Edit tour

Linux Analysis Report
http://31.214.243.29/Demon.mips

Overview

General Information

Sample URL:	http://31.214.243.29/Demon.mips
Analysis ID:	831144
Infos:

Detection

Gafgyt, Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Yara detected Gafgyt

Writes ELF files to disk

Yara signature match

Creates hidden files and/or directories

Uses the "uname" system call to query kernel version information (possible evasion)

Queries the installed Ubuntu/CentOS release

Classification

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	831144
Start date and time:	2023-03-21 06:16:03 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://31.214.243.29/Demon.mips
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal72.troj.lin@0/45@31/0

Warnings

Excluded domains from analysis (whitelisted): incoming.telemetry.mozilla.org, aus5.mozilla.org
VT rate limit hit for: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1
VT rate limit hit for: http://31.214.243.29/Demon.mipsstrongly-framed1request-methodGETresponse-headHTTP/1.1

Process Tree

system is lnxubuntu20

exo-open (PID: 6242, Parent: 6229, MD5: 60a307a6a6325e2034eb5cc56bff1abd) Arguments: exo-open http://31.214.243.29/Demon.mips

exo-open New Fork (PID: 6243, Parent: 6242)

exo-open New Fork (PID: 6244, Parent: 6243)

exo-helper-2 (PID: 6244, Parent: 1860, MD5: ab59c8990baa7254463cdf800a83b9e3) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/exo-2/exo-helper-2 --launch WebBrowser http://31.214.243.29/Demon.mips

exo-helper-2 New Fork (PID: 6247, Parent: 6244)

sensible-browser (PID: 6247, Parent: 6244, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/bin/sensible-browser http://31.214.243.29/Demon.mips

sensible-browser New Fork (PID: 6248, Parent: 6247)

which (PID: 6248, Parent: 6247, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: which sensible-browser

x-www-browser (PID: 6247, Parent: 6244, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/bin/x-www-browser http://31.214.243.29/Demon.mips

x-www-browser New Fork (PID: 6249, Parent: 6247)

which (PID: 6249, Parent: 6247, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: which /usr/bin/x-www-browser

firefox (PID: 6247, Parent: 6244, MD5: bf9680bcd223dba6b6e38b63bc4f73d7) Arguments: /usr/lib/firefox/firefox http://31.214.243.29/Demon.mips

firefox New Fork (PID: 6251, Parent: 6247)

firefox New Fork (PID: 6252, Parent: 6247)

firefox New Fork (PID: 6270, Parent: 6247)

lsb_release (PID: 6270, Parent: 6247, MD5: 69f442c3e33b5f9a66b722c29ad89435) Arguments: /usr/bin/lsb_release -idrc

firefox New Fork (PID: 6295, Parent: 6247)

dbus-launch (PID: 6295, Parent: 6247, MD5: 0b22a45154a51c6121bb1d208d8ab203) Arguments: dbus-launch --autolaunch=ee49dfd4fa47433baee88884e2d7de7c --binary-syntax --close-stderr

firefox New Fork (PID: 6304, Parent: 6247)

firefox New Fork (PID: 6306, Parent: 6304)

firefox (PID: 6304, Parent: 6247, MD5: bf9680bcd223dba6b6e38b63bc4f73d7) Arguments: /usr/lib/firefox/firefox -contentproc -parentBuildID 20210816143654 -prefsLen 1 -prefMapSize 238647 -appdir /usr/lib/firefox/browser 6247 true socket

firefox New Fork (PID: 6340, Parent: 6247)

firefox New Fork (PID: 6342, Parent: 6340)

firefox (PID: 6340, Parent: 6247, MD5: bf9680bcd223dba6b6e38b63bc4f73d7) Arguments: /usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 188 -prefMapSize 238647 -jsInit 285716 -parentBuildID 20210816143654 -appdir /usr/lib/firefox/browser 6247 true tab

firefox New Fork (PID: 6383, Parent: 6247)

firefox New Fork (PID: 6385, Parent: 6383)

firefox (PID: 6383, Parent: 6247, MD5: bf9680bcd223dba6b6e38b63bc4f73d7) Arguments: /usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 5911 -prefMapSize 238647 -jsInit 285716 -parentBuildID 20210816143654 -appdir /usr/lib/firefox/browser 6247 true tab

firefox New Fork (PID: 6434, Parent: 6247)

firefox New Fork (PID: 6436, Parent: 6434)

firefox (PID: 6434, Parent: 6247, MD5: bf9680bcd223dba6b6e38b63bc4f73d7) Arguments: /usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 6099 -prefMapSize 238647 -jsInit 285716 -parentBuildID 20210816143654 -appdir /usr/lib/firefox/browser 6247 true tab

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://blog.netlab.360.com/the-gafgyt-variant-vbot-and-its-31-campaigns/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1546e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15482:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15496:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1550e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1559c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15600:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15614:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15628:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1563c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15650:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15664:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
dump.pcap	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1541e:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Dropped Files

Source	Rule	Description	Author	Strings
/tmp/khk19L2S.mips.part	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
/tmp/khk19L2S.mips.part	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
/tmp/khk19L2S.mips.part	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x128c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1292c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1297c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x129a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x129b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x129cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x129e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x129f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
/tmp/khk19L2S.mips.part	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x12878:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x128c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1292c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1297c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x129a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x129b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x129cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x129e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x129f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x12878:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 3 entries

HTTP traffic detected: POST /submit/firefox-desktop/deletion-request/1/7c4c3d68-b8c8-44e6-a714-345a0583faf2 HTTP/1.1Host: incoming.telemetry.mozilla.orgUser-Agent: Glean/39.0.0 (Rust on Linux)Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brx-client-type: Gleanx-client-version: 39.0.0content-type: application/json; charset=utf-8date: Tue, 21 Mar 2023 06:17:35 GMTcontent-encoding: gzipcontent-length: 284Connection: keep-aliveSec-Fetch-Dest: emptySec-Fetch-Mode: no-corsSec-Fetch-Site: nonePragma: no-cacheCache-Control: no-cache

Source: unknown

HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.23:57056 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: /tmp/khk19L2S.mips.part, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: /tmp/khk19L2S.mips.part, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: /tmp/khk19L2S.mips.part, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: /tmp/khk19L2S.mips.part, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.troj.lin@0/45@31/0

Source: khk19L2S.mips.part.42.dr	ELF static info symbol of dropped file: libc/string/mips/memcpy.S
Source: khk19L2S.mips.part.42.dr	ELF static info symbol of dropped file: libc/string/mips/memset.S
Source: khk19L2S.mips.part.42.dr	ELF static info symbol of dropped file: libc/sysdeps/linux/mips/crt1.S
Source: khk19L2S.mips.part.42.dr	ELF static info symbol of dropped file: libc/sysdeps/linux/mips/crti.S
Source: khk19L2S.mips.part.42.dr	ELF static info symbol of dropped file: libc/sysdeps/linux/mips/crtn.S
Source: 730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr	ELF static info symbol of dropped file: libc/string/mips/memcpy.S
Source: 730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr	ELF static info symbol of dropped file: libc/string/mips/memset.S
Source: 730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr	ELF static info symbol of dropped file: libc/sysdeps/linux/mips/crt1.S
Source: 730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr	ELF static info symbol of dropped file: libc/sysdeps/linux/mips/crti.S
Source: 730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr	ELF static info symbol of dropped file: libc/sysdeps/linux/mips/crtn.S

Source: /usr/lib/firefox/firefox (PID: 6247)	File written: /tmp/khk19L2S.mips.part			Jump to dropped file
Source: /usr/lib/firefox/firefox (PID: 6247)	File written: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1			Jump to dropped file

Source: /usr/bin/exo-open (PID: 6242)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-2/exo-helper-2 (PID: 6244)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-2/exo-helper-2 (PID: 6244)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-2/exo-helper-2 (PID: 6244)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 6247)	Directory: /home/saturnino/.cache	Jump to behavior

Source: /usr/bin/exo-open (PID: 6242)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-2/exo-helper-2 (PID: 6244)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 6247)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 6252)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/dbus-launch (PID: 6295)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 6340)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 6383)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 6434)	Queries kernel information via 'uname':	Jump to behavior

Source: /usr/lib/firefox/firefox (PID: 6270)

Arguments: /usr/bin/lsb_release -> /usr/bin/lsb_release -idrc

Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: /tmp/khk19L2S.mips.part, type: DROPPED
Source: Yara match	File source: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1, type: DROPPED

Yara detected Gafgyt

Source: Yara match	File source: /tmp/khk19L2S.mips.part, type: DROPPED
Source: Yara match	File source: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1, type: DROPPED

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: /tmp/khk19L2S.mips.part, type: DROPPED
Source: Yara match	File source: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1, type: DROPPED

Yara detected Gafgyt

Source: Yara match	File source: /tmp/khk19L2S.mips.part, type: DROPPED
Source: Yara match	File source: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Hidden Files and Directories	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://31.214.243.29/Demon.mips	100%	Avira URL Cloud	malware

Dropped Files

Source	Detection	Scanner	Label	Link
/tmp/khk19L2S.mips.part	62%	ReversingLabs	Linux.Trojan.Mirai

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://www.billybobbot.com/crawler/)	0%	URL Reputation	safe
http://www.billybobbot.com/crawler/)	0%	URL Reputation	safe
https://trr.dns.nextdns.io/	0%	URL Reputation	safe
https://trr.dns.nextdns.io/	0%	URL Reputation	safe
http://pki.goog/repo/certs/gtsr1.der04	0%	URL Reputation	safe
https://firefox.dns.next	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://firefox.dns.nextdns.io/	0%	URL Reputation	safe
https://mozilla.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
http://fast.no/support/crawler.asp)	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
http://crl.pki.goog/gtsr1/gtsr1.crl0W	0%	URL Reputation	safe
https://pki.goog/repository/0	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
http://crl.pki.goog/gsr2/gsr2.crl0?	0%	URL Reputation	safe
http://feedback.redkolibri.com/	0%	URL Reputation	safe
http://31.214.243.29/	0%	Avira URL Cloud	safe
http://31.214.243.29/predictor::seen1	0%	Avira URL Cloud	safe
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
http://31.214.243.29/Demon.mipsstrongly-framed1request-methodGETresponse-headHTTP/1.1	0%	Avira URL Cloud	safe
http://31.214.243.29/	10%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
star-mini.c10r.facebook.com	157.240.20.35	true	false	high
fennec-catalog-cdn.prod.mozaws.net	34.111.73.144	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	unknown
twitter.com	104.244.42.129	true	false	high
youtube-ui.l.google.com	142.250.185.142	true	false	high
autopush.prod.mozaws.net	52.10.254.200	true	false	high
reddit.map.fastly.net	151.101.65.140	true	false	unknown
firefox.settings.services.mozilla.com	35.241.9.150	true	false	high
prod.ingestion-edge.prod.dataops.mozgcp.net	34.120.208.123	true	false	unknown
dyna.wikimedia.org	91.198.174.192	true	false	high
www.example.com	93.184.216.34	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	unknown
www.facebook.com	unknown	unknown	false	high
www.reddit.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
push.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high
firefox-settings-attachments.cdn.mozilla.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://firefox.settings.services.mozilla.com/v1/	false	high
http://31.214.243.29/Demon.mips	true	unknown
https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-language-packs/4f1bcaa0-ddf9-43ef-aca3-8378c4d05582.ftl	false	high
https://push.services.mozilla.com/	false	high
https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US	false	high
https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2021-09-19-15-17-11.chain	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com/policies/privacy/	scriptCache-new.bin.42.dr	false		high
http://www.billybobbot.com/crawler/)	730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr, khk19L2S.mips.part.42.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://settings.stage.mozaws.net/v1/buckets/main-preview/collections/search-config/records	scriptCache-new.bin.42.dr	false		high
https://support.mozilla.org/kb/	scriptCache-new.bin.42.dr	false		high
https://yandex.com	scriptCache-new.bin.42.dr	false		high
https://trr.dns.nextdns.io/	scriptCache-new.bin.42.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=921157	scriptCache-new.bin.42.dr	false		high
https://developer.mozilla.org/en-US/docs/JavaScript_OS.File/OS.File.Info#Cross-platform_Attributes	scriptCache-new.bin.42.dr	false		high
https://private.canadianshield.cira.ca/dns-query	3870112724rsegmnoittet-es.sqlite-wal.42.dr, 3870112724rsegmnoittet-es.sqlite.42.dr	false		high
http://31.214.243.29/	134714F2DF01B21FA934AB16898B0583114E19B0.42.dr	false	10%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://mozilla.org/MPL/2.0/.	asrouter.ftl.tmp.42.dr, DED23BB33EA3C88FAD1C0A1CD53916E0D8C424D3.42.dr	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1238180	scriptCache-new.bin.42.dr	false		high
https://ebay.com	scriptCache-new.bin.42.dr	false		high
https://www.openh264.org/	scriptCache-new.bin.42.dr	false		high
http://pki.goog/repo/certs/gtsr1.der04	cert9.db.42.dr, cert9.db-journal.42.dr	false	URL Reputation: safe	unknown
https://firefox.dns.next	3870112724rsegmnoittet-es.sqlite-wal.42.dr, 3870112724rsegmnoittet-es.sqlite.42.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings	scriptCache-new.bin.42.dr	false		high
http://31.214.243.29/predictor::seen1	134714F2DF01B21FA934AB16898B0583114E19B0.42.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com	scriptCache-new.bin.42.dr	false		high
http://x1.c.lencr.org/0	cert9.db.42.dr, cert9.db-journal.42.dr	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	cert9.db.42.dr, cert9.db-journal.42.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://firefox.dns.nextdns.io/	scriptCache-new.bin.42.dr	false	URL Reputation: safe	unknown
https://remote-settings.readthedocs.io	F8CBD54DDA10F4286A41EC6A537240712D6C2308.42.dr	false		high
https://profiler.firefox.com	scriptCache-new.bin.42.dr	false		high
http://json-schema.org/draft-04/schema#	scriptCache-new.bin.42.dr	false		high
http://www.baidu.com/search/spider.html)	730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr, khk19L2S.mips.part.42.dr	false		high
https://mozilla.cloudflare-dns.com/dns-query	3870112724rsegmnoittet-es.sqlite-wal.42.dr, 3870112724rsegmnoittet-es.sqlite.42.dr	false	URL Reputation: safe	unknown
http://fast.no/support/crawler.asp)	khk19L2S.mips.part.42.dr	false	URL Reputation: safe	unknown
https://doh.xfinity.com/dns-query	3870112724rsegmnoittet-es.sqlite-wal.42.dr, 3870112724rsegmnoittet-es.sqlite.42.dr	false		high
https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/	254256B27E0C48CF9B80B695F0B3B8CA84610495.42.dr	false		high
http://kinto.readthedocs.io/en/latest/tutorials/synchronisation.html#polling-for-remote-changes	F8CBD54DDA10F4286A41EC6A537240712D6C2308.42.dr	false		high
https://www.widevine.com/	scriptCache-new.bin.42.dr	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	cert9.db.42.dr, cert9.db-journal.42.dr	false	URL Reputation: safe	unknown
https://settings.stage.mozaws.net/v1/buckets/main/collections/search-config/records	scriptCache-new.bin.42.dr	false		high
http://crl.pki.goog/gtsr1/gtsr1.crl0W	cert9.db.42.dr, cert9.db-journal.42.dr	false	URL Reputation: safe	unknown
https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations	scriptCache-child-new.bin.42.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	cert9.db.42.dr, cert9.db-journal.42.dr	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes	scriptCache-new.bin.42.dr	false		high
https://pki.goog/repository/0	cert9.db.42.dr, cert9.db-journal.42.dr	false	URL Reputation: safe	unknown
http://31.214.243.29/Demon.mipsstrongly-framed1request-methodGETresponse-headHTTP/1.1	730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr	true	Avira URL Cloud: safe	unknown
https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-language-packs/4f1bcaa0-ddf9-	DED23BB33EA3C88FAD1C0A1CD53916E0D8C424D3.42.dr	false		high
https://firefox.settings.services.mozilla.com/v1	scriptCache-new.bin.42.dr	false		high
https://duckduckgo.com	scriptCache-new.bin.42.dr	false		high
https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records	scriptCache-new.bin.42.dr	false		high
https://github.com/Kinto/kinto-attachment/	F8CBD54DDA10F4286A41EC6A537240712D6C2308.42.dr	false		high
https://amazon.com	scriptCache-new.bin.42.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	cert9.db.42.dr, cert9.db-journal.42.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-help	scriptCache-new.bin.42.dr	false		high
https://firefox-settings-attachments.cdn.mozilla.net/	F8CBD54DDA10F4286A41EC6A537240712D6C2308.42.dr	false		high
https://support.mozilla.org/kb/flash-protected-mode-autodisabled	scriptCache-new.bin.42.dr	false		high
http://crl.pki.goog/gsr2/gsr2.crl0?	cert9.db.42.dr, cert9.db-journal.42.dr	false	URL Reputation: safe	unknown
https://google.com	scriptCache-new.bin.42.dr	false		high
http://feedback.redkolibri.com/	730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr, khk19L2S.mips.part.42.dr	false	URL Reputation: safe	unknown
http://www.baidu.com/search/spider.htm)	730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr, khk19L2S.mips.part.42.dr	false		high
https://hg.mozilla.org/releases/mozilla-release/rev/7dafd5f51c0afd1ae627bb4762ac0c140a6cd5f5	scriptCache-new.bin.42.dr	false		high
https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco	scriptCache-new.bin.42.dr	false		high
https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202	5FFD69415953BE9CE9C07B2E9C26DA959ADEA6CB.42.dr	false		high
https://baidu.com	scriptCache-new.bin.42.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
44.231.103.117	unknown	United States	16509	AMAZON-02US	false
52.25.208.227	unknown	United States	16509	AMAZON-02US	false
31.214.243.29	unknown	Germany	197071	ACTIVE-SERVERSactive-serverscomDE	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
34.120.208.123	prod.ingestion-edge.prod.dataops.mozgcp.net	United States	15169	GOOGLEUS	false
34.111.73.144	fennec-catalog-cdn.prod.mozaws.net	United States	15169	GOOGLEUS	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false
35.241.9.150	firefox.settings.services.mozilla.com	United States	15169	GOOGLEUS	false

Process:	/usr/lib/firefox/firefox
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Reputation:	low
Preview:	.

/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/134714F2DF01B21FA934AB16898B0583114E19B0

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	99
Entropy (8bit):	4.655293182125689
Encrypted:	false
SSDEEP:	3:c/mlg8ZKuWCuaD/3tb9vX3XDkAGKX8PXABHsX3u+llln:c/mrG0rLXDFGKXsX8sHHl/n
MD5:	A59361068F4770E9E7B5D8223DCA0468
SHA1:	9EF16ED85BEE0294B2D7276CD3D1C3C4BFD5FE74
SHA-256:	151C2FD771646D28B9466A4CE7C4033E714F168A67062C5363F0ED9B2F8FCE1F
SHA-512:	20854C0751E17625CAC8CB1F3ADA0411313D534DB69E44FF2B1E50BCFFC1D30E1C1D111A3DC528311B0731323217692C97E9DC05F7FEC3C1E42E3E94D7A7591F
Malicious:	false
Reputation:	low
Preview:	.t./........d.K.d.K.Eb.&.......(....~predictor-origin,:http://31.214.243.29/.predictor::seen.1.....

/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/254256B27E0C48CF9B80B695F0B3B8CA84610495

Download File

Process:	/usr/lib/firefox/firefox
File Type:	JSON data
Category:	dropped
Size (bytes):	15831
Entropy (8bit):	6.081896431247561
Encrypted:	false
SSDEEP:	384:vZWrhhqE7WrhhqE9AkWrhhqE7WrhhqE9Ak:vZSTnSTxAkSTnSTxAk
MD5:	CAB1654790CBEE68C2E6CC75F78DD5CA
SHA1:	C8E7369C6CE62A8047944CA827C0104161E085BA
SHA-256:	57B4245FD3C96925CB53590AEADF8F7FD28B942AC1C5A88CD6CC859B3A54FFC3
SHA-512:	9C11BE76AE5FCE3C6E4112C62E5C85303CBCE248EADE49D51C551306DAD440952D6CD54281C6AA526262EC53B3A5AA82C35820693844667449D91BC7C1219E90
Malicious:	false
Reputation:	low
Preview:	{"permissions":{},"data":{"attachment":{"hash":"0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0","size":7581,"filename":"asrouter.ftl","location":"main-workspace/ms-language-packs/4f1bcaa0-ddf9-43ef-aca3-8378c4d05582.ftl","mimetype":"application/octet-stream"},"id":"cfr-v1-en-US","last_modified":1648230346554}}.r&..............d.L.Eb.1d.L....q....:https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEANgFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAXlMIIF4TCCA8mgAwIBAgISBBDEHzrqTG3wR9H7k2mnMR8bMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEqMCgGA1UECgwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMSowKAYDVQQDDCFUaGUgVW5pdmVyc2UgU2VjdXJpdHkgQ29tcGFueSBMdGQwHhcNMjMwMzIwMDUxNzM5WhcNMjQwMzE5MDUxNzM5WjA5MTcwNQYDVQQDEy5tYWluLTItY2RuLnB

/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/5FFD69415953BE9CE9C07B2E9C26DA959ADEA6CB

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	7590
Entropy (8bit):	6.068942243339565
Encrypted:	false
SSDEEP:	192:8XG4FVou3lVd0rb+yBaiH6CgfbaI8j3qRFZLE:J4F69rbhciHOTaIdRbQ
MD5:	3884F9454A8EC208584C74D7FDEC1EBD
SHA1:	979CF16596DE5B923428F3D120D682C7BAC4FA30
SHA-256:	59890682DC2F14D0A9546CBAFACA5756AAE90573F000CB0F83EEC34052AC5BF1
SHA-512:	0215BB84E5785AF311EFA72BAEF8330D526C682A7955008D3627323553788EEE9D95E48F54979470C10B868947D482B27730D65031047D0D780A00EAAAF44FA4
Malicious:	false
Reputation:	low
Preview:	i4..z.........d.K.d.K.Eb.&d.K....{....:https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2021-09-19-15-17-11.chain.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEANgFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAWoMIIFpDCCA4ygAwIBAgISBGkTQga+WpAjWw/VxhBDplgUMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEqMCgGA1UECgwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMSowKAYDVQQDDCFUaGUgVW5pdmVyc2UgU2VjdXJpdHkgQ29tcGFueSBMdGQwHhcNMjMwMzIwMDUxNzIzWhcNMjQwMzE5MDUxNzIzWjAuMSwwKgYDVQQDEyNjb250ZW50LXNpZ25hdHVyZS0yLmNkbi5tb3ppbGxhLm5ldDCCASAwDQYJKoZIhvcNAQEBBQADggENADCCAQgCggEBAMlrLTT5ZcZIMo+jQ3m5d729kQuHBg1EYEsNTaxBaDDuT1um365Zg8yYI47UNhYOwPZD4WC+ejKBIPXz6TGl6cAVdzKAYWIg82rl+qJqv5Q2O3O7Rot8GZU09e4y+KVDwGJB+qDvwOlutttWy63LkVJy30VtJIqg1qMnBfckTDbApV04sQ4f8/cmYKp+n0pPYElB8aX7wWr8uGjDtH2ggrts47O4wR7Bo646Aa9myzZNGcyKC/KymU

/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/68B780A709FB903C666EF08F51EF5985A89FE446

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	15936
Entropy (8bit):	6.031156465271864
Encrypted:	false
SSDEEP:	192:FgZ8Zd0re+eBFbzHZ8Zd0re+eBFbztNbZovrAgZ8Zd0re+eBFbzHZ8Zd0re+eBFF:areZ7vreZ7tAzZreZ7vreZ7tAz2
MD5:	90BF69B3115D2008171C1E4659F305E0
SHA1:	C725AA2CC3D8BB0C470914DE09FC363ED6370605
SHA-256:	0E257BBE22CA1E987072E15286FD03E0C8008DE722698F23C62DE64942A79634
SHA-512:	680F5482104CB6214A4482D1C19C4C9BD20EA3034E02E0B6E9CBA15D1E6297A2ACE3C43F250BE9DC6C343D14D487975C3F2C6154D0DF1B168FE8DDCE39C78702
Malicious:	false
Reputation:	low
Preview:	4.>........d.L.d.L.Eb.0d.L.........a,~1679379424,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/deletion-request/1/7c4c3d68-b8c8-44e6-a714-345a0583faf2.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEANgFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX6MIIF9jCCA96gAwIBAgIQBsgDc7kGQ/YeoWDi8JqsCTANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTIzMDMyMDA1MTczOFoXDTI0MDMxOTA1MTczOFowejELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDU1vdW50YWluIFZpZXcxHDAaBgNVBAoTE01vemlsbGEgQ29ycG9yYXRpb24xIDAeBgNVBAMMFyoudGVsZW1ldHJ5Lm1vemlsbGEub3JnMIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEAyWstNPllxkgyj6NDebl3vb2RC4cGDURgSw1NrEFoMO5PW6bfrlmDzJgjjtQ2Fg7A9kPhYL56MoEg9fPpMaXpwBV3MoBhYiDzauX6omq/lDY7c7tGi3wZlTT17jL4pUPAYkH6oO/A6W6

/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, not stripped
Category:	dropped
Size (bytes):	117219
Entropy (8bit):	5.482600888040374
Encrypted:	false
SSDEEP:	3072:C/4g3Kd1rO5hZmxgA9OKdwwjF9GhsR1A4:O9anO5hZLHKdwwjF9GhsR1A4
MD5:	64D9FADD5391F35D70890A44DD894D2A
SHA1:	A0F8F04013C394734C333B47A2E32554CCF88076
SHA-256:	4F93F2A9207AB395F985917ED21A16414E01EA301AC566DC2483A8D20788CC0F
SHA-512:	0199993426118055656C465252D1756415FCE66E875479446DA5C598B921291C1FA5EC3CC9158FF1ED741609852773D65B23579EEC4F2DA9481B88B5F03D454D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Mirai_8, Description: Yara detected Mirai, Source: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1, Author: Joe Security Rule: JoeSecurity_Gafgyt, Description: Yara detected Gafgyt, Source: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1, Author: Joe Security Rule: Linux_Trojan_Gafgyt_28a2fe0c, Description: unknown, Source: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1, Author: unknown Rule: Linux_Trojan_Gafgyt_ea92cca8, Description: unknown, Source: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1, Author: unknown
Reputation:	low
Preview:	.ELF.....................@.....4..{......4. ...(....p........@...@...........................@...@....I...I...............I..EI..EI....8..q.........dt.Q.................................................E.<...'......!'.....................<...'.....!... ....'9... ......................<...'..p...!........'9... ..........................'.. ........<...'..0...!'..... ....................."W......@................N......Y....... ..$B... ....N...N......Y....... ..$B...........@..$................ ..$.I.....$...."W.... ............'..(<...'..t...!'.........................$.I..@..$.W.. ........................I......@..$.I.. ........... ..'.. ............'.. .......!........<...'......!...!........'...$......$'......$.......................4..... ..........................<...'.....!'........!.................bX(....<..74By..b.!........$BX(.C......<.<n4B.r.b.!........$BX(.C..$..........#................$B........ .$bX(...!.E..........$B........ .$bX(...!.B.........&.........b.&<..7

/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/DED23BB33EA3C88FAD1C0A1CD53916E0D8C424D3

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	15469
Entropy (8bit):	5.844886112139318
Encrypted:	false
SSDEEP:	192:63/CCBm4CsBJumwOGmnOqiwpJibAKGb9CqwGBLJnpl31imw8d0rU+yVTa6wIfbab:OHPnIwyqwGBln0pXrUhYiTaIdkoooa
MD5:	C62F072D083283EDE9BF610BA279F5EB
SHA1:	C1D56663ED550384EC0205F83CBF4B73250B9C65
SHA-256:	197A95F2B3C069E79576CEE941758B287526564DC520FED36BE3D04428913038
SHA-512:	03BC6B4C95E6E0CE3C7C2F67E72DAAFF399CC5C5CACED9203726B237261CC17391B3EEC4D05509B2705D6AC1B8415F4F0AD15AB1117E721E73E3A19AD69CA112
Malicious:	false
Reputation:	low
Preview:	# This Source Code Form is subject to the terms of the Mozilla Public.# License, v. 2.0. If a copy of the MPL was not distributed with this.# file, You can obtain one at http://mozilla.org/MPL/2.0/...## These messages are used as headings in the recommendation doorhanger..cfr-doorhanger-extension-heading = Recommended Extension.cfr-doorhanger-feature-heading = Recommended Feature..##..cfr-doorhanger-extension-sumo-link =. .tooltiptext = Why am I seeing this..cfr-doorhanger-extension-cancel-button = Not Now. .accesskey = N..cfr-doorhanger-extension-ok-button = Add Now. .accesskey = A..cfr-doorhanger-extension-manage-settings-button = Manage Recommendation Settings. .accesskey = M..cfr-doorhanger-extension-never-show-recommendation = Don.t Show Me This Recommendation. .accesskey = S..cfr-doorhanger-extension-learn-more-link = Learn more..# This string is used on a new line below the add-on name.# Variables:.# $name (String) - Add-on author name.cfr-doorhanger-extension-author =

/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/F8CBD54DDA10F4286A41EC6A537240712D6C2308

Download File

Process:	/usr/lib/firefox/firefox
File Type:	JSON data
Category:	dropped
Size (bytes):	8444
Entropy (8bit):	6.089173477440559
Encrypted:	false
SSDEEP:	192:PrzPDfd0rh+yzbKlHE7fd0rh+yzbKlHE9NbZovz:PrzbWrhhqE7WrhhqE9AL
MD5:	B4DE831269D262E38A8AD7E559C87F66
SHA1:	8D499CB9D9A6AB695B9A8CAA6A1C15ED6765D2BB
SHA-256:	A14FAFB4BC96AF986C4DEFB4518DF07CCBB67D4A02126BDE60D2E379FD79C551
SHA-512:	4012C2BA984FE9D230BEF391AB56B1970E2C6648699770C1B28032ABD3B493E694F6953257D778E32E0E1F79783672C8B30DB1A1A7DA4E162D1884499BBEF772
Malicious:	false
Reputation:	low
Preview:	{"project_name":"Remote Settings PROD","project_version":"15.0.0","http_api_version":"1.22","project_docs":"https://remote-settings.readthedocs.io","url":"https://firefox.settings.services.mozilla.com/v1/","settings":{"readonly":true,"explicit_permissions":false,"batch_max_requests":25},"capabilities":{"changes":{"description":"Track modifications of records in Kinto and store the collection timestamps into a specific bucket and collection.","url":"http://kinto.readthedocs.io/en/latest/tutorials/synchronisation.html#polling-for-remote-changes","version":"31.0.1","collections":["/buckets/blocklists","/buckets/blocklists-preview","/buckets/main","/buckets/main-preview","/buckets/security-state","/buckets/security-state-preview"]},"attachments":{"description":"Add file attachments to records","url":"https://github.com/Kinto/kinto-attachment/","version":"6.3.1","base_url":"https://firefox-settings-attachments.cdn.mozilla.net/"}}}.3..k.........d.L.d.L.Eb.2d.L....2....:https://firefox.settin

/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/settings/main/ms-language-packs/asrouter.ftl.tmp

Download File

Process:	/usr/lib/firefox/firefox
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7581
Entropy (8bit):	4.764879972898958
Encrypted:	false
SSDEEP:	192:63/CCBm4CsBJumwOGmnOqiwpJibAKGb9CqwGV:OHPnIwyqwGV
MD5:	C460716B62456449360B23CF5663F275
SHA1:	06573A83D88286153066BAE7062CC9300E567D92
SHA-256:	0EC0F16F92D876A9C1140D4C11E2B346A9292984D9A854360E54E99FDCD99CC0
SHA-512:	476BC3A333AACE4C75D9A971EF202D5889561E10D237792CA89F8D379280262CE98CF3D4728460696F8D7FF429A508237764BF4A9CCB59FD615AEE07BDCADF30
Malicious:	false
Reputation:	low
Preview:	# This Source Code Form is subject to the terms of the Mozilla Public.# License, v. 2.0. If a copy of the MPL was not distributed with this.# file, You can obtain one at http://mozilla.org/MPL/2.0/...## These messages are used as headings in the recommendation doorhanger..cfr-doorhanger-extension-heading = Recommended Extension.cfr-doorhanger-feature-heading = Recommended Feature..##..cfr-doorhanger-extension-sumo-link =. .tooltiptext = Why am I seeing this..cfr-doorhanger-extension-cancel-button = Not Now. .accesskey = N..cfr-doorhanger-extension-ok-button = Add Now. .accesskey = A..cfr-doorhanger-extension-manage-settings-button = Manage Recommendation Settings. .accesskey = M..cfr-doorhanger-extension-never-show-recommendation = Don.t Show Me This Recommendation. .accesskey = S..cfr-doorhanger-extension-learn-more-link = Learn more..# This string is used on a new line below the add-on name.# Variables:.# $name (String) - Add-on author name.cfr-doorhanger-extension-author =

/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/startupCache/scriptCache-child-new.bin

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	536915
Entropy (8bit):	5.066505078408843
Encrypted:	false
SSDEEP:	6144:fykPreu5AMr56pLwC4tbkd2+aPZLucfYJoRalo3sx+P6tmS3t:6GGW8LwC4tpS9JC/IV3t
MD5:	55630106B5662A447042CF0D00F121BA
SHA1:	474647BD351C4EBB5436319565FB88D85BC78976
SHA-256:	80886F16AC3A2CC5E5D5E1CFDDA49247CE76BCDDD5E173BE73F48AABFF3BAF51
SHA-512:	634FC500F6D3C70EA4915BA375D0797021F760F5CB62F7A0688BFF8927E9E07FB2E9B7C0E3554D85AD034C1F0AE1287AC265BF4EC4A68216F180B7243D512D40
Malicious:	false
Reputation:	low
Preview:	mozXDRcachev002......chrome://global/content/process-content.js.chrome://global/content/process-content.js....`....6.resource://gre/modules/extensionProcessScriptLoader.js6.resource://gre/modules/extensionProcessScriptLoader.js`...4....1.resource://gre/modules/ExtensionProcessScript.jsmF.jsloader/non-syntactic/resource/gre/modules/ExtensionProcessScript.jsm.....X...).resource://gre/modules/MessageChannel.jsm>.jsloader/non-syntactic/resource/gre/modules/MessageChannel.jsm0]..h....).resource://gre/modules/ExtensionUtils.jsm>.jsloader/non-syntactic/resource/gre/modules/ExtensionUtils.jsm.....?... .resource://gre/modules/Timer.jsm5.jsloader/non-syntactic/resource/gre/modules/Timer.jsmP'.......*.resource://gre/modules/ExtensionCommon.jsm?.jsloader/non-syntactic/resource/gre/modules/ExtensionCommon.jsmL=..t....".resource://gre/modules/Schemas.jsm7.jsloader/non-syntactic/resource/gre/modules/Schemas.jsm....d....<.resource://gre/modules/URLQueryStrippingListProcessScript.js<.resource://gre/m

/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/startupCache/scriptCache-new.bin

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	8065861
Entropy (8bit):	5.203405206838544
Encrypted:	false
SSDEEP:	49152:kZLE60+X3aplFYgW0+NI2tidKxgNbcuApK9llF3zyQFWjbVPU1Hd63p3sem7x:LT/p2tidKxgNbcuApKf3rabz3S
MD5:	00CC034B00F8B54901A3D72BD7FF8C3E
SHA1:	11103380E799ED834C6F87C106F13B69AA88707C
SHA-256:	AFBBB2F9CA5F8FF91ACB96FB21863F7827A4BCC277D3A832EE851B178693B1A5
SHA-512:	5FF782F90AD676A72F1CFC19C1030E0F4F46EFBF404A659B69B19B116A70C069E0C3E58F93F0488FC9C47DB4DA5C922301F697593D8038CB490BA5FC89DFD70E
Malicious:	false
Reputation:	low
Preview:	mozXDRcachev002...../.resource://gre/modules/MainProcessSingleton.jsmD.jsloader/non-syntactic/resource/gre/modules/MainProcessSingleton.jsm.........#.resource://gre/modules/Services.jsm8.jsloader/non-syntactic/resource/gre/modules/Services.jsm....d....1.resource://gre/modules/CustomElementsListener.jsmF.jsloader/non-syntactic/resource/gre/modules/CustomElementsListener.jsmh...L....#.resource:///modules/BrowserGlue.jsm;.jsloader/non-syntactic/resource/app/modules/BrowserGlue.jsm.........%.resource://gre/modules/XPCOMUtils.jsm:.jsloader/non-syntactic/resource/gre/modules/XPCOMUtils.jsmP...TU...'.resource://gre/modules/AppConstants.jsm<.jsloader/non-syntactic/resource/gre/modules/AppConstants.jsm.#.......-.resource://gre/modules/ActorManagerParent.jsmB.jsloader/non-syntactic/resource/gre/modules/ActorManagerParent.jsm08..0O...-.resource://gre/modules/EnterprisePolicies.jsmB.jsloader/non-syntactic/resource/gre/modules/EnterprisePolicies.jsm`........3.resource://gre/modules/EnterprisePolici

/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/startupCache/urlCache-new.bin

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	2359
Entropy (8bit):	4.723197587308875
Encrypted:	false
SSDEEP:	48:0oixAl2dXUGttISt3bqJtgtkt0IbFr9cHSWpVcaXBsneJrQc:76Al2dXUIIq3bAcwfWseJr3
MD5:	BBAFA4904B8EC4404105FD232E2D6BF3
SHA1:	764DC7BFD554F82C05EF43E9A8765B9CC2764A34
SHA-256:	08A0ADC928EB4C2B45C17203EA50A866128E2ACF4060A84CD6E7D301B3BBFFBD
SHA-512:	98EBCE5C1FBF9A25E1B5EED4284D2BE8948A02C4708995F81D3EC4C19E0974A1E83F4BDFF2A53C5F4129170D2C8A1327A3B62725D3449E55A6EE893A40202960
Malicious:	false
Reputation:	low
Preview:	mozURLcachev002.#....+./usr/lib/firefox/distribution/policies.json.3.chrome/browser/content/browser/built_in_addons.json.O./home/saturnino/.mozilla/firefox/a3xevaya.default-release/addonStartup.json.lz4.0.chrome/en-US/locale/en-US/global/intl.properties.../usr/lib/firefox/distribution/distribution.ini.7.chrome/en-US/locale/en-US/global/aboutReader.properties.%.chrome/toolkit/content/global/xul.css...chrome/toolkit/skin/classic/global/tooltip.css...res/contenteditable.css.$.chrome/toolkit/res/counterstyles.css...res/designmode.css...chrome/toolkit/res/forms.css...chrome/toolkit/res/html.css...chrome/toolkit/res/mathml.css.-.chrome/toolkit/content/global/minimal-xul.css...chrome/toolkit/res/noframes.css...chrome/toolkit/res/noscript.css...chrome/toolkit/res/quirk.css.1.chrome/toolkit/skin/classic/global/scrollbars.css...res/svg.css...chrome/toolkit/res/ua.css.G./home/saturnino/.mozilla/firefox/a3xevaya.default-release/xulstore.json.%.localization/en-US/branding/brand.ftl.2.localization/e

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/addonStartup.json.lz4.tmp

Download File

Process:	/usr/lib/firefox/firefox
File Type:	Mozilla lz4 compressed data, originally 17200 bytes
Category:	dropped
Size (bytes):	8599
Entropy (8bit):	6.567495269840381
Encrypted:	false
SSDEEP:	192:oftuM9K/DTZ97Xjq7XN+ftuM9K/DrZd7q/qBXoa:ofsM9eH7Tq74fsM9enZd7uqBJ
MD5:	A1D3DFDE4342A057ABB725F7326C08E9
SHA1:	A0AC57260753854C4F43CFF75497507B9570BEC7
SHA-256:	90B7DE98A0E12A8736D2D2B6A26516420A532165DE18349F16267BEBD2700AE9
SHA-512:	723DC8DA47CCD8959828C71DEE300E70B5F58AA36193497FCFFAC05AEC03CCE6E45BCD2CCAE8AF8C1F0742EF28B04311971FCE4F043D47951197CCC569E8B61B
Malicious:	false
Reputation:	low
Preview:	mozLz40.0C....{"app-system-addons":{"....reset-search-defaults@mozilla.com/..Gdependencies":[],"enabled":true,"lastModifiedTime":1629470033402,"loader":null,"path":\|.....xpi","rootURI":"jar:file:///home/saturnino/...../firefox/a3xevaya....-release/fe5...es/%7Bb2669443-b5ea-44d6-8105-fcece6050402%7D/'..... !/...unInSafeMode ..signedState":3...D...162764250...,"telemetryKey$..3%40.......:2.1.0","version":"..#},......tection..;/11....g..~...8..6....o.......&.8512593....{.....Y1.0.1......startupData...p..astentL..!er...webRequest%..onBefore...[[{"incognito..UtabId..!yp...."main_frame"],"url...."https://www.google.../\.9",!...amazon.de/exec/obidos/external3../6.ObingU..@duck..!go!..:..ebay.ch/sV...en.wikipedia.org/.../Special:S.....dwindow....},["blocking"]]]}..`,"stag..%{}.....0.{....}............`.....doh-rollout..1org.....#a147618.......r......uusr/lib..vbrowser...U.......u.....l..V..{.}org:2.0b.....{.....formautofilld.T.s...e.+.V...f.(.W..g...........g..picturein...k.T.n..w...o.+.Z...

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/broadcast-listeners.json.tmp

Download File

Process:	/usr/lib/firefox/firefox
File Type:	JSON data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.755039128811985
Encrypted:	false
SSDEEP:	6:YWLSf85jcM2MAfeKSyikXMDuQ6s/WoMmgjwHbSRmnPE2cb:YWLSf6gMAfzSy7MDNFMmqmpncBb
MD5:	3F4783C4A6E2C30C125D1A3E464B8381
SHA1:	E0341861A8E1E7A780AD941DBF2887C5C1DF734A
SHA-256:	DE1D02EC9612920EF8E6FC72D437259756D96CFB2FC6973EF69B29E3EA04C769
SHA-512:	9C580A197186EBBDB1DB70DE2945D93C68F07840BC0A207BCDEF7ECEDAC747F4B524279AD1CFE5EF32D309C0E548583AFCA912EC871F1FBC092415755EB93EBD
Malicious:	false
Reputation:	low
Preview:	{"version":1,"listeners":{"remote-settings/monitor_changes":{"version":"\"1629467836325\"","sourceInfo":{"moduleURI":"resource://services-settings/remote-settings.js","symbolName":"remoteSettingsBroadcastHandler"}}}}

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/cert9.db

Download File

Process:	/usr/lib/firefox/firefox
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 32768, file counter 9, database pages 7, cookie 0x5, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	458752
Entropy (8bit):	0.8648498389553788
Encrypted:	false
SSDEEP:	384:Ss1zkVmvQhyn+Zoz67uwJt2dZ60ubZI3C18+PNliMM0UDZ8BX9W1zkVmvQhyn+Z+:SsRwJtZNuMg3cwJtZNuMiq
MD5:	07809AC372EE02563E7F464075040D1C
SHA1:	1CEECCDE5C06073648353A03650353E79D56B3B1
SHA-256:	106F71FF709CE3998606E60FDBDBCCE6FD3F2DBC010B70B6EFCC84D650BD2E44
SHA-512:	71172E93979221AE38C734201EAF278B379C7A0DD0BBFD09879FD4CA638AB8BBAA759295DAE1653363D79A6F335415E108C538C78F20C4027F882C36331D2DA2
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................S`.....z..{...{.{j{*z.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/cert9.db-journal

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	459912
Entropy (8bit):	0.7971411050330949
Encrypted:	false
SSDEEP:	384:qDshGSZSdZ60ubZI3C18+PNliMM0f41zkVmvQhyn+Zoz67T+XUQZqwJt2dZ60ub4:OQNuMcQwJtZNuMKss
MD5:	9CAE07D08A4B1180D6CA2579B505BD56
SHA1:	B841414F36CB2882E5C578ECEF4C6C48D7D64061
SHA-256:	7A9F83DF4D1AD2D1F23619A3210F509D43C61716781DF69FA261953D51B4D9A6
SHA-512:	29704C4D024649ADBEB6CA076E50F941B13EE2E87B600F54DB8BCB3D630E53EC1DC8A988A4CD19BC36D4265D188C388CCE5144795A44D8FA0C1D20A665DD8376
Malicious:	false
Reputation:	low
Preview:	..............o?..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R..R.k........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/crashes/store.json.mozlz4.tmp

Download File

Process:	/usr/lib/firefox/firefox
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Reputation:	low
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/datareporting/aborted-session-ping.tmp

Download File

Process:	/usr/lib/firefox/firefox
File Type:	JSON data
Category:	dropped
Size (bytes):	34247
Entropy (8bit):	5.24628184173366
Encrypted:	false
SSDEEP:	768:YGPWwZ/znUe1n2/myB8F+hoaPQUXdmvwjQ4WUV6d6pxVs8:dbnUe1IwEPQUXS4WUV6d6dR
MD5:	7BB3B120C1DA9908EC2338520CF6C64B
SHA1:	A48F26904C4569C5572D3B43AD1715C5AE4F6C14
SHA-256:	686D6D51DEFFF62073AB28173189AF7354129974158CECC7907B437925D950DA
SHA-512:	AC2CC8885D01CBA7FFD8C358E03F5B6315C16A1CF8503FA6CF57B3E1A40F29C197C9AEA2DA31944D5413F16817E447E9CE57969B1C8F73F76C66A21F527DDFA3
Malicious:	false
Reputation:	low
Preview:	{"type":"main","id":"2ba52971-ddc6-446a-98ac-d27293eb4fe9","creationDate":"2023-03-21T06:18:02.976Z","version":4,"application":{"architecture":"x86-64","buildId":"20210816143654","name":"Firefox","version":"91.0.1","displayVersion":"91.0.1","vendor":"Mozilla","platformVersion":"91.0.1","xpcomAbi":"x86_64-gcc3","channel":"release"},"payload":{"ver":4,"simpleMeasurements":{"totalTime":70,"start":190,"main":1034,"selectProfile":2185,"afterProfileLocked":4242,"startupCrashDetectionBegin":5426,"firstPaint":19182,"firstPaint2":17926,"sessionRestoreInit":7932,"sessionRestored":22226,"createTopLevelWindow":7952,"AMI_startup_begin":5515,"XPI_startup_begin":5530,"XPI_bootstrap_addons_begin":5564,"XPI_bootstrap_addons_end":5603,"XPI_startup_end":5603,"AMI_startup_end":5605,"XPI_finalUIStartup":7932,"sessionRestoreInitialized":7935,"delayedStartupStarted":17934,"delayedStartupFinished":18212,"startupInterrupted":0,"debuggerAttached":0,"activeTicks":0},"processes":{"parent":{"scalars":{"formautofil

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/datareporting/glean/db/data.safe.bin

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	22034
Entropy (8bit):	4.167741435380332
Encrypted:	false
SSDEEP:	192:0FvQVb0FvQVbBFvQVbWFvQVbxFvQVbFFvQVbwFvQVbJFvQVb:JVbJVbEVbzVbUVbwVb9VbsVb
MD5:	23781F0E2B8785F1763060FE26F0F14E
SHA1:	899058D67D3AF17905C8CD6EA377AFF1624DEF49
SHA-256:	69518F55151C3443B58464F489B3F4433230B37F51176BB89F1742B96DC3CB95
SHA-512:	5CC9A580205D5E39DC66DB0E20C2558719ABCE35E65C772FD50E55E117BDB6E93F1DF03BABCD8D0FD2284B78642F1C7F1950D6E24208813D16A61A3335546219
Malicious:	false
Reputation:	low
Preview:	.................app....................glean_client_info#app_build#............................20210816143654........glean_client_info#app_channel.............................release%.......glean_client_info#app_display_version.............................91.0.1........glean_client_info#architecture.............................x86_64%.......glean_client_info#device_manufacturer.............................unknown........glean_client_info#device_model.............................unknown........glean_client_info#os.............................Linux........glean_client_info#os_version.............................5.4.........ping............2.......baseline#glean.validation.pings_submitted/baseline.........................!.......metrics#browser.ui.proton_enabled..............................metrics#fog.initialization..............................0..............metrics#fog.ipc.buffer_sizes=........4...................8..................................lX..?........metrics#fog.ipc.flush_du

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/datareporting/glean/tmp/7c4c3d68-b8c8-44e6-a714-345a0583faf2

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with very long lines (447)
Category:	dropped
Size (bytes):	527
Entropy (8bit):	5.029868752462172
Encrypted:	false
SSDEEP:	12:BG2asuzkh+ckmeiAU7nVp3mHjFHC4x8+44GkD4tATdNBHV:BGzsGkh+NU5p3AjFiI44GkD4ts1
MD5:	6B15C070788478408BA28503257BF81D
SHA1:	9F3C66994CA467BF84BEA582A07FB412E4EE04B9
SHA-256:	A8831DB7095681CBC38C205E7F3A908DF453FD76DD9AB5E6DA8806837CA53664
SHA-512:	997DF6E6252EF911D5C4A3FEF3E9C035328F6CC0523D2903DFCE6BCCEAC272AD5D0F74A0287022BCD8BA37F2D439CC8C1C02B2E5EB218C3FF71628BCE2179794
Malicious:	false
Reputation:	low
Preview:	/submit/firefox-desktop/deletion-request/1/7c4c3d68-b8c8-44e6-a714-345a0583faf2.{"ping_info":{"seq":0,"start_time":"2023-03-21T06:17+00:00","end_time":"2023-03-21T06:17+00:00","reason":"at_init"},"client_info":{"telemetry_sdk_build":"39.0.0","app_display_version":"91.0.1","architecture":"x86_64","app_build":"20210816143654","app_channel":"release","device_model":"unknown","os_version":"5.4","device_manufacturer":"unknown","os":"Linux","client_id":"f80109fa-2a5b-4fd2-a42f-76603a7fb825","first_run_date":"2021-08-17+00:00"}}

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/datareporting/session-state.json.tmp

Download File

Process:	/usr/lib/firefox/firefox
File Type:	JSON data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.858365186165159
Encrypted:	false
SSDEEP:	3:YWAqKs58fKzHFU3cmwUuTMf6phCKuGQHJ1XhJA2aqnLPJUoa/H5C:YWAqf58CzHFycmw+fAhuG61XhOanLc/Q
MD5:	81939E2A566C5C05E3490296D175FE9C
SHA1:	BBB479F94B31BBBFE0F499AE172D27BB28486E55
SHA-256:	C4EB5F5B88C77C2C00F1606FB61D01DDF3AFA9242EC8BAAC31844EDC78EE88AE
SHA-512:	4F3B94602553D2BBE5B315D36F1B83F16B7238297F03E79BE020FC65B9D04B206EB877186423CE9D241261ADC9A1D8E87C3CE6CA0DC3C06A06B5FEB77A6F467C
Malicious:	false
Reputation:	low
Preview:	{"sessionId":"da0f04f3-933b-481f-9b59-5149b68c141a","subsessionId":"942bda48-a1c5-4ecc-abf6-68a9de40fec5","profileSubsessionCounter":10,"newProfilePingSent":true}

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/datareporting/state.json.tmp

Download File

Process:	/usr/lib/firefox/firefox
File Type:	JSON data
Category:	dropped
Size (bytes):	51
Entropy (8bit):	3.2717530240771033
Encrypted:	false
SSDEEP:	3:YGJBQvAcgVgcVIDwf:YG8PgfiDE
MD5:	3E32E2CC1ED028DD8FF9B06F50A4707B
SHA1:	B3910351BD8E13AD1479DB699CF6FAC6544A5BEF
SHA-256:	4A3A666D98E61B5FE06FECAC56807137A0FFFB4BB71D4C3B16BAA8702DDE738C
SHA-512:	4585EE9EC04ADF138727CD039A9CBE78DB6CF2926F6CE92524312A42EFD1250100848A919EC4B833F9A013181CE93734575B86EED37F1BF32EFFA3237EBA84DB
Malicious:	false
Reputation:	low
Preview:	{"clientID":"c0ffeec0-ffee-c0ff-eec0-ffeec0ffeec0"}

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/extensions.json.tmp

Download File

Process:	/usr/lib/firefox/firefox
File Type:	JSON data
Category:	dropped
Size (bytes):	48713
Entropy (8bit):	5.174045011351523
Encrypted:	false
SSDEEP:	768:9On4M4wfVXy4nWXOxJO9/pN4sG4G4J4k4wh5hvM4r4y4l4G4O4gC6v4j:6ORpphfvG4co
MD5:	CAAE9DFD85622A51E40BC81E527E6A7D
SHA1:	8E1559A6C7E831446C791D827E4788EEF3FCFD59
SHA-256:	836339FA04A74196FAB90D3128B1C4AFEB52876322A0DB38001BD87AAD660488
SHA-512:	69053EBEBB03D84AF4FA8B1656B99F543F33414B039FEA55CB0F93BAA23AA169527DE10F9A45F6724A708BA8F638F4E4486D614FEC43EF85031C7572A95C9EE6
Malicious:	false
Reputation:	low
Preview:	{"schemaVersion":33,"addons":[{"id":"doh-rollout@mozilla.org","syncGUID":"{0b694065-4b8a-4b9f-bc88-9f12b8b5cf70}","version":"2.0.0","type":"extension","loader":null,"updateURL":null,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"DoH Roll-Out","description":"This used to be a Mozilla add-on that supported the roll-out of DoH, but now only exists as a stub to enable migrations.","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1628151708000,"updateDate":1629147618000,"applyBackgroundUpdates":1,"path":"/usr/lib/firefox/browser/features/doh-rollout@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":"72.0a1","maxVersion":null}],"target

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/key4.db

Download File

Process:	/usr/lib/firefox/firefox
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 32768, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.4036145626617334
Encrypted:	false
SSDEEP:	192:mva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vgrMfzZ:m1zkVmvQhyn+Zoz67FazZ
MD5:	B17E199AC22C99688CEACAE342FDE8D7
SHA1:	41F41E23CFD8F6110C7924BF6FB974D7A12328C9
SHA-256:	34C8F483575FD7AF331FBC6933F41D13A43A5FD1E556920C6E0EC71AE1C8F1DD
SHA-512:	D1DD5ACEE56BC358A37AA770C8794912E040261F2374B32BD2EECDBF1275FCC8870651BDE97FA5A4251E68886757F5B2EDDA256AFF2FD44306B574A5B3E35AE8
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................S`.....z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/key4.db-journal

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	98852
Entropy (8bit):	0.22662102288292932
Encrypted:	false
SSDEEP:	192:5zRVva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vI:jV1zkVmvQhyn+Zoz67J
MD5:	315E7B41F813586544D78840CB9559FB
SHA1:	D7E88B0FC5419B6857272480E4F46B0C60F49400
SHA-256:	DBAC272DC8669B1DBDF28833DAE4CD406F02B23118A7DC1783EACCB5FA6FAA07
SHA-512:	494202858E21DF9076F0C5AA1E827DCA58288D783CAF40144B33A298FF024810D924A20D7F69029DB36E4E10B483826980A2AF4CFA515F4EC64E676E25124D2E
Malicious:	false
Reputation:	low
Preview:	.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/prefs-1.js

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with very long lines (1127)
Category:	dropped
Size (bytes):	109769
Entropy (8bit):	5.218549712597015
Encrypted:	false
SSDEEP:	768:MoyhNJoyhNQoyhVQoyhjfoyhj9oyhj9oy4j9oy479oy4X/:5yKyByxyayAyAy5yRyw
MD5:	EA2B51E5F426E440E694DAC7D6C8FF7F
SHA1:	794AF31E121E7EE3E379D08FBD97194B102DB81F
SHA-256:	B7C63D896F321B442597FD2606D753A020703738A337C0590441B2D7D8D715CC
SHA-512:	1B9FECE42591E7FD580AFAF67BE84C1C2AD5B4D730EF051A457305AFB3021D6F49D7C2F0499ABB0FDF5F45B5C71BA7B5289C4E619A81E0C54EBF0BD0E24FC469
Malicious:	false
Reputation:	low
Preview:	// Mozilla User Preferences..// DO NOT EDIT THIS FILE..//.// If you make changes to this file while the application is running,.// the changes will be overwritten when the application exits..//.// To change a preference value, you can either:.// - modify it via the UI (e.g. via about:config in the browser); or.// - set it within a user.js file in your profile...user_pref("app.normandy.first_run", false);.user_pref("app.normandy.migrationsApplied", 12);.user_pref("app.normandy.startupRolloutPrefs.media.peerconnection.mtransport_process", true);.user_pref("app.normandy.startupRolloutPrefs.network.process.enabled", true);.user_pref("app.normandy.user_id", "e34bc139-ede7-4eef-acd2-d2d8ffa0c304");.user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1629470032);.user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1629466019);.user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1629467970);.user_pref("app.update.lastUpdateTime.region-update-timer", 0)

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/search.json.mozlz4

Download File

Process:	/usr/lib/firefox/firefox
File Type:	Mozilla lz4 compressed data, originally 467 bytes
Category:	dropped
Size (bytes):	196
Entropy (8bit):	5.4478819013219715
Encrypted:	false
SSDEEP:	6:vXvz2SNtSapaBlP7521T06xz3Jg75I2k7TEv2X8W6:vvz2SNtjpOPWgsz3JYk7vq
MD5:	DE18406D63DF1F173806E777DABDADFB
SHA1:	076F314F75C8555C0220BB0EF7129750D9B1B9C8
SHA-256:	89F9037A361F2A097E61121697426233D8D8AF5B6E18E92D6612E8D65D0A562C
SHA-512:	0E94A9D0D5DAC99BC07C1C9C191EDE376041D8C43D3B9DAC99A47ABE451C518B8F65EF6513A0956B9FC72AF96A05A7A81040257C40A26215F91841C7488C93B2
Malicious:	false
Reputation:	low
Preview:	mozLz40......A{"version":6,"engines":[{"_name":"Google","_isAppProvided":true,"_metaData":{}},8..Wikipedia (en)@..OBing6...Amazon.d.. @Duck../Gow..OeBay6.....?com<..7],"o..."useSavedOrder":false}}

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/sessionCheckpoints.json.tmp

Download File

Process:	/usr/lib/firefox/firefox
File Type:	JSON data
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.223691028533093
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+ABaQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+kOy6Lb1BA+m2L69Yr
MD5:	C0E4C22C50DD21142F57714EF49B8713
SHA1:	06B77307DCA5C889EA279243E74730CBC10801BE
SHA-256:	6FE46B65B76B3DF32D8392853740B35ED75B6E23F4FBD6F45F3EFA1D496E6717
SHA-512:	A4516B4F15EDB429F7B8CE3EA709D3777BFCC590838B1E113147E6BFB4DF0F34F0F2B24F6185D4E4277A77F75711BB470461B86AA507921AF037A6D22DF9278E
Malicious:	false
Reputation:	low
Preview:	{"profile-after-change":true,"final-ui-startup":true}{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/sessionstore-backups/recovery.jsonlz4.tmp

Download File

Process:	/usr/lib/firefox/firefox
File Type:	Mozilla lz4 compressed data, originally 3230 bytes
Category:	dropped
Size (bytes):	5126
Entropy (8bit):	6.269939167982209
Encrypted:	false
SSDEEP:	48:iZ5tpVoDft16Hhh7y4+Z0tpVoDq16vthh7ys+ZotpVoDft16vthwys+ZDutpVoDM:wuTz6rVue6vVpuTz6vIfuTz6vVB
MD5:	77B2E7BF4A6A503593121ABB422846B1
SHA1:	6DA47537BD4A3B288894278AC7EE9FD5C64EF0BA
SHA-256:	6B763F8AAC1487333EDC6786B141753F6EFF7EAC3AAA6E1BDD34F2B242751778
SHA-512:	4D134948646138C108DA6BD84E7333DB65DA642B28B874995A9CDAFD66060CDA77133E0849EA451E0178D2C36A2CAA81A44769ECD0A62D7CBCCA1726EB142847
Malicious:	false
Reputation:	low
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[],"selectedW...":0,"_clos...'..H...":{"lastUpdate":1679379456589,"startTim....20616,"recentCrashes":0},"global":{},"cooki......a..S..!Stg.....P{"tab..b{"entrU.. {"url":"about:home","title":"New Tab","cacheKey....ID":1,"docshellUU...."{387a7475-8923-4191-a685-829ff165a620}"....sultPrincipalURI":null,"p...sToInherit_base64":"eyIwIjp7IjAiOiJtb3otbnVsbHByaW5jaXBhbDp7ODQ1ZTllNTUtYzUwMi00Zjk2LThhMzAtOWNmMjRhZGMxYjNlfSJ9fQ==","partitionedP..k..hasUserInteract....false,"triggeringB..%..z%.0fX0....docIdentifier":2147483649,"persist":true}[..Accessed....29470047042,"hidde...searchMode...userContextId%..attribut.....Qindex8..requestedI....0,"image":"chrome://branding/cU..nt/icon32.png"......Q.....T.......dth":921,"height":666,"screenX":4...Y..Aizem..."maximized"...BeforeMin...&..workspace..S0","z...1K..._shouldRx....","Y.*At{..3...U..........................,26.....P39107......@{"hoG..."addons.mozilla.org","valu...A2da17c6a8cc11f2fc083590b3

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	6.117080021933792
Encrypted:	false
SSDEEP:	768:K3sCJm3z3a3M3jWHjF2NNrnsrx4Nab6MSBHhap6Ul22y1HaqeHhcHm91Hp:K3o3z3a3M3Ojf1kBHhap6Ul2n1HaqeH3
MD5:	2672D6B57621B74D060C6FC399DFCADD
SHA1:	7500A1E08D82966806E231D3DA34B211151B5457
SHA-256:	DA329DDB72B5E05874BA4E78B0D524F19BC200A0A539F6CDB273BDFAD304A65D
SHA-512:	643877BCEB2B0A74AF8B559B6060D30121FBC82B7AFBAF29BD62EC0985E3069F3434A1D6C0C29028188D98037DCABB1ADE1ABBBBDBAA895849D5DF620CD53151
Malicious:	false
Reputation:	low
Preview:	.... ......l...e...........n.........S.v.....`...n.l............,.D...j...F...~.......>.....N..............................................................................R..2~..0nbjo0tfbsdi.dpogjh.nbjo0tfbsdi.dpogjh.0f:9d774e.519e.5:12.:777.77f78b4195c5\..D~....nbjo0tfbsdi.dpogjh...w .....nbjo0tfbsdi.dpogjh.0d61edd98.12:3.5572.cc99.28b66cb292d8R..2~..0nbjo0tfbsdi.dpogjh.nbjo0tfbsdi.dpogjh.0d61edd98.12:3.5572.cc99.28b66cb292d8\..D~....nbjo0tfbsdi.dpogjh...w .....nbjo0tfbsdi.dpogjh.0g6:geecd.691c.5783.:deb.43:52dffd83:R..2~..0nbjo0tfbsdi.dpogjh.nbjo0tfbsdi.dpogjh.0g6:geecd.691c.5783.:deb.43:52dffd83:\..D~....nbjo0tfbsdi.dpogjh...w .....nbjo0tfbsdi.dpogjh.0f1db5:75.f435.55f8.91c7.27b942817e28R..2~..0nbjo0tfbsdi.dpogjh.nbjo0tfbsdi.dpogjh.0f1db5:75.f435.55f8.91c7.27b94...._..F......nbjo0qbttxpse.svmft...w..s2.nbjo0qbttxpse.svmft.0cg9f6958.c121.534f.:679.f2ed88g9g319...._..F......nbjo0qbttxpse.svmft...w..s`.nbjo0qbttxpse.svmft.0113b2f6e.5dg7.5:65.96b:.6e1f8d1edbge...8U..4....0nbjo0qbttxp

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal

Download File

Process:	/usr/lib/firefox/firefox
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	41232
Entropy (8bit):	6.16355630920134
Encrypted:	false
SSDEEP:	768:63sCJ23z3a3M3jW2q68BNNrnsrx4Nab6M7BHhap6Ul2R6jads1HDjeHhcHm91HQk:63I3z3a3M3vqE1pBHhap6Ul2R6jay1H6
MD5:	60EEB4D39634658C8016958069B8B39D
SHA1:	BE999F581849E9104EEC686D56E3C2A0772E3F03
SHA-256:	4BE536DE599525F53D315B4247A70B84F813D12D742B6F1B909607A3FD6A0A83
SHA-512:	370EC3E8B825EBAC97F8F26FFC0B5548003241D7A4A07B1071C05DA4BAF394A9ED94C484AAA63861B7A59187A0E0006B92E55ECA4E6660FEBFBB0026D1115475
Malicious:	false
Reputation:	low
Preview:	7....-...........#.M.Vj)".&..(T..........#.M.Vj)~;..<e^/.... ......l...e...........n.........S.v.....`...n.l............,.D...j...F...~.......>.....N..............................................................................R..2~..0nbjo0tfbsdi.dpogjh.nbjo0tfbsdi.dpogjh.0f:9d774e.519e.5:12.:777.77f78b4195c5\..D~....nbjo0tfbsdi.dpogjh...w .....nbjo0tfbsdi.dpogjh.0d61edd98.12:3.5572.cc99.28b66cb292d8R..2~..0nbjo0tfbsdi.dpogjh.nbjo0tfbsdi.dpogjh.0d61edd98.12:3.5572.cc99.28b66cb292d8\..D~....nbjo0tfbsdi.dpogjh...w .....nbjo0tfbsdi.dpogjh.0g6:geecd.691c.5783.:deb.43:52dffd83:R..2~..0nbjo0tfbsdi.dpogjh.nbjo0tfbsdi.dpogjh.0g6:geecd.691c.5783.:deb.43:52dffd83:\..D~....nbjo0tfbsdi.dpogjh...w .....nbjo0tfbsdi.dpogjh.0f1db5:75.f435.55f8.91c7.27b942817e28R..2~..0nbjo0tfbsdi.dpogjh.nbjo0tfbsdi.dpogjh.0f1db5:75.f435.55f8.91c7.27b94...._..F......nbjo0qbttxpse.svmft...w..s2.nbjo0qbttxpse.svmft.0cg9f6958.c121.534f.:679.f2ed88g9g319...._..F......nbjo0qbttxpse.svmft...w..s`.nbjo0qbttxpse.svmft.0113b

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/xulstore.json.tmp

Download File

Process:	/usr/lib/firefox/firefox
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	4.707807484588857
Encrypted:	false
SSDEEP:	6:YGNTG/SJ8KgfQYV2fVH8qLvrdpUhj2xJWl42xJEAUvEJBY1Y:YGNd5gfV2tH8avrnQ2fZ2feUY1Y
MD5:	4F2F57A0FACAF113FDEC5456EDF974C5
SHA1:	51BB98FBB11D07BD0343137B144B0A32DC1952D6
SHA-256:	F57089C81D75E95583D17E67496FB02DEE203DEBA36DD176BE35F0841654E9EA
SHA-512:	07291312066CD6C9B3BD70DBC20D1BBE8A0DD60648558812F888413CCF3628AFED82F7FC365F687036973FA3E106F08C27E891AAADB54FB9591F01D00CA753C0
Malicious:	false
Reputation:	low
Preview:	{"chrome://browser/content/browser.xhtml":{"main-window":{"sizemode":"maximized"},"sidebar-box":{"sidebarcommand":"","width":""},"sidebar-title":{"value":""}},"chrome://mozapps/content/downloads/unknownContentType.xhtml":{"unknownContentTypeWindow":{"screenX":"285","screenY":"275"}}}

/proc/6304/gid_map

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	1.4353713907745331
Encrypted:	false
SSDEEP:	3:MVUGn:MCG
MD5:	54258652109C33FE06188083A3EC23F4
SHA1:	013EC30A95D66C56642C193613A829B746982601
SHA-256:	C459EBB6CF3917EFB05A2E72EF25E223BE9B78780B1CE0CAACCE49C773DF199E
SHA-512:	AAE8A67B91BDEC9C21ACD88711C262EA3ACD3EE086AEB27645531C47DD618708C7FF284759A68000414579B77C0D8A3449F95480D039A9901F7352121B7D78F0
Malicious:	false
Reputation:	low
Preview:	1000 1000 1

/proc/6304/setgroups

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:9n:9n
MD5:	05AFB6CE69B9CEF1BD6ECE7E4745F96C
SHA1:	1D16DC2DCC6851208C1B981E2EC377250A4A0CC5
SHA-256:	3026A0CA485E5831657BA0120FA8DD66B3425427BFB0A2BE0DB743E2305CC7C5
SHA-512:	A37A7790CCB2FA5A3C3F2740480CF4035F2870502060F398A1882A44B675DE736E33D8ECD9B834BB3D19D807B46875E30AA835EDD847C5FE8F1F2942A870BAD5
Malicious:	false
Reputation:	low
Preview:	deny

/proc/6304/uid_map

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	1.4353713907745331
Encrypted:	false
SSDEEP:	3:MVUGn:MCG
MD5:	54258652109C33FE06188083A3EC23F4
SHA1:	013EC30A95D66C56642C193613A829B746982601
SHA-256:	C459EBB6CF3917EFB05A2E72EF25E223BE9B78780B1CE0CAACCE49C773DF199E
SHA-512:	AAE8A67B91BDEC9C21ACD88711C262EA3ACD3EE086AEB27645531C47DD618708C7FF284759A68000414579B77C0D8A3449F95480D039A9901F7352121B7D78F0
Malicious:	false
Reputation:	low
Preview:	1000 1000 1

/proc/6340/gid_map

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	1.4353713907745331
Encrypted:	false
SSDEEP:	3:MVUGn:MCG
MD5:	54258652109C33FE06188083A3EC23F4
SHA1:	013EC30A95D66C56642C193613A829B746982601
SHA-256:	C459EBB6CF3917EFB05A2E72EF25E223BE9B78780B1CE0CAACCE49C773DF199E
SHA-512:	AAE8A67B91BDEC9C21ACD88711C262EA3ACD3EE086AEB27645531C47DD618708C7FF284759A68000414579B77C0D8A3449F95480D039A9901F7352121B7D78F0
Malicious:	false
Reputation:	low
Preview:	1000 1000 1

/proc/6340/setgroups

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:9n:9n
MD5:	05AFB6CE69B9CEF1BD6ECE7E4745F96C
SHA1:	1D16DC2DCC6851208C1B981E2EC377250A4A0CC5
SHA-256:	3026A0CA485E5831657BA0120FA8DD66B3425427BFB0A2BE0DB743E2305CC7C5
SHA-512:	A37A7790CCB2FA5A3C3F2740480CF4035F2870502060F398A1882A44B675DE736E33D8ECD9B834BB3D19D807B46875E30AA835EDD847C5FE8F1F2942A870BAD5
Malicious:	false
Reputation:	low
Preview:	deny

/proc/6340/uid_map

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	1.4353713907745331
Encrypted:	false
SSDEEP:	3:MVUGn:MCG
MD5:	54258652109C33FE06188083A3EC23F4
SHA1:	013EC30A95D66C56642C193613A829B746982601
SHA-256:	C459EBB6CF3917EFB05A2E72EF25E223BE9B78780B1CE0CAACCE49C773DF199E
SHA-512:	AAE8A67B91BDEC9C21ACD88711C262EA3ACD3EE086AEB27645531C47DD618708C7FF284759A68000414579B77C0D8A3449F95480D039A9901F7352121B7D78F0
Malicious:	false
Reputation:	low
Preview:	1000 1000 1

/proc/6383/gid_map

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	1.4353713907745331
Encrypted:	false
SSDEEP:	3:MVUGn:MCG
MD5:	54258652109C33FE06188083A3EC23F4
SHA1:	013EC30A95D66C56642C193613A829B746982601
SHA-256:	C459EBB6CF3917EFB05A2E72EF25E223BE9B78780B1CE0CAACCE49C773DF199E
SHA-512:	AAE8A67B91BDEC9C21ACD88711C262EA3ACD3EE086AEB27645531C47DD618708C7FF284759A68000414579B77C0D8A3449F95480D039A9901F7352121B7D78F0
Malicious:	false
Reputation:	low
Preview:	1000 1000 1

/proc/6383/setgroups

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:9n:9n
MD5:	05AFB6CE69B9CEF1BD6ECE7E4745F96C
SHA1:	1D16DC2DCC6851208C1B981E2EC377250A4A0CC5
SHA-256:	3026A0CA485E5831657BA0120FA8DD66B3425427BFB0A2BE0DB743E2305CC7C5
SHA-512:	A37A7790CCB2FA5A3C3F2740480CF4035F2870502060F398A1882A44B675DE736E33D8ECD9B834BB3D19D807B46875E30AA835EDD847C5FE8F1F2942A870BAD5
Malicious:	false
Reputation:	low
Preview:	deny

/proc/6383/uid_map

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	1.4353713907745331
Encrypted:	false
SSDEEP:	3:MVUGn:MCG
MD5:	54258652109C33FE06188083A3EC23F4
SHA1:	013EC30A95D66C56642C193613A829B746982601
SHA-256:	C459EBB6CF3917EFB05A2E72EF25E223BE9B78780B1CE0CAACCE49C773DF199E
SHA-512:	AAE8A67B91BDEC9C21ACD88711C262EA3ACD3EE086AEB27645531C47DD618708C7FF284759A68000414579B77C0D8A3449F95480D039A9901F7352121B7D78F0
Malicious:	false
Reputation:	low
Preview:	1000 1000 1

/proc/6434/gid_map

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	1.4353713907745331
Encrypted:	false
SSDEEP:	3:MVUGn:MCG
MD5:	54258652109C33FE06188083A3EC23F4
SHA1:	013EC30A95D66C56642C193613A829B746982601
SHA-256:	C459EBB6CF3917EFB05A2E72EF25E223BE9B78780B1CE0CAACCE49C773DF199E
SHA-512:	AAE8A67B91BDEC9C21ACD88711C262EA3ACD3EE086AEB27645531C47DD618708C7FF284759A68000414579B77C0D8A3449F95480D039A9901F7352121B7D78F0
Malicious:	false
Reputation:	low
Preview:	1000 1000 1

/proc/6434/setgroups

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:9n:9n
MD5:	05AFB6CE69B9CEF1BD6ECE7E4745F96C
SHA1:	1D16DC2DCC6851208C1B981E2EC377250A4A0CC5
SHA-256:	3026A0CA485E5831657BA0120FA8DD66B3425427BFB0A2BE0DB743E2305CC7C5
SHA-512:	A37A7790CCB2FA5A3C3F2740480CF4035F2870502060F398A1882A44B675DE736E33D8ECD9B834BB3D19D807B46875E30AA835EDD847C5FE8F1F2942A870BAD5
Malicious:	false
Reputation:	low
Preview:	deny

/proc/6434/uid_map

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	1.4353713907745331
Encrypted:	false
SSDEEP:	3:MVUGn:MCG
MD5:	54258652109C33FE06188083A3EC23F4
SHA1:	013EC30A95D66C56642C193613A829B746982601
SHA-256:	C459EBB6CF3917EFB05A2E72EF25E223BE9B78780B1CE0CAACCE49C773DF199E
SHA-512:	AAE8A67B91BDEC9C21ACD88711C262EA3ACD3EE086AEB27645531C47DD618708C7FF284759A68000414579B77C0D8A3449F95480D039A9901F7352121B7D78F0
Malicious:	false
Reputation:	low
Preview:	1000 1000 1

/tmp/khk19L2S.mips.part

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, not stripped
Category:	dropped
Size (bytes):	116503
Entropy (8bit):	5.468343542813616
Encrypted:	false
SSDEEP:	3072:C/4g3Kd1rO5hZmxgA9OKdwwjF9GhsR1Ae:O9anO5hZLHKdwwjF9GhsR1Ae
MD5:	FB339CF69C95DC0CFC2E39212B653781
SHA1:	C3DFC45C904BF581CDC2CD4BB4AE3CD04AE5072C
SHA-256:	F01DD98CB5003B692B097C3E9E2493DDD041511D4E1B2874D85FB6E1BBFD3A9B
SHA-512:	2EE376B32955973FB2212C05CC6AE20B18A2A2CA1F3B3FD1F1956AA25EC9427C9E494A642B177B9BF9030466AE390A06E228B24921C7A848F212028CE451DB55
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Mirai_8, Description: Yara detected Mirai, Source: /tmp/khk19L2S.mips.part, Author: Joe Security Rule: JoeSecurity_Gafgyt, Description: Yara detected Gafgyt, Source: /tmp/khk19L2S.mips.part, Author: Joe Security Rule: Linux_Trojan_Gafgyt_28a2fe0c, Description: unknown, Source: /tmp/khk19L2S.mips.part, Author: unknown Rule: Linux_Trojan_Gafgyt_ea92cca8, Description: unknown, Source: /tmp/khk19L2S.mips.part, Author: unknown
Antivirus:	Antivirus: ReversingLabs, Detection: 62%
Reputation:	low
Preview:	.ELF.....................@.....4..{......4. ...(....p........@...@...........................@...@....I...I...............I..EI..EI....8..q.........dt.Q.................................................E.<...'......!'.....................<...'.....!... ....'9... ......................<...'..p...!........'9... ..........................'.. ........<...'..0...!'..... ....................."W......@................N......Y....... ..$B... ....N...N......Y....... ..$B...........@..$................ ..$.I.....$...."W.... ............'..(<...'..t...!'.........................$.I..@..$.W.. ........................I......@..$.I.. ........... ..'.. ............'.. .......!........<...'......!...!........'...$......$'......$.......................4..... ..........................<...'.....!'........!.................bX(....<..74By..b.!........$BX(.C......<.<n4B.r.b.!........$BX(.C..$..........#................$B........ .$bX(...!.E..........$B........ .$bX(...!.B.........&.........b.&<..7

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 21, 2023 06:16:50.033205032 CET	42836	443	192.168.2.23	91.189.91.43
Mar 21, 2023 06:16:50.801146030 CET	42516	80	192.168.2.23	109.202.202.202
Mar 21, 2023 06:17:04.880424023 CET	43928	443	192.168.2.23	91.189.91.42
Mar 21, 2023 06:17:11.193598986 CET	46334	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:12.208030939 CET	46334	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:14.223931074 CET	46334	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:14.241144896 CET	80	46334	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:14.241272926 CET	46334	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:17.167768955 CET	42836	443	192.168.2.23	91.189.91.43
Mar 21, 2023 06:17:19.254798889 CET	46334	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.272135973 CET	80	46334	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.272253036 CET	46334	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.434719086 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.451980114 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.452092886 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.452233076 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.469245911 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.469438076 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.469520092 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.469521046 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.469598055 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.469604015 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.469659090 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.469716072 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.469716072 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.469762087 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.469774008 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.469846010 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.469903946 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.469940901 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.469958067 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.469959974 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.470011950 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.470032930 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.470098019 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.470135927 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.470153093 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.487231970 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.487298012 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.487313986 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.487364054 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.487371922 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.487458944 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.487519979 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.487613916 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.487683058 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.487689018 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.487701893 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.487741947 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.487777948 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.487797976 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.487857103 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.487893105 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.487915039 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.487966061 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.487970114 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.488018990 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.488079071 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.488080978 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.488132000 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.488183022 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.488219023 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.488285065 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.488347054 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.488353968 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.488406897 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.488461971 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.488461971 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.488513947 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.488580942 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.505590916 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.505676031 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.505733967 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.505789995 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.505796909 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.505810976 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.505856037 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.505856991 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.505916119 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.505934954 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.505990028 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.506027937 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.506051064 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.506057024 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.506112099 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.506114006 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.506171942 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.506227970 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.506234884 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.506252050 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.506278038 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.506283045 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.506341934 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.506344080 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.506400108 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.506455898 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.506463051 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.506486893 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.506551027 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.506556988 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.506613970 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.506617069 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.506681919 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.506716013 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.506777048 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.506814957 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.506830931 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.506831884 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.506889105 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.506890059 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.506948948 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.506959915 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.507004976 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.507034063 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.507061005 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.507095098 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.507103920 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.507136106 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.507191896 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.507246017 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.507250071 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.507250071 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.507302046 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.507332087 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.507359028 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.507390976 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.507411957 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.507417917 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.507474899 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.507503033 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.507529974 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.507559061 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.507582903 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.507602930 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.507659912 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.507695913 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.507714987 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.507754087 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.507775068 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.507842064 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.507878065 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.507900000 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.507950068 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.507956028 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.508014917 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.508085966 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.525386095 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.525459051 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.525516033 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.525572062 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.525573015 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.525573015 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.525648117 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.525685072 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.525760889 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.525809050 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.525820017 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.525839090 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.525899887 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.525948048 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.525957108 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.525959015 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.526012897 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.526058912 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.526070118 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.526096106 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.526125908 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.526177883 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.526182890 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.526187897 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.526238918 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.526288986 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.526298046 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.526303053 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.526359081 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.526412010 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.526412010 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.526416063 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.526472092 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.526521921 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.526534081 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.526535034 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.526598930 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.526650906 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.526657104 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.526675940 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.526741982 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:19.526798964 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:19.526798964 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:21.263525009 CET	42516	80	192.168.2.23	109.202.202.202
Mar 21, 2023 06:17:23.297830105 CET	38690	443	192.168.2.23	34.160.144.191
Mar 21, 2023 06:17:23.297924042 CET	443	38690	34.160.144.191	192.168.2.23
Mar 21, 2023 06:17:23.298053980 CET	38690	443	192.168.2.23	34.160.144.191
Mar 21, 2023 06:17:23.301561117 CET	38690	443	192.168.2.23	34.160.144.191
Mar 21, 2023 06:17:23.301608086 CET	443	38690	34.160.144.191	192.168.2.23
Mar 21, 2023 06:17:23.367959023 CET	443	38690	34.160.144.191	192.168.2.23
Mar 21, 2023 06:17:23.368084908 CET	38690	443	192.168.2.23	34.160.144.191
Mar 21, 2023 06:17:23.462474108 CET	38690	443	192.168.2.23	34.160.144.191
Mar 21, 2023 06:17:23.462532043 CET	443	38690	34.160.144.191	192.168.2.23
Mar 21, 2023 06:17:23.462845087 CET	443	38690	34.160.144.191	192.168.2.23
Mar 21, 2023 06:17:23.462939024 CET	38690	443	192.168.2.23	34.160.144.191
Mar 21, 2023 06:17:23.462975025 CET	443	38690	34.160.144.191	192.168.2.23
Mar 21, 2023 06:17:23.463053942 CET	38690	443	192.168.2.23	34.160.144.191
Mar 21, 2023 06:17:23.501593113 CET	38690	443	192.168.2.23	34.160.144.191
Mar 21, 2023 06:17:23.501640081 CET	443	38690	34.160.144.191	192.168.2.23
Mar 21, 2023 06:17:23.520898104 CET	443	38690	34.160.144.191	192.168.2.23
Mar 21, 2023 06:17:23.521008015 CET	38690	443	192.168.2.23	34.160.144.191
Mar 21, 2023 06:17:23.521056890 CET	443	38690	34.160.144.191	192.168.2.23
Mar 21, 2023 06:17:23.521094084 CET	443	38690	34.160.144.191	192.168.2.23
Mar 21, 2023 06:17:23.521157026 CET	38690	443	192.168.2.23	34.160.144.191
Mar 21, 2023 06:17:23.521272898 CET	38690	443	192.168.2.23	34.160.144.191
Mar 21, 2023 06:17:23.521272898 CET	38690	443	192.168.2.23	34.160.144.191
Mar 21, 2023 06:17:23.521326065 CET	443	38690	34.160.144.191	192.168.2.23
Mar 21, 2023 06:17:24.511096954 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:24.511393070 CET	46336	80	192.168.2.23	31.214.243.29
Mar 21, 2023 06:17:24.528506994 CET	80	46336	31.214.243.29	192.168.2.23
Mar 21, 2023 06:17:35.935051918 CET	39200	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:35.935132027 CET	443	39200	52.25.208.227	192.168.2.23
Mar 21, 2023 06:17:35.935444117 CET	39200	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:35.999561071 CET	39200	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:35.999613047 CET	443	39200	52.25.208.227	192.168.2.23
Mar 21, 2023 06:17:36.586983919 CET	443	39200	52.25.208.227	192.168.2.23
Mar 21, 2023 06:17:36.587104082 CET	39200	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:36.698925972 CET	39200	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:36.699011087 CET	443	39200	52.25.208.227	192.168.2.23
Mar 21, 2023 06:17:36.699290037 CET	443	39200	52.25.208.227	192.168.2.23
Mar 21, 2023 06:17:36.699379921 CET	39200	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:36.699414015 CET	443	39200	52.25.208.227	192.168.2.23
Mar 21, 2023 06:17:36.699492931 CET	39200	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:36.699789047 CET	39200	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:36.699814081 CET	443	39200	52.25.208.227	192.168.2.23
Mar 21, 2023 06:17:36.889451981 CET	443	39200	52.25.208.227	192.168.2.23
Mar 21, 2023 06:17:36.889575958 CET	39200	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:36.889626980 CET	443	39200	52.25.208.227	192.168.2.23
Mar 21, 2023 06:17:36.930716038 CET	39200	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:37.224190950 CET	39200	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:37.224190950 CET	39200	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:37.224231005 CET	443	39200	52.25.208.227	192.168.2.23
Mar 21, 2023 06:17:37.224247932 CET	443	39200	52.25.208.227	192.168.2.23
Mar 21, 2023 06:17:38.180691004 CET	43386	443	192.168.2.23	34.120.208.123
Mar 21, 2023 06:17:38.180774927 CET	443	43386	34.120.208.123	192.168.2.23
Mar 21, 2023 06:17:38.180885077 CET	43386	443	192.168.2.23	34.120.208.123
Mar 21, 2023 06:17:38.205374002 CET	43386	443	192.168.2.23	34.120.208.123
Mar 21, 2023 06:17:38.205424070 CET	443	43386	34.120.208.123	192.168.2.23
Mar 21, 2023 06:17:38.263072014 CET	443	43386	34.120.208.123	192.168.2.23
Mar 21, 2023 06:17:38.263292074 CET	43386	443	192.168.2.23	34.120.208.123
Mar 21, 2023 06:17:38.453188896 CET	43386	443	192.168.2.23	34.120.208.123
Mar 21, 2023 06:17:38.453272104 CET	443	43386	34.120.208.123	192.168.2.23
Mar 21, 2023 06:17:38.453687906 CET	443	43386	34.120.208.123	192.168.2.23
Mar 21, 2023 06:17:38.453844070 CET	43386	443	192.168.2.23	34.120.208.123
Mar 21, 2023 06:17:38.453882933 CET	443	43386	34.120.208.123	192.168.2.23
Mar 21, 2023 06:17:38.453982115 CET	43386	443	192.168.2.23	34.120.208.123
Mar 21, 2023 06:17:38.474170923 CET	43386	443	192.168.2.23	34.120.208.123
Mar 21, 2023 06:17:38.474229097 CET	443	43386	34.120.208.123	192.168.2.23
Mar 21, 2023 06:17:38.717446089 CET	443	43386	34.120.208.123	192.168.2.23
Mar 21, 2023 06:17:38.717573881 CET	43386	443	192.168.2.23	34.120.208.123
Mar 21, 2023 06:17:38.717624903 CET	443	43386	34.120.208.123	192.168.2.23
Mar 21, 2023 06:17:38.717709064 CET	43386	443	192.168.2.23	34.120.208.123
Mar 21, 2023 06:17:38.717739105 CET	443	43386	34.120.208.123	192.168.2.23
Mar 21, 2023 06:17:38.726865053 CET	43386	443	192.168.2.23	34.120.208.123
Mar 21, 2023 06:17:38.726866007 CET	43386	443	192.168.2.23	34.120.208.123
Mar 21, 2023 06:17:38.726929903 CET	443	43386	34.120.208.123	192.168.2.23
Mar 21, 2023 06:17:39.053580999 CET	57862	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:39.053639889 CET	443	57862	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:39.053730965 CET	57862	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:39.062342882 CET	57862	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:39.062381983 CET	443	57862	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:39.126370907 CET	443	57862	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:39.126466990 CET	57862	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:39.189981937 CET	57862	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:39.190015078 CET	443	57862	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:39.190319061 CET	443	57862	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:39.190377951 CET	57862	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:39.190414906 CET	443	57862	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:39.190469980 CET	57862	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:39.206906080 CET	57862	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:39.206927061 CET	443	57862	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:39.207149029 CET	57864	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:39.207201958 CET	443	57864	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:39.207272053 CET	57864	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:39.218703985 CET	57864	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:39.218734980 CET	443	57864	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:39.225748062 CET	443	57862	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:39.225833893 CET	57862	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:39.225853920 CET	443	57862	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:39.225903034 CET	57862	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:39.225908041 CET	443	57862	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:39.232534885 CET	57862	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:39.232563019 CET	443	57862	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:39.232579947 CET	57862	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:39.232588053 CET	443	57862	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:39.275691986 CET	443	57864	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:39.275794029 CET	57864	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:39.277952909 CET	57864	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:39.277981997 CET	443	57864	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:39.278157949 CET	443	57864	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:39.278228998 CET	57864	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:40.870232105 CET	57864	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:40.870294094 CET	443	57864	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:40.889326096 CET	443	57864	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:40.889507055 CET	57864	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:40.889674902 CET	443	57864	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:40.889784098 CET	57864	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:40.889863014 CET	443	57864	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:40.889923096 CET	57864	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:40.889945984 CET	443	57864	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:40.890084982 CET	57864	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:40.890301943 CET	443	57864	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:40.917558908 CET	57864	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:40.917603016 CET	443	57864	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:40.917623043 CET	57864	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:40.917634964 CET	443	57864	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:41.105554104 CET	39582	443	192.168.2.23	34.111.73.144
Mar 21, 2023 06:17:41.105634928 CET	443	39582	34.111.73.144	192.168.2.23
Mar 21, 2023 06:17:41.105736017 CET	39582	443	192.168.2.23	34.111.73.144
Mar 21, 2023 06:17:41.114556074 CET	39582	443	192.168.2.23	34.111.73.144
Mar 21, 2023 06:17:41.114600897 CET	443	39582	34.111.73.144	192.168.2.23
Mar 21, 2023 06:17:41.177139044 CET	443	39582	34.111.73.144	192.168.2.23
Mar 21, 2023 06:17:41.177228928 CET	39582	443	192.168.2.23	34.111.73.144
Mar 21, 2023 06:17:41.228084087 CET	39582	443	192.168.2.23	34.111.73.144
Mar 21, 2023 06:17:41.228141069 CET	443	39582	34.111.73.144	192.168.2.23
Mar 21, 2023 06:17:41.228528976 CET	443	39582	34.111.73.144	192.168.2.23
Mar 21, 2023 06:17:41.228624105 CET	39582	443	192.168.2.23	34.111.73.144
Mar 21, 2023 06:17:41.228694916 CET	443	39582	34.111.73.144	192.168.2.23
Mar 21, 2023 06:17:41.228774071 CET	39582	443	192.168.2.23	34.111.73.144
Mar 21, 2023 06:17:41.237214088 CET	39582	443	192.168.2.23	34.111.73.144
Mar 21, 2023 06:17:41.237251997 CET	443	39582	34.111.73.144	192.168.2.23
Mar 21, 2023 06:17:41.256431103 CET	443	39582	34.111.73.144	192.168.2.23
Mar 21, 2023 06:17:41.256504059 CET	443	39582	34.111.73.144	192.168.2.23
Mar 21, 2023 06:17:41.256587982 CET	39582	443	192.168.2.23	34.111.73.144
Mar 21, 2023 06:17:41.256625891 CET	443	39582	34.111.73.144	192.168.2.23
Mar 21, 2023 06:17:41.256674051 CET	39582	443	192.168.2.23	34.111.73.144
Mar 21, 2023 06:17:41.256700993 CET	39582	443	192.168.2.23	34.111.73.144
Mar 21, 2023 06:17:41.256800890 CET	443	39582	34.111.73.144	192.168.2.23
Mar 21, 2023 06:17:41.256884098 CET	39582	443	192.168.2.23	34.111.73.144
Mar 21, 2023 06:17:41.256918907 CET	443	39582	34.111.73.144	192.168.2.23
Mar 21, 2023 06:17:41.257025003 CET	39582	443	192.168.2.23	34.111.73.144
Mar 21, 2023 06:17:41.257050991 CET	443	39582	34.111.73.144	192.168.2.23
Mar 21, 2023 06:17:41.257122993 CET	39582	443	192.168.2.23	34.111.73.144
Mar 21, 2023 06:17:41.257206917 CET	443	39582	34.111.73.144	192.168.2.23
Mar 21, 2023 06:17:41.257293940 CET	39582	443	192.168.2.23	34.111.73.144
Mar 21, 2023 06:17:41.257356882 CET	443	39582	34.111.73.144	192.168.2.23
Mar 21, 2023 06:17:41.257450104 CET	39582	443	192.168.2.23	34.111.73.144
Mar 21, 2023 06:17:41.257618904 CET	443	39582	34.111.73.144	192.168.2.23
Mar 21, 2023 06:17:41.257695913 CET	39582	443	192.168.2.23	34.111.73.144
Mar 21, 2023 06:17:41.257807970 CET	443	39582	34.111.73.144	192.168.2.23
Mar 21, 2023 06:17:41.286494017 CET	39582	443	192.168.2.23	34.111.73.144
Mar 21, 2023 06:17:41.286555052 CET	443	39582	34.111.73.144	192.168.2.23
Mar 21, 2023 06:17:41.286587954 CET	39582	443	192.168.2.23	34.111.73.144
Mar 21, 2023 06:17:41.286608934 CET	443	39582	34.111.73.144	192.168.2.23
Mar 21, 2023 06:17:41.316590071 CET	57056	443	192.168.2.23	35.244.181.201
Mar 21, 2023 06:17:41.316658020 CET	443	57056	35.244.181.201	192.168.2.23
Mar 21, 2023 06:17:41.316761971 CET	57056	443	192.168.2.23	35.244.181.201
Mar 21, 2023 06:17:41.316941977 CET	57056	443	192.168.2.23	35.244.181.201
Mar 21, 2023 06:17:41.316967964 CET	443	57056	35.244.181.201	192.168.2.23
Mar 21, 2023 06:17:41.374408007 CET	443	57056	35.244.181.201	192.168.2.23
Mar 21, 2023 06:17:41.374525070 CET	57056	443	192.168.2.23	35.244.181.201
Mar 21, 2023 06:17:41.445946932 CET	57056	443	192.168.2.23	35.244.181.201
Mar 21, 2023 06:17:41.446033001 CET	443	57056	35.244.181.201	192.168.2.23
Mar 21, 2023 06:17:41.446793079 CET	443	57056	35.244.181.201	192.168.2.23
Mar 21, 2023 06:17:41.446892023 CET	57056	443	192.168.2.23	35.244.181.201
Mar 21, 2023 06:17:41.491095066 CET	57056	443	192.168.2.23	35.244.181.201
Mar 21, 2023 06:17:41.491143942 CET	443	57056	35.244.181.201	192.168.2.23
Mar 21, 2023 06:17:41.711484909 CET	443	57056	35.244.181.201	192.168.2.23
Mar 21, 2023 06:17:41.711591005 CET	57056	443	192.168.2.23	35.244.181.201
Mar 21, 2023 06:17:41.711630106 CET	443	57056	35.244.181.201	192.168.2.23
Mar 21, 2023 06:17:41.711700916 CET	57056	443	192.168.2.23	35.244.181.201
Mar 21, 2023 06:17:41.711707115 CET	443	57056	35.244.181.201	192.168.2.23
Mar 21, 2023 06:17:41.718563080 CET	57056	443	192.168.2.23	35.244.181.201
Mar 21, 2023 06:17:41.718564034 CET	57056	443	192.168.2.23	35.244.181.201
Mar 21, 2023 06:17:41.718622923 CET	443	57056	35.244.181.201	192.168.2.23
Mar 21, 2023 06:17:43.306958914 CET	57870	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:43.307065964 CET	443	57870	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:43.307164907 CET	57870	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:43.323687077 CET	57870	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:43.323744059 CET	443	57870	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:43.374993086 CET	443	57870	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:43.375138044 CET	57870	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:43.378410101 CET	57870	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:43.378462076 CET	443	57870	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:43.378669977 CET	443	57870	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:43.380177021 CET	57870	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:43.439820051 CET	57870	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:43.439877033 CET	443	57870	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:43.459275007 CET	443	57870	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:43.459372997 CET	57870	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:43.459408045 CET	443	57870	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:43.459454060 CET	443	57870	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:43.459490061 CET	57870	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:43.464271069 CET	57870	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:43.464271069 CET	57870	443	192.168.2.23	35.241.9.150
Mar 21, 2023 06:17:43.464343071 CET	443	57870	35.241.9.150	192.168.2.23
Mar 21, 2023 06:17:45.047677040 CET	39214	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:45.047761917 CET	443	39214	52.25.208.227	192.168.2.23
Mar 21, 2023 06:17:45.047878027 CET	39214	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:45.058844090 CET	39214	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:45.058921099 CET	443	39214	52.25.208.227	192.168.2.23
Mar 21, 2023 06:17:45.446419001 CET	443	39214	52.25.208.227	192.168.2.23
Mar 21, 2023 06:17:45.446496964 CET	39214	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:45.449126005 CET	39214	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:45.449156046 CET	443	39214	52.25.208.227	192.168.2.23
Mar 21, 2023 06:17:45.449367046 CET	443	39214	52.25.208.227	192.168.2.23
Mar 21, 2023 06:17:45.449453115 CET	39214	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:45.486855984 CET	39214	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:45.486905098 CET	443	39214	52.25.208.227	192.168.2.23
Mar 21, 2023 06:17:45.838249922 CET	43928	443	192.168.2.23	91.189.91.42
Mar 21, 2023 06:17:45.862660885 CET	443	39214	52.25.208.227	192.168.2.23
Mar 21, 2023 06:17:45.862787962 CET	39214	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:45.863080978 CET	443	39214	52.25.208.227	192.168.2.23
Mar 21, 2023 06:17:45.906251907 CET	39214	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:46.933666945 CET	39214	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:46.933666945 CET	39214	443	192.168.2.23	52.25.208.227
Mar 21, 2023 06:17:46.933736086 CET	443	39214	52.25.208.227	192.168.2.23
Mar 21, 2023 06:17:46.933798075 CET	443	39214	52.25.208.227	192.168.2.23
Mar 21, 2023 06:17:57.011423111 CET	38246	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:17:57.011496067 CET	443	38246	44.231.103.117	192.168.2.23
Mar 21, 2023 06:17:57.011598110 CET	38246	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:17:57.016091108 CET	38246	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:17:57.016129971 CET	443	38246	44.231.103.117	192.168.2.23
Mar 21, 2023 06:17:57.604682922 CET	443	38246	44.231.103.117	192.168.2.23
Mar 21, 2023 06:17:57.604809046 CET	38246	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:17:57.642888069 CET	38246	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:17:57.642930984 CET	443	38246	44.231.103.117	192.168.2.23
Mar 21, 2023 06:17:57.643213987 CET	443	38246	44.231.103.117	192.168.2.23
Mar 21, 2023 06:17:57.643328905 CET	38246	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:17:57.643354893 CET	443	38246	44.231.103.117	192.168.2.23
Mar 21, 2023 06:17:57.643415928 CET	38246	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:17:57.644855976 CET	38246	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:17:57.644902945 CET	443	38246	44.231.103.117	192.168.2.23
Mar 21, 2023 06:17:57.837038040 CET	443	38246	44.231.103.117	192.168.2.23
Mar 21, 2023 06:17:57.837152958 CET	38246	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:17:57.837249041 CET	443	38246	44.231.103.117	192.168.2.23
Mar 21, 2023 06:17:57.877605915 CET	38246	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:17:58.016128063 CET	38246	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:17:58.016213894 CET	443	38246	44.231.103.117	192.168.2.23
Mar 21, 2023 06:17:58.016268969 CET	38246	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:17:58.016297102 CET	443	38246	44.231.103.117	192.168.2.23
Mar 21, 2023 06:18:18.065923929 CET	38248	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:18:18.066018105 CET	443	38248	44.231.103.117	192.168.2.23
Mar 21, 2023 06:18:18.066149950 CET	38248	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:18:18.071674109 CET	38248	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:18:18.071727037 CET	443	38248	44.231.103.117	192.168.2.23
Mar 21, 2023 06:18:18.467320919 CET	443	38248	44.231.103.117	192.168.2.23
Mar 21, 2023 06:18:18.467466116 CET	38248	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:18:18.471353054 CET	38248	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:18:18.471405029 CET	443	38248	44.231.103.117	192.168.2.23
Mar 21, 2023 06:18:18.471674919 CET	443	38248	44.231.103.117	192.168.2.23
Mar 21, 2023 06:18:18.471780062 CET	38248	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:18:18.619541883 CET	38248	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:18:18.619607925 CET	443	38248	44.231.103.117	192.168.2.23
Mar 21, 2023 06:18:18.891953945 CET	443	38248	44.231.103.117	192.168.2.23
Mar 21, 2023 06:18:18.892067909 CET	38248	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:18:18.892174959 CET	443	38248	44.231.103.117	192.168.2.23
Mar 21, 2023 06:18:18.932463884 CET	38248	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:18:18.994672060 CET	38248	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:18:18.994672060 CET	38248	443	192.168.2.23	44.231.103.117
Mar 21, 2023 06:18:18.994755030 CET	443	38248	44.231.103.117	192.168.2.23
Mar 21, 2023 06:18:18.994776964 CET	443	38248	44.231.103.117	192.168.2.23

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 21, 2023 06:17:23.237967014 CET	58862	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:17:23.238112926 CET	53016	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:17:23.255949974 CET	53	53016	1.1.1.1	192.168.2.23
Mar 21, 2023 06:17:23.256042957 CET	53	58862	1.1.1.1	192.168.2.23
Mar 21, 2023 06:17:35.165245056 CET	56496	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:17:35.165478945 CET	44930	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:17:35.183171034 CET	53	44930	1.1.1.1	192.168.2.23
Mar 21, 2023 06:17:35.183228016 CET	53	56496	1.1.1.1	192.168.2.23
Mar 21, 2023 06:17:35.183821917 CET	39634	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:17:35.201853037 CET	53	39634	1.1.1.1	192.168.2.23
Mar 21, 2023 06:17:35.679447889 CET	57021	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:17:35.697139025 CET	53	57021	1.1.1.1	192.168.2.23
Mar 21, 2023 06:17:35.824021101 CET	40333	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:17:35.842788935 CET	53	40333	1.1.1.1	192.168.2.23
Mar 21, 2023 06:17:38.104825974 CET	52600	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:17:38.122525930 CET	53	52600	1.1.1.1	192.168.2.23
Mar 21, 2023 06:17:39.018667936 CET	52200	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:17:39.018774986 CET	48673	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:17:39.036520958 CET	53	52200	1.1.1.1	192.168.2.23
Mar 21, 2023 06:17:39.036636114 CET	53	48673	1.1.1.1	192.168.2.23
Mar 21, 2023 06:17:41.042417049 CET	43120	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:17:41.042736053 CET	58507	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:17:41.060601950 CET	53	43120	1.1.1.1	192.168.2.23
Mar 21, 2023 06:17:41.061301947 CET	53	58507	1.1.1.1	192.168.2.23
Mar 21, 2023 06:17:41.061706066 CET	37885	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:17:41.079900980 CET	53	37885	1.1.1.1	192.168.2.23
Mar 21, 2023 06:17:41.278846979 CET	59646	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:17:41.297071934 CET	53	59646	1.1.1.1	192.168.2.23
Mar 21, 2023 06:17:44.986042023 CET	39990	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:17:45.003951073 CET	53	39990	1.1.1.1	192.168.2.23
Mar 21, 2023 06:17:56.937290907 CET	40597	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:17:56.937804937 CET	58383	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:17:56.955193996 CET	53	40597	1.1.1.1	192.168.2.23
Mar 21, 2023 06:17:56.955722094 CET	53	58383	1.1.1.1	192.168.2.23
Mar 21, 2023 06:18:10.062733889 CET	36717	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:18:10.062994957 CET	42877	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:18:10.080677032 CET	53	42877	1.1.1.1	192.168.2.23
Mar 21, 2023 06:18:10.080779076 CET	53	36717	1.1.1.1	192.168.2.23
Mar 21, 2023 06:18:10.130449057 CET	46658	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:18:10.130737066 CET	36520	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:18:10.148289919 CET	53	46658	1.1.1.1	192.168.2.23
Mar 21, 2023 06:18:10.148864985 CET	53	36520	1.1.1.1	192.168.2.23
Mar 21, 2023 06:18:10.213614941 CET	36878	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:18:10.213829041 CET	43737	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:18:10.231379032 CET	53	43737	1.1.1.1	192.168.2.23
Mar 21, 2023 06:18:10.231416941 CET	53	36878	1.1.1.1	192.168.2.23
Mar 21, 2023 06:18:10.263957024 CET	40262	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:18:10.264198065 CET	60654	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:18:10.281903028 CET	53	40262	1.1.1.1	192.168.2.23
Mar 21, 2023 06:18:10.281965017 CET	53	60654	1.1.1.1	192.168.2.23
Mar 21, 2023 06:18:10.325733900 CET	48111	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:18:10.325872898 CET	35342	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:18:10.343791962 CET	53	48111	1.1.1.1	192.168.2.23
Mar 21, 2023 06:18:10.344152927 CET	53	35342	1.1.1.1	192.168.2.23
Mar 21, 2023 06:18:10.344654083 CET	48925	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:18:10.350140095 CET	44835	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:18:10.350322008 CET	53348	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:18:10.362646103 CET	53	48925	1.1.1.1	192.168.2.23
Mar 21, 2023 06:18:10.367979050 CET	53	44835	1.1.1.1	192.168.2.23
Mar 21, 2023 06:18:10.368037939 CET	53	53348	1.1.1.1	192.168.2.23
Mar 21, 2023 06:18:17.931102037 CET	49611	53	192.168.2.23	1.1.1.1
Mar 21, 2023 06:18:17.949184895 CET	53	49611	1.1.1.1	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 21, 2023 06:17:23.237967014 CET	192.168.2.23	1.1.1.1	0x421b	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:23.238112926 CET	192.168.2.23	1.1.1.1	0x1038	Standard query (0)	content-signature-2.cdn.mozilla.net	28	IN (0x0001)	false
Mar 21, 2023 06:17:35.165245056 CET	192.168.2.23	1.1.1.1	0x8a45	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:35.165478945 CET	192.168.2.23	1.1.1.1	0xa879	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Mar 21, 2023 06:17:35.183821917 CET	192.168.2.23	1.1.1.1	0x21c4	Standard query (0)	autopush.prod.mozaws.net	28	IN (0x0001)	false
Mar 21, 2023 06:17:35.679447889 CET	192.168.2.23	1.1.1.1	0x1992	Standard query (0)	autopush.prod.mozaws.net	28	IN (0x0001)	false
Mar 21, 2023 06:17:35.824021101 CET	192.168.2.23	1.1.1.1	0x3fa3	Standard query (0)	autopush.prod.mozaws.net	28	IN (0x0001)	false
Mar 21, 2023 06:17:38.104825974 CET	192.168.2.23	1.1.1.1	0x5462	Standard query (0)	prod.ingestion-edge.prod.dataops.mozgcp.net	28	IN (0x0001)	false
Mar 21, 2023 06:17:39.018667936 CET	192.168.2.23	1.1.1.1	0x1ce4	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:39.018774986 CET	192.168.2.23	1.1.1.1	0xa38c	Standard query (0)	firefox.settings.services.mozilla.com	28	IN (0x0001)	false
Mar 21, 2023 06:17:41.042417049 CET	192.168.2.23	1.1.1.1	0xcbd4	Standard query (0)	firefox-settings-attachments.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:41.042736053 CET	192.168.2.23	1.1.1.1	0xf97e	Standard query (0)	firefox-settings-attachments.cdn.mozilla.net	28	IN (0x0001)	false
Mar 21, 2023 06:17:41.061706066 CET	192.168.2.23	1.1.1.1	0x482d	Standard query (0)	fennec-catalog-cdn.prod.mozaws.net	28	IN (0x0001)	false
Mar 21, 2023 06:17:41.278846979 CET	192.168.2.23	1.1.1.1	0x1e71	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Mar 21, 2023 06:17:44.986042023 CET	192.168.2.23	1.1.1.1	0xd15f	Standard query (0)	autopush.prod.mozaws.net	28	IN (0x0001)	false
Mar 21, 2023 06:17:56.937290907 CET	192.168.2.23	1.1.1.1	0x1598	Standard query (0)	autopush.prod.mozaws.net	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:56.937804937 CET	192.168.2.23	1.1.1.1	0xa7fe	Standard query (0)	autopush.prod.mozaws.net	28	IN (0x0001)	false
Mar 21, 2023 06:18:10.062733889 CET	192.168.2.23	1.1.1.1	0x9635	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.062994957 CET	192.168.2.23	1.1.1.1	0xd573	Standard query (0)	www.wikipedia.org	28	IN (0x0001)	false
Mar 21, 2023 06:18:10.130449057 CET	192.168.2.23	1.1.1.1	0x78b6	Standard query (0)	www.example.com	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.130737066 CET	192.168.2.23	1.1.1.1	0xad48	Standard query (0)	www.example.com	28	IN (0x0001)	false
Mar 21, 2023 06:18:10.213614941 CET	192.168.2.23	1.1.1.1	0x64c7	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.213829041 CET	192.168.2.23	1.1.1.1	0x528b	Standard query (0)	www.youtube.com	28	IN (0x0001)	false
Mar 21, 2023 06:18:10.263957024 CET	192.168.2.23	1.1.1.1	0xa647	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.264198065 CET	192.168.2.23	1.1.1.1	0x4033	Standard query (0)	www.facebook.com	28	IN (0x0001)	false
Mar 21, 2023 06:18:10.325733900 CET	192.168.2.23	1.1.1.1	0x29c3	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.325872898 CET	192.168.2.23	1.1.1.1	0xfcd	Standard query (0)	www.reddit.com	28	IN (0x0001)	false
Mar 21, 2023 06:18:10.344654083 CET	192.168.2.23	1.1.1.1	0x67d	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Mar 21, 2023 06:18:10.350140095 CET	192.168.2.23	1.1.1.1	0xe085	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.350322008 CET	192.168.2.23	1.1.1.1	0xf7d4	Standard query (0)	twitter.com	28	IN (0x0001)	false
Mar 21, 2023 06:18:17.931102037 CET	192.168.2.23	1.1.1.1	0xfde5	Standard query (0)	autopush.prod.mozaws.net	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 21, 2023 06:17:23.255949974 CET	1.1.1.1	192.168.2.23	0x1038	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 21, 2023 06:17:23.255949974 CET	1.1.1.1	192.168.2.23	0x1038	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 21, 2023 06:17:23.255949974 CET	1.1.1.1	192.168.2.23	0x1038	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Mar 21, 2023 06:17:23.256042957 CET	1.1.1.1	192.168.2.23	0x421b	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 21, 2023 06:17:23.256042957 CET	1.1.1.1	192.168.2.23	0x421b	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 21, 2023 06:17:23.256042957 CET	1.1.1.1	192.168.2.23	0x421b	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:35.183171034 CET	1.1.1.1	192.168.2.23	0xa879	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 21, 2023 06:17:35.183228016 CET	1.1.1.1	192.168.2.23	0x8a45	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 21, 2023 06:17:35.183228016 CET	1.1.1.1	192.168.2.23	0x8a45	No error (0)	autopush.prod.mozaws.net		52.10.254.200	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:35.183228016 CET	1.1.1.1	192.168.2.23	0x8a45	No error (0)	autopush.prod.mozaws.net		52.39.176.227	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:35.183228016 CET	1.1.1.1	192.168.2.23	0x8a45	No error (0)	autopush.prod.mozaws.net		35.84.57.165	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:35.183228016 CET	1.1.1.1	192.168.2.23	0x8a45	No error (0)	autopush.prod.mozaws.net		35.80.120.72	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:35.183228016 CET	1.1.1.1	192.168.2.23	0x8a45	No error (0)	autopush.prod.mozaws.net		52.89.64.64	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:35.183228016 CET	1.1.1.1	192.168.2.23	0x8a45	No error (0)	autopush.prod.mozaws.net		44.227.71.100	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:35.183228016 CET	1.1.1.1	192.168.2.23	0x8a45	No error (0)	autopush.prod.mozaws.net		35.166.158.207	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:35.183228016 CET	1.1.1.1	192.168.2.23	0x8a45	No error (0)	autopush.prod.mozaws.net		52.25.208.227	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:38.104091883 CET	1.1.1.1	192.168.2.23	0xa01f	No error (0)	telemetry-incoming.r53-2.services.mozilla.com	prod.ingestion-edge.prod.dataops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 21, 2023 06:17:38.104146957 CET	1.1.1.1	192.168.2.23	0x2bf9	No error (0)	telemetry-incoming.r53-2.services.mozilla.com	prod.ingestion-edge.prod.dataops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 21, 2023 06:17:38.104146957 CET	1.1.1.1	192.168.2.23	0x2bf9	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:39.036520958 CET	1.1.1.1	192.168.2.23	0x1ce4	No error (0)	firefox.settings.services.mozilla.com		35.241.9.150	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:41.060601950 CET	1.1.1.1	192.168.2.23	0xcbd4	No error (0)	firefox-settings-attachments.cdn.mozilla.net	fennec-catalog-cdn.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 21, 2023 06:17:41.060601950 CET	1.1.1.1	192.168.2.23	0xcbd4	No error (0)	fennec-catalog-cdn.prod.mozaws.net		34.111.73.144	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:41.061301947 CET	1.1.1.1	192.168.2.23	0xf97e	No error (0)	firefox-settings-attachments.cdn.mozilla.net	fennec-catalog-cdn.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 21, 2023 06:17:41.277940989 CET	1.1.1.1	192.168.2.23	0x5b3e	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 21, 2023 06:17:41.277940989 CET	1.1.1.1	192.168.2.23	0x5b3e	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:41.278381109 CET	1.1.1.1	192.168.2.23	0x5555	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 21, 2023 06:17:56.955193996 CET	1.1.1.1	192.168.2.23	0x1598	No error (0)	autopush.prod.mozaws.net		52.43.157.124	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:56.955193996 CET	1.1.1.1	192.168.2.23	0x1598	No error (0)	autopush.prod.mozaws.net		35.84.57.165	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:56.955193996 CET	1.1.1.1	192.168.2.23	0x1598	No error (0)	autopush.prod.mozaws.net		35.81.250.50	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:56.955193996 CET	1.1.1.1	192.168.2.23	0x1598	No error (0)	autopush.prod.mozaws.net		54.149.93.186	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:56.955193996 CET	1.1.1.1	192.168.2.23	0x1598	No error (0)	autopush.prod.mozaws.net		35.164.171.70	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:56.955193996 CET	1.1.1.1	192.168.2.23	0x1598	No error (0)	autopush.prod.mozaws.net		34.216.140.79	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:56.955193996 CET	1.1.1.1	192.168.2.23	0x1598	No error (0)	autopush.prod.mozaws.net		52.88.176.26	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:17:56.955193996 CET	1.1.1.1	192.168.2.23	0x1598	No error (0)	autopush.prod.mozaws.net		44.231.103.117	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.080677032 CET	1.1.1.1	192.168.2.23	0xd573	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Mar 21, 2023 06:18:10.080677032 CET	1.1.1.1	192.168.2.23	0xd573	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Mar 21, 2023 06:18:10.080779076 CET	1.1.1.1	192.168.2.23	0x9635	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Mar 21, 2023 06:18:10.080779076 CET	1.1.1.1	192.168.2.23	0x9635	No error (0)	dyna.wikimedia.org		91.198.174.192	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.148289919 CET	1.1.1.1	192.168.2.23	0x78b6	No error (0)	www.example.com		93.184.216.34	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.148864985 CET	1.1.1.1	192.168.2.23	0xad48	No error (0)	www.example.com			28	IN (0x0001)	false
Mar 21, 2023 06:18:10.231379032 CET	1.1.1.1	192.168.2.23	0x528b	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 21, 2023 06:18:10.231379032 CET	1.1.1.1	192.168.2.23	0x528b	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Mar 21, 2023 06:18:10.231379032 CET	1.1.1.1	192.168.2.23	0x528b	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Mar 21, 2023 06:18:10.231379032 CET	1.1.1.1	192.168.2.23	0x528b	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Mar 21, 2023 06:18:10.231379032 CET	1.1.1.1	192.168.2.23	0x528b	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Mar 21, 2023 06:18:10.231416941 CET	1.1.1.1	192.168.2.23	0x64c7	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 21, 2023 06:18:10.231416941 CET	1.1.1.1	192.168.2.23	0x64c7	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.231416941 CET	1.1.1.1	192.168.2.23	0x64c7	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.231416941 CET	1.1.1.1	192.168.2.23	0x64c7	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.231416941 CET	1.1.1.1	192.168.2.23	0x64c7	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.231416941 CET	1.1.1.1	192.168.2.23	0x64c7	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.231416941 CET	1.1.1.1	192.168.2.23	0x64c7	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.231416941 CET	1.1.1.1	192.168.2.23	0x64c7	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.231416941 CET	1.1.1.1	192.168.2.23	0x64c7	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.231416941 CET	1.1.1.1	192.168.2.23	0x64c7	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.231416941 CET	1.1.1.1	192.168.2.23	0x64c7	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.231416941 CET	1.1.1.1	192.168.2.23	0x64c7	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.231416941 CET	1.1.1.1	192.168.2.23	0x64c7	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.231416941 CET	1.1.1.1	192.168.2.23	0x64c7	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.231416941 CET	1.1.1.1	192.168.2.23	0x64c7	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.231416941 CET	1.1.1.1	192.168.2.23	0x64c7	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.231416941 CET	1.1.1.1	192.168.2.23	0x64c7	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.281903028 CET	1.1.1.1	192.168.2.23	0xa647	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 21, 2023 06:18:10.281903028 CET	1.1.1.1	192.168.2.23	0xa647	No error (0)	star-mini.c10r.facebook.com		157.240.20.35	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.281965017 CET	1.1.1.1	192.168.2.23	0x4033	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 21, 2023 06:18:10.281965017 CET	1.1.1.1	192.168.2.23	0x4033	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Mar 21, 2023 06:18:10.343791962 CET	1.1.1.1	192.168.2.23	0x29c3	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 21, 2023 06:18:10.343791962 CET	1.1.1.1	192.168.2.23	0x29c3	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.343791962 CET	1.1.1.1	192.168.2.23	0x29c3	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.343791962 CET	1.1.1.1	192.168.2.23	0x29c3	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.343791962 CET	1.1.1.1	192.168.2.23	0x29c3	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.344152927 CET	1.1.1.1	192.168.2.23	0xfcd	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 21, 2023 06:18:10.367979050 CET	1.1.1.1	192.168.2.23	0xe085	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.367979050 CET	1.1.1.1	192.168.2.23	0xe085	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.367979050 CET	1.1.1.1	192.168.2.23	0xe085	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Mar 21, 2023 06:18:10.367979050 CET	1.1.1.1	192.168.2.23	0xe085	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

content-signature-2.cdn.mozilla.net

push.services.mozilla.com

incoming.telemetry.mozilla.org

firefox.settings.services.mozilla.com

firefox-settings-attachments.cdn.mozilla.net

aus5.mozilla.org

31.214.243.29

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.23	38690	34.160.144.191	443

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.23	39200	52.25.208.227	443

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.23	38248	44.231.103.117	443

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.23	46336	31.214.243.29	80

Timestamp	kBytes transferred	Direction	Data
Mar 21, 2023 06:17:19.452233076 CET	1	OUT	GET /Demon.mips HTTP/1.1 Host: 31.214.243.29 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1
Mar 21, 2023 06:17:19.469438076 CET	2	IN	HTTP/1.1 200 OK Date: Tue, 21 Mar 2023 05:17:19 GMT Server: Apache/2.4.6 (CentOS) Last-Modified: Sat, 18 Mar 2023 21:24:02 GMT ETag: "1c717-5f733501889dd" Accept-Ranges: bytes Content-Length: 116503 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00 00 02 00 08 00 00 00 01 00 40 02 a0 00 00 00 34 00 01 7b f4 00 00 10 07 00 34 00 20 00 04 00 28 00 15 00 12 70 00 00 00 00 00 00 b4 00 40 00 b4 00 40 00 b4 00 00 00 18 00 00 00 18 00 00 00 04 00 00 00 04 00 00 00 01 00 00 00 00 00 40 00 00 00 40 00 00 00 01 49 98 00 01 49 98 00 00 00 05 00 01 00 00 00 00 00 01 00 01 49 98 00 45 49 98 00 45 49 98 00 00 0e 38 00 00 71 fc 00 00 00 06 00 01 00 00 64 74 e5 51 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 04 b2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 45 d3 90 3c 1c 00 06 27 9c d2 c4 03 99 e0 21 27 bd ff e0 af bc 00 10 af bf 00 1c af bc 00 18 04 11 00 01 00 00 00 00 3c 1c 00 06 27 9c d2 a0 03 9f e0 21 8f 99 80 20 00 00 00 00 27 39 02 1c 03 20 f8 09 00 00 00 00 8f bc 00 10 00 00 00 00 04 11 00 01 00 00 00 00 3c 1c 00 06 27 9c d2 70 03 9f e0 21 8f 99 80 1c 00 00 00 00 27 39 0b f0 03 20 f8 09 00 00 00 00 8f bc 00 10 00 00 00 00 8f bf 00 1c 00 00 00 00 03 e0 00 08 27 bd 00 20 00 00 00 00 00 00 00 00 3c 1c 00 06 27 9c d2 30 03 99 e0 21 27 bd ff d8 af bf 00 20 af b1 00 1c af b0 00 18 af bc 00 10 8f 91 80 18 00 00 00 00 92 22 57 f0 00 00 00 00 14 40 00 1d 00 00 00 00 8f 90 80 18 00 00 00 00 8e 02 4e 90 00 00 00 00 8c 59 00 00 00 00 00 00 13 20 00 09 24 42 00 04 03 20 f8 09 ae 02 4e 90 8e 02 4e 90 8f bc 00 10 8c 59 00 00 00 00 00 00 17 20 ff f9 24 42 00 04 8f 82 82 d4 00 00 00 00 10 40 00 08 24 02 00 01 8f 84 80 1c 8f 99 82 d4 00 00 00 00 03 20 f8 09 24 84 49 94 8f bc 00 10 24 02 00 01 a2 22 57 f0 8f bf 00 20 8f b1 00 1c 8f b0 00 18 03 e0 00 08 27 bd 00 28 3c 1c 00 06 27 9c d1 74 03 99 e0 21 27 bd ff e0 af bf 00 18 af bc 00 10 8f 84 80 1c 8f 85 80 18 8f 82 80 f8 8f 99 80 f8 24 84 49 94 10 40 00 05 24 a5 57 f4 03 20 f8 09 00 00 00 00 8f bc 00 10 00 00 00 00 8f 84 80 18 8f 99 81 04 8c 82 49 a8 00 00 00 00 10 40 00 06 24 84 49 a8 13 20 00 04 00 00 00 00 8f bf 00 18 03 20 00 08 27 bd 00 20 8f bf 00 18 00 00 00 00 03 e0 00 08 27 bd 00 20 00 00 00 00 03 e0 00 21 04 11 00 01 00 00 00 00 3c 1c 00 06 27 9c d0 e4 03 9f e0 21 00 00 f8 21 8f 84 82 1c 8f a5 00 00 27 a6 00 04 24 01 ff f8 03 a1 e8 24 27 bd ff e0 8f 87 83 24 8f 88 81 dc 00 00 00 00 af a8 00 10 af a2 00 14 af bd 00 18 8f 99 82 34 00 00 00 00 03 20 f8 09 00 00 00 00 10 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c 1c 00 06 27 9c d0 80 03 99 e0 21 27 bd ff e8 af be 00 10 03 a0 f0 21 af c4 00 18 8f 83 80 18 8f c2 00 18 00 00 00 00 ac 62 58 28 8f c3 00 18 3c 02 9e 37 34 42 79 b9 00 62 18 21 8f 82 80 18 00 00 00 00 24 42 58 28 ac 43 00 04 8f c3 00 18 3c 02 3c 6e 34 42 f3 72 00 62 18 21 8f 82 80 18 00 00 00 00 24 42 58 28 ac 43 00 08 24 02 00 03 af c2 00 08 10 00 00 23 00 00 00 00 8f c6 00 08 8f c2 00 08 00 00 00 00 24 42 ff fd 8f 83 80 18 00 02 20 80 24 62 58 28 00 82 10 21 8c 45 00 00 8f c2 00 08 00 00 00 00 24 42 ff fe 8f 83 80 18 00 02 20 80 24 62 58 28 00 82 10 21 8c 42 00 00 00 00 00 00 00 a2 18 26 8f c2 00 08 00 00 00 00 00 62 18 26 3c 02 9e 37 34 42 79 b9 00 62 20 26 8f 82 Data Ascii: ELF@4{4 (p@@@@IIIEIEI8qdtQE<'!'<'! '9 <'p!'9 ' <'0!' "W@NY $B NNY $B@$ $I$"W '(<'t!'$I@$W I@$I ' ' !<'!!'$$'$4 <'!'!bX(<74Byb!$BX(C<<n4Brb!$BX(C$#$B $bX(!E$B $bX(!B&b&<74Byb &
Mar 21, 2023 06:17:19.469520092 CET	4	IN	Data Raw: 80 18 00 06 18 80 24 42 58 28 00 62 10 21 ac 44 00 00 8f c2 00 08 00 00 00 00 24 42 00 01 af c2 00 08 8f c2 00 08 00 00 00 00 28 42 10 00 14 40 ff da 00 00 00 00 03 c0 e8 21 8f be 00 10 27 bd 00 18 03 e0 00 08 00 00 00 00 3c 1c 00 06 27 9c cf 54 Data Ascii: $BX(b!D$B(B@!'<'T!' !$I^!$BN$B0CCNBN $bX(!D!!D( (!
Mar 21, 2023 06:17:19.469598055 CET	5	IN	Data Raw: af c0 10 70 10 00 00 93 00 00 00 00 24 02 00 10 af c2 00 4c 27 c2 00 3c 27 c3 00 4c 8f c4 00 28 00 40 28 21 00 60 30 21 8f 99 80 d8 00 00 00 00 03 20 f8 09 00 00 00 00 8f dc 00 10 af c2 00 24 8f c3 00 24 24 02 ff ff 14 62 00 04 00 00 00 00 af c0 Data Ascii: p$L'<'L(@(!`0! $$$bp@C$D!(!< )'P@ !$E! @'P$B
Mar 21, 2023 06:17:19.469659090 CET	6	IN	Data Raw: 00 08 00 00 00 00 3c 1c 00 06 27 9c c5 a4 03 99 e0 21 27 bd ff d0 af bf 00 2c af be 00 28 03 a0 f0 21 af bc 00 10 af c4 00 30 af c5 00 34 af c6 00 38 af c7 00 3c af c0 00 24 24 02 00 20 af c2 00 20 8f c2 00 38 00 00 00 00 18 40 00 2a 00 00 00 00 Data Ascii: <'!',(!048<$$ 8@4$B$cb@8b@88C#8<0B@$0
Mar 21, 2023 06:17:19.469716072 CET	8	IN	Data Raw: af c4 00 50 af c5 00 54 af c6 00 58 af c0 00 34 10 00 01 49 00 00 00 00 8f c2 00 54 00 00 00 00 90 43 00 00 24 02 00 25 14 62 01 30 00 00 00 00 8f c2 00 54 00 00 00 00 24 42 00 01 af c2 00 54 af c0 00 38 8f c2 00 38 00 00 00 00 af c2 00 3c 8f c2 Data Ascii: PTX4ITC$%b0T$BT88<TB@;TC$%bTC$-bT$BT$8T$BT84B8TC$0b
Mar 21, 2023 06:17:19.469846010 CET	9	IN	Data Raw: 00 50 00 40 28 21 8f 82 80 20 00 00 00 00 24 59 0d 34 03 20 f8 09 00 00 00 00 8f dc 00 20 8f c2 00 34 00 00 00 00 24 42 00 01 af c2 00 34 8f c2 00 54 00 00 00 00 24 42 00 01 af c2 00 54 8f c2 00 54 00 00 00 00 90 42 00 00 00 00 00 00 14 40 fe b3 Data Ascii: P@(! $Y4 4$B4T$BTTB@P@PB@4!LH'P<' !',(!08<4$ @ !(!$
Mar 21, 2023 06:17:19.469903946 CET	10	IN	Data Raw: 8f 82 80 ec 00 00 00 00 8c 42 00 00 27 c3 00 c8 00 40 20 21 00 60 28 21 24 06 00 01 00 00 38 21 8f 99 83 f8 00 00 00 00 03 20 f8 09 00 00 00 00 8f dc 00 18 00 40 18 21 24 02 00 01 10 62 00 08 00 00 00 00 8f c2 00 34 00 00 00 00 a0 40 00 00 24 02 Data Ascii: B'@ !`(!$8! @!$b4@$"4C4$B4$b0$B0(B8B0C$B`4@0!
Mar 21, 2023 06:17:19.469958067 CET	12	IN	Data Raw: 00 04 00 40 20 21 8f 99 83 84 00 00 00 00 03 20 f8 09 00 00 00 00 8f dc 00 10 af c2 00 1c af c0 00 18 10 00 00 18 00 00 00 00 8f c2 00 18 00 00 00 00 00 02 10 80 00 40 18 21 8f c2 00 1c 00 00 00 00 00 62 20 21 8f c2 00 18 00 00 00 00 00 02 10 80 Data Ascii: @ ! @!b !@!Bb!B$B4 !04040ED$$!e@+! !!,((0+@
Mar 21, 2023 06:17:19.470032930 CET	13	IN	Data Raw: 8f c2 00 a8 00 00 00 00 00 02 18 80 00 03 10 80 00 43 10 23 8f c3 00 a8 00 00 00 00 00 43 10 21 00 02 10 40 00 82 20 23 af c4 00 a8 8f c3 00 a8 00 00 00 00 00 03 10 80 27 c3 00 18 00 43 10 21 8c 42 00 24 00 00 00 00 af c2 00 18 8f c2 00 1c 00 00 Data Ascii: C#C!@ #'C!B$,B2@-($8!8 ',(@(!$ ! @ !$b!*@(
Mar 21, 2023 06:17:19.470098019 CET	15	IN	Data Raw: 00 0c 00 00 00 00 8f c4 00 24 8f 99 80 f4 00 00 00 00 03 20 f8 09 00 00 00 00 8f dc 00 10 00 00 20 21 8f 99 81 44 00 00 00 00 03 20 f8 09 00 00 00 00 af c0 00 18 8f c2 00 18 00 00 00 00 24 42 00 01 af c2 00 18 10 00 ff c5 00 00 00 00 3c 1c 00 06 Data Ascii: $ !D $B<'!'H!$$0!t ( ! $@ ! ',@ !$@
Mar 21, 2023 06:17:19.487231970 CET	16	IN	Data Raw: 00 00 00 00 24 42 24 cc af a2 00 74 8f 82 80 1c 00 00 00 00 24 42 24 d0 af a2 00 78 8f 82 80 1c 00 00 00 00 24 42 24 d4 af a2 00 7c 8f 82 80 1c 00 00 00 00 24 42 24 d8 af a2 00 80 8f 82 80 1c 00 00 00 00 24 42 24 dc af a2 00 84 8f 82 80 1c 00 00 Data Ascii: $B$t$B$x$B$\|$B$$B$$B$$B$$B$$B$$B$$B$$B$$B$$B%$B%

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.23	43386	34.120.208.123	443

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.23	57862	35.241.9.150	443

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.23	57864	35.241.9.150	443

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.23	39582	34.111.73.144	443

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.23	57056	35.244.181.201	443

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.23	57870	35.241.9.150	443

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.23	39214	52.25.208.227	443

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.23	38246	44.231.103.117	443

Timestamp	kBytes transferred	Direction	Data

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.23	38690	34.160.144.191	443

Timestamp	kBytes transferred	Direction	Data
2023-03-21 05:17:23 UTC	0	OUT	GET /chains/remote-settings.content-signature.mozilla.org-2021-09-19-15-17-11.chain HTTP/1.1 Host: content-signature-2.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site If-Modified-Since: Sat, 31 Jul 2021 15:17:12 GMT If-None-Match: "8cfd2c8fe1fb0bc900759661d7a6ee89"
2023-03-21 05:17:23 UTC	0	IN	HTTP/1.1 304 Not Modified Date: Tue, 21 Mar 2023 03:59:25 GMT Age: 4678 ETag: "8cfd2c8fe1fb0bc900759661d7a6ee89" Cache-Control: public,max-age=3600 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.23	39200	52.25.208.227	443

Timestamp	kBytes transferred	Direction	Data
2023-03-21 05:17:36 UTC	0	OUT	GET / HTTP/1.1 Host: push.services.mozilla.com User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Sec-WebSocket-Version: 13 Origin: wss://push.services.mozilla.com/ Sec-WebSocket-Protocol: push-notification Sec-WebSocket-Extensions: permessage-deflate Sec-WebSocket-Key: /HsD9zTc2lDu1K9P7e79lw== Connection: keep-alive, Upgrade Sec-Fetch-Dest: websocket Sec-Fetch-Mode: websocket Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache Upgrade: websocket

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.23	38248	44.231.103.117	443

Timestamp	kBytes transferred	Direction	Data
2023-03-21 05:18:18 UTC	18	OUT	GET / HTTP/1.1 Host: push.services.mozilla.com User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Sec-WebSocket-Version: 13 Origin: wss://push.services.mozilla.com/ Sec-WebSocket-Protocol: push-notification Sec-WebSocket-Extensions: permessage-deflate Sec-WebSocket-Key: xcYDBoWaCBwQWORghw2Mew== Connection: keep-alive, Upgrade Sec-Fetch-Dest: websocket Sec-Fetch-Mode: websocket Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache Upgrade: websocket

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.23	43386	34.120.208.123	443

Timestamp	kBytes transferred	Direction	Data
2023-03-21 05:17:38 UTC	1	OUT	POST /submit/firefox-desktop/deletion-request/1/7c4c3d68-b8c8-44e6-a714-345a0583faf2 HTTP/1.1 Host: incoming.telemetry.mozilla.org User-Agent: Glean/39.0.0 (Rust on Linux) Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br x-client-type: Glean x-client-version: 39.0.0 content-type: application/json; charset=utf-8 date: Tue, 21 Mar 2023 06:17:35 GMT content-encoding: gzip content-length: 284 Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Pragma: no-cache Cache-Control: no-cache
2023-03-21 05:17:38 UTC	1	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 85 90 c1 6e c3 20 10 44 ff 85 6b 43 b4 60 9b 38 fe 86 1e 7b 47 1b b3 34 28 36 76 01 a7 89 22 ff 7b b1 95 a4 51 2f 3d c2 9b 9d 99 dd 1b 1b 9d ff d4 ce db 81 35 37 16 e9 8b 35 b0 61 31 61 48 3a b9 9e 58 c3 24 c8 82 43 c1 a5 f8 00 d5 88 dd 1b 40 03 c0 36 8c bc f9 57 13 08 e3 e0 b3 02 53 4e 71 89 cd 1b d6 76 8e 7c 7a 86 26 ea a8 a7 14 ae 3a 9a 93 3e 4c ae 33 59 5f ec b7 b0 5d 1c 70 1c b5 71 71 ec f0 aa cf 14 a2 5b ed f6 22 63 b1 e0 d0 1e 5d a2 36 4d 61 29 72 a9 95 56 e5 7d ec e1 95 db 09 a8 85 12 65 a1 aa 07 6c 8f e8 3d 75 19 87 5c 00 23 e5 7f 43 67 d7 92 ee 07 b3 82 c9 9f fc f0 ed 33 18 e2 4b 76 b5 2d 5f b4 e8 27 8b 6b 7c f8 33 92 9f ef ce 4f 17 f6 bb f2 d2 c6 d6 20 60 6f 91 4b ac 0e bc b4 46 72 2c a5 e5 3b a5 a0 c0 9d 3d d4 b2 Data Ascii: n DkC`8{G4(6v"{Q/=575a1aH:X$C@6WSNqv\|z&:>L3Y_]pqq["c]6Ma)rV}el=u\#Cg3Kv-_'k\|3O `oKFr,;=
2023-03-21 05:17:38 UTC	2	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 21 Mar 2023 05:17:38 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Alt-Svc: clear Connection: close
2023-03-21 05:17:38 UTC	2	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.23	57862	35.241.9.150	443

Timestamp	kBytes transferred	Direction	Data
2023-03-21 05:17:39 UTC	2	OUT	GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: application/json Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site If-Modified-Since: Tue, 01 Jun 2021 14:28:23 GMT If-None-Match: "1622557703112"
2023-03-21 05:17:39 UTC	3	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Type, Retry-After, Last-Modified, Content-Length, Pragma, Expires, ETag, Backoff, Alert, Cache-Control Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff Content-Length: 329 Via: 1.1 google Date: Tue, 21 Mar 2023 05:07:55 GMT Age: 584 Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT ETag: "1648230346554" Content-Type: application/json Cache-Control: max-age=3600,public Alt-Svc: clear Connection: close
2023-03-21 05:17:39 UTC	3	IN	Data Raw: 7b 22 70 65 72 6d 69 73 73 69 6f 6e 73 22 3a 7b 7d 2c 22 64 61 74 61 22 3a 7b 22 61 74 74 61 63 68 6d 65 6e 74 22 3a 7b 22 68 61 73 68 22 3a 22 30 65 63 30 66 31 36 66 39 32 64 38 37 36 61 39 63 31 31 34 30 64 34 63 31 31 65 32 62 33 34 36 61 39 32 39 32 39 38 34 64 39 61 38 35 34 33 36 30 65 35 34 65 39 39 66 64 63 64 39 39 63 63 30 22 2c 22 73 69 7a 65 22 3a 37 35 38 31 2c 22 66 69 6c 65 6e 61 6d 65 22 3a 22 61 73 72 6f 75 74 65 72 2e 66 74 6c 22 2c 22 6c 6f 63 61 74 69 6f 6e 22 3a 22 6d 61 69 6e 2d 77 6f 72 6b 73 70 61 63 65 2f 6d 73 2d 6c 61 6e 67 75 61 67 65 2d 70 61 63 6b 73 2f 34 66 31 62 63 61 61 30 2d 64 64 66 39 2d 34 33 65 66 2d 61 63 61 33 2d 38 33 37 38 63 34 64 30 35 35 38 32 2e 66 74 6c 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 61 70 70 6c Data Ascii: {"permissions":{},"data":{"attachment":{"hash":"0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0","size":7581,"filename":"asrouter.ftl","location":"main-workspace/ms-language-packs/4f1bcaa0-ddf9-43ef-aca3-8378c4d05582.ftl","mimetype":"appl

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.23	57864	35.241.9.150	443

Timestamp	kBytes transferred	Direction	Data
2023-03-21 05:17:40 UTC	4	OUT	GET /v1/ HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site
2023-03-21 05:17:40 UTC	4	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Retry-After, Content-Length, Alert, Content-Type, Backoff Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff Content-Length: 939 Via: 1.1 google Date: Tue, 21 Mar 2023 04:31:39 GMT Content-Type: application/json Age: 2761 Cache-Control: max-age=3600,public Alt-Svc: clear Connection: close
2023-03-21 05:17:40 UTC	5	IN	Data Raw: 7b 22 70 72 6f 6a 65 63 74 5f 6e 61 6d 65 22 3a 22 52 65 6d 6f 74 65 20 53 65 74 74 69 6e 67 73 20 50 52 4f 44 22 2c 22 70 72 6f 6a 65 63 74 5f 76 65 72 73 69 6f 6e 22 3a 22 31 35 2e 30 2e 30 22 2c 22 68 74 74 70 5f 61 70 69 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 32 32 22 2c 22 70 72 6f 6a 65 63 74 5f 64 6f 63 73 22 3a 22 68 74 74 70 73 3a 2f 2f 72 65 6d 6f 74 65 2d 73 65 74 74 69 6e 67 73 2e 72 65 61 64 74 68 65 64 6f 63 73 2e 69 6f 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 66 69 72 65 66 6f 78 2e 73 65 74 74 69 6e 67 73 2e 73 65 72 76 69 63 65 73 2e 6d 6f 7a 69 6c 6c 61 2e 63 6f 6d 2f 76 31 2f 22 2c 22 73 65 74 74 69 6e 67 73 22 3a 7b 22 72 65 61 64 6f 6e 6c 79 22 3a 74 72 75 65 2c 22 65 78 70 6c 69 63 69 74 5f 70 65 72 6d 69 73 73 69 6f 6e 73 Data Ascii: {"project_name":"Remote Settings PROD","project_version":"15.0.0","http_api_version":"1.22","project_docs":"https://remote-settings.readthedocs.io","url":"https://firefox.settings.services.mozilla.com/v1/","settings":{"readonly":true,"explicit_permissions
2023-03-21 05:17:40 UTC	5	IN	Data Raw: 63 72 69 70 74 69 6f 6e 22 3a 22 41 64 64 20 66 69 6c 65 20 61 74 74 61 63 68 6d 65 6e 74 73 20 74 6f 20 72 65 63 6f 72 64 73 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 4b 69 6e 74 6f 2f 6b 69 6e 74 6f 2d 61 74 74 61 63 68 6d 65 6e 74 2f 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 36 2e 33 2e 31 22 2c 22 62 61 73 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 66 69 72 65 66 6f 78 2d 73 65 74 74 69 6e 67 73 2d 61 74 74 61 63 68 6d 65 6e 74 73 2e 63 64 6e 2e 6d 6f 7a 69 6c 6c 61 2e 6e 65 74 2f 22 7d 7d 7d Data Ascii: cription":"Add file attachments to records","url":"https://github.com/Kinto/kinto-attachment/","version":"6.3.1","base_url":"https://firefox-settings-attachments.cdn.mozilla.net/"}}}

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.23	39582	34.111.73.144	443

Timestamp	kBytes transferred	Direction	Data
2023-03-21 05:17:41 UTC	5	OUT	GET /main-workspace/ms-language-packs/4f1bcaa0-ddf9-43ef-aca3-8378c4d05582.ftl HTTP/1.1 Host: firefox-settings-attachments.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site
2023-03-21 05:17:41 UTC	6	IN	HTTP/1.1 200 OK X-Amz-Id-2: 4ZH80hNl23+3AYy7V3kNUmXg4pNAW1kg97rBsZ1wFrGt08Ff0L1utwDuy6BsQ23FpUDWVN+cWx4= X-Amz-Request-Id: WBGVPYV69JF31N9T X-Amz-Version-Id: e7B0bYbdxIH00OBFDtYjUYFukCC5PJRb Accept-Ranges: bytes Server: AmazonS3 Content-Length: 7581 Via: 1.1 google Date: Thu, 16 Mar 2023 19:19:19 GMT Age: 381502 Last-Modified: Fri, 25 Mar 2022 17:29:17 GMT ETag: "c460716b62456449360b23cf5663f275" Content-Type: application/octet-stream Cache-Control: public,max-age=604800 Alt-Svc: clear Connection: close
2023-03-21 05:17:41 UTC	6	IN	Data Raw: 23 20 54 68 69 73 20 53 6f 75 72 63 65 20 43 6f 64 65 20 46 6f 72 6d 20 69 73 20 73 75 62 6a 65 63 74 20 74 6f 20 74 68 65 20 74 65 72 6d 73 20 6f 66 20 74 68 65 20 4d 6f 7a 69 6c 6c 61 20 50 75 62 6c 69 63 0a 23 20 4c 69 63 65 6e 73 65 2c 20 76 2e 20 32 2e 30 2e 20 49 66 20 61 20 63 6f 70 79 20 6f 66 20 74 68 65 20 4d 50 4c 20 77 61 73 20 6e 6f 74 20 64 69 73 74 72 69 62 75 74 65 64 20 77 69 74 68 20 74 68 69 73 0a 23 20 66 69 6c 65 2c 20 59 6f 75 20 63 61 6e 20 6f 62 74 61 69 6e 20 6f 6e 65 20 61 74 20 68 74 74 70 3a 2f 2f 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 4d 50 4c 2f 32 2e 30 2f 2e 0a 0a 23 23 20 54 68 65 73 65 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 75 73 65 64 20 61 73 20 68 65 61 64 69 6e 67 73 20 69 6e 20 74 68 65 20 72 65 63 6f 6d 6d 65 6e 64 Data Ascii: # This Source Code Form is subject to the terms of the Mozilla Public# License, v. 2.0. If a copy of the MPL was not distributed with this# file, You can obtain one at http://mozilla.org/MPL/2.0/.## These messages are used as headings in the recommend
2023-03-21 05:17:41 UTC	7	IN	Data Raw: 68 6f 77 2d 72 65 63 6f 6d 6d 65 6e 64 61 74 69 6f 6e 20 3d 20 44 6f 6e e2 80 99 74 20 53 68 6f 77 20 4d 65 20 54 68 69 73 20 52 65 63 6f 6d 6d 65 6e 64 61 74 69 6f 6e 0a 20 20 2e 61 63 63 65 73 73 6b 65 79 20 3d 20 53 0a 0a 63 66 72 2d 64 6f 6f 72 68 61 6e 67 65 72 2d 65 78 74 65 6e 73 69 6f 6e 2d 6c 65 61 72 6e 2d 6d 6f 72 65 2d 6c 69 6e 6b 20 3d 20 4c 65 61 72 6e 20 6d 6f 72 65 0a 0a 23 20 54 68 69 73 20 73 74 72 69 6e 67 20 69 73 20 75 73 65 64 20 6f 6e 20 61 20 6e 65 77 20 6c 69 6e 65 20 62 65 6c 6f 77 20 74 68 65 20 61 64 64 2d 6f 6e 20 6e 61 6d 65 0a 23 20 56 61 72 69 61 62 6c 65 73 3a 0a 23 20 20 20 24 6e 61 6d 65 20 28 53 74 72 69 6e 67 29 20 2d 20 41 64 64 2d 6f 6e 20 61 75 74 68 6f 72 20 6e 61 6d 65 0a 63 66 72 2d 64 6f 6f 72 68 61 6e 67 65 72 Data Ascii: how-recommendation = Dont Show Me This Recommendation .accesskey = Scfr-doorhanger-extension-learn-more-link = Learn more# This string is used on a new line below the add-on name# Variables:# $name (String) - Add-on author namecfr-doorhanger
2023-03-21 05:17:41 UTC	8	IN	Data Raw: 0a 23 20 20 20 24 74 6f 74 61 6c 20 28 4e 75 6d 62 65 72 29 20 2d 20 54 68 65 20 74 6f 74 61 6c 20 6e 75 6d 62 65 72 20 6f 66 20 75 73 65 72 73 20 75 73 69 6e 67 20 74 68 65 20 61 64 64 2d 6f 6e 0a 63 66 72 2d 64 6f 6f 72 68 61 6e 67 65 72 2d 65 78 74 65 6e 73 69 6f 6e 2d 74 6f 74 61 6c 2d 75 73 65 72 73 20 3d 0a 20 20 7b 20 24 74 6f 74 61 6c 20 2d 3e 0a 20 20 20 20 20 20 5b 6f 6e 65 5d 20 7b 20 24 74 6f 74 61 6c 20 7d 20 75 73 65 72 0a 20 20 20 20 20 2a 5b 6f 74 68 65 72 5d 20 7b 20 24 74 6f 74 61 6c 20 7d 20 75 73 65 72 73 0a 20 20 7d 0a 0a 23 23 20 46 69 72 65 66 6f 78 20 41 63 63 6f 75 6e 74 73 20 4d 65 73 73 61 67 65 0a 0a 63 66 72 2d 64 6f 6f 72 68 61 6e 67 65 72 2d 62 6f 6f 6b 6d 61 72 6b 2d 66 78 61 2d 68 65 61 64 65 72 20 3d 20 53 79 6e 63 20 79 Data Ascii: # $total (Number) - The total number of users using the add-oncfr-doorhanger-extension-total-users = { $total -> [one] { $total } user *[other] { $total } users }## Firefox Accounts Messagecfr-doorhanger-bookmark-fxa-header = Sync y
2023-03-21 05:17:41 UTC	10	IN	Data Raw: 4d 69 6c 65 73 74 6f 6e 65 73 0a 0a 23 20 56 61 72 69 61 62 6c 65 73 3a 0a 23 20 20 20 24 62 6c 6f 63 6b 65 64 43 6f 75 6e 74 20 28 4e 75 6d 62 65 72 29 20 2d 20 54 68 65 20 74 6f 74 61 6c 20 63 6f 75 6e 74 20 6f 66 20 62 6c 6f 63 6b 65 64 20 74 72 61 63 6b 65 72 73 2e 20 54 68 69 73 20 6e 75 6d 62 65 72 20 77 69 6c 6c 20 61 6c 77 61 79 73 20 62 65 20 67 72 65 61 74 65 72 20 74 68 61 6e 20 31 2e 0a 23 20 20 20 24 64 61 74 65 20 28 44 61 74 65 74 69 6d 65 29 20 2d 20 54 68 65 20 64 61 74 65 20 77 65 20 62 65 67 61 6e 20 72 65 63 6f 72 64 69 6e 67 20 74 68 65 20 63 6f 75 6e 74 20 6f 66 20 62 6c 6f 63 6b 65 64 20 74 72 61 63 6b 65 72 73 0a 63 66 72 2d 64 6f 6f 72 68 61 6e 67 65 72 2d 6d 69 6c 65 73 74 6f 6e 65 2d 68 65 61 64 69 6e 67 32 20 3d 0a 20 20 7b 20 Data Ascii: Milestones# Variables:# $blockedCount (Number) - The total count of blocked trackers. This number will always be greater than 1.# $date (Datetime) - The date we began recording the count of blocked trackerscfr-doorhanger-milestone-heading2 = {
2023-03-21 05:17:41 UTC	11	IN	Data Raw: 2d 64 6f 6f 72 68 61 6e 67 65 72 2d 66 69 73 73 69 6f 6e 2d 70 72 69 6d 61 72 79 2d 62 75 74 74 6f 6e 20 3d 20 4f 4b 2c 20 47 6f 74 20 69 74 0a 20 20 2e 61 63 63 65 73 73 6b 65 79 20 3d 20 4f 0a 63 66 72 2d 64 6f 6f 72 68 61 6e 67 65 72 2d 66 69 73 73 69 6f 6e 2d 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e 20 3d 20 4c 65 61 72 6e 20 6d 6f 72 65 0a 20 20 2e 61 63 63 65 73 73 6b 65 79 20 3d 20 4c 0a 0a 23 23 20 46 75 6c 6c 20 56 69 64 65 6f 20 53 75 70 70 6f 72 74 20 43 46 52 20 6d 65 73 73 61 67 65 0a 0a 63 66 72 2d 64 6f 6f 72 68 61 6e 67 65 72 2d 76 69 64 65 6f 2d 73 75 70 70 6f 72 74 2d 62 6f 64 79 20 3d 20 56 69 64 65 6f 73 20 6f 6e 20 74 68 69 73 20 73 69 74 65 20 6d 61 79 20 6e 6f 74 20 70 6c 61 79 20 63 6f 72 72 65 63 74 6c 79 20 6f 6e 20 74 68 Data Ascii: -doorhanger-fission-primary-button = OK, Got it .accesskey = Ocfr-doorhanger-fission-secondary-button = Learn more .accesskey = L## Full Video Support CFR messagecfr-doorhanger-video-support-body = Videos on this site may not play correctly on th
2023-03-21 05:17:41 UTC	12	IN	Data Raw: 63 65 73 20 6c 69 6b 65 20 61 69 72 70 6f 72 74 73 20 61 6e 64 20 63 6f 66 66 65 65 20 73 68 6f 70 73 2e 0a 73 70 6f 74 6c 69 67 68 74 2d 70 75 62 6c 69 63 2d 77 69 66 69 2d 76 70 6e 2d 70 72 69 6d 61 72 79 2d 62 75 74 74 6f 6e 20 3d 20 53 74 61 79 20 70 72 69 76 61 74 65 20 77 69 74 68 20 7b 20 2d 6d 6f 7a 69 6c 6c 61 2d 76 70 6e 2d 62 72 61 6e 64 2d 6e 61 6d 65 20 7d 0a 20 20 2e 61 63 63 65 73 73 6b 65 79 20 3d 20 53 0a 73 70 6f 74 6c 69 67 68 74 2d 70 75 62 6c 69 63 2d 77 69 66 69 2d 76 70 6e 2d 6c 69 6e 6b 20 3d 20 4e 6f 74 20 4e 6f 77 0a 20 20 2e 61 63 63 65 73 73 6b 65 79 20 3d 20 4e 0a 0a 23 23 20 54 6f 74 61 6c 20 43 6f 6f 6b 69 65 20 50 72 6f 74 65 63 74 69 6f 6e 20 52 6f 6c 6c 6f 75 74 0a 0a 23 20 22 54 65 73 74 20 70 69 6c 6f 74 22 20 69 73 20 Data Ascii: ces like airports and coffee shops.spotlight-public-wifi-vpn-primary-button = Stay private with { -mozilla-vpn-brand-name } .accesskey = Sspotlight-public-wifi-vpn-link = Not Now .accesskey = N## Total Cookie Protection Rollout# "Test pilot" is
2023-03-21 05:17:41 UTC	13	IN	Data Raw: 72 20 69 6e 74 65 72 6e 65 74 20 73 74 61 72 74 73 20 77 69 74 68 20 79 6f 75 0a 73 70 6f 74 6c 69 67 68 74 2d 62 65 74 74 65 72 2d 69 6e 74 65 72 6e 65 74 2d 62 6f 64 79 20 3d 20 57 68 65 6e 20 79 6f 75 20 75 73 65 20 7b 20 2d 62 72 61 6e 64 2d 73 68 6f 72 74 2d 6e 61 6d 65 7d 2c 20 79 6f 75 e2 80 99 72 65 20 76 6f 74 69 6e 67 20 66 6f 72 20 61 6e 20 6f 70 65 6e 20 61 6e 64 20 61 63 63 65 73 73 69 62 6c 65 20 69 6e 74 65 72 6e 65 74 20 74 68 61 74 e2 80 99 73 20 62 65 74 74 65 72 20 66 6f 72 20 65 76 65 72 79 6f 6e 65 2e 0a 73 70 6f 74 6c 69 67 68 74 2d 70 65 61 63 65 2d 6d 69 6e 64 2d 68 65 61 64 65 72 20 3d 20 57 65 e2 80 99 76 65 20 67 6f 74 20 79 6f 75 20 63 6f 76 65 72 65 64 0a 73 70 6f 74 6c 69 67 68 74 2d 70 65 61 63 65 2d 6d 69 6e 64 2d 62 6f 64 Data Ascii: r internet starts with youspotlight-better-internet-body = When you use { -brand-short-name}, youre voting for an open and accessible internet thats better for everyone.spotlight-peace-mind-header = Weve got you coveredspotlight-peace-mind-bod

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.23	57056	35.244.181.201	443

Timestamp	kBytes transferred	Direction	Data
2023-03-21 05:17:41 UTC	14	OUT	GET /update/3/GMP/91.0.1/20210816143654/Linux_x86_64-gcc3/null/release-cck-ubuntu/Linux%205.4.0-72-generic%20(GTK%203.24.20%2Clibpulse%2013.99.0)/canonical/1.0/update.xml HTTP/1.1 Host: aus5.mozilla.org User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Pragma: no-cache Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site
2023-03-21 05:17:41 UTC	14	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 21 Mar 2023 05:17:41 GMT Content-Type: text/xml; charset=utf-8 Content-Length: 720 Vary: Accept-Encoding Rule-ID: 17581 Rule-Data-Version: 16 Content-Signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2023-04-30-16-53-15.chain; p384ecdsa=vPq58MixfE6UZfYeHNz6sXkifCVa1-Bqzd_ebLiEGBgTAqxlHQpJ1eMNwxIggFAv4lvf1CFnUR0aTvSe_agmK1zFZwzdnPzit9vt4pyestFwcM35Mmrw_kzxoWou2cd9 Strict-Transport-Security: max-age=31536000; X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'none'; frame-ancestors 'none' X-Proxy-Cache-Status: MISS Via: 1.1 google Cache-Control: public,max-age=90 Alt-Svc: clear Connection: close
2023-03-21 05:17:41 UTC	15	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3f 3e 0a 3c 75 70 64 61 74 65 73 3e 0a 20 20 20 20 3c 61 64 64 6f 6e 73 3e 0a 20 20 20 20 20 20 20 20 3c 61 64 64 6f 6e 20 69 64 3d 22 67 6d 70 2d 67 6d 70 6f 70 65 6e 68 32 36 34 22 20 55 52 4c 3d 22 68 74 74 70 3a 2f 2f 63 69 73 63 6f 62 69 6e 61 72 79 2e 6f 70 65 6e 68 32 36 34 2e 6f 72 67 2f 6f 70 65 6e 68 32 36 34 2d 6c 69 6e 75 78 36 34 2d 32 65 31 37 37 34 61 62 36 64 63 36 63 34 33 64 65 62 62 30 62 35 62 36 32 38 62 64 66 31 32 32 61 33 39 31 64 35 32 31 2e 7a 69 70 22 20 68 61 73 68 46 75 6e 63 74 69 6f 6e 3d 22 73 68 61 35 31 32 22 20 68 61 73 68 56 61 6c 75 65 3d 22 39 34 35 33 31 65 32 36 37 33 31 34 64 65 36 36 31 62 32 32 30 35 63 36 30 36 32 38 33 66 62 30 36 36 64 37 38 31 65 35 63 Data Ascii: <?xml version="1.0"?><updates> <addons> <addon id="gmp-gmpopenh264" URL="http://ciscobinary.openh264.org/openh264-linux64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip" hashFunction="sha512" hashValue="94531e267314de661b2205c606283fb066d781e5c
2023-03-21 05:17:41 UTC	15	IN	Data Raw: 6c 75 65 3d 22 35 35 61 37 65 34 62 33 37 39 64 35 38 32 36 66 30 31 62 31 61 33 36 61 62 64 38 37 32 66 34 31 31 62 30 62 61 33 63 64 32 65 64 65 63 30 63 37 39 39 65 38 32 64 65 66 30 32 66 31 37 31 64 66 31 65 33 33 33 36 35 66 35 38 64 39 31 64 32 35 32 37 66 31 64 63 61 66 33 36 34 34 62 30 62 61 39 66 35 63 34 61 33 31 65 37 31 32 62 65 65 34 32 62 63 37 38 36 61 35 34 35 61 33 34 39 31 63 22 20 73 69 7a 65 3d 22 37 38 30 36 36 38 36 22 20 76 65 72 73 69 6f 6e 3d 22 34 2e 31 30 2e 32 35 35 37 2e 30 22 2f 3e 0a 20 20 20 20 3c 2f 61 64 64 6f 6e 73 3e 0a 3c 2f 75 70 64 61 74 65 73 3e Data Ascii: lue="55a7e4b379d5826f01b1a36abd872f411b0ba3cd2edec0c799e82def02f171df1e33365f58d91d2527f1dcaf3644b0ba9f5c4a31e712bee42bc786a545a3491c" size="7806686" version="4.10.2557.0"/> </addons></updates>

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.23	57870	35.241.9.150	443

Timestamp	kBytes transferred	Direction	Data
2023-03-21 05:17:43 UTC	16	OUT	GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: application/json Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site If-Modified-Since: Fri, 25 Mar 2022 17:45:46 GMT If-None-Match: "1648230346554"
2023-03-21 05:17:43 UTC	16	IN	HTTP/1.1 304 Not Modified Date: Tue, 21 Mar 2023 05:03:05 GMT Age: 878 ETag: "1648230346554" Cache-Control: max-age=3600,public Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.23	39214	52.25.208.227	443

Timestamp	kBytes transferred	Direction	Data
2023-03-21 05:17:45 UTC	16	OUT	GET / HTTP/1.1 Host: push.services.mozilla.com User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Sec-WebSocket-Version: 13 Origin: wss://push.services.mozilla.com/ Sec-WebSocket-Protocol: push-notification Sec-WebSocket-Extensions: permessage-deflate Sec-WebSocket-Key: Pv/Zvfj6YW6T57Phu897Ug== Connection: keep-alive, Upgrade Sec-Fetch-Dest: websocket Sec-Fetch-Mode: websocket Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache Upgrade: websocket

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.23	38246	44.231.103.117	443

Timestamp	kBytes transferred	Direction	Data
2023-03-21 05:17:57 UTC	17	OUT	GET / HTTP/1.1 Host: push.services.mozilla.com User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Sec-WebSocket-Version: 13 Origin: wss://push.services.mozilla.com/ Sec-WebSocket-Protocol: push-notification Sec-WebSocket-Extensions: permessage-deflate Sec-WebSocket-Key: U4qUgcEAUSmpmIII+0JwlQ== Connection: keep-alive, Upgrade Sec-Fetch-Dest: websocket Sec-Fetch-Mode: websocket Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache Upgrade: websocket

System Behavior

Analysis Process: exo-open PID: 6242, Parent PID: 6229

General

Start time:	06:16:50
Start date:	21/03/2023
Path:	/usr/bin/exo-open
Arguments:	exo-open http://31.214.243.29/Demon.mips
File size:	27264 bytes
MD5 hash:	60a307a6a6325e2034eb5cc56bff1abd

Start time:	06:16:51
Start date:	21/03/2023
Path:	/usr/bin/exo-open
Arguments:	n/a
File size:	27264 bytes
MD5 hash:	60a307a6a6325e2034eb5cc56bff1abd

Start time:	06:16:51
Start date:	21/03/2023
Path:	/usr/bin/exo-open
Arguments:	n/a
File size:	27264 bytes
MD5 hash:	60a307a6a6325e2034eb5cc56bff1abd

Start time:	06:16:51
Start date:	21/03/2023
Path:	/usr/lib/x86_64-linux-gnu/xfce4/exo-2/exo-helper-2
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/exo-2/exo-helper-2 --launch WebBrowser http://31.214.243.29/Demon.mips
File size:	80256 bytes
MD5 hash:	ab59c8990baa7254463cdf800a83b9e3

Start time:	06:16:52
Start date:	21/03/2023
Path:	/usr/lib/x86_64-linux-gnu/xfce4/exo-2/exo-helper-2
Arguments:	n/a
File size:	80256 bytes
MD5 hash:	ab59c8990baa7254463cdf800a83b9e3

Start time:	06:16:52
Start date:	21/03/2023
Path:	/usr/bin/sensible-browser
Arguments:	/usr/bin/sensible-browser http://31.214.243.29/Demon.mips
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	06:16:52
Start date:	21/03/2023
Path:	/usr/bin/sensible-browser
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	06:16:52
Start date:	21/03/2023
Path:	/usr/bin/which
Arguments:	which sensible-browser
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	06:16:52
Start date:	21/03/2023
Path:	/usr/bin/x-www-browser
Arguments:	/usr/bin/x-www-browser http://31.214.243.29/Demon.mips
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	06:16:52
Start date:	21/03/2023
Path:	/usr/bin/x-www-browser
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	06:16:52
Start date:	21/03/2023
Path:	/usr/bin/which
Arguments:	which /usr/bin/x-www-browser
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	06:16:52
Start date:	21/03/2023
Path:	/usr/lib/firefox/firefox
Arguments:	/usr/lib/firefox/firefox http://31.214.243.29/Demon.mips
File size:	736648 bytes
MD5 hash:	bf9680bcd223dba6b6e38b63bc4f73d7

Start time:	06:16:52
Start date:	21/03/2023
Path:	/usr/lib/firefox/firefox
Arguments:	n/a
File size:	736648 bytes
MD5 hash:	bf9680bcd223dba6b6e38b63bc4f73d7

Analysis Process: firefox PID: 6252, Parent PID: 6247

General

Start time:	06:16:53
Start date:	21/03/2023
Path:	/usr/lib/firefox/firefox
Arguments:	n/a
File size:	736648 bytes
MD5 hash:	bf9680bcd223dba6b6e38b63bc4f73d7

Start time:	06:16:57
Start date:	21/03/2023
Path:	/usr/lib/firefox/firefox
Arguments:	n/a
File size:	736648 bytes
MD5 hash:	bf9680bcd223dba6b6e38b63bc4f73d7

Start time:	06:16:57
Start date:	21/03/2023
Path:	/usr/bin/lsb_release
Arguments:	/usr/bin/lsb_release -idrc
File size:	5490352 bytes
MD5 hash:	69f442c3e33b5f9a66b722c29ad89435

Start time:	06:17:02
Start date:	21/03/2023
Path:	/usr/lib/firefox/firefox
Arguments:	n/a
File size:	736648 bytes
MD5 hash:	bf9680bcd223dba6b6e38b63bc4f73d7

Start time:	06:17:02
Start date:	21/03/2023
Path:	/usr/bin/dbus-launch
Arguments:	dbus-launch --autolaunch=ee49dfd4fa47433baee88884e2d7de7c --binary-syntax --close-stderr
File size:	34960 bytes
MD5 hash:	0b22a45154a51c6121bb1d208d8ab203

Start time:	06:17:03
Start date:	21/03/2023
Path:	/usr/lib/firefox/firefox
Arguments:	n/a
File size:	736648 bytes
MD5 hash:	bf9680bcd223dba6b6e38b63bc4f73d7

Start time:	06:17:03
Start date:	21/03/2023
Path:	/usr/lib/firefox/firefox
Arguments:	n/a
File size:	736648 bytes
MD5 hash:	bf9680bcd223dba6b6e38b63bc4f73d7

Start time:	06:17:03
Start date:	21/03/2023
Path:	/usr/lib/firefox/firefox
Arguments:	/usr/lib/firefox/firefox -contentproc -parentBuildID 20210816143654 -prefsLen 1 -prefMapSize 238647 -appdir /usr/lib/firefox/browser 6247 true socket
File size:	736648 bytes
MD5 hash:	bf9680bcd223dba6b6e38b63bc4f73d7

Start time:	06:17:07
Start date:	21/03/2023
Path:	/usr/lib/firefox/firefox
Arguments:	n/a
File size:	736648 bytes
MD5 hash:	bf9680bcd223dba6b6e38b63bc4f73d7

Start time:	06:17:07
Start date:	21/03/2023
Path:	/usr/lib/firefox/firefox
Arguments:	n/a
File size:	736648 bytes
MD5 hash:	bf9680bcd223dba6b6e38b63bc4f73d7

Start time:	06:17:07
Start date:	21/03/2023
Path:	/usr/lib/firefox/firefox
Arguments:	/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 188 -prefMapSize 238647 -jsInit 285716 -parentBuildID 20210816143654 -appdir /usr/lib/firefox/browser 6247 true tab
File size:	736648 bytes
MD5 hash:	bf9680bcd223dba6b6e38b63bc4f73d7

Start time:	06:17:24
Start date:	21/03/2023
Path:	/usr/lib/firefox/firefox
Arguments:	n/a
File size:	736648 bytes
MD5 hash:	bf9680bcd223dba6b6e38b63bc4f73d7

Start time:	06:17:24
Start date:	21/03/2023
Path:	/usr/lib/firefox/firefox
Arguments:	n/a
File size:	736648 bytes
MD5 hash:	bf9680bcd223dba6b6e38b63bc4f73d7

Start time:	06:17:24
Start date:	21/03/2023
Path:	/usr/lib/firefox/firefox
Arguments:	/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 5911 -prefMapSize 238647 -jsInit 285716 -parentBuildID 20210816143654 -appdir /usr/lib/firefox/browser 6247 true tab
File size:	736648 bytes
MD5 hash:	bf9680bcd223dba6b6e38b63bc4f73d7

Start time:	06:17:46
Start date:	21/03/2023
Path:	/usr/lib/firefox/firefox
Arguments:	n/a
File size:	736648 bytes
MD5 hash:	bf9680bcd223dba6b6e38b63bc4f73d7

Start time:	06:17:46
Start date:	21/03/2023
Path:	/usr/lib/firefox/firefox
Arguments:	n/a
File size:	736648 bytes
MD5 hash:	bf9680bcd223dba6b6e38b63bc4f73d7

Start time:	06:17:46
Start date:	21/03/2023
Path:	/usr/lib/firefox/firefox
Arguments:	/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 6099 -prefMapSize 238647 -jsInit 285716 -parentBuildID 20210816143654 -appdir /usr/lib/firefox/browser 6247 true tab
File size:	736648 bytes
MD5 hash:	bf9680bcd223dba6b6e38b63bc4f73d7

Source: global traffic	HTTP traffic detected: GET /chains/remote-settings.content-signature.mozilla.org-2021-09-19-15-17-11.chain HTTP/1.1Host: content-signature-2.cdn.mozilla.netUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-aliveSec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: cross-siteIf-Modified-Since: Sat, 31 Jul 2021 15:17:12 GMTIf-None-Match: "8cfd2c8fe1fb0bc900759661d7a6ee89"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: push.services.mozilla.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brSec-WebSocket-Version: 13Origin: wss://push.services.mozilla.com/Sec-WebSocket-Protocol: push-notificationSec-WebSocket-Extensions: permessage-deflateSec-WebSocket-Key: /HsD9zTc2lDu1K9P7e79lw==Connection: keep-alive, UpgradeSec-Fetch-Dest: websocketSec-Fetch-Mode: websocketSec-Fetch-Site: cross-sitePragma: no-cacheCache-Control: no-cacheUpgrade: websocket
Source: global traffic	HTTP traffic detected: GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1Host: firefox.settings.services.mozilla.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: application/jsonAccept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brContent-Type: application/jsonConnection: keep-aliveSec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: cross-siteIf-Modified-Since: Tue, 01 Jun 2021 14:28:23 GMTIf-None-Match: "1622557703112"
Source: global traffic	HTTP traffic detected: GET /v1/ HTTP/1.1Host: firefox.settings.services.mozilla.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-aliveSec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: cross-site
Source: global traffic	HTTP traffic detected: GET /main-workspace/ms-language-packs/4f1bcaa0-ddf9-43ef-aca3-8378c4d05582.ftl HTTP/1.1Host: firefox-settings-attachments.cdn.mozilla.netUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-aliveSec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: cross-site
Source: global traffic	HTTP traffic detected: GET /update/3/GMP/91.0.1/20210816143654/Linux_x86_64-gcc3/null/release-cck-ubuntu/Linux%205.4.0-72-generic%20(GTK%203.24.20%2Clibpulse%2013.99.0)/canonical/1.0/update.xml HTTP/1.1Host: aus5.mozilla.orgUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brCache-Control: no-cachePragma: no-cacheConnection: keep-aliveSec-Fetch-Dest: emptySec-Fetch-Mode: no-corsSec-Fetch-Site: cross-site
Source: global traffic	HTTP traffic detected: GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1Host: firefox.settings.services.mozilla.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: application/jsonAccept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brContent-Type: application/jsonConnection: keep-aliveSec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: cross-siteIf-Modified-Since: Fri, 25 Mar 2022 17:45:46 GMTIf-None-Match: "1648230346554"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: push.services.mozilla.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brSec-WebSocket-Version: 13Origin: wss://push.services.mozilla.com/Sec-WebSocket-Protocol: push-notificationSec-WebSocket-Extensions: permessage-deflateSec-WebSocket-Key: Pv/Zvfj6YW6T57Phu897Ug==Connection: keep-alive, UpgradeSec-Fetch-Dest: websocketSec-Fetch-Mode: websocketSec-Fetch-Site: cross-sitePragma: no-cacheCache-Control: no-cacheUpgrade: websocket
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: push.services.mozilla.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brSec-WebSocket-Version: 13Origin: wss://push.services.mozilla.com/Sec-WebSocket-Protocol: push-notificationSec-WebSocket-Extensions: permessage-deflateSec-WebSocket-Key: U4qUgcEAUSmpmIII+0JwlQ==Connection: keep-alive, UpgradeSec-Fetch-Dest: websocketSec-Fetch-Mode: websocketSec-Fetch-Site: cross-sitePragma: no-cacheCache-Control: no-cacheUpgrade: websocket
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: push.services.mozilla.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brSec-WebSocket-Version: 13Origin: wss://push.services.mozilla.com/Sec-WebSocket-Protocol: push-notificationSec-WebSocket-Extensions: permessage-deflateSec-WebSocket-Key: xcYDBoWaCBwQWORghw2Mew==Connection: keep-alive, UpgradeSec-Fetch-Dest: websocketSec-Fetch-Mode: websocketSec-Fetch-Site: cross-sitePragma: no-cacheCache-Control: no-cacheUpgrade: websocket
Source: global traffic	HTTP traffic detected: GET /Demon.mips HTTP/1.1Host: 31.214.243.29User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-aliveUpgrade-Insecure-Requests: 1

Source: 134714F2DF01B21FA934AB16898B0583114E19B0.42.dr	String found in binary or memory: http://31.214.243.29/
Source: 730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr	String found in binary or memory: http://31.214.243.29/Demon.mips
Source: 730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr	String found in binary or memory: http://31.214.243.29/Demon.mipsstrongly-framed1request-methodGETresponse-headHTTP/1.1
Source: 134714F2DF01B21FA934AB16898B0583114E19B0.42.dr	String found in binary or memory: http://31.214.243.29/predictor::seen1
Source: cert9.db.42.dr, cert9.db-journal.42.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: cert9.db.42.dr, cert9.db-journal.42.dr	String found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0?
Source: cert9.db.42.dr, cert9.db-journal.42.dr	String found in binary or memory: http://crl.pki.goog/gtsr1/gtsr1.crl0W
Source: cert9.db.42.dr, cert9.db-journal.42.dr	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: cert9.db.42.dr, cert9.db-journal.42.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: cert9.db.42.dr, cert9.db-journal.42.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: cert9.db.42.dr, cert9.db-journal.42.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: cert9.db.42.dr, cert9.db-journal.42.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: cert9.db.42.dr, cert9.db-journal.42.dr	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: khk19L2S.mips.part.42.dr	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: 730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr, khk19L2S.mips.part.42.dr	String found in binary or memory: http://feedback.redkolibri.com/
Source: scriptCache-new.bin.42.dr	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: F8CBD54DDA10F4286A41EC6A537240712D6C2308.42.dr	String found in binary or memory: http://kinto.readthedocs.io/en/latest/tutorials/synchronisation.html#polling-for-remote-changes
Source: asrouter.ftl.tmp.42.dr, DED23BB33EA3C88FAD1C0A1CD53916E0D8C424D3.42.dr	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: cert9.db-journal.42.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: cert9.db.42.dr, cert9.db-journal.42.dr	String found in binary or memory: http://ocsp.digicert.com0K
Source: cert9.db.42.dr, cert9.db-journal.42.dr	String found in binary or memory: http://ocsp.pki.goog/gsr202
Source: cert9.db.42.dr, cert9.db-journal.42.dr	String found in binary or memory: http://ocsp.pki.goog/gtsr100
Source: cert9.db.42.dr, cert9.db-journal.42.dr	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: cert9.db.42.dr, cert9.db-journal.42.dr	String found in binary or memory: http://pki.goog/repo/certs/gtsr1.der04
Source: 730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr, khk19L2S.mips.part.42.dr	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: 730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr, khk19L2S.mips.part.42.dr	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: 730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr, khk19L2S.mips.part.42.dr	String found in binary or memory: http://www.billybobbot.com/crawler/)
Source: scriptCache-new.bin.42.dr	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: scriptCache-new.bin.42.dr	String found in binary or memory: http://www.mozilla.org/newlayout/xml/parsererror.xml
Source: cert9.db.42.dr, cert9.db-journal.42.dr	String found in binary or memory: http://x1.c.lencr.org/0
Source: cert9.db.42.dr, cert9.db-journal.42.dr	String found in binary or memory: http://x1.i.lencr.org/0
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://amazon.com
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://baidu.com
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=921157
Source: 5FFD69415953BE9CE9C07B2E9C26DA959ADEA6CB.42.dr	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: scriptCache-child-new.bin.42.dr	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/JavaScript_OS.File/OS.File.Info#Cross-platform_Attributes
Source: 3870112724rsegmnoittet-es.sqlite-wal.42.dr, 3870112724rsegmnoittet-es.sqlite.42.dr	String found in binary or memory: https://doh.xfinity.com/dns-query
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://duckduckgo.com
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://ebay.com
Source: F8CBD54DDA10F4286A41EC6A537240712D6C2308.42.dr	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/
Source: DED23BB33EA3C88FAD1C0A1CD53916E0D8C424D3.42.dr	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-language-packs/4f1bcaa0-ddf9-
Source: 3870112724rsegmnoittet-es.sqlite-wal.42.dr, 3870112724rsegmnoittet-es.sqlite.42.dr	String found in binary or memory: https://firefox.dns.next
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://firefox.dns.nextdns.io/
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1
Source: F8CBD54DDA10F4286A41EC6A537240712D6C2308.42.dr	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: 254256B27E0C48CF9B80B695F0B3B8CA84610495.42.dr	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: F8CBD54DDA10F4286A41EC6A537240712D6C2308.42.dr	String found in binary or memory: https://github.com/Kinto/kinto-attachment/
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://google.com
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/7dafd5f51c0afd1ae627bb4762ac0c140a6cd5f5
Source: 68B780A709FB903C666EF08F51EF5985A89FE446.42.dr	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/deletion-request/1/7c4c3d68-b8c8-44e6-
Source: 3870112724rsegmnoittet-es.sqlite-wal.42.dr, 3870112724rsegmnoittet-es.sqlite.42.dr	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: cert9.db.42.dr, cert9.db-journal.42.dr	String found in binary or memory: https://pki.goog/repository/0
Source: 3870112724rsegmnoittet-es.sqlite-wal.42.dr, 3870112724rsegmnoittet-es.sqlite.42.dr	String found in binary or memory: https://private.canadianshield.cira.ca/dns-query
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://profiler.firefox.com
Source: F8CBD54DDA10F4286A41EC6A537240712D6C2308.42.dr	String found in binary or memory: https://remote-settings.readthedocs.io
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://settings.stage.mozaws.net/v1/buckets/main-preview/collections/search-config/records
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://settings.stage.mozaws.net/v1/buckets/main/collections/search-config/records
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://support.mozilla.org/kb/
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-help
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://support.mozilla.org/kb/flash-protected-mode-autodisabled
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://trr.dns.nextdns.io/
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://twitter.com
Source: cert9.db.42.dr, cert9.db-journal.42.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://www.google.com/policies/privacy/
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://www.openh264.org/
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://www.widevine.com/
Source: scriptCache-new.bin.42.dr	String found in binary or memory: https://yandex.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43386
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38690
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39582
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39200
Source: unknown	Network traffic detected: HTTP traffic on port 39200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57870
Source: unknown	Network traffic detected: HTTP traffic on port 57862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39214 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38248 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38246
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38248
Source: unknown	Network traffic detected: HTTP traffic on port 43386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57862
Source: unknown	Network traffic detected: HTTP traffic on port 38690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39582 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.243.29

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report http://31.214.243.29/Demon.mips

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Process Tree

Malware Threat Intel

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.cache/dconf/user

/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/134714F2DF01B21FA934AB16898B0583114E19B0

/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/254256B27E0C48CF9B80B695F0B3B8CA84610495

/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/5FFD69415953BE9CE9C07B2E9C26DA959ADEA6CB

/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/68B780A709FB903C666EF08F51EF5985A89FE446

/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1

/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/DED23BB33EA3C88FAD1C0A1CD53916E0D8C424D3

/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/F8CBD54DDA10F4286A41EC6A537240712D6C2308

/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/settings/main/ms-language-packs/asrouter.ftl.tmp

/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/startupCache/scriptCache-child-new.bin

/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/startupCache/scriptCache-new.bin

/home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/startupCache/urlCache-new.bin

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/addonStartup.json.lz4.tmp

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/broadcast-listeners.json.tmp

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/cert9.db

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/cert9.db-journal

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/crashes/store.json.mozlz4.tmp

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/datareporting/aborted-session-ping.tmp

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/datareporting/glean/db/data.safe.bin

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/datareporting/glean/tmp/7c4c3d68-b8c8-44e6-a714-345a0583faf2

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/datareporting/session-state.json.tmp

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/datareporting/state.json.tmp

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/extensions.json.tmp

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/key4.db

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/key4.db-journal

/home/saturnino/.mozilla/firefox/a3xevaya.default-release/prefs-1.js

Linux Analysis Report
http://31.214.243.29/Demon.mips