Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1483423
MD5: b078d31fc894b91a32e1c40c596fe1ec
SHA1: ed490245f51c3b2fad83e2eb22ad48d5260a8ad8
SHA256: 3188153b52c7148bf97d29e8d0447b1d50ddbde7d0ac56005e2b758dab432030
Tags: exe
Infos:

Detection

Score: 84
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Hides threads from debuggers
Machine Learning detection for sample
PE file has nameless sections
Abnormal high CPU Usage
Connects to many different domains
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Sample file is different than original file name gathered from version info
Sleep loop found (likely to delay execution)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Keylogger Generic

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: file.exe Virustotal: Detection: 33% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown HTTPS traffic detected: 143.204.215.115:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49788 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49793 version: TLS 1.2
Source: Binary string: rsaenh.pdb source: firefox.exe, 00000004.00000003.2096956640.0000020BA94FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2104230942.0000020BA94FE000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: UMPDC.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wininet.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: winsta.pdb source: firefox.exe, 00000004.00000003.2104854909.0000020BA9468000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: ktmw32.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: pnrpnsp.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wshbth.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: WscApi.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: winhttp.pdbP4O source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: NapiNSP.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: xul.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: nssckbi.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: winnsi.pdb source: firefox.exe, 00000004.00000003.2104854909.0000020BA9468000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2104987514.0000020BA9456000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dcomp.pdb source: firefox.exe, 00000004.00000003.2104854909.0000020BA9468000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: cryptsp.pdb source: firefox.exe, 00000004.00000003.2096956640.0000020BA94FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2104230942.0000020BA94FE000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: sspicli.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: CLBCatQ.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: urlmon.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnsapi.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA9456000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: userenv.pdb source: firefox.exe, 00000004.00000003.2104854909.0000020BA9468000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: nlaapi.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: winhttp.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: msimg32.pdb source: firefox.exe, 00000004.00000003.2096956640.0000020BA94FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2104230942.0000020BA94FE000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: ntasn1.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: devobj.pdb source: firefox.exe, 00000004.00000003.2104854909.0000020BA9468000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: d3d11.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dwmapi.pdb source: firefox.exe, 00000004.00000003.2104854909.0000020BA9468000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dbghelp.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: srvcli.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: freebl3.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: profapi.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: avrt.pdb source: firefox.exe, 00000004.00000003.2096956640.0000020BA94FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2104230942.0000020BA94FE000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: mswsock.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: nsi.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA9456000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: propsys.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.4.dr
Source: Binary string: winmm.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: winrnr.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA9456000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: msctf.pdb source: firefox.exe, 00000004.00000003.2104854909.0000020BA9468000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: version.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dbgcore.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: mscms.pdb source: firefox.exe, 00000004.00000003.2104854909.0000020BA9468000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: twinapi.pdb source: firefox.exe, 00000004.00000003.2104854909.0000020BA9468000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: msasn1.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.4.dr
Source: Binary string: psapi.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: DWrite.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dxgi.pdb source: firefox.exe, 00000004.00000003.2104854909.0000020BA9468000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: ncrypt.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: firefox.exe Memory has grown: Private usage: 1MB later: 279MB
Connects to many different domains
Source: unknown Network traffic detected: DNS query count 30
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 34.149.100.209 34.149.100.209
Source: Joe Sandbox View IP Address: 34.117.188.166 34.117.188.166
Source: Joe Sandbox View IP Address: 143.204.215.115 143.204.215.115
Source: Joe Sandbox View IP Address: 34.160.144.191 34.160.144.191
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: firefox.exe, 00000003.00000002.1894536119.0000027CDC470000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 00000003.00000002.1894536119.0000027CDC470000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevatione equals www.youtube.com (Youtube)
Source: firefox.exe, 00000002.00000002.1883864318.0000025C5AE10000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000002.00000002.1883864318.0000025C5AE10000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account, equals www.youtube.com (Youtube)
Source: firefox.exe, 00000004.00000003.2077134557.0000020BA3F73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://www.youtube.com/* equals www.youtube.com (Youtube)
Source: firefox.exe, 00000004.00000003.2061402287.0000020BB10C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2038473193.0000020BAB46F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2061714268.0000020BB10A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000004.00000003.2061402287.0000020BB10C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2038473193.0000020BAB46F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2062792736.0000020BAB46F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000004.00000003.2044409145.0000020BA9452000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2094238979.0000020BAE459000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2069277322.0000020BA9445000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000A.00000002.4154017883.000001692A9E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: =::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 00000006.00000002.4154688751.0000028F875E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: =::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows.+:3d equals www.youtube.com (Youtube)
Source: firefox.exe, 00000009.00000002.4153856392.0000012C8E2C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: =::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsB equals www.youtube.com (Youtube)
Source: firefox.exe, 00000004.00000003.2094664082.0000020BAB686000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2101201125.0000020BAB686000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: @https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000006.00000002.4155296365.0000028F876B4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000009.00000002.4154893087.0000012C8E564000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154659738.000001692AC64000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 00000003.00000002.1894536119.0000027CDC470000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account--attempting-deelevation' equals www.youtube.com (Youtube)
Source: firefox.exe, 00000002.00000002.1883864318.0000025C5AE10000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/accountj equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000002.4164485337.00000000054D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\Desktop\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/accountC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default=::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows%Bg equals www.youtube.com (Youtube)
Source: firefox.exe, 00000002.00000002.1883864318.0000025C5AE10000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\Desktop\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/accountC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Defaulth equals www.youtube.com (Youtube)
Source: firefox.exe, 00000003.00000002.1894536119.0000027CDC470000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevationC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default! equals www.youtube.com (Youtube)
Source: firefox.exe, 00000006.00000002.4154688751.0000028F875EA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.4155296365.0000028F876B0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.4155296365.0000028F876B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000A.00000002.4154017883.000001692A9EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/account, equals www.youtube.com (Youtube)
Source: firefox.exe, 00000009.00000002.4153856392.0000012C8E2CA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountX` equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000A.00000002.4154017883.000001692A9E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountbl equals www.youtube.com (Youtube)
Source: firefox.exe, 00000004.00000003.2044409145.0000020BA9452000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2069090105.0000020BA9459000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: WindowGlobalParent.getActor: Window protocol 'Translations' doesn't match uri about:certerror?e=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000002.00000002.1883864318.0000025C5AE34000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000002.00000003.1882789044.0000025C5AE2F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Z8p8https://www.youtube.com/account --attempting-deelevationUser equals www.youtube.com (Youtube)
Source: firefox.exe, 00000004.00000003.2069708035.0000020BA4A7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2100499450.0000020BAE3C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2062075598.0000020BAE48D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: about:certerror?e=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000006.00000002.4155296365.0000028F876B0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000009.00000002.4154893087.0000012C8E560000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154659738.000001692AC60000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: aming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\bro equals www.youtube.com (Youtube)
Source: firefox.exe, 00000004.00000003.2105513292.0000020BAE428000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2062075598.0000020BAE48D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2099408334.0000020BAE48A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: e=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000A.00000002.4154017883.000001692A9EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: efox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000004.00000003.1958372160.0000020BA2667000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.facebook.com/ and total time spent inside rs-experiment-loader-timerWillChangeBrowserRemotenesshttps://www.amazon.co.uk/main/nimbus-desktop-experiments equals www.facebook.com (Facebook)
Source: firefox.exe, 00000004.00000003.2061402287.0000020BB10C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2038473193.0000020BAB46F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2061714268.0000020BB10A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000004.00000003.2075197556.0000020BA3A12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2100794324.0000020BAE3BB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000004.00000003.2061402287.0000020BB10C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2038473193.0000020BAB46F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2062792736.0000020BAB46F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000A.00000002.4155065106.000001692AD0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000A.00000002.4155065106.000001692AD0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000000A.00000002.4155065106.000001692AD0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000009.00000002.4155925343.0000012C8E60A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4155065106.000001692AD0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000009.00000002.4155925343.0000012C8E60A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4155065106.000001692AD0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000009.00000002.4155925343.0000012C8E60A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4155065106.000001692AD0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000002.4162212300.0000000002516000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4164878709.0000000006A4D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2044409145.0000020BA9452000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000002.4164878709.0000000006A4D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/account# equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000002.4164878709.0000000006A4D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/account* equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000002.4164878709.0000000006A4D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountL equals www.youtube.com (Youtube)
Source: firefox.exe, 00000004.00000003.2077134557.0000020BA3F73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: moz-extension://a581a2f1-688c-434b-8db8-16166b1993d9/injections/js/bug1842437-www.youtube.com-performance-now-precision.js equals www.youtube.com (Youtube)
Source: firefox.exe, 00000002.00000002.1883864318.0000025C5AE34000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000002.00000003.1882789044.0000025C5AE2F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: s://www.youtube.com/account --attempting-deelevation equals www.youtube.com (Youtube)
Source: recovery.jsonlz4.tmp.4.dr String found in binary or memory: url":"https://www.youtube.com/account","title* equals www.youtube.com (Youtube)
Source: firefox.exe, 00000004.00000003.2063916413.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2082638399.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2039493724.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000004.00000003.2044409145.0000020BA9452000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2069708035.0000020BA4A7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1930434277.0000020BAB3D6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000004.00000003.2063916413.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2082638399.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2039493724.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.com- equals www.youtube.com (Youtube)
Source: firefox.exe, 00000004.00000003.2069708035.0000020BA4A7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2100499450.0000020BAE3C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2062075598.0000020BAE48D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: xabout:certerror?e=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000004.00000003.2105513292.0000020BAE428000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2062075598.0000020BAE48D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2099408334.0000020BAE48A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: xe=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000004.00000003.2062075598.0000020BAE48D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2099408334.0000020BAE48A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2082411555.0000020BAE48D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: xhttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic DNS traffic detected: DNS query: www.youtube.com
Source: global traffic DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic DNS traffic detected: DNS query: example.org
Source: global traffic DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: www.facebook.com
Source: global traffic DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic DNS traffic detected: DNS query: www.reddit.com
Source: global traffic DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic DNS traffic detected: DNS query: twitter.com
Source: global traffic DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: http://127.0.0.1:
Source: firefox.exe, 00000004.00000003.1958372160.0000020BA2667000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2072399347.0000020BA3D90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045160907.0000020BA3D90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 00000004.00000003.1958372160.0000020BA2667000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2072399347.0000020BA3D90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045160907.0000020BA3D90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 00000004.00000003.1958372160.0000020BA2667000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2072399347.0000020BA3D90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045160907.0000020BA3D90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 00000004.00000003.1958372160.0000020BA2667000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2072399347.0000020BA3D90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045160907.0000020BA3D90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: firefox.exe, 00000004.00000003.2091753320.0000020BA1300000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: firefox.exe, 00000004.00000003.2091753320.0000020BA1300000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: firefox.exe, 00000004.00000003.2091753320.0000020BA1300000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: firefox.exe, 00000004.00000003.2091753320.0000020BA1300000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: firefox.exe, 00000004.00000003.2091753320.0000020BA1300000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: gmpopenh264.dll.tmp.4.dr String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: firefox.exe, 00000004.00000003.2091753320.0000020BA1300000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: firefox.exe, 00000004.00000003.2091753320.0000020BA1300000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: firefox.exe, 00000004.00000003.2091753320.0000020BA1300000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: firefox.exe, 00000004.00000003.2091753320.0000020BA1300000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: firefox.exe, 00000004.00000003.2091753320.0000020BA1300000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: firefox.exe, 00000004.00000003.2091753320.0000020BA1300000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: firefox.exe, 00000004.00000003.2091753320.0000020BA1300000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: gmpopenh264.dll.tmp.4.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: firefox.exe, 00000004.00000003.2069708035.0000020BA4A5E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000004.00000003.2100029510.0000020BAE459000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 00000004.00000003.2069708035.0000020BA4A5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000004.00000003.2069708035.0000020BA4A7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2101775067.0000020BAB4AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2096493863.0000020BAA0D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2103517132.0000020BAA0D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2062672605.0000020BAB4AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2097454702.0000020BAA0D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2065837210.0000020BAA0CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2038473193.0000020BAB4AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2106554328.0000020BAAEEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2042051836.0000020BAA0CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000004.00000003.2104987514.0000020BA9451000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2042051836.0000020BAA0CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://json-schema.org/draft-04/schema#(version
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://json-schema.org/draft-06/schema#browser.toolbars.bookmarks.visibilityhttp://json-schema.org/d
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://json-schema.org/draft-07/schema#Index
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org
Source: firefox.exe, 00000004.00000003.2030274249.0000020BAA6F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2028253332.0000020BAA6F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2027098403.0000020BAA6F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/appId
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/appName
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches
Source: firefox.exe, 00000004.00000003.1958199617.0000020BA2692000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature
Source: firefox.exe, 00000004.00000003.1958157270.0000020BA2697000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/featureId
Source: firefox.exe, 00000004.00000003.1958157270.0000020BA2697000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/value
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/ratio
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/ratiohttp://mozilla.org/#/properti
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0The
Source: firefox.exe, 00000004.00000003.1958199617.0000020BA2692000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature
Source: firefox.exe, 00000004.00000003.1958157270.0000020BA2697000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/enabled
Source: firefox.exe, 00000004.00000003.1958157270.0000020BA2697000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/featureId
Source: firefox.exe, 00000004.00000003.1958157270.0000020BA2697000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value
Source: firefox.exe, 00000004.00000003.1958157270.0000020BA2697000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/valuehttp://moz
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items
Source: firefox.exe, 00000004.00000003.1958157270.0000020BA2697000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/featureI
Source: firefox.exe, 00000004.00000003.1958157270.0000020BA2697000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value
Source: firefox.exe, 00000004.00000003.1958199617.0000020BA2692000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value/ad
Source: firefox.exe, 00000004.00000003.1958157270.0000020BA2697000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/valuehtt
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/ratio
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/slug
Source: firefox.exe, 00000004.00000003.1958199617.0000020BA2692000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/itemsTesting
Source: firefox.exe, 00000004.00000003.1958157270.0000020BA2697000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2
Source: firefox.exe, 00000004.00000003.1958199617.0000020BA2692000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features
Source: firefox.exe, 00000004.00000003.1958157270.0000020BA2697000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/featureI
Source: firefox.exe, 00000004.00000003.1958157270.0000020BA2697000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value
Source: firefox.exe, 00000004.00000003.1958199617.0000020BA2692000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/itemshttp://mozilla.org/#
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/ratio
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/slug
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/bucketConfig
Source: firefox.exe, 00000004.00000003.1958199617.0000020BA2692000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/count
Source: firefox.exe, 00000004.00000003.1958199617.0000020BA2692000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/countVersion
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/namespace
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/randomizationUnit
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/randomizationUnitThe
Source: firefox.exe, 00000004.00000003.1958199617.0000020BA2692000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/start
Source: firefox.exe, 00000004.00000003.1958199617.0000020BA2692000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/startA
Source: firefox.exe, 00000004.00000003.1958199617.0000020BA2692000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/total
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/channel
Source: firefox.exe, 00000004.00000003.1958157270.0000020BA2697000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/endDate
Source: firefox.exe, 00000004.00000003.1958157270.0000020BA2697000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/endDatehttp://mozilla.org/#/properties/proposedDurationhttp://mozill
Source: firefox.exe, 00000004.00000003.1958199617.0000020BA2692000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/enrollmentEndDate
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/featureIds/itemshttp://mozilla.org/#/properties/branches/anyOf/1http
Source: firefox.exe, 00000004.00000003.1958199617.0000020BA2692000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/featureValidationOptOut
Source: firefox.exe, 00000004.00000003.1958199617.0000020BA2692000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/featureValidationOptOuthttp://mozilla.org/#/properties/localizations
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/id
Source: firefox.exe, 00000004.00000003.1958199617.0000020BA2692000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/isEnrollmentPaused
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/isRollout
Source: firefox.exe, 00000004.00000003.1958157270.0000020BA2697000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/localizations
Source: firefox.exe, 00000004.00000003.1958199617.0000020BA2692000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties
Source: firefox.exe, 00000004.00000003.1958157270.0000020BA2697000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties/additionalProperties
Source: firefox.exe, 00000004.00000003.1958199617.0000020BA2692000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/1
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/outcomes
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/outcomes/items
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/priority
Source: firefox.exe, 00000004.00000003.1958199617.0000020BA2692000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/slug
Source: firefox.exe, 00000004.00000003.1958157270.0000020BA2697000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/proposedDurationhttp://mozilla.org/#/properties/referenceBranch
Source: firefox.exe, 00000004.00000003.1958199617.0000020BA2692000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/proposedEnrollment
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/schemaVersion
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/schemaVersionhttp://mozilla.org/#/properties/channelhttp://mozilla.o
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/slug
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/slughttp://mozilla.org/#/properties/appIdhttp://mozilla.org/#/proper
Source: firefox.exe, 00000004.00000003.1958157270.0000020BA2697000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/startDate
Source: firefox.exe, 00000004.00000003.1958157270.0000020BA2697000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/targeting
Source: firefox.exe, 00000004.00000003.1958199617.0000020BA2692000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/userFacingDescription
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/userFacingName
Source: firefox.exe, 00000004.00000003.2020070030.0000020BAB8C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2051278414.0000020BA2EBD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2035148281.0000020BA963E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2015771215.0000020BA962B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2015057135.0000020BA2EC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2033107433.0000020BA966A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2084170747.0000020BA96AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2069708035.0000020BA4A7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2012808297.0000020BA963D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1930434277.0000020BAB3D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2046482379.0000020BA3D58000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2021157775.0000020BA95F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2036989054.0000020B9E446000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2033107433.0000020BA9663000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2091439508.0000020BA1A3B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2088452327.0000020BA963D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2101912110.0000020BAB373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2075197556.0000020BA3A25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2031031640.0000020BA9634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2078374857.0000020BA145F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2020070030.0000020BAB8C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 00000004.00000003.2091753320.0000020BA1300000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: firefox.exe, 00000004.00000003.2091753320.0000020BA1300000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: firefox.exe, 00000004.00000003.2091753320.0000020BA1300000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.dr String found in binary or memory: http://ocsp.digicert.com0N
Source: firefox.exe, 00000004.00000003.2091753320.0000020BA1300000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: gmpopenh264.dll.tmp.4.dr String found in binary or memory: http://ocsp.thawte.com0
Source: file.exe String found in binary or memory: http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07
Source: file.exe String found in binary or memory: http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr
Source: file.exe String found in binary or memory: http://pki-ocsp.symauth.com0
Source: firefox.exe, 00000004.00000003.2069708035.0000020BA4A7F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r3.i.lencr.org/0
Source: firefox.exe, 00000004.00000003.2069708035.0000020BA4A7F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r3.o.lencr.org0
Source: gmpopenh264.dll.tmp.4.dr String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: gmpopenh264.dll.tmp.4.dr String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: gmpopenh264.dll.tmp.4.dr String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: firefox.exe, 00000004.00000003.2091753320.0000020BA1300000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/CPS0
Source: gmpopenh264.dll.tmp.4.dr String found in binary or memory: http://www.mozilla.com0
Source: firefox.exe, 00000004.00000003.2094664082.0000020BAB693000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 00000004.00000003.1958372160.0000020BA2667000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2072399347.0000020BA3D90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045160907.0000020BA3D90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 00000004.00000003.2047275337.0000020BA399E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000004.00000003.2047275337.0000020BA399E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xule
Source: firefox.exe, 00000004.00000003.1958372160.0000020BA2667000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttps://www.amazon.com/exec/obidos/exte
Source: firefox.exe, 00000004.00000003.2047275337.0000020BA399E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xuln
Source: firefox.exe, 00000009.00000003.1921380657.0000012C8F2FC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000009.00000003.1922433616.0000012C8F2FC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000009.00000002.4160690423.0000012C8F2FC000.00000004.00000020.00020000.00000000.sdmp, mozilla-temp-41.4.dr String found in binary or memory: http://www.videolan.org/x264.html
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000004.00000003.2071287474.0000020BA3E6E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://MD8.mozilla.org/1/m
Source: firefox.exe, 00000004.00000003.1898086067.0000020BA142C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1899135786.0000020BA1481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1898276197.0000020BA1441000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1898838101.0000020BA146C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1897906074.0000020BA1417000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1897759443.0000020BA0F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1898489911.0000020BA1457000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000004.00000003.2069708035.0000020BA4A7F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000004.00000003.2038473193.0000020BAB4E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2101477064.0000020BAB4E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2062446661.0000020BAB4E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2094967435.0000020BAB4E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 00000004.00000003.2039493724.0000020BAAF21000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000004.00000003.2063916413.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2082638399.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2039493724.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2106285255.0000020BAAFA6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/firefox/addon/enhancer-for-youtube/
Source: firefox.exe, 00000004.00000003.2063916413.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2082638399.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2039493724.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2106285255.0000020BAAFA6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/firefox/addon/facebook-container/
Source: firefox.exe, 00000004.00000003.2063916413.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2082638399.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2039493724.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2106285255.0000020BAAFA6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/firefox/addon/reddit-enhancement-suite/
Source: firefox.exe, 00000004.00000003.2063916413.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2082638399.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2039493724.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2106285255.0000020BAAFA6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/firefox/addon/to-google-translate/
Source: firefox.exe, 00000004.00000003.2063916413.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2082638399.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2039493724.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2106285255.0000020BAAFA6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/firefox/addon/wikipedia-context-menu-search/
Source: firefox.exe, 00000004.00000003.2103699447.0000020BAA098000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2042940902.0000020BAA091000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2065952803.0000020BAA098000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000004.00000003.2106285255.0000020BAAFA6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
Source: firefox.exe, 00000004.00000003.2106285255.0000020BAAFA6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://app.adjust.com/a8bxj8j?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 00000004.00000003.2095098975.0000020BAB0CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2102374771.0000020BAB0D6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000004.00000003.2082814005.0000020BAAB64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2064728646.0000020BAAB64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2106751786.0000020BAAB64000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: firefox.exe, 00000006.00000002.4155867378.0000028F878C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000009.00000002.4155925343.0000012C8E6E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4158602626.000001692AF03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.dr String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: firefox.exe, 00000006.00000002.4155867378.0000028F878C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000009.00000002.4155925343.0000012C8E6E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4158602626.000001692AF03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.dr String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 00000004.00000003.2063916413.0000020BAAFCC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000004.00000003.2010918291.0000020BA1D86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2010120968.0000020BA1D80000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1189266
Source: firefox.exe, 00000004.00000003.2010918291.0000020BA1D86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2010120968.0000020BA1D80000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1193802
Source: firefox.exe, 00000004.00000003.2010918291.0000020BA1D86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2010120968.0000020BA1D80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2010120968.0000020BA1D75000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1207993
Source: firefox.exe, 00000004.00000003.2010918291.0000020BA1D86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2010120968.0000020BA1D75000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1266220
Source: firefox.exe, 00000004.00000003.2010918291.0000020BA1D86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2010120968.0000020BA1D80000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1283601
Source: firefox.exe, 00000004.00000003.1958372160.0000020BA2667000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1930434277.0000020BAB3EF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 00000004.00000003.1930434277.0000020BAB3EF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 00000004.00000003.1930434277.0000020BAB3EF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 00000004.00000003.1958372160.0000020BA2667000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1930434277.0000020BAB3EF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: firefox.exe, 00000004.00000003.1958372160.0000020BA2667000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739Certificate
Source: firefox.exe, 00000004.00000003.2010918291.0000020BA1D86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2010120968.0000020BA1D80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2011108278.0000020BA1D99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1678448
Source: firefox.exe, 00000004.00000003.2060628072.0000020BA2E45000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1694699#c21
Source: firefox.exe, 00000004.00000003.2010918291.0000020BA1D86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2010120968.0000020BA1D80000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=792480
Source: firefox.exe, 00000004.00000003.2010120968.0000020BA1D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2010918291.0000020BA1D86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2010120968.0000020BA1D80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2010120968.0000020BA1D75000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=809550
Source: firefox.exe, 00000004.00000003.2010918291.0000020BA1D86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2010120968.0000020BA1D80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2010120968.0000020BA1D75000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=840161
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000004.00000003.1898086067.0000020BA142C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1899135786.0000020BA1481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1898276197.0000020BA1441000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1898838101.0000020BA146C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1897906074.0000020BA1417000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1897759443.0000020BA0F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1898489911.0000020BA1457000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000004.00000003.2100029510.0000020BAE459000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://content-signature-2.cdn.mozilla.net/
Source: firefox.exe, 00000004.00000003.2046482379.0000020BA3D4B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://content.cdn.mozilla.net
Source: firefox.exe, 00000006.00000002.4155867378.0000028F878C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000009.00000002.4155925343.0000012C8E6E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4158602626.000001692AF03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.dr String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: firefox.exe, 00000006.00000002.4155867378.0000028F878C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000009.00000002.4155925343.0000012C8E6E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4158602626.000001692AF03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.dr String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000004.00000003.2101477064.0000020BAB4FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000004.00000003.2033107433.0000020BA9663000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2015771215.0000020BA9662000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2031031640.0000020BA9662000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 00000004.00000003.2062792736.0000020BAB482000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1897759443.0000020BA0F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1898489911.0000020BA1457000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 00000004.00000003.2038046959.0000020BB10AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: firefox.exe, 00000004.00000003.1900654977.0000020B9ED33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2029892686.0000020B9ED32000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000004.00000003.1900654977.0000020B9ED33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2029892686.0000020B9ED32000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000000A.00000002.4155065106.000001692AD13000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000004.00000003.1950360625.0000020BAE227000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1952277996.0000020BAE224000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1970864817.0000020BA957B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000004.00000003.2039493724.0000020BAAF21000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000000A.00000002.4155065106.000001692AD13000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000009.00000002.4155925343.0000012C8E6C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4155065106.000001692ADC4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000009.00000002.4155925343.0000012C8E6C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4155065106.000001692ADC4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000000A.00000002.4155065106.000001692AD30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000009.00000002.4155925343.0000012C8E6C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4155065106.000001692ADC4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000004.00000003.2101912110.0000020BAB373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2063546660.0000020BAB373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 00000004.00000003.2094967435.0000020BAB4E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000009.00000002.4155925343.0000012C8E6C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4155065106.000001692ADC4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000004.00000003.2101912110.0000020BAB373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2063546660.0000020BAB373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 00000004.00000003.2101912110.0000020BAB373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2063546660.0000020BAB373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 00000004.00000003.2101912110.0000020BAB373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2063546660.0000020BAB373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA267B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/cfworker
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA267B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/cfworker__absolute_recursive_ref__
Source: firefox.exe, 00000004.00000003.2020070030.0000020BAB8C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 00000004.00000003.2020070030.0000020BAB8C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 00000004.00000003.1898086067.0000020BA142C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1898276197.0000020BA1441000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1898838101.0000020BA146C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1897906074.0000020BA1417000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1897759443.0000020BA0F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1898489911.0000020BA1457000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000004.00000003.2081084461.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2105366270.0000020BB2675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2092959899.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2061114344.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: firefox.exe, 00000004.00000003.1930434277.0000020BAB3EF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 00000004.00000003.1930434277.0000020BAB3EF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 00000004.00000003.2101912110.0000020BAB373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2063546660.0000020BAB373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 00000004.00000003.1930434277.0000020BAB3EF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000004.00000003.2083457713.0000020BAAB54000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2106751786.0000020BAAB54000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2028894780.0000020BAB12C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2041311912.0000020BAAB54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ib.absa.co.za/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000004.00000003.2081084461.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2105366270.0000020BB2675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2092959899.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2061114344.0000020BB26A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://identity.mozilla.com/apps/oldsyncS
Source: firefox.exe, 00000004.00000003.2081084461.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2105366270.0000020BB2675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2092959899.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2061114344.0000020BB26A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://identity.mozilla.com/cmd/H
Source: firefox.exe, 00000004.00000003.2081084461.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2105366270.0000020BB2675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2092959899.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2061114344.0000020BB26A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://identity.mozilla.com/cmd/HCX
Source: firefox.exe, 00000004.00000003.2081084461.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2105366270.0000020BB2675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2092959899.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2061114344.0000020BB26A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryU
Source: firefox.exe, 00000004.00000003.2081084461.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2105366270.0000020BB2675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2092959899.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2061114344.0000020BB26A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryUFj
Source: prefs-1.js.4.dr String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000004.00000003.2095098975.0000020BAB095000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2102603698.0000020BAB096000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000004.00000003.2063546660.0000020BAB3B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1930829914.0000020BAB3BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2101912110.0000020BAB3B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000009.00000002.4155925343.0000012C8E6CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4155065106.000001692ADF6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000004.00000003.2096433936.0000020BAA0EC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2103460993.0000020BAA0EC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2061114344.0000020BB2622000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/events/1/c85f2a42-5cf5-4b5a-bdeb-5f922
Source: firefox.exe, 00000004.00000003.2063546660.0000020BAB3B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2101912110.0000020BAB3B6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submitX
Source: firefox.exe, 00000004.00000003.1930829914.0000020BAB3BB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submitp
Source: firefox.exe, 00000004.00000003.2101912110.0000020BAB373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2063546660.0000020BAB373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000004.00000003.1958372160.0000020BA2667000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://json-schema.org/draft/2019-09/schemahttps://json-schema.org/draft/2020-12/schemaresource://g
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA2689000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://json-schema.org/draft/2020-12/schema
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000004.00000003.2069708035.0000020BA4A7F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000004.00000003.2069708035.0000020BA4A7F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000004.00000003.1900654977.0000020B9ED33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2029892686.0000020B9ED32000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000004.00000003.1900654977.0000020B9ED33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2029892686.0000020B9ED32000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000004.00000003.1900654977.0000020B9ED33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2029892686.0000020B9ED32000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000000A.00000002.4155065106.000001692AD8F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000004.00000003.2039493724.0000020BAAF21000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000004.00000003.2091753320.0000020BA1300000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://mozilla.org0/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000004.00000003.1900654977.0000020B9ED33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2029892686.0000020B9ED32000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000004.00000003.1900654977.0000020B9ED33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2029892686.0000020B9ED32000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000004.00000003.2063546660.0000020BAB373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000004.00000003.1898489911.0000020BA1457000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000004.00000003.2033107433.0000020BA9663000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2015771215.0000020BA9662000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2031031640.0000020BA9662000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000004.00000003.2067305300.0000020BA949F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000004.00000003.2103699447.0000020BAA0CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2042541026.0000020BAA0CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2065952803.0000020BAA0CA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000004.00000003.2046482379.0000020BA3D6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2102374771.0000020BAB0FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2105827069.0000020BAB0FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2095098975.0000020BAB0FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 0000000A.00000002.4155065106.000001692AD13000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000004.00000003.2038191292.0000020BB10A5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000004.00000003.2101912110.0000020BAB373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2063546660.0000020BAB373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2063546660.0000020BAB3B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1930829914.0000020BAB3BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2101912110.0000020BAB3B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000009.00000002.4155925343.0000012C8E6CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4155065106.000001692ADF6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000004.00000003.2103699447.0000020BAA098000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2042940902.0000020BAA091000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2065952803.0000020BAA098000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000004.00000003.2103699447.0000020BAA098000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2042940902.0000020BAA091000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2065952803.0000020BAA098000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000004.00000003.2098941063.0000020BB109D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2038244106.0000020BB109D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2061743331.0000020BB109D000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.4.dr String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000004.00000003.2039493724.0000020BAAF21000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000004.00000003.2062075598.0000020BAE48D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2099408334.0000020BAE48A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2072057027.0000020BA3E48000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2082411555.0000020BAE48D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000004.00000003.2044409145.0000020BA9452000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2063546660.0000020BAB3B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2069090105.0000020BA9459000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2104888762.0000020BA9459000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2101912110.0000020BAB3B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 00000004.00000003.2094238979.0000020BAE46C000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.4.dr String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000004.00000003.2018791084.0000020BA3FB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1947915852.0000020BA3FB2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 00000004.00000003.2071287474.0000020BA3E9E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: places.sqlite-wal.4.dr String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.
Source: firefox.exe, 00000004.00000003.2094238979.0000020BAE46C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000004.00000003.2039493724.0000020BAAF21000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://truecolors.firefox.com/
Source: firefox.exe, 00000004.00000003.2038191292.0000020BB10A5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 00000004.00000003.2101912110.0000020BAB373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2063546660.0000020BAB373000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 00000004.00000003.1958372160.0000020BA2667000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000004.00000003.1958372160.0000020BA2667000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.aliexpress.com/https://www.leboncoin.fr/nimbus-desktop-experimentshttps://www.wikipedia.
Source: firefox.exe, 00000004.00000003.1958372160.0000020BA2667000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 00000004.00000003.2073594698.0000020BA3D6F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/
Source: firefox.exe, 00000006.00000002.4155867378.0000028F878C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000009.00000002.4155925343.0000012C8E6E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4158602626.000001692AF03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.dr String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 00000004.00000003.1898086067.0000020BA142C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1899135786.0000020BA1481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1898276197.0000020BA1441000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1898838101.0000020BA146C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2020309372.0000020BAB8A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1897906074.0000020BA1417000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1958372160.0000020BA2667000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1897759443.0000020BA0F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1898489911.0000020BA1457000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000004.00000003.2046482379.0000020BA3D4B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 00000004.00000003.2091753320.0000020BA1300000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: firefox.exe, 00000006.00000002.4155867378.0000028F878C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000009.00000002.4155925343.0000012C8E6E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4158602626.000001692AF03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.dr String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 00000004.00000003.2072399347.0000020BA3D7F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: firefox.exe, 00000004.00000003.1944204385.0000020BAB870000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1947141147.0000020BA32EA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 00000004.00000003.1898086067.0000020BA142C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1899135786.0000020BA1481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1898276197.0000020BA1441000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1898838101.0000020BA146C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1897906074.0000020BA1417000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1897759443.0000020BA0F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1898489911.0000020BA1457000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: firefox.exe, 00000004.00000003.1958372160.0000020BA2667000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1897759443.0000020BA0F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1898489911.0000020BA1457000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000004.00000003.2038046959.0000020BB10AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1958324936.0000020BA2671000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000004.00000003.1958372160.0000020BA2667000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 00000004.00000003.2045160907.0000020BA3DA0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2038473193.0000020BAB482000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2062792736.0000020BAB482000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2098941063.0000020BB109D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2038244106.0000020BB109D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2061743331.0000020BB109D000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.4.dr String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000004.00000003.2039493724.0000020BAAF21000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: places.sqlite-wal.4.dr String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.
Source: firefox.exe, 00000004.00000003.2094238979.0000020BAE46C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: firefox.exe, 00000004.00000003.1958244288.0000020BA267B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1970864817.0000020BA957B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 00000004.00000003.2082638399.0000020BAAF73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2039493724.0000020BAAF73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2063916413.0000020BAAF73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/anything/?
Source: places.sqlite-wal.4.dr String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.
Source: firefox.exe, 00000004.00000003.2094238979.0000020BAE46C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: targeting.snapshot.json.tmp.4.dr String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: firefox.exe, 00000004.00000003.2100029510.0000020BAE46C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2094238979.0000020BAE46C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2072399347.0000020BA3DD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045160907.0000020BA3DD0000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.4.dr String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: firefox.exe, 00000004.00000003.2094238979.0000020BAE46C000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.4.dr String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000004.00000003.2063916413.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2082638399.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2039493724.0000020BAAF9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2106285255.0000020BAAFA6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-mod
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 00000006.00000002.4155867378.0000028F878C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000009.00000002.4155925343.0000012C8E6CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4155065106.000001692ADF6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000006.00000002.4155561425.0000028F876C0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.4155101745.0000012C8E570000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154865297.000001692AC70000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000000A.00000002.4155065106.000001692ADF6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/g
Source: firefox.exe, 00000004.00000003.2100029510.0000020BAE46C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2094238979.0000020BAE46C000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.4.dr String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000004.00000003.2069708035.0000020BA4A7F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000004.00000003.2038191292.0000020BB10A5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000004.00000003.2075197556.0000020BA3A12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2100794324.0000020BAE3BB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com
Source: firefox.exe, 0000000A.00000002.4155065106.000001692AD0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000000A.00000002.4154017883.000001692A9EA000.00000004.00000020.00020000.00000000.sdmp, recovery.jsonlz4.tmp.4.dr String found in binary or memory: https://www.youtube.com/account
Source: file.exe, 00000000.00000002.4164878709.0000000006A4D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/account#
Source: firefox.exe, 00000003.00000002.1894536119.0000027CDC470000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/account--attempting-deelevation
Source: file.exe, 00000000.00000002.4164485337.00000000054D1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000002.00000002.1883864318.0000025C5AE10000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountC:
Source: file.exe, 00000000.00000002.4164878709.0000000006A4D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountL
Source: firefox.exe, 0000000A.00000002.4154017883.000001692A9EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountMOZ
Source: firefox.exe, 00000006.00000002.4155296365.0000028F876B0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.4155296365.0000028F876B4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.4154688751.0000028F875E0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000009.00000002.4154893087.0000012C8E564000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000009.00000002.4154893087.0000012C8E560000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000009.00000002.4153856392.0000012C8E2C0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154659738.000001692AC64000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154017883.000001692A9E0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154659738.000001692AC60000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:
Source: firefox.exe, 00000009.00000002.4153856392.0000012C8E2CA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountX
Source: firefox.exe, 0000000A.00000002.4154017883.000001692A9E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountbl
Source: firefox.exe, 00000002.00000002.1883864318.0000025C5AE10000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountj
Source: firefox.exe, 00000004.00000003.2075197556.0000020BA3A0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown HTTPS traffic detected: 143.204.215.115:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49788 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49793 version: TLS 1.2
Installs a raw input device (often for capturing keystrokes)
Source: file.exe, 00000000.00000002.4162315605.000000000258D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _WINAPI_GETRAWINPUTDATA memstr_13583f49-8
Yara detected Keylogger Generic
Source: Yara match File source: Process Memory Space: file.exe PID: 7392, type: MEMORYSTR

System Summary
barindex
Binary is likely a compiled AutoIt script file
Source: file.exe, 00000000.00000002.4150606469.00000000006E2000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_3585a449-4
Source: file.exe, 00000000.00000002.4150606469.00000000006E2000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_89e01ee5-3
PE file has nameless sections
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name:
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\file.exe Process Stats: CPU usage > 49%
Contains functionality to call native functions
Source: C:\Program Files\Mozilla Firefox\firefox.exe Code function: 9_2_0000012C8E5D2377 NtQuerySystemInformation, 9_2_0000012C8E5D2377
Source: C:\Program Files\Mozilla Firefox\firefox.exe Code function: 9_2_0000012C8E5F63B2 NtQuerySystemInformation, 9_2_0000012C8E5F63B2
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF8907B8 0_2_FF8907B8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF890000 0_2_FF890000
Source: C:\Program Files\Mozilla Firefox\firefox.exe Code function: 9_2_0000012C8E5D2377 9_2_0000012C8E5D2377
Source: C:\Program Files\Mozilla Firefox\firefox.exe Code function: 9_2_0000012C8E5F63B2 9_2_0000012C8E5F63B2
Source: C:\Program Files\Mozilla Firefox\firefox.exe Code function: 9_2_0000012C8E5F6ADC 9_2_0000012C8E5F6ADC
Source: C:\Program Files\Mozilla Firefox\firefox.exe Code function: 9_2_0000012C8E5F63F2 9_2_0000012C8E5F63F2
Sample file is different than original file name gathered from version info
Source: file.exe, 00000000.00000002.4162069374.00000000024B9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Comments|CompanyName|FileDescription|FileVersion|InternalName|LegalCopyright|LegalTrademarks|OriginalFilename|ProductName|ProductVersion|PrivateBuild|SpecialBuildrrorHp) vs file.exe
Source: file.exe, 00000000.00000002.4162069374.00000000024B9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Comments|CompanyName|FileDescription|FileVersion|InternalName|LegalCopyright|LegalTrademarks|OriginalFilename|ProductName|ProductVersion|PrivateBuild|SpecialBuildhs;ptf) vs file.exe
Source: file.exe, 00000000.00000002.4156644230.0000000001E3C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs file.exe
Source: file.exe, 00000000.00000002.4157110061.0000000001E92000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000002.4157110061.0000000001E92000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs file.exe
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: file.exe Static PE information: Section: ZLIB complexity 1.0002166748046875
Source: file.exe Static PE information: Section: ZLIB complexity 0.9943181818181818
Source: file.exe Static PE information: Section: ZLIB complexity 0.9993479330708661
Source: firefox.exe, 00000004.00000003.2025639777.0000020BA32D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2021484313.0000020BA32D1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: 2.SLn
Source: classification engine Classification label: mal84.evad.winEXE@19/40@64/11
Source: C:\Program Files\Mozilla Firefox\firefox.exe File created: C:\Users\user\AppData\Local\Mozilla\Firefox\SkeletonUILock-c388d246 Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe File created: C:\Users\user\AppData\Local\Temp\firefox Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Program Files\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: firefox.exe, 00000004.00000003.2081084461.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2105366270.0000020BB2675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2092959899.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2061114344.0000020BB26A8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SELECT * FROM events WHERE timestamp BETWEEN date(:dateFrom) AND date(:dateTo);
Source: firefox.exe, 00000004.00000003.2081084461.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2105366270.0000020BB2675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2092959899.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2061114344.0000020BB26A8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE events (id INTEGER PRIMARY KEY, type INTEGER NOT NULL, count INTEGER NOT NULL, timestamp DATE );
Source: firefox.exe, 00000004.00000003.2081084461.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2105366270.0000020BB2675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2092959899.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2061114344.0000020BB26A8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: INSERT INTO events (type, count, timestamp) VALUES (:type, 1, date(:date));
Source: firefox.exe, 00000004.00000003.2081084461.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2105366270.0000020BB2675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2092959899.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2061114344.0000020BB26A8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;
Source: firefox.exe, 00000004.00000003.2081084461.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2105366270.0000020BB2675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2092959899.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2061114344.0000020BB26A8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;Fy6
Source: firefox.exe, 00000004.00000003.2081084461.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2105366270.0000020BB2675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2092959899.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2061114344.0000020BB26A8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: UPDATE events SET count = count + 1 WHERE id = :id;-
Source: firefox.exe, 00000004.00000003.2081084461.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2105366270.0000020BB2675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2092959899.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2061114344.0000020BB26A8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SELECT sum(count) FROM events;9'
Source: firefox.exe, 00000004.00000003.2081084461.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2105366270.0000020BB2675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2092959899.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2061114344.0000020BB26A8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SELECT sum(count) FROM events;9
Source: firefox.exe, 00000004.00000003.2081084461.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2105366270.0000020BB2675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2092959899.0000020BB2625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2061114344.0000020BB26A8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SELECT * FROM events WHERE type = :type AND timestamp = date(:date);
Source: file.exe Virustotal: Detection: 33%
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: unknown Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aab533d8-a973-49df-af8e-2a2d2e8eca71} 7644 "\\.\pipe\gecko-crash-server-pipe.7644" 20b9176d110 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1552 -parentBuildID 20230927232528 -prefsHandle 1568 -prefMapHandle 3876 -prefsLen 26208 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0c04207-d988-4604-93b1-3fc9de6d621b} 7644 "\\.\pipe\gecko-crash-server-pipe.7644" 20b91742910 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5444 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5456 -prefMapHandle 5408 -prefsLen 33185 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e09085be-52c2-4e9a-a064-f9a8b5c45ee7} 7644 "\\.\pipe\gecko-crash-server-pipe.7644" 20baab68510 utility
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aab533d8-a973-49df-af8e-2a2d2e8eca71} 7644 "\\.\pipe\gecko-crash-server-pipe.7644" 20b9176d110 socket Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1552 -parentBuildID 20230927232528 -prefsHandle 1568 -prefMapHandle 3876 -prefsLen 26208 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0c04207-d988-4604-93b1-3fc9de6d621b} 7644 "\\.\pipe\gecko-crash-server-pipe.7644" 20b91742910 rdd Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5444 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5456 -prefMapHandle 5408 -prefsLen 33185 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e09085be-52c2-4e9a-a064-f9a8b5c45ee7} 7644 "\\.\pipe\gecko-crash-server-pipe.7644" 20baab68510 utility Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sfc_os.dll Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: file.exe Static file information: File size 3206656 > 1048576
Source: file.exe Static PE information: Raw size of .data is bigger than: 0x100000 < 0x21e600
Source: Binary string: rsaenh.pdb source: firefox.exe, 00000004.00000003.2096956640.0000020BA94FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2104230942.0000020BA94FE000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: UMPDC.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wininet.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: winsta.pdb source: firefox.exe, 00000004.00000003.2104854909.0000020BA9468000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: ktmw32.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: pnrpnsp.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wshbth.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: WscApi.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: winhttp.pdbP4O source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: NapiNSP.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: xul.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: nssckbi.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: winnsi.pdb source: firefox.exe, 00000004.00000003.2104854909.0000020BA9468000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2104987514.0000020BA9456000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dcomp.pdb source: firefox.exe, 00000004.00000003.2104854909.0000020BA9468000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: cryptsp.pdb source: firefox.exe, 00000004.00000003.2096956640.0000020BA94FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2104230942.0000020BA94FE000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: sspicli.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: CLBCatQ.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: urlmon.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnsapi.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA9456000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: userenv.pdb source: firefox.exe, 00000004.00000003.2104854909.0000020BA9468000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: nlaapi.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: winhttp.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: msimg32.pdb source: firefox.exe, 00000004.00000003.2096956640.0000020BA94FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2104230942.0000020BA94FE000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: ntasn1.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: devobj.pdb source: firefox.exe, 00000004.00000003.2104854909.0000020BA9468000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: d3d11.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dwmapi.pdb source: firefox.exe, 00000004.00000003.2104854909.0000020BA9468000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dbghelp.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: srvcli.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: freebl3.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: profapi.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: avrt.pdb source: firefox.exe, 00000004.00000003.2096956640.0000020BA94FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2104230942.0000020BA94FE000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: mswsock.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: nsi.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA9456000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: propsys.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.4.dr
Source: Binary string: winmm.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: winrnr.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA9456000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: msctf.pdb source: firefox.exe, 00000004.00000003.2104854909.0000020BA9468000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: version.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dbgcore.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: mscms.pdb source: firefox.exe, 00000004.00000003.2104854909.0000020BA9468000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: twinapi.pdb source: firefox.exe, 00000004.00000003.2104854909.0000020BA9468000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: msasn1.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.4.dr
Source: Binary string: psapi.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: DWrite.pdb source: firefox.exe, 00000004.00000003.2104987514.0000020BA944A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dxgi.pdb source: firefox.exe, 00000004.00000003.2104854909.0000020BA9468000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: ncrypt.pdb source: firefox.exe, 00000004.00000003.2104312265.0000020BA94E8000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\file.exe Unpacked PE file: 0.2.file.exe.620000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .data
PE file contains an invalid checksum
Source: file.exe Static PE information: real checksum: 0x129231 should be: 0x311189
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name:
Source: gmpopenh264.dll.tmp.4.dr Static PE information: section name: .rodata
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF892780 push FF890002h; ret 0_2_FF89278F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF891880 push FF890002h; ret 0_2_FF89188F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF890C80 push FF890002h; ret 0_2_FF890C8F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF890F80 push FF890002h; ret 0_2_FF890F8F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF891280 push FF890002h; ret 0_2_FF89128F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF891580 push FF890002h; ret 0_2_FF89158F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF891B80 push FF890002h; ret 0_2_FF891B8F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF891E80 push FF890002h; ret 0_2_FF891E8F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF892180 push FF890002h; ret 0_2_FF89218F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF892480 push FF890002h; ret 0_2_FF89248F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF892990 push FF890002h; ret 0_2_FF89299F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF892690 push FF890002h; ret 0_2_FF89269F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF891A90 push FF890002h; ret 0_2_FF891A9F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF891790 push FF890002h; ret 0_2_FF89179F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF890B90 push FF890002h; ret 0_2_FF890B9F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF890E90 push FF890002h; ret 0_2_FF890E9F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF891190 push FF890002h; ret 0_2_FF89119F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF891490 push FF890002h; ret 0_2_FF89149F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF891D90 push FF890002h; ret 0_2_FF891D9F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF892090 push FF890002h; ret 0_2_FF89209F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF892390 push FF890002h; ret 0_2_FF89239F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF8928A0 push FF890002h; ret 0_2_FF8928AF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF8925A0 push FF890002h; ret 0_2_FF8925AF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF8919A0 push FF890002h; ret 0_2_FF8919AF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF890AA0 push FF890002h; ret 0_2_FF890AAF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF890DA0 push FF890002h; ret 0_2_FF890DAF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF8910A0 push FF890002h; ret 0_2_FF8910AF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF8913A0 push FF890002h; ret 0_2_FF8913AF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF8916A0 push FF890002h; ret 0_2_FF8916AF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF891CA0 push FF890002h; ret 0_2_FF891CAF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF891FA0 push FF890002h; ret 0_2_FF891FAF
Source: file.exe Static PE information: section name: entropy: 7.999455501205013
Source: file.exe Static PE information: section name: entropy: 7.9916241651821105
Source: file.exe Static PE information: section name: entropy: 7.999159860330949
Source: file.exe Static PE information: section name: entropy: 7.965597778388454
Drops PE files
Source: C:\Program Files\Mozilla Firefox\firefox.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy) Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Program Files\Mozilla Firefox\firefox.exe Code function: 9_2_0000012C8E5D2377 rdtsc 9_2_0000012C8E5D2377
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 513 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 2404 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1936 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1380 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1500 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 511 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 414 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 7408 Thread sleep time: -2404000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7412 Thread sleep time: -1500000s >= -30000s Jump to behavior
Sleep loop found (likely to delay execution)
Source: C:\Users\user\Desktop\file.exe Thread sleep count: Count: 1936 delay: -10 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread sleep count: Count: 1380 delay: -10 Jump to behavior
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 3Windows 2012 Server Standard without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 11 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: #Windows 10 Microsoft Hyper-V Server
Source: firefox.exe, 00000009.00000002.4158913142.0000012C8EB60000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW|
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 8.1 Microsoft Hyper-V Server
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2012 Server Standard without Hyper-V
Source: firefox.exe, 00000006.00000002.4154688751.0000028F875EA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWn
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 8 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 3Windows 2016 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000002.4161530171.0000000002351000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 8.1 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: (Windows 2012 R2 Microsoft Hyper-V Server
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 11 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 6Windows 2012 R2 Server Standard without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 8 Server Datacenter without Hyper-V (core)
Source: firefox.exe, 00000009.00000002.4153856392.0000012C8E2CA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWb
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 10 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 0Windows 8 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 6Windows 8.1 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: vmware
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 8 Server Standard without Hyper-V
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 4Windows 8 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2016 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: "Windows 8 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 10 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2012 R2 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 11 Server Standard without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 8.1 Essential Server Solutions without Hyper-V
Source: firefox.exe, 00000006.00000002.4159732457.0000028F87A18000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll_
Source: firefox.exe, 00000006.00000002.4159732457.0000028F87A18000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlla
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Hyper-V (guest)
Source: firefox.exe, 00000006.00000002.4154688751.0000028F875EA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllu
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 10 Microsoft Hyper-V Server
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2012 Essential Server Solutions without Hyper-V
Source: firefox.exe, 00000009.00000002.4158913142.0000012C8EB60000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll|
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000886000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: ~VirtualMachineTypes
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000886000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: ]DLL_Loader_VirtualMachine
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2016 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.4151938239.0000000000886000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: /Windows 2012 R2 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 11 Server Standard without Hyper-V
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: )Windows 8 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 11 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 11 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: %Windows 2012 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Hyper-V
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: $Windows 8.1 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: ,Windows 2012 Server Standard without Hyper-V
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2012 Microsoft Hyper-V Server
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 10 Essential Server Solutions without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 8 Essential Server Solutions without Hyper-V
Source: firefox.exe, 00000006.00000002.4159732457.0000028F87A18000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.4154688751.0000028F875EA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4154017883.000001692A9EA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.4158334696.000001692AE00000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: firefox.exe, 00000006.00000002.4158856734.0000028F8791A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: firefox.exe, 00000009.00000002.4158913142.0000012C8EB60000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll(
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 10 Server Standard without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 7Windows 2012 Essential Server Solutions without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 8 Server Enterprise without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: %Windows 2016 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 7Windows 2016 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: +Windows 8.1 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2016 Server Standard without Hyper-V
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 11 Server Enterprise without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 11 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 10 Server Enterprise without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 10 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: :Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 5Windows 11 Essential Server Solutions without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2016 Server Standard without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 8 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 5Windows 10 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: xVBoxService.exe
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 8 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: *Windows 11 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: ,Windows 2016 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2012 Server Standard without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 8 Server Datacenter without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (full)
Source: firefox.exe, 00000009.00000002.4158913142.0000012C8EB60000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: VBoxService.exe
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 8.1 Server Standard without Hyper-V
Source: file.exe, 00000000.00000002.4161530171.0000000002351000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: *Windows 10 Server Standard without Hyper-V
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 1Windows 11 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 1Windows 10 Server Standard without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: VMWare
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Windows 10 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 2Windows 8.1 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.4151938239.0000000000756000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: #Windows 11 Microsoft Hyper-V Server
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Program Files\Mozilla Firefox\firefox.exe Code function: 9_2_0000012C8E5D2377 rdtsc 9_2_0000012C8E5D2377
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\file.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account Jump to behavior
Source: file.exe, 00000000.00000002.4150606469.00000000006E2000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_FF891BE0 GetUserNameA, 0_2_FF891BE0
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1483423 Sample: file.exe Startdate: 27/07/2024 Architecture: WINDOWS Score: 84 29 youtube-ui.l.google.com 2->29 31 www.youtube.com 2->31 33 33 other IPs or domains 2->33 41 Antivirus / Scanner detection for submitted sample 2->41 43 Multi AV Scanner detection for submitted file 2->43 45 Machine Learning detection for sample 2->45 47 2 other signatures 2->47 8 file.exe 1 2->8         started        11 firefox.exe 1 2->11         started        signatures3 process4 signatures5 49 Detected unpacking (changes PE section rights) 8->49 51 Binary is likely a compiled AutoIt script file 8->51 53 Hides threads from debuggers 8->53 13 firefox.exe 1 8->13         started        15 firefox.exe 13 221 11->15         started        process6 dnsIp7 35 youtube-ui.l.google.com 142.250.186.110, 443, 49745, 49747 GOOGLEUS United States 15->35 37 prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82, 49746, 49751, 49759 GOOGLEUS United States 15->37 39 9 other IPs or domains 15->39 25 C:\Users\user\AppData\...\gmpopenh264.dll.tmp, PE32+ 15->25 dropped 27 C:\Users\user\...\gmpopenh264.dll (copy), PE32+ 15->27 dropped 19 firefox.exe 1 15->19         started        21 firefox.exe 1 15->21         started        23 firefox.exe 1 15->23         started        file8 process9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
34.149.100.209
 prod.remote-settings.prod.webservices.mozgcp.net United States
2686 ATGS-MMD-ASUS false
34.107.221.82
 prod.detectportal.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
35.244.181.201
 prod.balrog.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
34.117.188.166
 contile.services.mozilla.com United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
143.204.215.115
 services.addons.mozilla.org United States
16509 AMAZON-02US false
35.201.103.21
 normandy-cdn.services.mozilla.com United States
15169 GOOGLEUS false
142.250.186.110
 youtube-ui.l.google.com United States
15169 GOOGLEUS false
35.190.72.216
 prod.classify-client.prod.webservices.mozgcp.net United States
15169 GOOGLEUS false
34.160.144.191
 prod.content-signature-chains.prod.webservices.mozgcp.net United States
2686 ATGS-MMD-ASUS false
34.120.208.123
 telemetry-incoming.r53-2.services.mozilla.com United States
15169 GOOGLEUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
example.org 93.184.215.14 true
star-mini.c10r.facebook.com 157.240.252.35 true
prod.classify-client.prod.webservices.mozgcp.net 35.190.72.216 true
prod.balrog.prod.cloudops.mozgcp.net 35.244.181.201 true
twitter.com 104.244.42.1 true
prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 true
services.addons.mozilla.org 143.204.215.115 true
dyna.wikimedia.org 185.15.59.224 true
prod.remote-settings.prod.webservices.mozgcp.net 34.149.100.209 true
contile.services.mozilla.com 34.117.188.166 true
prod.content-signature-chains.prod.webservices.mozgcp.net 34.160.144.191 true
youtube-ui.l.google.com 142.250.186.110 true
us-west1.prod.sumo.prod.webservices.mozgcp.net 34.149.128.2 true
reddit.map.fastly.net 151.101.129.140 true
ipv4only.arpa 192.0.0.171 true
prod.ads.prod.webservices.mozgcp.net 34.117.188.166 true
normandy-cdn.services.mozilla.com 35.201.103.21 true
telemetry-incoming.r53-2.services.mozilla.com 34.120.208.123 true
www.reddit.com unknown unknown
spocs.getpocket.com unknown unknown
content-signature-2.cdn.mozilla.net unknown unknown
support.mozilla.org unknown unknown
firefox.settings.services.mozilla.com unknown unknown
push.services.mozilla.com unknown unknown
www.youtube.com unknown unknown
www.facebook.com unknown unknown
detectportal.firefox.com unknown unknown
normandy.cdn.mozilla.net unknown unknown
shavar.services.mozilla.com unknown unknown
www.wikipedia.org unknown unknown