443	49701	34.36.137.203	192.168.2.5
Apr 15, 2025 17:12:49.112014055 CEST	49700	443	192.168.2.5	74.125.136.93
Apr 15, 2025 17:12:49.112030983 CEST	49701	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.112051010 CEST	49703	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.112268925 CEST	443	49702	35.244.181.201	192.168.2.5
Apr 15, 2025 17:12:49.112377882 CEST	49702	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:12:49.113750935 CEST	49703	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.113770962 CEST	443	49703	34.36.137.203	192.168.2.5
Apr 15, 2025 17:12:49.117614985 CEST	49702	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:12:49.117624044 CEST	443	49702	35.244.181.201	192.168.2.5
Apr 15, 2025 17:12:49.117877007 CEST	443	49702	35.244.181.201	192.168.2.5
Apr 15, 2025 17:12:49.120198965 CEST	49702	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:12:49.120326996 CEST	443	49702	35.244.181.201	192.168.2.5
Apr 15, 2025 17:12:49.121037006 CEST	49702	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:12:49.121043921 CEST	443	49702	35.244.181.201	192.168.2.5
Apr 15, 2025 17:12:49.123348951 CEST	49702	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:12:49.123389006 CEST	49702	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:12:49.123389959 CEST	49702	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:12:49.123404026 CEST	49702	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:12:49.202131033 CEST	49704	443	192.168.2.5	34.160.144.191
Apr 15, 2025 17:12:49.202182055 CEST	443	49704	34.160.144.191	192.168.2.5
Apr 15, 2025 17:12:49.202380896 CEST	49704	443	192.168.2.5	34.160.144.191
Apr 15, 2025 17:12:49.202529907 CEST	49704	443	192.168.2.5	34.160.144.191
Apr 15, 2025 17:12:49.202547073 CEST	443	49704	34.160.144.191	192.168.2.5
Apr 15, 2025 17:12:49.214660883 CEST	49705	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:49.320766926 CEST	80	49705	34.107.221.82	192.168.2.5
Apr 15, 2025 17:12:49.320935965 CEST	49705	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:49.321052074 CEST	49705	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:49.328730106 CEST	49699	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:49.340591908 CEST	443	49703	34.36.137.203	192.168.2.5
Apr 15, 2025 17:12:49.340610981 CEST	443	49703	34.36.137.203	192.168.2.5
Apr 15, 2025 17:12:49.340667009 CEST	49703	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.345679045 CEST	49703	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.345700979 CEST	443	49703	34.36.137.203	192.168.2.5
Apr 15, 2025 17:12:49.345752954 CEST	49703	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.345927954 CEST	443	49703	34.36.137.203	192.168.2.5
Apr 15, 2025 17:12:49.346019030 CEST	49703	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.361305952 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:49.383553028 CEST	49707	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.383605957 CEST	443	49707	34.36.137.203	192.168.2.5
Apr 15, 2025 17:12:49.386743069 CEST	49707	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.388206005 CEST	49707	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.388226986 CEST	443	49707	34.36.137.203	192.168.2.5
Apr 15, 2025 17:12:49.427119970 CEST	80	49705	34.107.221.82	192.168.2.5
Apr 15, 2025 17:12:49.429039955 CEST	80	49705	34.107.221.82	192.168.2.5
Apr 15, 2025 17:12:49.429434061 CEST	49705	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:49.430934906 CEST	443	49704	34.160.144.191	192.168.2.5
Apr 15, 2025 17:12:49.431005001 CEST	49704	443	192.168.2.5	34.160.144.191
Apr 15, 2025 17:12:49.433861971 CEST	49704	443	192.168.2.5	34.160.144.191
Apr 15, 2025 17:12:49.433872938 CEST	443	49704	34.160.144.191	192.168.2.5
Apr 15, 2025 17:12:49.434259892 CEST	443	49704	34.160.144.191	192.168.2.5
Apr 15, 2025 17:12:49.435046911 CEST	80	49699	34.107.221.82	192.168.2.5
Apr 15, 2025 17:12:49.436211109 CEST	49704	443	192.168.2.5	34.160.144.191
Apr 15, 2025 17:12:49.436335087 CEST	49704	443	192.168.2.5	34.160.144.191
Apr 15, 2025 17:12:49.436383963 CEST	443	49704	34.160.144.191	192.168.2.5
Apr 15, 2025 17:12:49.436708927 CEST	49708	443	192.168.2.5	34.160.144.191
Apr 15, 2025 17:12:49.436748028 CEST	443	49708	34.160.144.191	192.168.2.5
Apr 15, 2025 17:12:49.438179970 CEST	49704	443	192.168.2.5	34.160.144.191
Apr 15, 2025 17:12:49.438199043 CEST	49699	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:49.438222885 CEST	49704	443	192.168.2.5	34.160.144.191
Apr 15, 2025 17:12:49.438256979 CEST	49708	443	192.168.2.5	34.160.144.191
Apr 15, 2025 17:12:49.438397884 CEST	49708	443	192.168.2.5	34.160.144.191
Apr 15, 2025 17:12:49.438415051 CEST	443	49708	34.160.144.191	192.168.2.5
Apr 15, 2025 17:12:49.467609882 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:12:49.467701912 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:49.467839003 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:49.479881048 CEST	49709	443	192.168.2.5	52.36.50.141
Apr 15, 2025 17:12:49.479928970 CEST	443	49709	52.36.50.141	192.168.2.5
Apr 15, 2025 17:12:49.481004000 CEST	49709	443	192.168.2.5	52.36.50.141
Apr 15, 2025 17:12:49.481754065 CEST	49709	443	192.168.2.5	52.36.50.141
Apr 15, 2025 17:12:49.481774092 CEST	443	49709	52.36.50.141	192.168.2.5
Apr 15, 2025 17:12:49.535506964 CEST	80	49705	34.107.221.82	192.168.2.5
Apr 15, 2025 17:12:49.535887003 CEST	49705	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:49.574129105 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:12:49.575422049 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:12:49.607316971 CEST	443	49707	34.36.137.203	192.168.2.5
Apr 15, 2025 17:12:49.613483906 CEST	49707	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.619183064 CEST	49707	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.619203091 CEST	443	49707	34.36.137.203	192.168.2.5
Apr 15, 2025 17:12:49.619302034 CEST	49707	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.619455099 CEST	443	49707	34.36.137.203	192.168.2.5
Apr 15, 2025 17:12:49.619664907 CEST	49710	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.619709969 CEST	443	49710	34.36.137.203	192.168.2.5
Apr 15, 2025 17:12:49.628997087 CEST	49707	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.629057884 CEST	49710	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.629101992 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:49.630505085 CEST	49710	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.630517006 CEST	443	49710	34.36.137.203	192.168.2.5
Apr 15, 2025 17:12:49.656193018 CEST	443	49708	34.160.144.191	192.168.2.5
Apr 15, 2025 17:12:49.660444975 CEST	49708	443	192.168.2.5	34.160.144.191
Apr 15, 2025 17:12:49.663505077 CEST	49708	443	192.168.2.5	34.160.144.191
Apr 15, 2025 17:12:49.663523912 CEST	443	49708	34.160.144.191	192.168.2.5
Apr 15, 2025 17:12:49.663836956 CEST	443	49708	34.160.144.191	192.168.2.5
Apr 15, 2025 17:12:49.665833950 CEST	49708	443	192.168.2.5	34.160.144.191
Apr 15, 2025 17:12:49.665908098 CEST	49708	443	192.168.2.5	34.160.144.191
Apr 15, 2025 17:12:49.666043997 CEST	443	49708	34.160.144.191	192.168.2.5
Apr 15, 2025 17:12:49.675879002 CEST	49708	443	192.168.2.5	34.160.144.191
Apr 15, 2025 17:12:49.675879002 CEST	49708	443	192.168.2.5	34.160.144.191
Apr 15, 2025 17:12:49.856044054 CEST	443	49710	34.36.137.203	192.168.2.5
Apr 15, 2025 17:12:49.856062889 CEST	443	49710	34.36.137.203	192.168.2.5
Apr 15, 2025 17:12:49.858493090 CEST	49710	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.969016075 CEST	49710	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.969058990 CEST	443	49710	34.36.137.203	192.168.2.5
Apr 15, 2025 17:12:49.969120979 CEST	49710	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:49.969316006 CEST	443	49710	34.36.137.203	192.168.2.5
Apr 15, 2025 17:12:49.969837904 CEST	49710	443	192.168.2.5	34.36.137.203
Apr 15, 2025 17:12:50.106668949 CEST	443	49709	52.36.50.141	192.168.2.5
Apr 15, 2025 17:12:50.106741905 CEST	49709	443	192.168.2.5	52.36.50.141
Apr 15, 2025 17:12:50.111187935 CEST	49709	443	192.168.2.5	52.36.50.141
Apr 15, 2025 17:12:50.111200094 CEST	443	49709	52.36.50.141	192.168.2.5
Apr 15, 2025 17:12:50.111310959 CEST	49709	443	192.168.2.5	52.36.50.141
Apr 15, 2025 17:12:50.111449003 CEST	443	49709	52.36.50.141	192.168.2.5
Apr 15, 2025 17:12:50.111584902 CEST	49709	443	192.168.2.5	52.36.50.141
Apr 15, 2025 17:12:50.529417038 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:50.549319983 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:50.635834932 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:12:50.637067080 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:50.637223959 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:50.656717062 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:12:50.710486889 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:50.743509054 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:12:50.744652033 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:12:50.795051098 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:51.489080906 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:51.596704960 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:12:51.640614986 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:12:59.523823977 CEST	49713	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:12:59.523889065 CEST	443	49713	34.107.243.93	192.168.2.5
Apr 15, 2025 17:12:59.524282932 CEST	49713	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:12:59.526124954 CEST	49713	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:12:59.526139021 CEST	443	49713	34.107.243.93	192.168.2.5
Apr 15, 2025 17:12:59.612123013 CEST	49714	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:12:59.612158060 CEST	443	49714	34.120.208.123	192.168.2.5
Apr 15, 2025 17:12:59.612390995 CEST	49714	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:12:59.613828897 CEST	49714	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:12:59.613838911 CEST	443	49714	34.120.208.123	192.168.2.5
Apr 15, 2025 17:12:59.753179073 CEST	443	49713	34.107.243.93	192.168.2.5
Apr 15, 2025 17:12:59.753272057 CEST	49713	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:12:59.758423090 CEST	49713	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:12:59.758433104 CEST	443	49713	34.107.243.93	192.168.2.5
Apr 15, 2025 17:12:59.758528948 CEST	49713	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:12:59.758627892 CEST	443	49713	34.107.243.93	192.168.2.5
Apr 15, 2025 17:12:59.758697033 CEST	49713	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:12:59.847954988 CEST	443	49714	34.120.208.123	192.168.2.5
Apr 15, 2025 17:12:59.848042011 CEST	49714	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:12:59.852885962 CEST	49714	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:12:59.852900028 CEST	443	49714	34.120.208.123	192.168.2.5
Apr 15, 2025 17:12:59.852982044 CEST	49714	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:12:59.853161097 CEST	443	49714	34.120.208.123	192.168.2.5
Apr 15, 2025 17:12:59.853221893 CEST	49714	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:00.249803066 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:00.359050035 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:00.361382008 CEST	49715	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:00.361424923 CEST	443	49715	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:00.361726999 CEST	49715	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:00.363127947 CEST	49715	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:00.363146067 CEST	443	49715	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:00.402010918 CEST	49716	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:00.402072906 CEST	443	49716	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:00.402384996 CEST	49716	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:00.402524948 CEST	49716	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:00.402539015 CEST	443	49716	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:00.411705017 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:00.581727982 CEST	443	49715	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:00.587275982 CEST	49715	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:00.591835022 CEST	49715	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:00.591850042 CEST	443	49715	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:00.591924906 CEST	49715	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:00.592094898 CEST	443	49715	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:00.593043089 CEST	49715	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:00.624829054 CEST	443	49716	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:00.627141953 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:00.631561995 CEST	49716	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:00.635267019 CEST	49716	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:00.635288954 CEST	443	49716	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:00.635927916 CEST	443	49716	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:00.637713909 CEST	49716	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:00.637787104 CEST	49716	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:00.638025045 CEST	443	49716	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:00.641105890 CEST	49716	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:00.641135931 CEST	49716	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:00.686688900 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:00.688349962 CEST	49717	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:00.688400030 CEST	443	49717	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:00.690257072 CEST	49717	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:00.691607952 CEST	49717	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:00.691620111 CEST	443	49717	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:00.735641956 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:00.780374050 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:00.794485092 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:00.849395037 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:00.912266970 CEST	443	49717	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:00.912369013 CEST	49717	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:00.995063066 CEST	49718	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:00.995121956 CEST	443	49718	34.149.100.209	192.168.2.5
Apr 15, 2025 17:13:00.996611118 CEST	49718	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:00.999232054 CEST	49718	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:00.999248981 CEST	443	49718	34.149.100.209	192.168.2.5
Apr 15, 2025 17:13:01.001142979 CEST	49717	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:01.001156092 CEST	443	49717	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:01.001231909 CEST	49717	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:01.001390934 CEST	443	49717	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:01.001471996 CEST	49717	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:01.096827030 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:01.099872112 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:01.204391956 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:01.207604885 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:01.224092007 CEST	443	49718	34.149.100.209	192.168.2.5
Apr 15, 2025 17:13:01.231352091 CEST	49718	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:01.235414028 CEST	49718	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:01.235435963 CEST	443	49718	34.149.100.209	192.168.2.5
Apr 15, 2025 17:13:01.235541105 CEST	49718	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:01.235609055 CEST	443	49718	34.149.100.209	192.168.2.5
Apr 15, 2025 17:13:01.235945940 CEST	49719	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:01.235986948 CEST	443	49719	34.149.100.209	192.168.2.5
Apr 15, 2025 17:13:01.235999107 CEST	49718	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:01.236191988 CEST	49719	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:01.237533092 CEST	49719	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:01.237546921 CEST	443	49719	34.149.100.209	192.168.2.5
Apr 15, 2025 17:13:01.248624086 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:01.248626947 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:01.368917942 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:01.455456018 CEST	443	49719	34.149.100.209	192.168.2.5
Apr 15, 2025 17:13:01.455610991 CEST	49719	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:01.476912975 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:01.535840988 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:01.909133911 CEST	49719	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:01.909183025 CEST	443	49719	34.149.100.209	192.168.2.5
Apr 15, 2025 17:13:01.909219027 CEST	49719	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:01.909852982 CEST	443	49719	34.149.100.209	192.168.2.5
Apr 15, 2025 17:13:01.910000086 CEST	49719	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:01.953120947 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:02.061825037 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:02.115511894 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:02.157238960 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:02.158580065 CEST	49720	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:02.158628941 CEST	443	49720	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:02.158951998 CEST	49721	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:02.159003019 CEST	443	49721	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:02.165752888 CEST	49720	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:02.165838957 CEST	49721	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:02.165987968 CEST	49720	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:02.166001081 CEST	443	49720	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:02.166098118 CEST	49721	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:02.166116953 CEST	443	49721	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:02.236746073 CEST	49722	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:02.236797094 CEST	443	49722	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:02.237947941 CEST	49722	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:02.239599943 CEST	49722	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:02.239614010 CEST	443	49722	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:02.266911983 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:02.316011906 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:02.385457039 CEST	443	49721	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:02.385473013 CEST	443	49721	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:02.385499954 CEST	443	49720	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:02.385515928 CEST	443	49720	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:02.385533094 CEST	49721	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:02.385579109 CEST	49720	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:02.388497114 CEST	49721	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:02.388510942 CEST	443	49721	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:02.388822079 CEST	443	49721	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:02.390887022 CEST	49720	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:02.390898943 CEST	443	49720	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:02.391149044 CEST	443	49720	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:02.394243002 CEST	49721	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:02.394243002 CEST	49721	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:02.394326925 CEST	49720	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:02.394373894 CEST	49720	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:02.394429922 CEST	443	49721	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:02.394469023 CEST	443	49720	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:02.394531012 CEST	49720	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:02.395000935 CEST	49721	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:02.401669979 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:02.457629919 CEST	443	49722	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:02.457714081 CEST	49722	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:02.509051085 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:02.554452896 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:02.978054047 CEST	49722	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:02.978137970 CEST	443	49722	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:02.978173018 CEST	49722	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:02.978419065 CEST	443	49722	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:02.978487015 CEST	49722	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:04.071572065 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:04.178966999 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:04.236824036 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:04.850975990 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:04.853148937 CEST	49725	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:04.853204012 CEST	443	49725	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:04.854312897 CEST	49725	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:04.859843969 CEST	49725	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:04.859878063 CEST	443	49725	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:04.958667994 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:04.963057041 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:05.007977962 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:05.070394993 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:05.079247952 CEST	443	49725	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:05.079499006 CEST	49725	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:05.123924017 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:05.203052044 CEST	49725	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:05.203085899 CEST	443	49725	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:05.203172922 CEST	49725	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:05.203344107 CEST	443	49725	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:05.204046011 CEST	49725	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:06.621329069 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:06.729420900 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:06.781929970 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:07.354557037 CEST	49726	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:07.354604959 CEST	443	49726	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:07.354765892 CEST	49726	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:07.356770992 CEST	49726	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:07.356787920 CEST	443	49726	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:07.582268000 CEST	443	49726	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:07.582377911 CEST	49726	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:07.621140957 CEST	49726	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:07.621155024 CEST	443	49726	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:07.621225119 CEST	49726	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:07.621707916 CEST	443	49726	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:07.621833086 CEST	49726	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:07.828108072 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:07.842001915 CEST	49727	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:13:07.842053890 CEST	443	49727	34.107.243.93	192.168.2.5
Apr 15, 2025 17:13:07.847388029 CEST	49727	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:13:07.850450993 CEST	49727	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:13:07.850476980 CEST	443	49727	34.107.243.93	192.168.2.5
Apr 15, 2025 17:13:07.850594044 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:07.935625076 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:07.959590912 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:07.966579914 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:08.011390924 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:08.069555044 CEST	443	49727	34.107.243.93	192.168.2.5
Apr 15, 2025 17:13:08.069632053 CEST	49727	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:13:08.074491978 CEST	49727	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:13:08.074502945 CEST	443	49727	34.107.243.93	192.168.2.5
Apr 15, 2025 17:13:08.074592113 CEST	49727	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:13:08.074647903 CEST	443	49727	34.107.243.93	192.168.2.5
Apr 15, 2025 17:13:08.074784040 CEST	49727	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:13:08.075012922 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:08.077444077 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:08.116962910 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:08.185446978 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:08.188616037 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:08.231971979 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:08.296094894 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:08.348773003 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:14.854748011 CEST	49728	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:14.854851007 CEST	443	49728	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:14.857178926 CEST	49728	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:14.857542038 CEST	49728	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:14.857573986 CEST	443	49728	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:14.878448009 CEST	49729	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:14.878506899 CEST	443	49729	34.149.100.209	192.168.2.5
Apr 15, 2025 17:13:14.879236937 CEST	49730	443	192.168.2.5	35.190.72.216
Apr 15, 2025 17:13:14.879292011 CEST	443	49730	35.190.72.216	192.168.2.5
Apr 15, 2025 17:13:14.882668018 CEST	49729	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:14.882750988 CEST	49730	443	192.168.2.5	35.190.72.216
Apr 15, 2025 17:13:14.882833958 CEST	49729	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:14.882852077 CEST	443	49729	34.149.100.209	192.168.2.5
Apr 15, 2025 17:13:14.884423971 CEST	49730	443	192.168.2.5	35.190.72.216
Apr 15, 2025 17:13:14.884443998 CEST	443	49730	35.190.72.216	192.168.2.5
Apr 15, 2025 17:13:14.991868019 CEST	49731	443	192.168.2.5	34.49.51.44
Apr 15, 2025 17:13:14.991910934 CEST	443	49731	34.49.51.44	192.168.2.5
Apr 15, 2025 17:13:14.991986036 CEST	49731	443	192.168.2.5	34.49.51.44
Apr 15, 2025 17:13:14.993397951 CEST	49731	443	192.168.2.5	34.49.51.44
Apr 15, 2025 17:13:14.993418932 CEST	443	49731	34.49.51.44	192.168.2.5
Apr 15, 2025 17:13:15.015964031 CEST	49732	443	192.168.2.5	151.101.1.91
Apr 15, 2025 17:13:15.016011000 CEST	443	49732	151.101.1.91	192.168.2.5
Apr 15, 2025 17:13:15.016400099 CEST	49732	443	192.168.2.5	151.101.1.91
Apr 15, 2025 17:13:15.016520977 CEST	49732	443	192.168.2.5	151.101.1.91
Apr 15, 2025 17:13:15.016534090 CEST	443	49732	151.101.1.91	192.168.2.5
Apr 15, 2025 17:13:15.078234911 CEST	443	49728	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.078309059 CEST	49728	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.081655979 CEST	49728	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.081669092 CEST	443	49728	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.081912041 CEST	443	49728	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.084537983 CEST	49728	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.084645987 CEST	49728	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.084697008 CEST	443	49728	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.084809065 CEST	49728	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.088814974 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:15.102368116 CEST	443	49729	34.149.100.209	192.168.2.5
Apr 15, 2025 17:13:15.102498055 CEST	49729	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:15.103168964 CEST	443	49730	35.190.72.216	192.168.2.5
Apr 15, 2025 17:13:15.103235960 CEST	49730	443	192.168.2.5	35.190.72.216
Apr 15, 2025 17:13:15.105669022 CEST	49729	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:15.105686903 CEST	443	49729	34.149.100.209	192.168.2.5
Apr 15, 2025 17:13:15.105976105 CEST	443	49729	34.149.100.209	192.168.2.5
Apr 15, 2025 17:13:15.110517025 CEST	49729	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:15.110640049 CEST	49729	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:15.110677004 CEST	443	49729	34.149.100.209	192.168.2.5
Apr 15, 2025 17:13:15.110761881 CEST	49730	443	192.168.2.5	35.190.72.216
Apr 15, 2025 17:13:15.110781908 CEST	443	49730	35.190.72.216	192.168.2.5
Apr 15, 2025 17:13:15.110816002 CEST	49730	443	192.168.2.5	35.190.72.216
Apr 15, 2025 17:13:15.110961914 CEST	49729	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:15.111063004 CEST	443	49730	35.190.72.216	192.168.2.5
Apr 15, 2025 17:13:15.112139940 CEST	49730	443	192.168.2.5	35.190.72.216
Apr 15, 2025 17:13:15.198126078 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:15.201396942 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:15.215015888 CEST	443	49731	34.49.51.44	192.168.2.5
Apr 15, 2025 17:13:15.215087891 CEST	49731	443	192.168.2.5	34.49.51.44
Apr 15, 2025 17:13:15.219681978 CEST	49731	443	192.168.2.5	34.49.51.44
Apr 15, 2025 17:13:15.219698906 CEST	443	49731	34.49.51.44	192.168.2.5
Apr 15, 2025 17:13:15.219769955 CEST	49731	443	192.168.2.5	34.49.51.44
Apr 15, 2025 17:13:15.219846010 CEST	443	49731	34.49.51.44	192.168.2.5
Apr 15, 2025 17:13:15.220186949 CEST	49731	443	192.168.2.5	34.49.51.44
Apr 15, 2025 17:13:15.223108053 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:15.232536077 CEST	49733	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:15.232578993 CEST	443	49733	34.149.100.209	192.168.2.5
Apr 15, 2025 17:13:15.232645988 CEST	49733	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:15.232764959 CEST	49733	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:15.232775927 CEST	443	49733	34.149.100.209	192.168.2.5
Apr 15, 2025 17:13:15.236124039 CEST	443	49732	151.101.1.91	192.168.2.5
Apr 15, 2025 17:13:15.236196041 CEST	49732	443	192.168.2.5	151.101.1.91
Apr 15, 2025 17:13:15.239353895 CEST	49732	443	192.168.2.5	151.101.1.91
Apr 15, 2025 17:13:15.239373922 CEST	443	49732	151.101.1.91	192.168.2.5
Apr 15, 2025 17:13:15.239638090 CEST	443	49732	151.101.1.91	192.168.2.5
Apr 15, 2025 17:13:15.242149115 CEST	49732	443	192.168.2.5	151.101.1.91
Apr 15, 2025 17:13:15.242216110 CEST	49732	443	192.168.2.5	151.101.1.91
Apr 15, 2025 17:13:15.242315054 CEST	443	49732	151.101.1.91	192.168.2.5
Apr 15, 2025 17:13:15.243681908 CEST	49732	443	192.168.2.5	151.101.1.91
Apr 15, 2025 17:13:15.249011993 CEST	49734	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.249058962 CEST	443	49734	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.249233961 CEST	49734	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.249361038 CEST	49734	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.249372005 CEST	443	49734	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.251008034 CEST	49735	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.251039028 CEST	443	49735	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.251333952 CEST	49735	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.251426935 CEST	49735	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.251437902 CEST	443	49735	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.253299952 CEST	49736	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.253339052 CEST	443	49736	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.253567934 CEST	49736	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.253664970 CEST	49736	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.253674030 CEST	443	49736	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.308974981 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:15.331867933 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:15.334386110 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:15.375226974 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:15.442353964 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:15.453607082 CEST	443	49733	34.149.100.209	192.168.2.5
Apr 15, 2025 17:13:15.453722000 CEST	49733	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:15.456548929 CEST	49733	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:15.456573963 CEST	443	49733	34.149.100.209	192.168.2.5
Apr 15, 2025 17:13:15.457333088 CEST	443	49733	34.149.100.209	192.168.2.5
Apr 15, 2025 17:13:15.458983898 CEST	49733	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:15.459063053 CEST	49733	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:15.459140062 CEST	443	49733	34.149.100.209	192.168.2.5
Apr 15, 2025 17:13:15.459884882 CEST	49733	443	192.168.2.5	34.149.100.209
Apr 15, 2025 17:13:15.463682890 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:15.467514038 CEST	443	49734	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.469490051 CEST	443	49735	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.472271919 CEST	443	49734	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.472621918 CEST	49734	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.472625971 CEST	49735	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.474489927 CEST	443	49736	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.475109100 CEST	49734	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.475125074 CEST	443	49734	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.475409031 CEST	443	49734	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.475509882 CEST	49736	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.477900982 CEST	49735	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.477920055 CEST	443	49735	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.478209972 CEST	443	49735	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.480484009 CEST	49736	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.480503082 CEST	443	49736	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.480794907 CEST	443	49736	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.484285116 CEST	49734	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.484493971 CEST	49734	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.484533072 CEST	443	49734	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.485726118 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:15.486476898 CEST	49735	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.486546040 CEST	49735	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.486679077 CEST	443	49735	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.491202116 CEST	49735	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.491235018 CEST	49734	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.491241932 CEST	49735	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.499103069 CEST	49736	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.499186993 CEST	49736	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.499360085 CEST	443	49736	35.244.181.201	192.168.2.5
Apr 15, 2025 17:13:15.505418062 CEST	49736	443	192.168.2.5	35.244.181.201
Apr 15, 2025 17:13:15.572060108 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:15.575589895 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:15.613609076 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:15.618345976 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.683072090 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:15.724071980 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.724299908 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.724452972 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.729511976 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:15.830200911 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.831537008 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.831562042 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.831692934 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.832273006 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.832288980 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.832391024 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.834089994 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.834112883 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.834158897 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.835871935 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.835891962 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.835979939 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.837147951 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.837163925 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.837193966 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.838784933 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.838802099 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.838848114 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.840632915 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.840775013 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.840822935 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.841979980 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.841993093 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.842046976 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.843637943 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.843651056 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.844016075 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.845529079 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.845542908 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.846851110 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.846864939 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.849354029 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.849371910 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.850079060 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.850099087 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.850122929 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.851131916 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.851865053 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.851878881 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.852006912 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.853266954 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.853281975 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.853413105 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.855345964 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.855360985 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.855429888 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.856559038 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.856573105 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.857465029 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.858234882 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.858247995 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.858473063 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.860027075 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.860038996 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.861103058 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.861385107 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.861402035 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.863189936 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.863209009 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.864582062 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.864605904 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.866250992 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.866269112 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.868331909 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.937321901 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.937346935 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.937534094 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.938085079 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.938098907 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.938155890 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.939693928 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.939707994 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.939763069 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.941318035 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.941338062 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.941380024 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.942910910 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.942930937 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.942981958 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.944542885 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.944567919 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.944786072 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.946161985 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.946190119 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.946314096 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.947810888 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.947833061 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.947935104 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.949404955 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.949428082 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.949750900 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.950994015 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.951020002 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.951078892 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.952655077 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.952676058 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.952729940 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.954231977 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.954247952 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.954302073 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.955821037 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.955836058 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.955888987 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.957461119 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.957484961 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.957539082 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.959096909 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.959111929 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.959172010 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.960700035 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.960714102 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.960776091 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.962297916 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.962316990 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.962363958 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.963921070 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.963942051 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.964005947 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.965543032 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.965567112 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.965704918 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.967103958 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.967125893 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.967179060 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.968761921 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.968781948 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.968837023 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.970381975 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.970403910 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.970465899 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.972022057 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.972042084 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.972100019 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.973608971 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.973645926 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.973710060 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.975263119 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.975296974 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.975347042 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.976866007 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.976906061 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.977089882 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.978441954 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.978478909 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.978600979 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.980091095 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.980129957 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.980182886 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.981678963 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.981714010 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.981775999 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.983283997 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.983319998 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.983377934 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.984900951 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.984935999 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.984987974 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.986524105 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.986560106 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.986675978 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.988138914 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.988173962 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.988301039 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.989789009 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.989825010 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.990061998 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.991352081 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.991432905 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.991501093 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.992990017 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.993035078 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.993165016 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.994602919 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.994648933 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.994750023 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.996237993 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.996298075 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.996400118 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.997828960 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.997864962 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.997984886 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:15.999466896 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.999506950 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:15.999568939 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.001059055 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.001099110 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.001194000 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.002705097 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.002753019 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.002851009 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.004292011 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.004328966 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.004460096 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.005911112 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.006007910 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.006154060 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.007523060 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.007561922 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.007677078 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.009151936 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.009197950 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.009306908 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.043230057 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.043252945 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.043313980 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.043953896 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.043967009 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.044008970 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.045526981 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.045538902 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.045593023 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.047143936 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.047157049 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.047220945 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.048656940 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.048669100 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.048723936 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.051422119 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.051434040 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.051480055 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.051714897 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.051917076 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.051997900 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.053535938 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.053546906 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.053595066 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.054814100 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.054826975 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.054868937 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.056833982 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.056847095 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.057329893 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.057816982 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.057830095 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.057882071 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.059696913 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.059710979 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.059746981 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.060791016 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.060806990 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.060846090 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.062315941 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.062328100 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.062396049 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.063735962 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.063750029 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.063791990 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.065211058 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.065227985 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.065269947 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.066674948 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.066687107 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.066735029 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.068111897 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.068125963 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.068171978 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.069544077 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.069556952 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.069600105 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.070960999 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.070972919 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.071089983 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.072405100 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.072418928 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.072468996 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.073817968 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.073832035 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.073870897 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.075246096 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.075258970 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.075376987 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.076644897 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.076659918 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.076700926 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.078082085 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.078095913 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.078334093 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.079463005 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.079477072 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.079533100 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.080908060 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.080923080 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.080957890 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.082317114 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.082334042 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.082390070 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.083766937 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.083784103 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.083822966 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.085150003 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.085165977 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.085202932 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.086554050 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.086566925 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.086611032 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.089106083 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.089119911 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.089178085 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.089483976 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.089498997 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.089534998 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.090878010 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.090934992 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.090966940 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.092472076 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.092485905 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.092520952 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.093703985 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.093715906 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.093753099 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.094731092 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.094743013 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.094793081 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.096489906 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.096502066 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.096549034 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.097600937 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.097615957 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.097656012 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.098809958 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.098824024 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.098861933 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.100389004 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.100404024 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.100475073 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.101188898 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.101202011 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.101238012 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.102574110 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.102586985 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.102627993 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.103715897 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.103729963 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.103770018 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.105417967 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.105429888 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.105482101 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.106520891 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.106534004 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.106580019 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.107701063 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.107712030 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.107759953 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.108827114 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.108841896 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.108891010 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.111036062 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.111047983 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.111058950 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.111071110 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.111098051 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.111124992 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.112181902 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.112195015 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.112257957 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.113289118 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.113300085 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.113356113 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.114377975 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.114396095 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.114454031 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.115259886 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.115276098 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.115317106 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.116530895 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.116544008 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.116605997 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.117712975 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.117731094 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.117784977 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.118664980 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.118676901 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.118741989 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.120002985 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.120016098 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.120059967 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.120759964 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.120771885 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.120826006 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.121789932 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.121803999 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.121849060 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.122900009 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.122916937 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.122972965 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.124016047 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.124032021 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.124075890 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.125030041 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.125044107 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.125081062 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.126177073 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.126189947 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.126246929 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.127252102 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.127265930 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.127309084 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.128357887 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.128371000 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.128412962 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.129398108 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.129410982 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.129456997 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.130471945 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.130528927 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.130670071 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.131622076 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.131634951 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.131678104 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.132678032 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.132692099 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.132725954 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.133759022 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.133773088 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.133814096 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.134882927 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.134896040 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.134946108 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.135906935 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.135921955 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.135965109 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.137053967 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.137068033 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.137223959 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.138103008 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.138117075 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.138151884 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.139259100 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.139273882 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.139303923 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.140259981 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.140273094 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.140312910 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.143179893 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.143193007 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.143203974 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.143217087 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.143249035 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.143363953 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.143533945 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.143546104 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.143589020 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.145042896 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.145055056 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.145092964 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.146083117 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.146096945 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.146132946 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.146971941 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.146985054 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.148288012 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.148302078 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.148967981 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.148979902 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.150438070 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.150583982 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.151602030 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.151614904 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.151943922 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.151956081 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.153337955 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.153348923 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.153928041 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.153939009 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.154426098 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.154462099 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.154474020 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.154665947 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.155615091 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.155627012 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.155735016 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.156119108 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.156131029 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.156181097 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.157249928 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.157263041 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.157298088 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.157509089 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.157521009 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.157561064 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.158349991 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.158364058 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.158399105 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.159588099 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.159601927 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.159651041 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:16.160141945 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.160156012 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:16.160198927 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:17.580985069 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:17.688407898 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:17.691310883 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:17.735332966 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:17.799670935 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:17.851231098 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:18.157378912 CEST	49739	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:13:18.157418966 CEST	443	49739	34.107.243.93	192.168.2.5
Apr 15, 2025 17:13:18.157495975 CEST	49739	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:13:18.158863068 CEST	49739	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:13:18.158874035 CEST	443	49739	34.107.243.93	192.168.2.5
Apr 15, 2025 17:13:18.377223969 CEST	443	49739	34.107.243.93	192.168.2.5
Apr 15, 2025 17:13:18.377304077 CEST	49739	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:13:18.381107092 CEST	49739	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:13:18.381119013 CEST	443	49739	34.107.243.93	192.168.2.5
Apr 15, 2025 17:13:18.381191015 CEST	49739	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:13:18.381253004 CEST	443	49739	34.107.243.93	192.168.2.5
Apr 15, 2025 17:13:18.381531954 CEST	49739	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:13:18.383913994 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:18.491388083 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:18.496786118 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:18.537591934 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:18.605087042 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:18.653507948 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:26.174906015 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:26.280570030 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:28.497662067 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:28.604132891 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:28.613487959 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:28.720011950 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:36.282043934 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:36.387914896 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:38.529555082 CEST	49741	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:13:38.529613018 CEST	443	49741	34.107.243.93	192.168.2.5
Apr 15, 2025 17:13:38.531054020 CEST	49741	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:13:38.531232119 CEST	49741	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:13:38.531245947 CEST	443	49741	34.107.243.93	192.168.2.5
Apr 15, 2025 17:13:38.609692097 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:38.716095924 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:38.725536108 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:38.752039909 CEST	443	49741	34.107.243.93	192.168.2.5
Apr 15, 2025 17:13:38.753860950 CEST	49741	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:13:38.757514954 CEST	49741	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:13:38.757534027 CEST	443	49741	34.107.243.93	192.168.2.5
Apr 15, 2025 17:13:38.757600069 CEST	49741	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:13:38.757742882 CEST	443	49741	34.107.243.93	192.168.2.5
Apr 15, 2025 17:13:38.759769917 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:38.760584116 CEST	49741	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:13:38.831857920 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:38.866055965 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:38.867207050 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:38.872227907 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:38.910559893 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:38.978463888 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:38.980235100 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:39.026494026 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:44.774357080 CEST	49742	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:44.774399042 CEST	443	49742	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:44.774525881 CEST	49742	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:44.774703979 CEST	49743	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:44.774739027 CEST	443	49743	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:44.774821997 CEST	49742	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:44.774835110 CEST	443	49742	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:44.774941921 CEST	49743	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:44.775074005 CEST	49743	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:44.775087118 CEST	443	49743	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:44.993066072 CEST	443	49742	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:44.993208885 CEST	49742	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:44.994061947 CEST	443	49743	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:44.994142056 CEST	49743	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:44.996192932 CEST	49742	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:44.996213913 CEST	443	49742	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:44.996522903 CEST	443	49742	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:44.998641968 CEST	49743	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:44.998661995 CEST	443	49743	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:44.998898983 CEST	443	49743	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.002238035 CEST	49742	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.002455950 CEST	443	49742	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.002486944 CEST	49742	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.002497911 CEST	443	49742	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.002685070 CEST	49743	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.002769947 CEST	49743	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.002825022 CEST	443	49743	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.002902031 CEST	49743	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.056358099 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:45.058984995 CEST	49744	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.059031963 CEST	443	49744	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.059390068 CEST	49744	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.059552908 CEST	49744	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.059562922 CEST	443	49744	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.095247984 CEST	49745	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.095295906 CEST	443	49745	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.095418930 CEST	49745	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.095556974 CEST	49745	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.095566988 CEST	443	49745	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.163979053 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:45.207173109 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:45.208283901 CEST	443	49742	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.208374977 CEST	49742	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.278261900 CEST	443	49744	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.279721022 CEST	49744	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.282846928 CEST	49744	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.282864094 CEST	443	49744	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.283169031 CEST	443	49744	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.286072016 CEST	49744	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.286166906 CEST	49744	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.286242008 CEST	443	49744	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.286334991 CEST	49744	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.315278053 CEST	443	49745	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.320287943 CEST	443	49745	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.324798107 CEST	49745	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.332881927 CEST	49745	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.332902908 CEST	443	49745	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.333307028 CEST	443	49745	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.336540937 CEST	49745	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.336693048 CEST	49745	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.336765051 CEST	443	49745	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.337102890 CEST	49745	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.493712902 CEST	49746	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.493762016 CEST	443	49746	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.501903057 CEST	49746	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.502099037 CEST	49746	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.502114058 CEST	443	49746	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.518309116 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:45.518498898 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:45.625576019 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:45.625710011 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:45.677298069 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:45.677337885 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:45.720412016 CEST	443	49746	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.720431089 CEST	443	49746	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.720499992 CEST	49746	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.724205017 CEST	49746	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.724224091 CEST	443	49746	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.724473000 CEST	443	49746	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.727562904 CEST	49746	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.727674961 CEST	49746	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.727721930 CEST	443	49746	34.120.208.123	192.168.2.5
Apr 15, 2025 17:13:45.727838039 CEST	49746	443	192.168.2.5	34.120.208.123
Apr 15, 2025 17:13:45.828216076 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:45.828708887 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:45.935528994 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:45.936119080 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:45.978207111 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:45.978207111 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:45.999192953 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:46.106640100 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:46.147550106 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:46.395009995 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:46.501394987 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:13:55.938627005 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:56.044975042 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:56.107930899 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:13:56.214127064 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:13:56.509181976 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:13:56.614798069 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:14:06.055387974 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:14:06.161885023 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:14:06.224839926 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:14:06.331166029 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:14:06.626092911 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:14:06.731848955 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:14:16.167365074 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:14:16.274347067 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:14:16.336793900 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:14:16.443217993 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:14:16.737788916 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:14:16.843559980 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:14:18.971095085 CEST	49747	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:14:18.971251011 CEST	443	49747	34.107.243.93	192.168.2.5
Apr 15, 2025 17:14:18.971647024 CEST	49747	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:14:18.973123074 CEST	49747	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:14:18.973143101 CEST	443	49747	34.107.243.93	192.168.2.5
Apr 15, 2025 17:14:19.192023039 CEST	443	49747	34.107.243.93	192.168.2.5
Apr 15, 2025 17:14:19.192190886 CEST	49747	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:14:19.203573942 CEST	49747	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:14:19.203603983 CEST	443	49747	34.107.243.93	192.168.2.5
Apr 15, 2025 17:14:19.203794956 CEST	49747	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:14:19.203816891 CEST	443	49747	34.107.243.93	192.168.2.5
Apr 15, 2025 17:14:19.204695940 CEST	49747	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:14:19.206784010 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:14:19.313158989 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:14:19.314347029 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:14:19.319910049 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:14:19.360647917 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:14:19.426234961 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:14:19.427356005 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:14:19.476521015 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:14:26.852664948 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:14:26.958782911 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:14:29.328855991 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:14:29.429400921 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:14:29.435187101 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:14:29.535888910 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:14:36.967056990 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:14:37.073014975 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:14:39.437170982 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:14:39.537431955 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:14:39.543596029 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:14:39.643784046 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:14:47.080650091 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:14:47.186275959 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:14:49.547489882 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:14:49.647845984 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:14:49.653855085 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:14:49.754683971 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:14:57.188895941 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:14:57.294692039 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:14:59.661724091 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:14:59.763134956 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:14:59.768269062 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:14:59.869461060 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:15:07.309724092 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:15:07.415422916 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:15:09.779493093 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:15:09.879898071 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:15:09.885930061 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:15:09.986372948 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:15:11.839144945 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:15:11.945085049 CEST	80	49737	23.47.204.64	192.168.2.5
Apr 15, 2025 17:15:11.947151899 CEST	49737	80	192.168.2.5	23.47.204.64
Apr 15, 2025 17:15:19.893830061 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:15:19.994091988 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:15:20.000392914 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:15:20.100513935 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:15:30.006355047 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:15:30.106621981 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:15:30.112858057 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:15:30.212949991 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:15:39.436690092 CEST	49748	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:15:39.436784029 CEST	443	49748	34.107.243.93	192.168.2.5
Apr 15, 2025 17:15:39.436887026 CEST	49748	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:15:39.438205957 CEST	49748	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:15:39.438235044 CEST	443	49748	34.107.243.93	192.168.2.5
Apr 15, 2025 17:15:39.658404112 CEST	443	49748	34.107.243.93	192.168.2.5
Apr 15, 2025 17:15:39.658502102 CEST	49748	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:15:39.664581060 CEST	49748	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:15:39.664607048 CEST	443	49748	34.107.243.93	192.168.2.5
Apr 15, 2025 17:15:39.664704084 CEST	49748	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:15:39.664740086 CEST	443	49748	34.107.243.93	192.168.2.5
Apr 15, 2025 17:15:39.666287899 CEST	49748	443	192.168.2.5	34.107.243.93
Apr 15, 2025 17:15:39.668096066 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:15:39.774363995 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:15:39.778141022 CEST	80	49706	34.107.221.82	192.168.2.5
Apr 15, 2025 17:15:39.781752110 CEST	49711	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:15:39.817734957 CEST	49706	80	192.168.2.5	34.107.221.82
Apr 15, 2025 17:15:39.888093948 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:15:39.911681890 CEST	80	49711	34.107.221.82	192.168.2.5
Apr 15, 2025 17:15:39.964922905 CEST	49711	80	192.168.2.5	34.107.221.82

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 15, 2025 17:12:45.963665962 CEST	59039	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:46.072285891 CEST	53	59039	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:46.073295116 CEST	54359	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:46.182343960 CEST	53	54359	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:48.030714989 CEST	51947	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:48.137454987 CEST	53	51947	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:48.141498089 CEST	52599	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:48.249380112 CEST	53	52599	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:48.251348972 CEST	59506	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:48.358683109 CEST	53	59506	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:48.445441008 CEST	59449	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:48.552948952 CEST	53	59449	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:48.560616970 CEST	52836	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:48.667411089 CEST	53	52836	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:48.670785904 CEST	54156	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:48.713942051 CEST	58472	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:48.777636051 CEST	53	54156	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:48.790323973 CEST	53552	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:48.820322990 CEST	53	58472	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:48.821528912 CEST	50626	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:48.876982927 CEST	56195	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:48.896625996 CEST	53	53552	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:48.928689957 CEST	53	50626	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:48.929408073 CEST	55306	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:48.983485937 CEST	53	56195	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:48.984213114 CEST	64644	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:49.035857916 CEST	53	55306	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:49.089680910 CEST	62641	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:49.090529919 CEST	53	64644	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:49.092992067 CEST	59376	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:49.093624115 CEST	53124	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:49.097085953 CEST	55159	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:49.107245922 CEST	64062	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:49.195988894 CEST	53	62641	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:49.199971914 CEST	53	59376	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:49.200541019 CEST	53	53124	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:49.202233076 CEST	52385	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:49.206130028 CEST	53	55159	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:49.206661940 CEST	54840	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:49.213907003 CEST	53	64062	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:49.310553074 CEST	53	52385	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:49.311367989 CEST	63106	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:49.312954903 CEST	53	54840	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:49.369914055 CEST	58176	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:49.478491068 CEST	53	58176	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:49.479723930 CEST	63854	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:49.518255949 CEST	53	63106	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:49.587609053 CEST	53	63854	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:49.600079060 CEST	62801	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:49.707832098 CEST	53	62801	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:54.771419048 CEST	49739	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:54.879188061 CEST	53	49739	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:54.895829916 CEST	58541	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:55.003734112 CEST	53	58541	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:55.004492044 CEST	49452	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:55.112354994 CEST	53	49452	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:55.188888073 CEST	61128	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:55.296572924 CEST	53	61128	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:55.297835112 CEST	50416	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:55.404747963 CEST	53	50416	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:55.405452967 CEST	59331	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:55.512746096 CEST	53	59331	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:59.612335920 CEST	51396	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:59.719369888 CEST	53	51396	1.1.1.1	192.168.2.5
Apr 15, 2025 17:12:59.720169067 CEST	57032	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:12:59.826634884 CEST	53	57032	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:00.249474049 CEST	56712	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:00.357419014 CEST	53	56712	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:00.686536074 CEST	64739	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:00.793626070 CEST	53	64739	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:00.995539904 CEST	58098	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:01.103420019 CEST	53	58098	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:01.104090929 CEST	54495	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:01.211615086 CEST	53	54495	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:02.983094931 CEST	58328	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:02.983794928 CEST	51960	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:02.984072924 CEST	52151	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:03.089848042 CEST	53	58328	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:03.090722084 CEST	53	51960	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:03.090739965 CEST	53	52151	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:04.068099976 CEST	60876	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:04.068175077 CEST	60952	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:04.071121931 CEST	63740	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:04.174988985 CEST	53	60952	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:04.175689936 CEST	57511	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:04.176320076 CEST	53	60876	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:04.176718950 CEST	58318	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:04.177884102 CEST	53	63740	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:04.178451061 CEST	55848	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:04.282325029 CEST	53	57511	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:04.284614086 CEST	53	58318	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:04.285062075 CEST	53	55848	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:04.825870991 CEST	54418	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:04.826425076 CEST	55068	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:04.852159977 CEST	54159	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:04.932638884 CEST	53	54418	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:04.933103085 CEST	53	55068	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:04.933504105 CEST	53398	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:04.934235096 CEST	62815	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:04.959851980 CEST	53	54159	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:04.961138964 CEST	64913	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:05.040498972 CEST	53	62815	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:05.040602922 CEST	53	53398	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:05.041337013 CEST	50220	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:05.041397095 CEST	61843	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:05.069593906 CEST	53	64913	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:05.148019075 CEST	53	61843	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:05.148437023 CEST	53	50220	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:07.438296080 CEST	61954	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:07.545447111 CEST	53	61954	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:07.842669010 CEST	56433	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:07.950077057 CEST	53	56433	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:14.874761105 CEST	60455	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:14.882436991 CEST	61880	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:14.990865946 CEST	53	61880	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:14.992266893 CEST	58374	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:15.013794899 CEST	53	60455	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:15.016330004 CEST	60390	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:15.099956036 CEST	53	58374	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:15.100692034 CEST	56079	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:15.125690937 CEST	53	60390	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:15.126394987 CEST	57627	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:15.208599091 CEST	53	56079	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:15.234111071 CEST	53	57627	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:15.618721962 CEST	59809	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:15.730434895 CEST	53	59809	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:15.731077909 CEST	63372	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:15.843597889 CEST	53	63372	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:18.156907082 CEST	59583	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:18.264193058 CEST	53	59583	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:18.265503883 CEST	64959	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:18.371997118 CEST	53	64959	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:38.529809952 CEST	57941	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:38.636720896 CEST	53	57941	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:39.617103100 CEST	53561	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:39.724483013 CEST	53	53561	1.1.1.1	192.168.2.5
Apr 15, 2025 17:13:44.666611910 CEST	52947	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:13:44.773547888 CEST	53	52947	1.1.1.1	192.168.2.5
Apr 15, 2025 17:14:18.862505913 CEST	51851	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:14:18.969846010 CEST	53	51851	1.1.1.1	192.168.2.5
Apr 15, 2025 17:14:18.972697973 CEST	58297	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:14:19.081181049 CEST	53	58297	1.1.1.1	192.168.2.5
Apr 15, 2025 17:14:19.207027912 CEST	63425	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:14:19.314055920 CEST	53	63425	1.1.1.1	192.168.2.5
Apr 15, 2025 17:14:19.315958023 CEST	62972	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:14:19.423082113 CEST	53	62972	1.1.1.1	192.168.2.5
Apr 15, 2025 17:15:39.221169949 CEST	54890	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:15:39.327697992 CEST	53	54890	1.1.1.1	192.168.2.5
Apr 15, 2025 17:15:39.329175949 CEST	59013	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:15:39.435667992 CEST	53	59013	1.1.1.1	192.168.2.5
Apr 15, 2025 17:15:39.436557055 CEST	59046	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:15:39.543618917 CEST	53	59046	1.1.1.1	192.168.2.5
Apr 15, 2025 17:15:39.668494940 CEST	62300	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:15:39.778120995 CEST	53	62300	1.1.1.1	192.168.2.5
Apr 15, 2025 17:15:39.783938885 CEST	54525	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:15:39.892653942 CEST	53	54525	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 15, 2025 17:12:45.963665962 CEST	192.168.2.5	1.1.1.1	0x607b	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:46.073295116 CEST	192.168.2.5	1.1.1.1	0xd22e	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Apr 15, 2025 17:12:48.030714989 CEST	192.168.2.5	1.1.1.1	0x8a44	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.141498089 CEST	192.168.2.5	1.1.1.1	0x4115	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.251348972 CEST	192.168.2.5	1.1.1.1	0x894f	Standard query (0)	youtube.com	28	IN (0x0001)	false
Apr 15, 2025 17:12:48.445441008 CEST	192.168.2.5	1.1.1.1	0xbf96	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.560616970 CEST	192.168.2.5	1.1.1.1	0xeea3	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.670785904 CEST	192.168.2.5	1.1.1.1	0x22ac	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Apr 15, 2025 17:12:48.713942051 CEST	192.168.2.5	1.1.1.1	0x7e1f	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.790323973 CEST	192.168.2.5	1.1.1.1	0xf136	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.821528912 CEST	192.168.2.5	1.1.1.1	0xc85f	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.876982927 CEST	192.168.2.5	1.1.1.1	0x7170	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.929408073 CEST	192.168.2.5	1.1.1.1	0xb0f9	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Apr 15, 2025 17:12:48.984213114 CEST	192.168.2.5	1.1.1.1	0x2263	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Apr 15, 2025 17:12:49.089680910 CEST	192.168.2.5	1.1.1.1	0xd562	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.092992067 CEST	192.168.2.5	1.1.1.1	0x146	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.093624115 CEST	192.168.2.5	1.1.1.1	0xb5fc	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.097085953 CEST	192.168.2.5	1.1.1.1	0x1047	Standard query (0)	mc.prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.107245922 CEST	192.168.2.5	1.1.1.1	0x83bb	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.202233076 CEST	192.168.2.5	1.1.1.1	0x6b54	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.206661940 CEST	192.168.2.5	1.1.1.1	0xacfc	Standard query (0)	mc.prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Apr 15, 2025 17:12:49.311367989 CEST	192.168.2.5	1.1.1.1	0x93f0	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Apr 15, 2025 17:12:49.369914055 CEST	192.168.2.5	1.1.1.1	0x4977	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.479723930 CEST	192.168.2.5	1.1.1.1	0xae5c	Standard query (0)	shavar.prod.mozaws.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.600079060 CEST	192.168.2.5	1.1.1.1	0xeb38	Standard query (0)	shavar.prod.mozaws.net	28	IN (0x0001)	false
Apr 15, 2025 17:12:54.771419048 CEST	192.168.2.5	1.1.1.1	0x342b	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:54.895829916 CEST	192.168.2.5	1.1.1.1	0x6271	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:55.004492044 CEST	192.168.2.5	1.1.1.1	0x5cd4	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Apr 15, 2025 17:12:55.188888073 CEST	192.168.2.5	1.1.1.1	0x40e5	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:55.297835112 CEST	192.168.2.5	1.1.1.1	0x986	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:55.405452967 CEST	192.168.2.5	1.1.1.1	0xf7e2	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Apr 15, 2025 17:12:59.612335920 CEST	192.168.2.5	1.1.1.1	0x8fb0	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:59.720169067 CEST	192.168.2.5	1.1.1.1	0xdfb1	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Apr 15, 2025 17:13:00.249474049 CEST	192.168.2.5	1.1.1.1	0xa4c9	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:00.686536074 CEST	192.168.2.5	1.1.1.1	0xde1e	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:00.995539904 CEST	192.168.2.5	1.1.1.1	0x120b	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:01.104090929 CEST	192.168.2.5	1.1.1.1	0xb2bc	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Apr 15, 2025 17:13:02.983094931 CEST	192.168.2.5	1.1.1.1	0xb257	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:02.983794928 CEST	192.168.2.5	1.1.1.1	0x16bb	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:02.984072924 CEST	192.168.2.5	1.1.1.1	0x66ce	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.068099976 CEST	192.168.2.5	1.1.1.1	0x50f0	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.068175077 CEST	192.168.2.5	1.1.1.1	0x8ef7	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.071121931 CEST	192.168.2.5	1.1.1.1	0xbe70	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.175689936 CEST	192.168.2.5	1.1.1.1	0xec4e	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Apr 15, 2025 17:13:04.176718950 CEST	192.168.2.5	1.1.1.1	0x827	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Apr 15, 2025 17:13:04.178451061 CEST	192.168.2.5	1.1.1.1	0x5133	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Apr 15, 2025 17:13:04.825870991 CEST	192.168.2.5	1.1.1.1	0x8b3c	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.826425076 CEST	192.168.2.5	1.1.1.1	0x3a4	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.852159977 CEST	192.168.2.5	1.1.1.1	0xd0ff	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Apr 15, 2025 17:13:04.933504105 CEST	192.168.2.5	1.1.1.1	0x7d12	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.934235096 CEST	192.168.2.5	1.1.1.1	0x3e6b	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.961138964 CEST	192.168.2.5	1.1.1.1	0xbaf3	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:05.041337013 CEST	192.168.2.5	1.1.1.1	0xa9b7	Standard query (0)	twitter.com	28	IN (0x0001)	false
Apr 15, 2025 17:13:05.041397095 CEST	192.168.2.5	1.1.1.1	0x49fb	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Apr 15, 2025 17:13:07.438296080 CEST	192.168.2.5	1.1.1.1	0xb0e7	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:07.842669010 CEST	192.168.2.5	1.1.1.1	0x32c2	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Apr 15, 2025 17:13:14.874761105 CEST	192.168.2.5	1.1.1.1	0xb802	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:14.882436991 CEST	192.168.2.5	1.1.1.1	0x62cf	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:14.992266893 CEST	192.168.2.5	1.1.1.1	0x57f8	Standard query (0)	normandy.tombstone.experimenter.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:15.016330004 CEST	192.168.2.5	1.1.1.1	0x8519	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:15.100692034 CEST	192.168.2.5	1.1.1.1	0x38ef	Standard query (0)	normandy.tombstone.experimenter.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Apr 15, 2025 17:13:15.126394987 CEST	192.168.2.5	1.1.1.1	0x264b	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Apr 15, 2025 17:13:15.618721962 CEST	192.168.2.5	1.1.1.1	0xc76f	Standard query (0)	a19.dscg10.akamai.net	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:15.731077909 CEST	192.168.2.5	1.1.1.1	0x956a	Standard query (0)	a19.dscg10.akamai.net	28	IN (0x0001)	false
Apr 15, 2025 17:13:18.156907082 CEST	192.168.2.5	1.1.1.1	0xc77d	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:18.265503883 CEST	192.168.2.5	1.1.1.1	0x6057	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Apr 15, 2025 17:13:38.529809952 CEST	192.168.2.5	1.1.1.1	0xa732	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Apr 15, 2025 17:13:39.617103100 CEST	192.168.2.5	1.1.1.1	0x4790	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:44.666611910 CEST	192.168.2.5	1.1.1.1	0xa647	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Apr 15, 2025 17:14:18.862505913 CEST	192.168.2.5	1.1.1.1	0xb630	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:14:18.972697973 CEST	192.168.2.5	1.1.1.1	0x567b	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Apr 15, 2025 17:14:19.207027912 CEST	192.168.2.5	1.1.1.1	0x4e6c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:14:19.315958023 CEST	192.168.2.5	1.1.1.1	0xba2	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:15:39.221169949 CEST	192.168.2.5	1.1.1.1	0x598c	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:15:39.329175949 CEST	192.168.2.5	1.1.1.1	0x70a4	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:15:39.436557055 CEST	192.168.2.5	1.1.1.1	0xd8ca	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Apr 15, 2025 17:15:39.668494940 CEST	192.168.2.5	1.1.1.1	0xf536	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:15:39.783938885 CEST	192.168.2.5	1.1.1.1	0x87c7	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 15, 2025 17:12:45.952992916 CEST	1.1.1.1	192.168.2.5	0x7e0e	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:46.072285891 CEST	1.1.1.1	192.168.2.5	0x607b	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.137454987 CEST	1.1.1.1	192.168.2.5	0x8a44	No error (0)	youtube.com		74.125.136.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.137454987 CEST	1.1.1.1	192.168.2.5	0x8a44	No error (0)	youtube.com		74.125.136.190	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.137454987 CEST	1.1.1.1	192.168.2.5	0x8a44	No error (0)	youtube.com		74.125.136.136	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.137454987 CEST	1.1.1.1	192.168.2.5	0x8a44	No error (0)	youtube.com		74.125.136.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.249380112 CEST	1.1.1.1	192.168.2.5	0x4115	No error (0)	youtube.com		173.194.219.136	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.249380112 CEST	1.1.1.1	192.168.2.5	0x4115	No error (0)	youtube.com		173.194.219.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.249380112 CEST	1.1.1.1	192.168.2.5	0x4115	No error (0)	youtube.com		173.194.219.190	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.249380112 CEST	1.1.1.1	192.168.2.5	0x4115	No error (0)	youtube.com		173.194.219.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.358683109 CEST	1.1.1.1	192.168.2.5	0x894f	No error (0)	youtube.com			28	IN (0x0001)	false
Apr 15, 2025 17:12:48.358683109 CEST	1.1.1.1	192.168.2.5	0x894f	No error (0)	youtube.com			28	IN (0x0001)	false
Apr 15, 2025 17:12:48.358683109 CEST	1.1.1.1	192.168.2.5	0x894f	No error (0)	youtube.com			28	IN (0x0001)	false
Apr 15, 2025 17:12:48.358683109 CEST	1.1.1.1	192.168.2.5	0x894f	No error (0)	youtube.com			28	IN (0x0001)	false
Apr 15, 2025 17:12:48.552948952 CEST	1.1.1.1	192.168.2.5	0xbf96	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:12:48.552948952 CEST	1.1.1.1	192.168.2.5	0xbf96	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:12:48.552948952 CEST	1.1.1.1	192.168.2.5	0xbf96	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.667411089 CEST	1.1.1.1	192.168.2.5	0xeea3	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.777636051 CEST	1.1.1.1	192.168.2.5	0x22ac	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Apr 15, 2025 17:12:48.820322990 CEST	1.1.1.1	192.168.2.5	0x7e1f	No error (0)	contile.services.mozilla.com		34.36.137.203	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.872586966 CEST	1.1.1.1	192.168.2.5	0xbcb7	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:12:48.872586966 CEST	1.1.1.1	192.168.2.5	0xbcb7	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.896625996 CEST	1.1.1.1	192.168.2.5	0xf136	No error (0)	spocs.getpocket.com	mc.prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:12:48.896625996 CEST	1.1.1.1	192.168.2.5	0xf136	No error (0)	mc.prod.ads.prod.webservices.mozgcp.net		34.36.137.203	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.928689957 CEST	1.1.1.1	192.168.2.5	0xc85f	No error (0)	contile.services.mozilla.com		34.36.137.203	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:48.983485937 CEST	1.1.1.1	192.168.2.5	0x7170	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.090529919 CEST	1.1.1.1	192.168.2.5	0x2263	No error (0)	prod.balrog.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Apr 15, 2025 17:12:49.195988894 CEST	1.1.1.1	192.168.2.5	0xd562	No error (0)	example.org		23.215.0.132	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.195988894 CEST	1.1.1.1	192.168.2.5	0xd562	No error (0)	example.org		96.7.128.186	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.195988894 CEST	1.1.1.1	192.168.2.5	0xd562	No error (0)	example.org		23.215.0.133	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.195988894 CEST	1.1.1.1	192.168.2.5	0xd562	No error (0)	example.org		96.7.128.192	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.199971914 CEST	1.1.1.1	192.168.2.5	0x146	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.199971914 CEST	1.1.1.1	192.168.2.5	0x146	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.200541019 CEST	1.1.1.1	192.168.2.5	0xb5fc	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:12:49.200541019 CEST	1.1.1.1	192.168.2.5	0xb5fc	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:12:49.200541019 CEST	1.1.1.1	192.168.2.5	0xb5fc	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.206130028 CEST	1.1.1.1	192.168.2.5	0x1047	No error (0)	mc.prod.ads.prod.webservices.mozgcp.net		34.36.137.203	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.213907003 CEST	1.1.1.1	192.168.2.5	0x83bb	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:12:49.213907003 CEST	1.1.1.1	192.168.2.5	0x83bb	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:12:49.213907003 CEST	1.1.1.1	192.168.2.5	0x83bb	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.310553074 CEST	1.1.1.1	192.168.2.5	0x6b54	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.478491068 CEST	1.1.1.1	192.168.2.5	0x4977	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:12:49.478491068 CEST	1.1.1.1	192.168.2.5	0x4977	No error (0)	shavar.prod.mozaws.net		52.36.50.141	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.478491068 CEST	1.1.1.1	192.168.2.5	0x4977	No error (0)	shavar.prod.mozaws.net		52.37.232.247	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.478491068 CEST	1.1.1.1	192.168.2.5	0x4977	No error (0)	shavar.prod.mozaws.net		44.230.225.207	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.518255949 CEST	1.1.1.1	192.168.2.5	0x93f0	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Apr 15, 2025 17:12:49.587609053 CEST	1.1.1.1	192.168.2.5	0xae5c	No error (0)	shavar.prod.mozaws.net		52.37.232.247	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.587609053 CEST	1.1.1.1	192.168.2.5	0xae5c	No error (0)	shavar.prod.mozaws.net		52.36.50.141	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:49.587609053 CEST	1.1.1.1	192.168.2.5	0xae5c	No error (0)	shavar.prod.mozaws.net		44.230.225.207	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:54.879188061 CEST	1.1.1.1	192.168.2.5	0x342b	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:12:54.879188061 CEST	1.1.1.1	192.168.2.5	0x342b	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:12:54.879188061 CEST	1.1.1.1	192.168.2.5	0x342b	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:55.003734112 CEST	1.1.1.1	192.168.2.5	0x6271	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:55.296572924 CEST	1.1.1.1	192.168.2.5	0x40e5	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:55.404747963 CEST	1.1.1.1	192.168.2.5	0x986	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:59.611088991 CEST	1.1.1.1	192.168.2.5	0x34bb	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:12:59.719369888 CEST	1.1.1.1	192.168.2.5	0x8fb0	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:00.357419014 CEST	1.1.1.1	192.168.2.5	0xa4c9	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:13:00.357419014 CEST	1.1.1.1	192.168.2.5	0xa4c9	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:13:00.357419014 CEST	1.1.1.1	192.168.2.5	0xa4c9	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:00.357449055 CEST	1.1.1.1	192.168.2.5	0xc4b0	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:00.380980015 CEST	1.1.1.1	192.168.2.5	0x84e8	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:13:00.380980015 CEST	1.1.1.1	192.168.2.5	0x84e8	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:00.793626070 CEST	1.1.1.1	192.168.2.5	0xde1e	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:13:00.793626070 CEST	1.1.1.1	192.168.2.5	0xde1e	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:01.103420019 CEST	1.1.1.1	192.168.2.5	0x120b	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:01.211615086 CEST	1.1.1.1	192.168.2.5	0xb2bc	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Apr 15, 2025 17:13:03.089848042 CEST	1.1.1.1	192.168.2.5	0xb257	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:13:03.089848042 CEST	1.1.1.1	192.168.2.5	0xb257	No error (0)	youtube-ui.l.google.com		108.177.122.190	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:03.089848042 CEST	1.1.1.1	192.168.2.5	0xb257	No error (0)	youtube-ui.l.google.com		74.125.138.190	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:03.089848042 CEST	1.1.1.1	192.168.2.5	0xb257	No error (0)	youtube-ui.l.google.com		142.251.15.136	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:03.089848042 CEST	1.1.1.1	192.168.2.5	0xb257	No error (0)	youtube-ui.l.google.com		142.251.15.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:03.089848042 CEST	1.1.1.1	192.168.2.5	0xb257	No error (0)	youtube-ui.l.google.com		74.125.21.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:03.089848042 CEST	1.1.1.1	192.168.2.5	0xb257	No error (0)	youtube-ui.l.google.com		74.125.138.136	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:03.089848042 CEST	1.1.1.1	192.168.2.5	0xb257	No error (0)	youtube-ui.l.google.com		108.177.122.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:03.089848042 CEST	1.1.1.1	192.168.2.5	0xb257	No error (0)	youtube-ui.l.google.com		64.233.176.190	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:03.089848042 CEST	1.1.1.1	192.168.2.5	0xb257	No error (0)	youtube-ui.l.google.com		142.251.15.190	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:03.089848042 CEST	1.1.1.1	192.168.2.5	0xb257	No error (0)	youtube-ui.l.google.com		172.217.215.190	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:03.089848042 CEST	1.1.1.1	192.168.2.5	0xb257	No error (0)	youtube-ui.l.google.com		64.233.176.136	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:03.089848042 CEST	1.1.1.1	192.168.2.5	0xb257	No error (0)	youtube-ui.l.google.com		108.177.122.136	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:03.089848042 CEST	1.1.1.1	192.168.2.5	0xb257	No error (0)	youtube-ui.l.google.com		142.251.15.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:03.089848042 CEST	1.1.1.1	192.168.2.5	0xb257	No error (0)	youtube-ui.l.google.com		74.125.138.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:03.089848042 CEST	1.1.1.1	192.168.2.5	0xb257	No error (0)	youtube-ui.l.google.com		74.125.138.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:03.089848042 CEST	1.1.1.1	192.168.2.5	0xb257	No error (0)	youtube-ui.l.google.com		108.177.122.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:03.090722084 CEST	1.1.1.1	192.168.2.5	0x16bb	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:13:03.090722084 CEST	1.1.1.1	192.168.2.5	0x16bb	No error (0)	star-mini.c10r.facebook.com		31.13.88.35	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:03.090739965 CEST	1.1.1.1	192.168.2.5	0x66ce	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:13:03.090739965 CEST	1.1.1.1	192.168.2.5	0x66ce	No error (0)	dyna.wikimedia.org		208.80.154.224	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.174988985 CEST	1.1.1.1	192.168.2.5	0x8ef7	No error (0)	star-mini.c10r.facebook.com		31.13.88.35	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.176320076 CEST	1.1.1.1	192.168.2.5	0x50f0	No error (0)	dyna.wikimedia.org		208.80.154.224	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.177884102 CEST	1.1.1.1	192.168.2.5	0xbe70	No error (0)	youtube-ui.l.google.com		74.125.21.136	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.177884102 CEST	1.1.1.1	192.168.2.5	0xbe70	No error (0)	youtube-ui.l.google.com		142.250.105.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.177884102 CEST	1.1.1.1	192.168.2.5	0xbe70	No error (0)	youtube-ui.l.google.com		64.233.185.136	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.177884102 CEST	1.1.1.1	192.168.2.5	0xbe70	No error (0)	youtube-ui.l.google.com		64.233.185.190	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.177884102 CEST	1.1.1.1	192.168.2.5	0xbe70	No error (0)	youtube-ui.l.google.com		173.194.219.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.177884102 CEST	1.1.1.1	192.168.2.5	0xbe70	No error (0)	youtube-ui.l.google.com		142.250.105.136	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.177884102 CEST	1.1.1.1	192.168.2.5	0xbe70	No error (0)	youtube-ui.l.google.com		74.125.21.190	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.177884102 CEST	1.1.1.1	192.168.2.5	0xbe70	No error (0)	youtube-ui.l.google.com		64.233.177.190	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.177884102 CEST	1.1.1.1	192.168.2.5	0xbe70	No error (0)	youtube-ui.l.google.com		173.194.219.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.177884102 CEST	1.1.1.1	192.168.2.5	0xbe70	No error (0)	youtube-ui.l.google.com		64.233.185.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.177884102 CEST	1.1.1.1	192.168.2.5	0xbe70	No error (0)	youtube-ui.l.google.com		142.250.105.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.177884102 CEST	1.1.1.1	192.168.2.5	0xbe70	No error (0)	youtube-ui.l.google.com		64.233.177.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.177884102 CEST	1.1.1.1	192.168.2.5	0xbe70	No error (0)	youtube-ui.l.google.com		173.194.219.136	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.177884102 CEST	1.1.1.1	192.168.2.5	0xbe70	No error (0)	youtube-ui.l.google.com		173.194.219.190	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.177884102 CEST	1.1.1.1	192.168.2.5	0xbe70	No error (0)	youtube-ui.l.google.com		64.233.185.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.177884102 CEST	1.1.1.1	192.168.2.5	0xbe70	No error (0)	youtube-ui.l.google.com		64.233.177.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.282325029 CEST	1.1.1.1	192.168.2.5	0xec4e	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Apr 15, 2025 17:13:04.284614086 CEST	1.1.1.1	192.168.2.5	0x827	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Apr 15, 2025 17:13:04.285062075 CEST	1.1.1.1	192.168.2.5	0x5133	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Apr 15, 2025 17:13:04.285062075 CEST	1.1.1.1	192.168.2.5	0x5133	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Apr 15, 2025 17:13:04.285062075 CEST	1.1.1.1	192.168.2.5	0x5133	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Apr 15, 2025 17:13:04.285062075 CEST	1.1.1.1	192.168.2.5	0x5133	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Apr 15, 2025 17:13:04.932638884 CEST	1.1.1.1	192.168.2.5	0x8b3c	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:13:04.932638884 CEST	1.1.1.1	192.168.2.5	0x8b3c	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.932638884 CEST	1.1.1.1	192.168.2.5	0x8b3c	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.932638884 CEST	1.1.1.1	192.168.2.5	0x8b3c	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.932638884 CEST	1.1.1.1	192.168.2.5	0x8b3c	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:04.933103085 CEST	1.1.1.1	192.168.2.5	0x3a4	No error (0)	twitter.com		162.159.140.229	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:05.040498972 CEST	1.1.1.1	192.168.2.5	0x3e6b	No error (0)	twitter.com		172.66.0.227	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:05.040602922 CEST	1.1.1.1	192.168.2.5	0x7d12	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:05.040602922 CEST	1.1.1.1	192.168.2.5	0x7d12	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:05.040602922 CEST	1.1.1.1	192.168.2.5	0x7d12	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:05.040602922 CEST	1.1.1.1	192.168.2.5	0x7d12	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:05.069593906 CEST	1.1.1.1	192.168.2.5	0xbaf3	No error (0)	example.org		96.7.128.186	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:05.069593906 CEST	1.1.1.1	192.168.2.5	0xbaf3	No error (0)	example.org		96.7.128.192	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:05.069593906 CEST	1.1.1.1	192.168.2.5	0xbaf3	No error (0)	example.org		23.215.0.133	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:05.069593906 CEST	1.1.1.1	192.168.2.5	0xbaf3	No error (0)	example.org		23.215.0.132	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:07.545447111 CEST	1.1.1.1	192.168.2.5	0xb0e7	No error (0)	example.org		96.7.128.186	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:07.545447111 CEST	1.1.1.1	192.168.2.5	0xb0e7	No error (0)	example.org		23.215.0.133	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:07.545447111 CEST	1.1.1.1	192.168.2.5	0xb0e7	No error (0)	example.org		23.215.0.132	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:07.545447111 CEST	1.1.1.1	192.168.2.5	0xb0e7	No error (0)	example.org		96.7.128.192	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:14.990865946 CEST	1.1.1.1	192.168.2.5	0x62cf	No error (0)	normandy.cdn.mozilla.net	normandy.tombstone.experimenter.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:13:14.990865946 CEST	1.1.1.1	192.168.2.5	0x62cf	No error (0)	normandy.tombstone.experimenter.prod.webservices.mozgcp.net		34.49.51.44	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:15.013794899 CEST	1.1.1.1	192.168.2.5	0xb802	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:15.013794899 CEST	1.1.1.1	192.168.2.5	0xb802	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:15.013794899 CEST	1.1.1.1	192.168.2.5	0xb802	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:15.013794899 CEST	1.1.1.1	192.168.2.5	0xb802	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:15.099956036 CEST	1.1.1.1	192.168.2.5	0x57f8	No error (0)	normandy.tombstone.experimenter.prod.webservices.mozgcp.net		34.49.51.44	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:15.125690937 CEST	1.1.1.1	192.168.2.5	0x8519	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:15.125690937 CEST	1.1.1.1	192.168.2.5	0x8519	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:15.125690937 CEST	1.1.1.1	192.168.2.5	0x8519	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:15.125690937 CEST	1.1.1.1	192.168.2.5	0x8519	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:15.234111071 CEST	1.1.1.1	192.168.2.5	0x264b	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Apr 15, 2025 17:13:15.234111071 CEST	1.1.1.1	192.168.2.5	0x264b	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Apr 15, 2025 17:13:15.234111071 CEST	1.1.1.1	192.168.2.5	0x264b	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Apr 15, 2025 17:13:15.234111071 CEST	1.1.1.1	192.168.2.5	0x264b	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Apr 15, 2025 17:13:15.615933895 CEST	1.1.1.1	192.168.2.5	0x4356	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:13:15.615933895 CEST	1.1.1.1	192.168.2.5	0x4356	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:13:15.615933895 CEST	1.1.1.1	192.168.2.5	0x4356	No error (0)	a17.rackcdn.com.mdc.edgesuite.net	a19.dscg10.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:13:15.615933895 CEST	1.1.1.1	192.168.2.5	0x4356	No error (0)	a19.dscg10.akamai.net		23.47.204.64	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:15.615933895 CEST	1.1.1.1	192.168.2.5	0x4356	No error (0)	a19.dscg10.akamai.net		23.47.204.51	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:15.730434895 CEST	1.1.1.1	192.168.2.5	0xc76f	No error (0)	a19.dscg10.akamai.net		23.40.207.139	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:15.730434895 CEST	1.1.1.1	192.168.2.5	0xc76f	No error (0)	a19.dscg10.akamai.net		23.40.207.178	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:15.843597889 CEST	1.1.1.1	192.168.2.5	0x956a	No error (0)	a19.dscg10.akamai.net			28	IN (0x0001)	false
Apr 15, 2025 17:13:15.843597889 CEST	1.1.1.1	192.168.2.5	0x956a	No error (0)	a19.dscg10.akamai.net			28	IN (0x0001)	false
Apr 15, 2025 17:13:18.264193058 CEST	1.1.1.1	192.168.2.5	0xc77d	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:39.724483013 CEST	1.1.1.1	192.168.2.5	0x4790	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:13:44.773092985 CEST	1.1.1.1	192.168.2.5	0xbcef	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:14:18.969846010 CEST	1.1.1.1	192.168.2.5	0xb630	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:14:19.314055920 CEST	1.1.1.1	192.168.2.5	0x4e6c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:14:19.314055920 CEST	1.1.1.1	192.168.2.5	0x4e6c	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:14:19.314055920 CEST	1.1.1.1	192.168.2.5	0x4e6c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:14:19.423082113 CEST	1.1.1.1	192.168.2.5	0xba2	No error (0)	example.org		96.7.128.192	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:14:19.423082113 CEST	1.1.1.1	192.168.2.5	0xba2	No error (0)	example.org		23.215.0.132	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:14:19.423082113 CEST	1.1.1.1	192.168.2.5	0xba2	No error (0)	example.org		23.215.0.133	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:14:19.423082113 CEST	1.1.1.1	192.168.2.5	0xba2	No error (0)	example.org		96.7.128.186	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:15:39.327697992 CEST	1.1.1.1	192.168.2.5	0x598c	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:15:39.435667992 CEST	1.1.1.1	192.168.2.5	0x70a4	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:15:39.778120995 CEST	1.1.1.1	192.168.2.5	0xf536	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:15:39.778120995 CEST	1.1.1.1	192.168.2.5	0xf536	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:15:39.778120995 CEST	1.1.1.1	192.168.2.5	0xf536	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:15:39.892653942 CEST	1.1.1.1	192.168.2.5	0x87c7	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false

HTTP Request Dependency Graph

detectportal.firefox.com

ciscobinary.openh264.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49699	34.107.221.82	80	3308	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2025 17:12:48.668674946 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:12:48.776213884 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82624 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	34.107.221.82	80	3308	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2025 17:12:49.321052074 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:12:49.429039955 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82698 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	34.107.221.82	80	3308	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2025 17:12:49.467839003 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:12:49.575422049 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82625 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:12:50.549319983 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:12:50.656717062 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82626 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:13:00.249803066 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:13:00.359050035 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82636 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:13:00.686688900 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:13:00.794485092 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82636 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:13:01.099872112 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:13:01.207604885 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82637 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:13:01.953120947 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:13:02.061825037 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82638 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:13:02.401669979 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:13:02.509051085 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82638 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:13:04.850975990 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:13:04.958667994 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82640 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:13:06.621329069 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:13:06.729420900 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82642 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:13:07.850594044 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:13:07.959590912 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82643 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:13:08.077444077 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:13:08.185446978 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82644 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:13:15.088814974 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:13:15.198126078 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82651 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:13:15.223108053 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:13:15.331867933 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82651 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:13:15.463682890 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:13:15.572060108 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82651 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:13:17.580985069 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:13:17.688407898 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82653 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:13:18.383913994 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:13:18.491388083 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82654 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:13:28.497662067 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:13:38.609692097 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:13:38.759769917 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:13:38.867207050 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82674 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:13:45.056358099 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:13:45.163979053 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82681 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:13:45.518498898 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:13:45.625710011 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82681 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:13:45.828708887 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:13:45.936119080 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82681 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:13:55.938627005 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:14:06.055387974 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:14:16.167365074 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:14:19.206784010 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:14:19.314347029 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82715 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Apr 15, 2025 17:14:29.328855991 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:14:39.437170982 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:14:49.547489882 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:14:59.661724091 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:15:09.779493093 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:15:39.668096066 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 15, 2025 17:15:39.778141022 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 14 Apr 2025 16:15:44 GMT Age: 82795 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	34.107.221.82	80	3308	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2025 17:12:50.637223959 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:12:50.744652033 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82699 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:12:51.489080906 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:12:51.596704960 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82700 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:13:00.627141953 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:13:00.735641956 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82709 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:13:01.096827030 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:13:01.204391956 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82710 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:13:01.368917942 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:13:01.476912975 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82710 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:13:02.157238960 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:13:02.266911983 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82711 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:13:04.071572065 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:13:04.178966999 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82713 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:13:04.963057041 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:13:05.070394993 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82714 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:13:07.828108072 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:13:07.935625076 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82716 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:13:07.966579914 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:13:08.075012922 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82717 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:13:08.188616037 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:13:08.296094894 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82717 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:13:15.201396942 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:13:15.308974981 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82724 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:13:15.334386110 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:13:15.442353964 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82724 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:13:15.575589895 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:13:15.683072090 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82724 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:13:17.691310883 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:13:17.799670935 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82726 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:13:18.496786118 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:13:18.605087042 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82727 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:13:28.613487959 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:13:38.725536108 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:13:38.872227907 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:13:38.980235100 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82747 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:13:45.518309116 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:13:45.625576019 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82754 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:13:45.828216076 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:13:45.935528994 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82754 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:13:45.999192953 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:13:46.106640100 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82755 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:13:56.107930899 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:14:06.224839926 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:14:16.336793900 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:14:19.319910049 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:14:19.427356005 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82788 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 15, 2025 17:14:29.429400921 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:14:39.537431955 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:14:49.647845984 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:14:59.763134956 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:15:09.879898071 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 15, 2025 17:15:39.781752110 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 15, 2025 17:15:39.911681890 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 14 Apr 2025 16:14:31 GMT Age: 82868 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49737	23.47.204.64	80	3308	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2025 17:13:15.724452972 CEST	305	OUT	GET /openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip HTTP/1.1 Host: ciscobinary.openh264.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive
Apr 15, 2025 17:13:15.831537008 CEST	1358	IN	HTTP/1.1 200 OK Last-Modified: Wed, 12 Mar 2025 04:19:28 GMT ETag: 85430baed3398695717b0263807cf97c Content-Length: 453023 Accept-Ranges: bytes X-Timestamp: 1741753167.65917 Content-Type: application/zip X-Trans-Id: tx01b3942a3e444fe795adb-0067d453d3dfw1 Cache-Control: public, max-age=63720 Expires: Wed, 16 Apr 2025 08:55:15 GMT Date: Tue, 15 Apr 2025 15:13:15 GMT Connection: keep-alive Data Raw: 50 4b 03 04 14 00 00 00 08 00 cd 8d 62 4e d0 b9 df e8 52 e8 06 00 d0 97 0f 00 0f 00 00 00 67 6d 70 6f 70 65 6e 68 32 36 34 2e 64 6c 6c ec bd 0b 7c 14 45 b6 30 de 3d 99 84 49 98 a4 07 8c 18 31 c2 e8 ce ea 34 66 31 71 e3 9a 60 d4 e9 d0 93 f4 e0 04 c2 d3 80 88 71 a3 b9 a0 08 11 27 2b b8 10 08 93 68 2a 6d 7b d9 bb 7a d7 dd 6f 5f ff 7b 77 ef dd e7 c5 bd ee f2 d0 95 cc 24 92 07 28 24 41 21 c0 8a 11 7c 4c 18 81 00 42 26 41 32 ff 73 aa 7b 9e 04 44 64 f7 ff dd ff f7 f1 63 d2 55 d5 55 e7 d4 39 75 ce a9 53 a7 aa bb 4b 16 6c 60 12 18 86 d1 c3 2f 18 64 98 2d 8c fa cf c6 7c f9 bf 00 fc d2 26 be 9e c6 fc 39 f9 9d 9b b6 b0 ce 77 6e 9a b3 78 c9 d3 e6 aa 15 cb ff 69 c5 23 4f 9a 2b 1e 59 b6 6c b9 cb fc dd c7 cc 2b aa 97 99 97 2c 33 8b 33 66 9b 9f 5c fe e8 63 93 53 53 53 2c 1a 8c e9 d2 cf b7 a4 f0 fd fe d0 ef b1 92 cf 8f 4e a4 d7 d3 47 47 d1 eb 99 a3 ff 46 af 27 8f 26 d3 3a 27 fd 4b e0 5a 26 9c 3e 9a 40 af 67 8e de 4d af 9f 1f 4d d7 60 fc 13 fc 2a 84 fe a3 a3 e9 f5 14 bd ce 5a 52 b1 18 ef 85 fa 5e 6a 67 98 47 9f 4b 62 [TRUNCATED] Data Ascii: PKbNRgmpopenh264.dll\|E0=I14f1q`q'+hm{zo_{w$($A!\|LB&A2s{DdcUU9uSKl`/d-\|&9wnxi#O+Yl+,33f\cSSS,NGGF'&:'KZ&>@gMM`ZR^jgGKbo~va<Z1.#OeDXi$imBWQ&P,M,:c-\-iKI4a6Ov=WFCH>a'x#@fdu1OV1o}g5_3JHiZipM.bZ%GF/3qJo%gN})3N%!q^Im~6#~+AI]rx<IYjp0`SM@Ef=;!@EE 0nJdduM-qIlRz=}rDXLZx$\|c1cUkM&Qn]a]th!6 7JdDvKJ"Wgd*%nwJniinmr@M$'Zs#)%Rs:hR\t6'gUj+Fcr:\|!KWY17,r>N3RY_\IrDNJdM k&V-
Apr 15, 2025 17:13:15.831562042 CEST	1358	IN	Data Raw: 96 9a fc 7a 9a 25 01 e0 8e 2d 96 99 dc 44 11 c0 69 fc 04 26 99 81 9d 36 df 83 e6 d1 0c 37 ba 32 54 29 fe 3e b0 1b 30 da fb 25 d2 26 c9 b6 95 92 3b 60 5a 01 63 90 2c 29 a5 ac 54 3b 84 6a bf e2 06 49 7e 0a f0 79 03 12 7f 52 72 0f 9a 9f 9e 26 b9 3d Data Ascii: z%-Di&672T)>0%&;`Zc,)T;jI~yRr&=V4C\|-h(*dIUkq9[dvl4Mtb.o\|o'J_:G Z,C0.a._9}-mOy9sC0/a?wJWxekb
Apr 15, 2025 17:13:15.832273006 CEST	1358	IN	Data Raw: e4 fb 0b b5 66 76 ec 61 29 f5 e2 47 90 5f 10 ca c7 4b a1 17 fd be 3d 67 54 13 97 1d bf 1a 0a f9 3b 73 43 1e cf 2b b1 1e 8f 09 c9 29 21 bb 1c e4 3d 07 d9 ed bb 3d 91 96 1a 54 f3 5a 42 c7 e2 36 7d c8 8b 88 9a 9e 1f ce 93 e4 6a 83 43 b6 33 4e d2 a7 Data Ascii: fva)G_K=gT;sC+)!==TZB6}jC3NZtSnp$KUl'}U IN~\+PU^Kt:u*;I/l`%s^9pD<No\|&zc%Z}ne2!-~;15Dcx%1<`v
Apr 15, 2025 17:13:15.832288980 CEST	1358	IN	Data Raw: 3f c5 f9 a3 91 f9 d4 a6 51 75 95 84 30 34 34 d1 be c0 25 e7 7b 1a 04 f7 bd e8 4b 09 ef 29 85 44 76 e4 f9 df 86 a3 ee 00 d9 b8 8a aa 13 52 f9 cb c2 ef fb 8f a4 4b f9 27 36 df 73 5f 72 bf f2 4b ee 17 25 85 fd 9b 2f f5 5f 57 3c 11 f2 5f ad 5f dd 7f Data Ascii: ?Qu044%{K)DvRK'6s_rK%/_W<__?JsCZrw:DHVK#gz)/1R88):g>ySgnX-P16E)XA!^8>9"Z[Q&%>+xFz^XCWr_-j&(C
Apr 15, 2025 17:13:15.834089994 CEST	1358	IN	Data Raw: 41 4d 6d c3 e7 1d cc 76 b2 cb 49 da 24 b2 93 ee 1d dc b1 15 a7 08 df 1f 0f a0 b9 ab d2 f6 0e 3e 2d d7 34 b2 0c b5 d2 2c 92 2a 6b 78 cf 40 9b d6 a5 0a 01 3c 77 c1 20 ca 82 d5 89 1b b5 f2 4c 50 16 af 23 f8 61 94 fd 8b 3d 1d b9 35 3b 1d f5 9f 62 02 Data Ascii: AMmvI$>-4,kx@<w LP#a=5;byI bIj+pB1\X%]"^\no%S<ov\|2z_gOg/n}{6{ED$Y'1ZHBFi0(CgMQ%E\|O<?x(s#Gt
Apr 15, 2025 17:13:15.834112883 CEST	1358	IN	Data Raw: 0a df c6 d3 7a e4 0c d6 a9 0d 22 d1 22 48 9a 85 5b ff 53 6a 9c 80 1a 0f 0c 88 57 1b 90 76 5f d6 4e e0 a4 b2 f8 56 87 fb e3 5e 07 b1 07 fa 08 35 ca 9f 3a f9 01 29 ff dc d3 77 20 7c fe 03 27 f9 50 22 43 f8 ac 47 c1 d1 14 c6 a1 e8 33 91 49 50 c7 c1 Data Ascii: z""H[SjWv_NV^5:)w \|'P"CG3IPHg{JG-3;{^"tH<G>J@91Bu-q8 oXXP\|?G_}!=q%gNRip'$qHFOcVM@*;^8x{~/
Apr 15, 2025 17:13:15.835871935 CEST	1358	IN	Data Raw: a2 d7 dd 16 94 94 c4 19 d8 34 41 bf 45 70 b7 b3 a4 47 e4 3d 35 46 11 39 96 7c 06 89 29 43 ba 05 be 07 06 14 0a bf 3a 25 5b 54 4a bc 7b 7a 07 3a 6f ea 87 c6 da 70 79 60 b8 72 3c ea da 22 fe b8 5d d8 3f c6 75 9e 83 ec e0 36 3d 35 1e 7c 27 d5 47 4e Data Ascii: 4AEpG=5F9\|)C:%[TJ{z:opy`r<"]?u6=5\|'GN^m{\|\rVdS^`n_aL:)oh:\|d`M8i0AEj8@>8F?#X8^ZuEM&oz:ena,lG}?#AIX=
Apr 15, 2025 17:13:15.835891962 CEST	1358	IN	Data Raw: 6a 83 c8 4f 81 2b da 1d cd 50 c5 1e e1 27 27 6e 57 d9 c9 02 8a 04 fd 56 f0 c1 54 2c d4 e5 ff 44 a4 3b 9a fe 05 11 8c e7 68 a4 f5 f4 57 8c b4 46 05 f5 45 ba 95 19 5e ee e0 aa 04 48 4e 8f 27 f9 a9 fb 35 92 7b 60 8e 47 92 f7 63 07 7a ae 26 c9 69 f7 Data Ascii: jO+P''nWVT,D;hWFE^HN'5{`Gcz&iGHF,$0^-C6bKi#[(FjiE%~":\d5cZThW[4{:l(It><*fzJW{h0(OJ:nf<7
Apr 15, 2025 17:13:15.837147951 CEST	1358	IN	Data Raw: 71 4c af db d4 5e 2f cc a7 5b 85 3f a0 47 9e 50 17 b8 17 1f 4d 08 45 97 93 77 62 af 13 d8 50 5f bf b6 25 a1 e6 ab ef 37 1a f1 02 ef c5 90 0a 3d 16 76 85 f2 de 11 67 12 81 ed fe 79 a1 ce b6 7f fd ce ee 8c 51 5d 10 d3 a2 64 b7 47 15 53 a6 de 83 62 Data Ascii: qL^/[?GPMEwbP_%7=vgyQ]dGSbI,n8g7`r/GP.&TL1(x@x}\d:>oiYfP.TJD~qRz.zm1^c{0osDHtai#>WD'ywR>~
Apr 15, 2025 17:13:15.837163925 CEST	1358	IN	Data Raw: a8 c7 a3 c0 5c e9 61 c4 0d 23 3f 10 a1 7d e7 c2 41 76 48 72 e2 7d 3f 8a bc c2 1b 8f ed 73 db a6 dd c2 9e 5c 69 72 0f e6 6e 41 9d 02 c8 52 45 3b d8 17 fc 9e d8 ac 74 23 7e 1f 33 93 e5 b6 cd ba 95 3d b5 92 73 0f 85 6a 35 4b af d0 6f c3 2a d7 3e 09 Data Ascii: \a#?}AvHr}?s\irnARE;t#~3=sj5Ko*>mzi;k^.).K6ijHQn&pe1tYw,rvv81~V\s)D7{~o)L`!@]X9VuR^:+:-@;)]m+Ud{@
Apr 15, 2025 17:13:15.838784933 CEST	1358	IN	Data Raw: ab 10 41 97 45 34 8f 1a 32 18 09 56 a4 ae 5a 48 d3 2e c6 d3 fb 41 da 40 19 6e a7 f7 eb 0f ba 1e a3 7d c3 de 40 77 8d b8 62 64 24 b6 8f f6 3a 84 5a 22 a7 25 d9 05 bd 1d 07 35 ce 87 6b 2c 8c ea dc 38 45 4f 9b 2a 7a 1b 78 b0 17 de 96 b4 a5 25 8a f8 Data Ascii: AE42VZH.A@n}@wbd$:Z"%5k,8EO*zx%`]x)AAC;x/SslU80njn.oG]}}0Z78&{cv"X,picHcS'(!(%]bCLS 2?Aqbkd

Target ID:	3
Start time:	11:12:36
Start date:	15/04/2025
Path:	C:\Users\user\Desktop\random.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\random.exe"
Imagebase:	0x6b0000
File size:	970'240 bytes
MD5 hash:	55C6AC234ACA077957813B6A5B94A805
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:12:38
Start date:	15/04/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x970000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:12:38
Start date:	15/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7e2000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:12:41
Start date:	15/04/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x970000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:12:41
Start date:	15/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7e2000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:12:41
Start date:	15/04/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x970000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:12:41
Start date:	15/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7e2000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:12:41
Start date:	15/04/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x970000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:12:41
Start date:	15/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7e2000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:12:41
Start date:	15/04/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x970000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:12:41
Start date:	15/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7e2000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:12:42
Start date:	15/04/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff7de980000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:12:42
Start date:	15/04/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff7de980000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:12:42
Start date:	15/04/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff7de980000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	11:12:43
Start date:	15/04/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2188 -parentBuildID 20230927232528 -prefsHandle 2136 -prefMapHandle 2128 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bf562db-b021-4f69-861d-d0c8b4628b56} 3308 "\\.\pipe\gecko-crash-server-pipe.3308" 2a5ea96f110 socket
Imagebase:	0x7ff7de980000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	11:12:47
Start date:	15/04/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3904 -parentBuildID 20230927232528 -prefsHandle 3932 -prefMapHandle 3792 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {64025ebd-91c0-456e-aab9-fa0b6e3c6798} 3308 "\\.\pipe\gecko-crash-server-pipe.3308" 2a5fcee2410 rdd
Imagebase:	0x7ff7de980000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	11:12:59
Start date:	15/04/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5224 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5228 -prefMapHandle 2992 -prefsLen 33119 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cf9bd39-8f88-4f62-8978-d6e0767493a5} 3308 "\\.\pipe\gecko-crash-server-pipe.3308" 2a5fa9a6d10 utility
Imagebase:	0x7ff7de980000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	11:13:01
Start date:	15/04/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
Imagebase:	0x7ff7de980000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:13:02
Start date:	15/04/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
Imagebase:	0x7ff7de980000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report random.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_9885f803-13ff-420e-aa11-c00010e71f31.json (copy)

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_9885f803-13ff-420e-aa11-c00010e71f31.json.tmp

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\jumpListCache\pV+3TL7Nu3EP5juvr_gPjg==.ico

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

C:\Users\user\AppData\Local\Temp\tmpaddon

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2KFZ1YA7SAB0TC6PSPTU.temp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\40371339ad31a7e6.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\A2OZ3FX79SMOWPEHK9KZ.temp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\syjwmoxm.MozillaBackgroundTask-308046B0AF4A39CB-backgroundupdate\compatibility.ini

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\syjwmoxm.MozillaBackgroundTask-308046B0AF4A39CB-backgroundupdate\prefs.js

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4 (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json (copy)

Windows Analysis Report
random.exe