Edit tour

Windows Analysis Report
Refund Details.com

Overview

General Information

Sample Name:	Refund Details.com (renamed file extension from com to exe)
Analysis ID:	602124
MD5:	4f3781678b0516506da4919ae93a7968
SHA1:	cbf03b1da6c2caf820855ae3d9b1b0e89a0c2eb6
SHA256:	686481e1331a265e5c5630b85ae9d69c18c975fa1d63995c103cd91470d135ca
Infos:

Detection

AveMaria UACMe

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Yara detected UACMe UAC Bypass tool

Yara detected AveMaria stealer

Initial sample is a PE file and has a suspicious name

Contains functionality to hide user accounts

Machine Learning detection for sample

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Tries to harvest and steal browser information (history, passwords, etc)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

Connects to many different domains

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

PE file does not import any functions

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Classification

Process Tree

System is start

Refund Details.exe (PID: 2024 cmdline: "C:\Users\user\Desktop\Refund Details.exe" MD5: 4F3781678B0516506DA4919AE93A7968)

firefox.exe (PID: 6308 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" MD5: F7A3347AC587E97C57CFAC49A17BD309)

firefox.exe (PID: 2492 cmdline: C:\Program Files\Mozilla Firefox\firefox.exe MD5: F7A3347AC587E97C57CFAC49A17BD309)

firefox.exe (PID: 5536 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.0.488927132\823982072" -childID 1 -isForBrowser -prefsHandle 2672 -prefMapHandle 2680 -prefsLen 1 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 2560 tab MD5: F7A3347AC587E97C57CFAC49A17BD309)

firefox.exe (PID: 1396 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.6.1666811742\456711594" -childID 2 -isForBrowser -prefsHandle 3076 -prefMapHandle 3068 -prefsLen 1 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 3088 tab MD5: F7A3347AC587E97C57CFAC49A17BD309)

firefox.exe (PID: 3596 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.12.1229122738\1823760468" -parentBuildID 20210504152106 -prefsHandle 3792 -prefMapHandle 3788 -prefsLen 160 -prefMapSize 235609 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 1032 rdd MD5: F7A3347AC587E97C57CFAC49A17BD309)

firefox.exe (PID: 4244 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.13.2039529717\595573382" -childID 3 -isForBrowser -prefsHandle 4132 -prefMapHandle 4128 -prefsLen 160 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 4368 tab MD5: F7A3347AC587E97C57CFAC49A17BD309)

firefox.exe (PID: 4816 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.17.2031288100\1490268157" -childID 4 -isForBrowser -prefsHandle 4504 -prefMapHandle 4500 -prefsLen 5258 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 4420 tab MD5: F7A3347AC587E97C57CFAC49A17BD309)

firefox.exe (PID: 6688 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.28.1606140724\1125369852" -childID 5 -isForBrowser -prefsHandle 4960 -prefMapHandle 5176 -prefsLen 5436 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 4664 tab MD5: F7A3347AC587E97C57CFAC49A17BD309)

firefox.exe (PID: 5908 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.34.1568289426\1261120468" -childID 6 -isForBrowser -prefsHandle 5712 -prefMapHandle 4972 -prefsLen 6561 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 5780 tab MD5: F7A3347AC587E97C57CFAC49A17BD309)

firefox.exe (PID: 4016 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.40.1897084510\906370204" -childID 7 -isForBrowser -prefsHandle 7248 -prefMapHandle 7244 -prefsLen 6742 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 7252 tab MD5: F7A3347AC587E97C57CFAC49A17BD309)

pingsender.exe (PID: 6308 cmdline: "C:\Program Files\Mozilla Firefox\pingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/4d4e9ed8-d41e-47c2-af5c-0d0eb3230cdd/event/Firefox/88.0.1/release/20210504152106?v=4 C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\4d4e9ed8-d41e-47c2-af5c-0d0eb3230cdd https://incoming.telemetry.mozilla.org/submit/telemetry/c07646ef-d9d3-4d8c-811b-81063ab65053/health/Firefox/88.0.1/release/20210504152106?v=4 C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\c07646ef-d9d3-4d8c-811b-81063ab65053 https://incoming.telemetry.mozilla.org/submit/telemetry/02261d48-0564-4e3d-9859-ba76e838e396/main/Firefox/88.0.1/release/20210504152106?v=4 C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\02261d48-0564-4e3d-9859-ba76e838e396 MD5: 07CDCC91CA168BB8992BB86A8BC69FFB)

conhost.exe (PID: 5348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: C5E9B1D1103EDCEA2E408E9497A5A88F)

cleanup

Malware Configuration

Threatname: AveMaria

{"C2 url": "iphanyi.chickenkiller.com", "port": 5552}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Refund Details.exe	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0x1a85b:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
Refund Details.exe	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x1a85b:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x1a85b:$c1: Elevation:Administrator!new:
Refund Details.exe	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x15b53:$a1: \Opera Software\Opera Stable\Login Data 0x15e7b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x157c3:$a3: \Google\Chrome\User Data\Default\Login Data
Refund Details.exe	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
Refund Details.exe	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
Refund Details.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Refund Details.exe	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x17d48:$r1: Classes\Folder\shell\open\command 0x17d6b:$k1: DelegateExecute
Refund Details.exe	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x1774f:$s1: RDPClip 0x17e37:$s2: Grabber 0x1794b:$s3: Ave_Maria Stealer OpenSource 0x17a4b:$s4: \MidgetPorn\workspace\MsgBox.exe 0x17781:$s5: @\cmd.exe 0x1a97b:$s6: /n:%temp%\ellocnak.xml 0x1a9ab:$s7: Hey I'm Admin 0x152bb:$s8: warzone160
Refund Details.exe	AveMaria_WarZone	unknown	unknown	0x17c9b:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x17a77:$str2: MsgBox.exe 0x17d07:$str4: \System32\cmd.exe 0x1794b:$str6: Ave_Maria 0x171e3:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x164e3:$str8: SMTP Password 0x157c3:$str11: \Google\Chrome\User Data\Default\Login Data 0x171af:$str12: \sqlmap.dll 0x1a85b:$str16: Elevation:Administrator!new 0x1a97b:$str17: /n:%temp%
Click to see the 4 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x1a65b:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x1a65b:$c1: Elevation:Administrator!new:
00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1533482048.0000000000A52000.00000002.00000001.01000000.00000003.sdmp	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x1a65b:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x1a65b:$c1: Elevation:Administrator!new:
00000000.00000000.1533482048.0000000000A52000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
00000000.00000000.1533482048.0000000000A52000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000000.00000000.1533482048.0000000000A52000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Refund Details.exe PID: 2024	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
Process Memory Space: Refund Details.exe PID: 2024	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Refund Details.exe.a6b8db.1.raw.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0xd80:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
0.0.Refund Details.exe.a6b8db.1.raw.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0xd80:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0xd80:$c1: Elevation:Administrator!new:
0.0.Refund Details.exe.a6b8db.1.raw.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
0.2.Refund Details.exe.a6b8db.2.raw.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0xd80:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
0.2.Refund Details.exe.a6b8db.2.raw.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0xd80:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0xd80:$c1: Elevation:Administrator!new:
0.2.Refund Details.exe.a6b8db.2.raw.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
0.2.Refund Details.exe.a5346b.1.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0x17ff0:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
0.2.Refund Details.exe.a5346b.1.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x17ff0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x17ff0:$c1: Elevation:Administrator!new:
0.2.Refund Details.exe.a5346b.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x138e8:$a1: \Opera Software\Opera Stable\Login Data 0x13c10:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13558:$a3: \Google\Chrome\User Data\Default\Login Data
0.0.Refund Details.exe.a5346b.2.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0x17ff0:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
0.0.Refund Details.exe.a5346b.2.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x17ff0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x17ff0:$c1: Elevation:Administrator!new:
0.2.Refund Details.exe.a5346b.1.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
0.2.Refund Details.exe.a5346b.1.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
0.2.Refund Details.exe.a5346b.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Refund Details.exe.a5346b.1.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x15add:$r1: Classes\Folder\shell\open\command 0x15b00:$k1: DelegateExecute
0.2.Refund Details.exe.a5346b.1.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x154e4:$s1: RDPClip 0x15bcc:$s2: Grabber 0x156e0:$s3: Ave_Maria Stealer OpenSource 0x157e0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x15516:$s5: @\cmd.exe 0x18110:$s6: /n:%temp%\ellocnak.xml 0x18140:$s7: Hey I'm Admin 0x13050:$s8: warzone160
0.2.Refund Details.exe.a5346b.1.unpack	AveMaria_WarZone	unknown	unknown	0x15a30:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1580c:$str2: MsgBox.exe 0x15a9c:$str4: \System32\cmd.exe 0x156e0:$str6: Ave_Maria 0x14f78:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x14278:$str8: SMTP Password 0x13558:$str11: \Google\Chrome\User Data\Default\Login Data 0x14f44:$str12: \sqlmap.dll 0x17ff0:$str16: Elevation:Administrator!new 0x18110:$str17: /n:%temp%
0.0.Refund Details.exe.a5346b.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x138e8:$a1: \Opera Software\Opera Stable\Login Data 0x13c10:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13558:$a3: \Google\Chrome\User Data\Default\Login Data
0.0.Refund Details.exe.a5346b.2.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
0.0.Refund Details.exe.a5346b.2.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
0.0.Refund Details.exe.a5346b.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.Refund Details.exe.a5346b.2.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x15add:$r1: Classes\Folder\shell\open\command 0x15b00:$k1: DelegateExecute
0.0.Refund Details.exe.a5346b.2.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x154e4:$s1: RDPClip 0x15bcc:$s2: Grabber 0x156e0:$s3: Ave_Maria Stealer OpenSource 0x157e0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x15516:$s5: @\cmd.exe 0x18110:$s6: /n:%temp%\ellocnak.xml 0x18140:$s7: Hey I'm Admin 0x13050:$s8: warzone160
0.0.Refund Details.exe.a5346b.2.unpack	AveMaria_WarZone	unknown	unknown	0x15a30:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1580c:$str2: MsgBox.exe 0x15a9c:$str4: \System32\cmd.exe 0x156e0:$str6: Ave_Maria 0x14f78:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x14278:$str8: SMTP Password 0x13558:$str11: \Google\Chrome\User Data\Default\Login Data 0x14f44:$str12: \sqlmap.dll 0x17ff0:$str16: Elevation:Administrator!new 0x18110:$str17: /n:%temp%
0.0.Refund Details.exe.a5346b.2.raw.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
0.0.Refund Details.exe.a5346b.2.raw.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x191f0:$c1: Elevation:Administrator!new:
0.0.Refund Details.exe.a5346b.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x144e8:$a1: \Opera Software\Opera Stable\Login Data 0x14810:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14158:$a3: \Google\Chrome\User Data\Default\Login Data
0.2.Refund Details.exe.a5346b.1.raw.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
0.2.Refund Details.exe.a5346b.1.raw.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x191f0:$c1: Elevation:Administrator!new:
0.2.Refund Details.exe.a5346b.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x144e8:$a1: \Opera Software\Opera Stable\Login Data 0x14810:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14158:$a3: \Google\Chrome\User Data\Default\Login Data
0.0.Refund Details.exe.a5346b.2.raw.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
0.2.Refund Details.exe.a5346b.1.raw.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
0.2.Refund Details.exe.a5346b.1.raw.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
0.2.Refund Details.exe.a5346b.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Refund Details.exe.a50000.0.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0x1a85b:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
0.2.Refund Details.exe.a50000.0.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x1a85b:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x1a85b:$c1: Elevation:Administrator!new:
0.2.Refund Details.exe.a50000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x15b53:$a1: \Opera Software\Opera Stable\Login Data 0x15e7b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x157c3:$a3: \Google\Chrome\User Data\Default\Login Data
0.0.Refund Details.exe.a5346b.2.raw.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
0.0.Refund Details.exe.a5346b.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.Refund Details.exe.a5346b.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x166dd:$r1: Classes\Folder\shell\open\command 0x16700:$k1: DelegateExecute
0.0.Refund Details.exe.a5346b.2.raw.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x160e4:$s1: RDPClip 0x167cc:$s2: Grabber 0x162e0:$s3: Ave_Maria Stealer OpenSource 0x163e0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16116:$s5: @\cmd.exe 0x19310:$s6: /n:%temp%\ellocnak.xml 0x19340:$s7: Hey I'm Admin 0x13c50:$s8: warzone160
0.0.Refund Details.exe.a5346b.2.raw.unpack	AveMaria_WarZone	unknown	unknown	0x16630:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1640c:$str2: MsgBox.exe 0x1669c:$str4: \System32\cmd.exe 0x162e0:$str6: Ave_Maria 0x15b78:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x14e78:$str8: SMTP Password 0x14158:$str11: \Google\Chrome\User Data\Default\Login Data 0x15b44:$str12: \sqlmap.dll 0x191f0:$str16: Elevation:Administrator!new 0x19310:$str17: /n:%temp%
0.2.Refund Details.exe.a5346b.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x166dd:$r1: Classes\Folder\shell\open\command 0x16700:$k1: DelegateExecute
0.2.Refund Details.exe.a5346b.1.raw.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x160e4:$s1: RDPClip 0x167cc:$s2: Grabber 0x162e0:$s3: Ave_Maria Stealer OpenSource 0x163e0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16116:$s5: @\cmd.exe 0x19310:$s6: /n:%temp%\ellocnak.xml 0x19340:$s7: Hey I'm Admin 0x13c50:$s8: warzone160
0.2.Refund Details.exe.a5346b.1.raw.unpack	AveMaria_WarZone	unknown	unknown	0x16630:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1640c:$str2: MsgBox.exe 0x1669c:$str4: \System32\cmd.exe 0x162e0:$str6: Ave_Maria 0x15b78:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x14e78:$str8: SMTP Password 0x14158:$str11: \Google\Chrome\User Data\Default\Login Data 0x15b44:$str12: \sqlmap.dll 0x191f0:$str16: Elevation:Administrator!new 0x19310:$str17: /n:%temp%
0.2.Refund Details.exe.a50000.0.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
0.0.Refund Details.exe.a50000.0.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0x1a85b:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
0.0.Refund Details.exe.a50000.0.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x1a85b:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x1a85b:$c1: Elevation:Administrator!new:
0.2.Refund Details.exe.a50000.0.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
0.2.Refund Details.exe.a50000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Refund Details.exe.a50000.0.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x17d48:$r1: Classes\Folder\shell\open\command 0x17d6b:$k1: DelegateExecute
0.2.Refund Details.exe.a50000.0.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x1774f:$s1: RDPClip 0x17e37:$s2: Grabber 0x1794b:$s3: Ave_Maria Stealer OpenSource 0x17a4b:$s4: \MidgetPorn\workspace\MsgBox.exe 0x17781:$s5: @\cmd.exe 0x1a97b:$s6: /n:%temp%\ellocnak.xml 0x1a9ab:$s7: Hey I'm Admin 0x152bb:$s8: warzone160
0.2.Refund Details.exe.a50000.0.unpack	AveMaria_WarZone	unknown	unknown	0x17c9b:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x17a77:$str2: MsgBox.exe 0x17d07:$str4: \System32\cmd.exe 0x1794b:$str6: Ave_Maria 0x171e3:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x164e3:$str8: SMTP Password 0x157c3:$str11: \Google\Chrome\User Data\Default\Login Data 0x171af:$str12: \sqlmap.dll 0x1a85b:$str16: Elevation:Administrator!new 0x1a97b:$str17: /n:%temp%
0.0.Refund Details.exe.a50000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x15b53:$a1: \Opera Software\Opera Stable\Login Data 0x15e7b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x157c3:$a3: \Google\Chrome\User Data\Default\Login Data
0.0.Refund Details.exe.a50000.0.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
0.0.Refund Details.exe.a50000.0.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
0.0.Refund Details.exe.a50000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.Refund Details.exe.a50000.0.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x17d48:$r1: Classes\Folder\shell\open\command 0x17d6b:$k1: DelegateExecute
0.0.Refund Details.exe.a50000.0.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x1774f:$s1: RDPClip 0x17e37:$s2: Grabber 0x1794b:$s3: Ave_Maria Stealer OpenSource 0x17a4b:$s4: \MidgetPorn\workspace\MsgBox.exe 0x17781:$s5: @\cmd.exe 0x1a97b:$s6: /n:%temp%\ellocnak.xml 0x1a9ab:$s7: Hey I'm Admin 0x152bb:$s8: warzone160
0.0.Refund Details.exe.a50000.0.unpack	AveMaria_WarZone	unknown	unknown	0x17c9b:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x17a77:$str2: MsgBox.exe 0x17d07:$str4: \System32\cmd.exe 0x1794b:$str6: Ave_Maria 0x171e3:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x164e3:$str8: SMTP Password 0x157c3:$str11: \Google\Chrome\User Data\Default\Login Data 0x171af:$str12: \sqlmap.dll 0x1a85b:$str16: Elevation:Administrator!new 0x1a97b:$str17: /n:%temp%
Click to see the 55 entries

HTTP traffic detected: POST /submit/telemetry/4d4e9ed8-d41e-47c2-af5c-0d0eb3230cdd/event/Firefox/88.0.1/release/20210504152106?v=4 HTTP/1.1Date: Mon, 04 Apr 2022 11:57:44 GMTX-PingSender-Version: 1.0Content-Encoding: gzipUser-Agent: pingsender/1.0Host: incoming.telemetry.mozilla.orgContent-Length: 2786Cache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: detectportal.firefox.com

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.facebook.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-aliveUpgrade-Insecure-Requests: 1
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.2:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.2:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.2:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.2:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.2:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.2:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.2:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.2:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.2:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.2:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.2:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.2:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.2:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.2:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.2:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.2:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.2:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.2:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.2:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.2:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.2:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.2:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.2:49880 version: TLS 1.2

Source: Refund Details.exe

Binary or memory string: GetRawInputData

E-Banking Fraud

Yara detected AveMaria stealer

Source: Yara match	File source: Refund Details.exe, type: SAMPLE
Source: Yara match	File source: 0.2.Refund Details.exe.a5346b.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Refund Details.exe.a5346b.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Refund Details.exe.a5346b.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Refund Details.exe.a5346b.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1533482048.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: Refund Details.exe, type: SAMPLE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: Refund Details.exe, type: SAMPLE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: Refund Details.exe, type: SAMPLE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: Refund Details.exe, type: SAMPLE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: Refund Details.exe, type: SAMPLE	Matched rule: AveMaria_WarZone Author: unknown
Source: 0.0.Refund Details.exe.a6b8db.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 0.2.Refund Details.exe.a6b8db.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 0.2.Refund Details.exe.a5346b.1.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 0.2.Refund Details.exe.a5346b.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.0.Refund Details.exe.a5346b.2.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 0.2.Refund Details.exe.a5346b.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.2.Refund Details.exe.a5346b.1.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 0.2.Refund Details.exe.a5346b.1.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 0.0.Refund Details.exe.a5346b.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.0.Refund Details.exe.a5346b.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.0.Refund Details.exe.a5346b.2.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 0.0.Refund Details.exe.a5346b.2.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 0.0.Refund Details.exe.a5346b.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 0.0.Refund Details.exe.a5346b.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Refund Details.exe.a5346b.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 0.2.Refund Details.exe.a5346b.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 0.2.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.0.Refund Details.exe.a5346b.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.0.Refund Details.exe.a5346b.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 0.0.Refund Details.exe.a5346b.2.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 0.2.Refund Details.exe.a5346b.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.2.Refund Details.exe.a5346b.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 0.2.Refund Details.exe.a5346b.1.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 0.0.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 0.2.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.2.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 0.2.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 0.0.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.0.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.0.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 0.0.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Refund Details.exe

Source: Refund Details.exe, type: SAMPLE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: Refund Details.exe, type: SAMPLE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: Refund Details.exe, type: SAMPLE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: Refund Details.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: Refund Details.exe, type: SAMPLE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: Refund Details.exe, type: SAMPLE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.0.Refund Details.exe.a6b8db.1.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.0.Refund Details.exe.a6b8db.1.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.2.Refund Details.exe.a6b8db.2.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.2.Refund Details.exe.a6b8db.2.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.2.Refund Details.exe.a5346b.1.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.2.Refund Details.exe.a5346b.1.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.2.Refund Details.exe.a5346b.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.0.Refund Details.exe.a5346b.2.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.0.Refund Details.exe.a5346b.2.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.2.Refund Details.exe.a5346b.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 0.2.Refund Details.exe.a5346b.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 0.2.Refund Details.exe.a5346b.1.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.0.Refund Details.exe.a5346b.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.0.Refund Details.exe.a5346b.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 0.0.Refund Details.exe.a5346b.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 0.0.Refund Details.exe.a5346b.2.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.0.Refund Details.exe.a5346b.2.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.0.Refund Details.exe.a5346b.2.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.0.Refund Details.exe.a5346b.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Refund Details.exe.a5346b.1.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.2.Refund Details.exe.a5346b.1.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.2.Refund Details.exe.a5346b.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.2.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.2.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.0.Refund Details.exe.a5346b.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 0.0.Refund Details.exe.a5346b.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 0.0.Refund Details.exe.a5346b.2.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.Refund Details.exe.a5346b.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 0.2.Refund Details.exe.a5346b.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 0.2.Refund Details.exe.a5346b.1.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.0.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.0.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.2.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 0.2.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 0.2.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.0.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.0.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 0.0.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 0.0.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 00000000.00000000.1533482048.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841

Source: C:\Users\user\Desktop\Refund Details.exe	Code function: 0_2_00A64463	0_2_00A64463
Source: C:\Users\user\Desktop\Refund Details.exe	Code function: 0_2_00A58B02	0_2_00A58B02
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 7_2_000001EF00F29F58	7_2_000001EF00F29F58
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 7_2_000001EF00F48CEC	7_2_000001EF00F48CEC
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 7_2_000001EF00F493E7	7_2_000001EF00F493E7

Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 7_2_000001EF00F29F58 NtQuerySystemInformation,		7_2_000001EF00F29F58
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 7_2_000001EF00F48CEC NtQuerySystemInformation,		7_2_000001EF00F48CEC

Source: Refund Details.exe

Static PE information: No import functions for PE file found

Source: Refund Details.exe	Binary or memory string: OriginalFilename vs Refund Details.exe
Source: Refund Details.exe, 00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenametiny_runpe.dll6 vs Refund Details.exe
Source: Refund Details.exe, 00000000.00000000.1533643846.0000000000A84000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOYton.exe4 vs Refund Details.exe
Source: Refund Details.exe, 00000000.00000002.1544724796.00000000013FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Refund Details.exe

Source: Refund Details.exe	Virustotal: Detection: 66%
Source: Refund Details.exe	Metadefender: Detection: 37%
Source: Refund Details.exe	ReversingLabs: Detection: 85%

Source: Refund Details.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Refund Details.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\pingsender.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Refund Details.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Refund Details.exe.log

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File created: C:\Users\user\AppData\Local\Temp\firefox

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@23/76@391/18

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Refund Details.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ec23d1294499b4ffba61f212cb1217cd\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5348:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5348:120:WilError_02

Source: C:\Program Files\Mozilla Firefox\pingsender.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Program Files\Mozilla Firefox\pingsender.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Refund Details.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Refund Details.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Refund Details.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: ntmarta.pdb source: firefox.exe, 00000004.00000003.2120317807.000001D97B436000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: avrt.pdb source: firefox.exe, 00000004.00000003.2126029691.000001D975A96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: DWrite.pdb source: firefox.exe, 00000004.00000003.2118988872.000001D97B690000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8Windows.Storage.pdb source: firefox.exe, 00000004.00000003.2127269325.000001D975681000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: Refund Details.exe, Core1.cs

.Net Code: Run System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\Refund Details.exe	Code function: 0_2_00A539FB push rax; ret	0_2_00A53A0F
Source: C:\Users\user\Desktop\Refund Details.exe	Code function: 0_2_00A539FB push rax; ret	0_2_00A53A37
Source: C:\Users\user\Desktop\Refund Details.exe	Code function: 0_2_00A66DB3 push rbp; retf	0_2_00A66DCF
Source: C:\Users\user\Desktop\Refund Details.exe	Code function: 0_2_00007FFA2F210183 push E95BF271h; ret	0_2_00007FFA2F210209

Hooking and other Techniques for Hiding and Protection

Contains functionality to hide user accounts

Source: Refund Details.exe	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: Refund Details.exe, 00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: Refund Details.exe, 00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType

Source: C:\Users\user\Desktop\Refund Details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Refund Details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Refund Details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Refund Details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Refund Details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Refund Details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Refund Details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Refund Details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Refund Details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Refund Details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Refund Details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Refund Details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Refund Details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Refund Details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Refund Details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Refund Details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Refund Details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Refund Details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Refund Details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Refund Details.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Refund Details.exe TID: 1164

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Program Files\Mozilla Firefox\firefox.exe

Code function: 7_2_000001EF00F29F58 rdtsc

7_2_000001EF00F29F58

Source: C:\Users\user\Desktop\Refund Details.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\Refund Details.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: firefox.exe, 0000000D.00000002.2725120559.0000026765C10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWro
Source: firefox.exe, 00000007.00000002.2821190387.000001EF00D90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW2P
Source: firefox.exe, 00000007.00000002.2821760838.000001EF00D9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^i
Source: firefox.exe, 00000006.00000002.2774430006.000002632E0A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWm
Source: firefox.exe, 00000008.00000002.2003573799.00000242294CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll%Xb
Source: firefox.exe, 00000006.00000003.1822427416.000002632E0E5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000007.00000002.2821760838.000001EF00D9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 00000006.00000002.2776612280.000002632E0D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^Q
Source: firefox.exe, 00000005.00000002.2028801223.0000027A5C247000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2758357660.000002632C843000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000008.00000002.2000025823.0000024227C47000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: firefox.exe, 0000000D.00000002.2712601695.0000026764060000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C
Source: firefox.exe, 00000005.00000002.2032987099.0000027A5D92D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2774430006.000002632E0A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWdiskVolume4Users\user\AppData\LocalLow\Mozilla\Temp-{a93be640-61d8-41db-9ece-f76b96818898}818898}Winds\Syst\WinwsrS
Source: firefox.exe, 00000005.00000002.2033668216.0000027A5D948000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllA
Source: firefox.exe, 00000008.00000002.2003070263.00000242294A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWgr0
Source: firefox.exe, 00000008.00000002.2003573799.00000242294CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWdiskVolume4Users\user\AppData\LocalLow\Mozilla\Temp-{a93be640-61d8-41db-9ece-f76b96818898}818898}ava\vapathWinds\em
Source: firefox.exe, 00000005.00000002.2033668216.0000027A5D948000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2776612280.000002632E0D9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000007.00000002.2821760838.000001EF00D9E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000008.00000002.2003573799.00000242294CB000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000002.2726779437.0000026765C4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: firefox.exe, 00000005.00000002.2032330360.0000027A5D910000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW FP

Source: C:\Program Files\Mozilla Firefox\firefox.exe

Code function: 7_2_000001EF00F29F58 rdtsc

7_2_000001EF00F29F58

Source: C:\Users\user\Desktop\Refund Details.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Refund Details.exe

Queries volume information: C:\Users\user\Desktop\Refund Details.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Refund Details.exe

Code function: 0_2_00A621AA cpuid

0_2_00A621AA

Stealing of Sensitive Information

Yara detected AveMaria stealer

Source: Yara match	File source: Refund Details.exe, type: SAMPLE
Source: Yara match	File source: 0.2.Refund Details.exe.a5346b.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Refund Details.exe.a5346b.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Refund Details.exe.a5346b.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Refund Details.exe.a5346b.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1533482048.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files\Mozilla Firefox\pingsender.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\4d4e9ed8-d41e-47c2-af5c-0d0eb3230cdd	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\pingsender.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\c07646ef-d9d3-4d8c-811b-81063ab65053	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\pingsender.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\02261d48-0564-4e3d-9859-ba76e838e396	Jump to behavior

Source: Yara match	File source: Refund Details.exe, type: SAMPLE
Source: Yara match	File source: 0.2.Refund Details.exe.a5346b.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Refund Details.exe.a5346b.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Refund Details.exe.a5346b.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Refund Details.exe.a5346b.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1533482048.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Refund Details.exe PID: 2024, type: MEMORYSTR

Remote Access Functionality

Yara detected AveMaria stealer

Source: Yara match	File source: Refund Details.exe, type: SAMPLE
Source: Yara match	File source: 0.2.Refund Details.exe.a5346b.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Refund Details.exe.a5346b.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Refund Details.exe.a5346b.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Refund Details.exe.a5346b.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Refund Details.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1533482048.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Command and Scripting Interpreter	Path Interception	1 Process Injection	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	11 Input Capture	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Disable or Modify Tools	11 Input Capture	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	1 Remote System Discovery	SMB/Windows Admin Shares	1 Data from Local System	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Process Injection	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	14 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Hidden Users	LSA Secrets	21 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Obfuscated Files or Information	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	11 Software Packing	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Extra Window Memory Injection	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Refund Details.exe	66%	Virustotal		Browse
Refund Details.exe	37%	Metadefender		Browse
Refund Details.exe	85%	ReversingLabs	Win64.Trojan.Tnega
Refund Details.exe	100%	Avira	TR/Redcap.ghjpt
Refund Details.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.2.Refund Details.exe.a50000.0.unpack	100%	Avira	TR/Redcap.ghjpt		Download File
0.0.Refund Details.exe.a50000.0.unpack	100%	Avira	TR/Redcap.ghjpt		Download File

Domains

Source	Detection	Scanner	Label	Link
prod.balrog.prod.cloudops.mozgcp.net	0%	Virustotal		Browse
prod.detectportal.prod.cloudops.mozgcp.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://webcompat.com/issues/45019	0%	Avira URL Cloud	safe
https://webcompat.com/issues/50961	0%	Avira URL Cloud	safe
https://webcompat.com/issues/52463	0%	Avira URL Cloud	safe
https://webcompat.com/issues/16363	0%	Avira URL Cloud	safe
https://tracking-protection-issues.herokuapp.com/new	0%	Avira URL Cloud	safe
http://exslt.org/sets	0%	Avira URL Cloud	safe
http://exslt.org/common	0%	URL Reputation	safe
http://127.0.0.1:	0%	Avira URL Cloud	safe
https://webcompat.com/issues/49886	0%	Avira URL Cloud	safe
https://bugzilla.mo	0%	Avira URL Cloud	safe
https://webcompat.com/issues/3846	0%	Avira URL Cloud	safe
http://exslt.org/strings	0%	Avira URL Cloud	safe
https://webcompat.com/issues/4608	0%	Avira URL Cloud	safe
http://exslt.org/dates-and-times$	0%	Avira URL Cloud	safe
https://webcompat.com/issues/60043	0%	Avira URL Cloud	safe
https://mozilla.cloudflare-dns.com/dns-query	0%	Avira URL Cloud	safe
https://mail.yahoo.co.jp/compose/?To=%s	0%	Avira URL Cloud	safe
https://webcompat.com/issues/18455	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
example.org	93.184.216.34	true	false		high
star-mini.c10r.facebook.com	157.240.17.35	true	false		high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	0%, Virustotal, Browse	unknown
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	0%, Virustotal, Browse	unknown
shavar.prod.mozaws.net	18.236.18.10	true	false		high
autopush.prod.mozaws.net	54.191.212.31	true	false		high
dyna.wikimedia.org	91.198.174.192	true	false		high
d228z91au11ukj.cloudfront.net	143.204.98.72	true	false		high
d2nxq2uap88usk.cloudfront.net	18.66.248.5	true	false		high
youtube-ui.l.google.com	216.58.215.238	true	false		high
scontent.xx.fbcdn.net	157.240.17.15	true	false		high
reddit.map.fastly.net	151.101.65.140	true	false		unknown
locprod2-elb-us-west-2.prod.mozaws.net	35.161.134.161	true	false		high
ipv4only.arpa	192.0.0.171	true	false		unknown
www.mozorg.moz.works	108.157.3.185	true	false		unknown
firefox.settings.services.mozilla.com	13.226.158.36	true	false		high
facebook.com	157.240.17.35	true	false		high
www.google.com	142.250.185.100	true	false		high
prod.ingestion-edge.prod.dataops.mozgcp.net	34.120.208.123	true	false		unknown
normandy-cdn.services.mozilla.com	18.66.248.38	true	false		high
prod-tp.sumo.mozit.cloud	54.148.60.204	true	false		unknown
www.reddit.com	unknown	unknown	false		high
content-signature-2.cdn.mozilla.net	unknown	unknown	false		high
support.mozilla.org	unknown	unknown	false		high
push.services.mozilla.com	unknown	unknown	false		high
www.youtube.com	unknown	unknown	false		high
www.facebook.com	unknown	unknown	false		high
detectportal.firefox.com	unknown	unknown	false		high
static.xx.fbcdn.net	unknown	unknown	false		high
normandy.cdn.mozilla.net	unknown	unknown	false		high
www.ebay.de	unknown	unknown	false		high
shavar.services.mozilla.com	unknown	unknown	false		high
www.wikipedia.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
iphanyi.chickenkiller.com	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://basket.mozilla.org/news/subscribe_sms/	firefox.exe, 00000006.00000002.2807491730.000002633304E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000005.00000002.2022925926.0000027A5BE90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2748858936.000002632C5F0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1678942	firefox.exe, 00000004.00000003.2142023369.000001D975D32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4	firefox.exe, 00000006.00000002.2804757238.0000026333002000.00000004.00000800.00020000.00000000.sdmp	false		high
https://webcompat.com/issues/45019	firefox.exe, 0000000D.00000003.2101450076.000002676B159000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://webcompat.com/issues/50961	firefox.exe, 0000000D.00000003.2101450076.000002676B159000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://webcompat.com/issues/52463	firefox.exe, 0000000D.00000003.2101450076.000002676B159000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://datastudio.google.com/embed/reporting/	firefox.exe, 0000000D.00000002.2745855510.000002676AC13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.2118094166.000002676B14D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.2111250006.000002676B14A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=$	firefox.exe, 0000000D.00000003.2127049602.000002676B134000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	firefox.exe, 00000005.00000002.2022925926.0000027A5BE90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2748858936.000002632C5F0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 00000006.00000002.2807491730.000002633304E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://detectportal.firefox.com/success.txtresource://gre/modules/PageThumbs.jsmresource://gre/modul	firefox.exe, 00000004.00000003.1950846693.000001D9709FD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1853227617.000001D9709FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://completion.amazon.com/search/complete?q=	firefox.exe, 00000004.00000003.1781181210.000001D974209000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1783353896.000001D974267000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1781959685.000001D974228000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1780563449.000001D974000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1782768875.000001D974248000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000008.00000002.2020061258.000002422E700000.00000002.08000000.00040000.00000000.sdmp	false		high
https://wiki.mozilla.org/Addons/Extension_Signing	firefox.exe, 00000005.00000002.2022925926.0000027A5BE90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2748858936.000002632C5F0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false		high
https://webcompat.com/issues/16363	firefox.exe, 0000000D.00000003.2101450076.000002676B159000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://monitor.firefox.com/breach-details/	firefox.exe, 00000005.00000002.2022925926.0000027A5BE90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2748858936.000002632C5F0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false		high
https://addons.mozilla.org/en-US/firefox/themes/?utm_source=desktop-snippet&utm_medium=snippet&utm_c	firefox.exe, 00000004.00000003.2142108478.000001D975D40000.00000004.00000800.00020000.00000000.sdmp	false		high
https://vr.mozilla.org/?utm_source=desktop-snippet&utm_medium=snippet&utm_campaign=f100_week14_mozvr	firefox.exe, 00000004.00000003.2069078256.000001D97B92F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://hg.mozilla.org/releases/mozilla-release/rev/179e1482851c07d65bf29a21c9e42ea312fc87faC:	firefox.exe, 00000006.00000002.2804757238.0000026333002000.00000004.00000800.00020000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000005.00000002.2022925926.0000027A5BE90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2748858936.000002632C5F0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000004.00000003.2127269325.000001D975681000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1783353896.000001D974267000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1781959685.000001D974228000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1780563449.000001D974000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1782768875.000001D974248000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000008.00000002.2020061258.000002422E700000.00000002.08000000.00040000.00000000.sdmp	false		high
https://github.com/mozilla/activity-stream/blob/master/content-src/asrouter/docs/debugging-docs.md	firefox.exe, 00000006.00000002.2804757238.0000026333002000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.pcloud.com/	firefox.exe, 0000000D.00000003.2118094166.000002676B14D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.2111250006.000002676B14A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000002.2823274179.00000F869DEB5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://identity.mozilla.com/cmd/DEPRECATED_SCOPE_ECOSYSTEM_TELEMETRYFailed	firefox.exe, 00000004.00000003.2142326815.000001D975D28000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 00000004.00000003.2141543747.000001D975D88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1781181210.000001D974209000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1781959685.000001D974228000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1780563449.000001D974000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1782768875.000001D974248000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000008.00000002.2020061258.000002422E700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2745855510.000002676AC13000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/addon/	firefox.exe, 00000005.00000002.2022925926.0000027A5BE90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2748858936.000002632C5F0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000005.00000002.2022925926.0000027A5BE90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2748858936.000002632C5F0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://exslt.org/sets	firefox.exe, 00000005.00000002.2031838112.0000027A5C2CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2771912783.000002632C8CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000008.00000002.2002382739.0000024227CBD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=	firefox.exe, 0000000D.00000002.2745855510.000002676AC13000.00000004.00000800.00020000.00000000.sdmp	false		high
https://basket.mozilla.org/subscribe.jsonNewtabRenderUtils	firefox.exe, 00000006.00000002.2807491730.000002633304E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://img-getpocket.cdn.mozilla.net/NewtabRenderUtils	firefox.exe, 00000006.00000002.2807491730.000002633304E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.instagram.com/	firefox.exe, 0000000D.00000002.2745855510.000002676AC13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.2091552320.000002676B1EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.2112952839.000002676B1EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.2117511253.000002676B1F0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/?q=	firefox.exe, 00000004.00000003.1781181210.000001D974209000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1783353896.000001D974267000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1781959685.000001D974228000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1780563449.000001D974000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1782768875.000001D974248000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000008.00000002.2020061258.000002422E700000.00000002.08000000.00040000.00000000.sdmp	false		high
https://fb.me/react-polyfillshttps://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&cons	firefox.exe, 00000006.00000002.2805588074.0000026333010000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.accounts.firefox.com/v1	firefox.exe, 00000005.00000002.2022925926.0000027A5BE90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2748858936.000002632C5F0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false		high
http://exslt.org/common	firefox.exe, 00000005.00000002.2031838112.0000027A5C2CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2771912783.000002632C8CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000008.00000002.2002382739.0000024227CBD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc	firefox.exe, 00000004.00000003.2120558334.000001D97B44B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2143612272.000001D97B44B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	firefox.exe, 00000005.00000002.2022925926.0000027A5BE90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2748858936.000002632C5F0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 00000004.00000003.2118014056.000001D97B64C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	firefox.exe, 00000006.00000003.2472059050.0000026336F26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2904574215.000039BE3B4CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000007.00000002.2815474303.000001EF00910000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000008.00000002.2016601658.000002422E3CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000002.2717851159.0000026764510000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1283601	firefox.exe, 00000004.00000003.2142023369.000001D975D32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2067093753.000001D97B5E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com/?utm_source=desktop-snippet&utm_medium=snippet&utm_campaign=f100_wee	firefox.exe, 00000004.00000003.2142108478.000001D975D40000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.com/	firefox.exe, 00000006.00000002.2892161602.00000EE5C4586000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/firefox/addon/to-google-translate/	firefox.exe, 00000004.00000003.2123028354.000001D978A4D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:	firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2720601779.0000026764562000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1266220	firefox.exe, 00000004.00000003.2142023369.000001D975D32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://webcompat.com/issues/49886	firefox.exe, 0000000D.00000003.2101450076.000002676B159000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugzilla.mo	firefox.exe, 00000004.00000003.2119623615.000001D97B6CF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000005.00000002.2022925926.0000027A5BE90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2748858936.000002632C5F0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false		high
https://amazon.com	firefox.exe, 00000006.00000003.2438177103.000039E007780000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2904574215.000039BE3B4CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false		high
https://webcompat.com/issues/3846	firefox.exe, 0000000D.00000003.2101450076.000002676B159000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.mibbit.com/?url=%s	firefox.exe, 00000004.00000003.2129613602.000001D97B511000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/en-US/firefox/collections/mozilla/featured-personas/?utm_source=desktop-s	firefox.exe, 00000004.00000003.2142669312.000001D975D64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2069078256.000001D97B92F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com/OnBeforeSendHeadersOptionsContentScriptContextChild	firefox.exe, 0000000D.00000002.2745855510.000002676AC13000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/firefox/addon/reddit-enhancement-suite/chrome://activity-stream/content/d	firefox.exe, 00000004.00000003.1950789792.000001D9709F6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://basket.mozilla.org/subscribe.json	firefox.exe, 00000006.00000002.2807491730.000002633304E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 0000000D.00000002.2723475002.00000267645CB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/syohex/java-simple-mine-sweeperC:	Refund Details.exe, 00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 00000005.00000002.2022925926.0000027A5BE90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2748858936.000002632C5F0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000005.00000002.2022925926.0000027A5BE90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2748858936.000002632C5F0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false		high
https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/?utm_source=desktop-snippet&	firefox.exe, 00000004.00000003.2141777223.000001D975D7B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://compose.mail.yahoo.com/?To=%s	firefox.exe, 00000004.00000003.2129613602.000001D97B511000.00000004.00000800.00020000.00000000.sdmp	false		high
http://exslt.org/strings	firefox.exe, 00000005.00000002.2027220969.0000027A5C200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2751435621.000002632C800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000008.00000002.1998875798.0000024227C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000002.2716544138.0000026764500000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r	firefox.exe, 00000005.00000002.2022925926.0000027A5BE90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2748858936.000002632C5F0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 00000005.00000002.2022925926.0000027A5BE90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2748858936.000002632C5F0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false		high
https://webcompat.com/issues/4608	firefox.exe, 0000000D.00000003.2101450076.000002676B159000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=11938027aa72748bb62b4f52cdb53f261a2626507c0c669772737a4	firefox.exe, 00000004.00000003.2142023369.000001D975D32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	firefox.exe, 00000005.00000002.2022925926.0000027A5BE90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2748858936.000002632C5F0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false		high
https://hacks.mozilla.org/?utm_source=desktop-snippet&utm_medium=snippet&utm_campaign=mozdev-hacks-b	firefox.exe, 00000004.00000003.2142108478.000001D975D40000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefox/protect-your-privacy?utm_source=desktop-snippet&utm_med	firefox.exe, 00000004.00000003.2069078256.000001D97B92F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2141777223.000001D975D7B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.s-kanava.fi/	firefox.exe, 0000000D.00000002.2745855510.000002676AC13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.2118094166.000002676B14D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.2111250006.000002676B14A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.com/firefox_learnmore?utm_source=desktop-snippet&utm_medium=snippet&utm_campaign=f	firefox.exe, 00000004.00000003.2142108478.000001D975D40000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/en-US/kb/keyboard-shortcuts-perform-firefox-tasks-quickly?utm_source=des	firefox.exe, 00000004.00000003.2069078256.000001D97B92F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/dashboard	firefox.exe, 00000005.00000002.2022925926.0000027A5BE90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2748858936.000002632C5F0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1170143	firefox.exe, 00000004.00000003.2142023369.000001D975D32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID	firefox.exe, 00000005.00000002.2022925926.0000027A5BE90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2748858936.000002632C5F0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/about	firefox.exe, 00000005.00000002.2022925926.0000027A5BE90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2748858936.000002632C5F0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false		high
http://mozilla.org/MPL/2.0/.	firefox.exe, 00000004.00000003.2192287577.000001D97418E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2142669312.000001D975D64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1877516186.000001D9789BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1869963416.000001D9789F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1877423445.000001D9789A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1947193206.000001D9789F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2124539044.000001D978AF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2178984405.000001D975B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1869589058.000001D9789DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2140334829.000001D97B1B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1947894266.000001D9789DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1853573389.000001D975B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2212688174.000001D97B1A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1869274853.000001D9789A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2123599028.000001D978A92000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1878336911.000001D97845F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2122375348.000001D97B4D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2069078256.000001D97B92F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1941067476.000001D9789F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2027968172.000001D97ACC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2212337754.000001D97B16A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.openh264.org/	firefox.exe, 00000004.00000003.2128600461.000001D975622000.00000004.00000800.00020000.00000000.sdmp	false		high
https://accounts.firefox.com/signin?action=email&utm_source=desktop-snippet&utm_campaign=fxa_sync_20	firefox.exe, 00000004.00000003.2069078256.000001D97B92F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gaana.com/	firefox.exe, 0000000D.00000002.2823274179.00000F869DEB5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://coverage.mozilla.org	firefox.exe, 00000005.00000002.2022925926.0000027A5BE90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2748858936.000002632C5F0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false		high
https://snippets.mozilla.com/show/	firefox.exe, 00000006.00000002.2807491730.000002633304E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://blocked.cdn.mozilla.net/	firefox.exe, 00000005.00000002.2022925926.0000027A5BE90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2748858936.000002632C5F0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false		high
http://exslt.org/dates-and-times$	firefox.exe, 00000005.00000002.2027729975.0000027A5C20F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2752977160.000002632C80E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000008.00000002.1999059888.0000024227C0E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000002.2717102781.000002676450E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/make-firefox-your-default-browser?utm_source=desktop-snippet&utm_medi	firefox.exe, 00000004.00000003.2142669312.000001D975D64000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com	firefox.exe, 00000005.00000002.2022925926.0000027A5BE90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2748858936.000002632C5F0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false		high
https://webcompat.com/issues/60043	firefox.exe, 0000000D.00000003.2101450076.000002676B159000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=793869	firefox.exe, 00000004.00000003.2142023369.000001D975D32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mozilla.cloudflare-dns.com/dns-query	firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1678448	firefox.exe, 00000004.00000003.2066655189.000001D97B5D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2142023369.000001D975D32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2067093753.000001D97B5E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 00000004.00000003.2118014056.000001D97B64C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://webcompat.com/issues/18455	firefox.exe, 0000000D.00000003.2101450076.000002676B159000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://addons.mozilla.org/firefox/addon/reddit-enhancement-suite/	firefox.exe, 00000004.00000003.1950789792.000001D9709F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2123028354.000001D978A4D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/	firefox.exe, 00000004.00000003.2125517595.000001D975A7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2141903572.000001D975D81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/projectfluent/fluent.js/wiki/React-Overlays.x	firefox.exe, 00000006.00000002.2807491730.000002633304E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/preferences	firefox.exe, 00000005.00000002.2022925926.0000027A5BE90000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2748858936.000002632C5F0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2823910076.000001EF00EA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1996155947.0000024227A00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2715010490.0000026764340000.00000002.08000000.00040000.00000000.sdmp	false		high
https://screenshots.firefox.com/	firefox.exe, 0000000D.00000002.2745855510.000002676AC13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000002.2742067591.000002676ABBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000002.2741190644.000002676ABA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000002.2787218273.000002676CC6B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/search	firefox.exe, 00000004.00000003.2127269325.000001D975681000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1781959685.000001D974228000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1780563449.000001D974000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1782768875.000001D974248000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000008.00000002.2020061258.000002422E700000.00000002.08000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.191.212.31	autopush.prod.mozaws.net	United States	16509	AMAZON-02US	false
35.81.85.200	unknown	United States	237	MERIT-AS-14US	false
13.226.158.36	firefox.settings.services.mozilla.com	United States	16509	AMAZON-02US	false
35.155.98.26	unknown	United States	16509	AMAZON-02US	false
18.236.18.10	shavar.prod.mozaws.net	United States	16509	AMAZON-02US	false
35.164.251.155	unknown	United States	16509	AMAZON-02US	false
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
157.240.17.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
157.240.17.15	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
108.157.4.26	unknown	United States	16509	AMAZON-02US	false
143.204.98.72	d228z91au11ukj.cloudfront.net	United States	16509	AMAZON-02US	false
157.240.20.35	unknown	United States	32934	FACEBOOKUS	false
18.66.248.5	d2nxq2uap88usk.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
34.120.208.123	prod.ingestion-edge.prod.dataops.mozgcp.net	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	602124
Start date and time:	2022-04-04 01:16:45 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Refund Details.com (renamed file extension from com to exe)
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@23/76@391/18
EGA Information:	Successful, ratio: 11.1%
HDC Information:	Successful, ratio: 96.5% (good quality ratio 77.2%) Quality average: 58% Quality standard deviation: 36.9%
HCA Information:	Successful, ratio: 100% Number of executed functions: 14 Number of non-executed functions: 8
Cookbook Comments:	Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): taskhostw.exe, MusNotification.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, UpdateNotificationMgr.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, MusNotificationUx.exe, svchost.exe, UsoClient.exe
Excluded IPs from analysis (whitelisted): 184.30.25.119, 2.20.41.96, 142.250.203.106, 142.250.184.202, 142.250.74.202
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, slscr.update.microsoft.com, incoming.telemetry.mozilla.org, settings-win.data.microsoft.com, ctldl.windowsupdate.com, ipv4.slot11847.ebay.com.edgekey.net, aus5.mozilla.org, snippets.cdn.mozilla.net, arc.msn.com, ris.api.iris.microsoft.com, go.microsoft.com, login.live.com, safebrowsing.googleapis.com, www.mozilla.org, img-prod-cms-rt-microsoft-com.akamaized.net, e11847.a.akamaiedge.net, nexusrules.officeapps.live.com, location.services.mozilla.com
Execution Graph export aborted for target Refund Details.exe, PID 2024 because it is empty
Execution Graph export aborted for target firefox.exe, PID 1396 because it is empty
Execution Graph export aborted for target firefox.exe, PID 4816 because it is empty
Execution Graph export aborted for target firefox.exe, PID 6688 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:18:14	API Interceptor	1x Sleep call for process: firefox.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
143.204.98.72	Daily Ringtones.apk	Get hash	malicious	Browse
18.66.248.5	m-i.p-s.Sakura	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
example.org	Harvest Global.exe	Get hash	malicious	Browse	93.184.216.34
shavar.prod.mozaws.net	Harvest Global.exe	Get hash	malicious	Browse	52.40.173.137
	firefox-3.0.0.zip	Get hash	malicious	Browse	34.216.80.151
	8iAbuSGbC4.exe	Get hash	malicious	Browse	44.241.216.67
	3rbDKSjFvH.doc	Get hash	malicious	Browse	54.201.6.28
	Invoice.doc	Get hash	malicious	Browse	52.25.189.61
	28photo.doc	Get hash	malicious	Browse	54.201.6.28
	17Payment copy.doc	Get hash	malicious	Browse	54.191.240.183
	12invoice copy.doc	Get hash	malicious	Browse	52.34.90.23
	20order PO-010816-WA0002.doc	Get hash	malicious	Browse	54.201.6.28
	33Order Specification.doc	Get hash	malicious	Browse	54.187.147.167
	3Purchase order.doc	Get hash	malicious	Browse	52.35.21.241
	3Order 578653.doc	Get hash	malicious	Browse	54.191.20.229
	22New Order2.doc	Get hash	malicious	Browse	54.71.218.22
	25Order.doc	Get hash	malicious	Browse	52.43.148.74
	1SWIFT.doc	Get hash	malicious	Browse	54.187.147.167
	30IMG_BILL_DRAFTCOPY_595986876.doc	Get hash	malicious	Browse	54.201.6.28
	30IMG_BILL_DRAFTCOPY_595986876.doc	Get hash	malicious	Browse	52.38.215.55
	15Swift.doc	Get hash	malicious	Browse	54.187.197.166
	34PO#59652597.doc	Get hash	malicious	Browse	54.191.240.183
	34Invoice-U6AI017400.doc	Get hash	malicious	Browse	52.35.21.241

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
MERIT-AS-14US	mips-20220403-1044	Get hash	malicious	Browse	35.87.63.175
	fHOZmsfcaI	Get hash	malicious	Browse	35.101.96.179
	arm6-20220401-2259	Get hash	malicious	Browse	35.88.212.62
	i686-20220401-2259	Get hash	malicious	Browse	35.100.70.186
	x86_64-20220401-2259	Get hash	malicious	Browse	35.104.171.51
	http://haciendajuanitapr.com	Get hash	malicious	Browse	35.83.74.1
	ORgt7AWPH8	Get hash	malicious	Browse	164.76.186.151
	kwPF1TJUfl	Get hash	malicious	Browse	35.120.105.195
	8faPwhwOUp	Get hash	malicious	Browse	35.108.218.129
	Mogu.arm	Get hash	malicious	Browse	35.118.178.190
	Xzh7CHryI8	Get hash	malicious	Browse	164.76.186.118
	js3MwBuKaZ	Get hash	malicious	Browse	204.38.173.214
	arm7	Get hash	malicious	Browse	198.111.174.157
	5OpAIg7nxK	Get hash	malicious	Browse	141.217.137.24
	root.exe	Get hash	malicious	Browse	35.90.18.0
	LILpSZSEX9	Get hash	malicious	Browse	198.108.156.184
	sora.arm	Get hash	malicious	Browse	35.64.205.186
	x86	Get hash	malicious	Browse	35.118.248.149
	8ZrIgWjGyu	Get hash	malicious	Browse	35.64.133.9
	o9qN1Vlxuq	Get hash	malicious	Browse	35.87.38.58
AMAZON-02US	https://cvxceude.web.app/gtse/sessexpired/index.html?a=headstart@eclkc.info	Get hash	malicious	Browse	13.226.158.17
	vI5lDvvXc7	Get hash	malicious	Browse	18.251.7.205
	Ww5vqyba5b.exe	Get hash	malicious	Browse	13.226.158.29
	CiHd6QN2HU.exe	Get hash	malicious	Browse	3.142.167.54
	arm-20220403-1044	Get hash	malicious	Browse	184.77.138.11
	arm6-20220403-1044	Get hash	malicious	Browse	184.76.52.187
	arm7-20220403-1044	Get hash	malicious	Browse	184.76.52.187
	https://amlakazizi.ir	Get hash	malicious	Browse	52.218.133.73
	mips-20220403-1044	Get hash	malicious	Browse	184.76.52.172
	mipsel-20220403-1044	Get hash	malicious	Browse	34.244.124.165
	Massive Theme SMS.apk	Get hash	malicious	Browse	52.30.4.246
	http://boycottbeijing2022.net	Get hash	malicious	Browse	65.9.82.36
	https://s3.amazonaws.com/delivery.canadapost-postescanada-ca.parcel-reprogrammer5/1SEGDSHGS.html	Get hash	malicious	Browse	52.217.103.182
	pandora.arm7	Get hash	malicious	Browse	75.3.32.110
	ClQMIyqcqT	Get hash	malicious	Browse	18.253.59.60
	4e3qx6wbA6	Get hash	malicious	Browse	54.109.99.193
	QUulJKF3ug	Get hash	malicious	Browse	18.241.248.15
	Pvev4QNbFf	Get hash	malicious	Browse	13.236.232.112
	http://denverurbanleague.org	Get hash	malicious	Browse	35.156.233.6
	javac	Get hash	malicious	Browse	15.185.213.122

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
a72f351cf3c3cd1edb345f7dc071d813	Harvest Global.exe	Get hash	malicious	Browse	35.244.181.201 34.120.208.123
	http://209.141.59.94/jaws	Get hash	malicious	Browse	35.244.181.201 34.120.208.123
	http://a.oracleservice.top/xms	Get hash	malicious	Browse	35.244.181.201 34.120.208.123
	firefox-3.0.0.zip	Get hash	malicious	Browse	35.244.181.201 34.120.208.123
	H5MmXCKkB1.exe	Get hash	malicious	Browse	35.244.181.201 34.120.208.123
37f463bf4616ecd445d4a1937da06e19	https://cvxceude.web.app/gtse/sessexpired/index.html?a=headstart@eclkc.info	Get hash	malicious	Browse	34.120.208.123
	https://amlakazizi.ir	Get hash	malicious	Browse	34.120.208.123
	office365 Activation.html	Get hash	malicious	Browse	34.120.208.123
	SecuriteInfo.com.Trojan.Siggen17.32175.9558.exe	Get hash	malicious	Browse	34.120.208.123
	https://vgon.com.br/-/E-M/	Get hash	malicious	Browse	34.120.208.123
	Priority Payment Advice.pdf.Htm	Get hash	malicious	Browse	34.120.208.123
	ZrAFa5bTpZ.exe	Get hash	malicious	Browse	34.120.208.123
	SecuriteInfo.com.Trojan.Siggen17.32175.3080.exe	Get hash	malicious	Browse	34.120.208.123
	https://docs.google.com/drawings/u/315717065153/d/1g6YkBpSaOJCHsm2VUu0vXZj4W5qx4KEWK9K9TNCBObs/preview	Get hash	malicious	Browse	34.120.208.123
	SecuriteInfo.com.Trojan.Siggen17.32175.20640.exe	Get hash	malicious	Browse	34.120.208.123
	TGX.exe	Get hash	malicious	Browse	34.120.208.123
	BF2.exe	Get hash	malicious	Browse	34.120.208.123
	CCleaner64.exe	Get hash	malicious	Browse	34.120.208.123
	V54382011.html	Get hash	malicious	Browse	34.120.208.123
	https://tophelmet.org/spencerfane/of2	Get hash	malicious	Browse	34.120.208.123
	http://clickserve.dartsearch.net/link/click?&ds_a_cid=680760384&ds_a_caid=12694754542&ds_a_agid=123477218634&ds_a_fiid=&ds_a_lid=&&ds_e_adid=512650395034&ds_e_matchtype=&ds_e_device=c&ds_e_network=&&ds_url_v=2&ds_dest_url=https%3a%2f%2fjkywc4.codesandbox.io/?dg=bmljb2xhLmJhcmF0aEBpc2xhbmRoZWFsdGguY2E	Get hash	malicious	Browse	34.120.208.123
	http://clickserve.dartsearch.net/link/click?&ds_a_cid=680760384&ds_a_caid=12694754542&ds_a_agid=123477218634&ds_a_fiid=&ds_a_lid=&&ds_e_adid=512650395034&ds_e_matchtype=&ds_e_device=c&ds_e_network=&&ds_url_v=2&ds_dest_url=https%3a%2f%2fjkywc4.codesandbox.io/?dg=bmljb2xhLmJhcmF0aEBpc2xhbmRoZWFsdGguY2E	Get hash	malicious	Browse	34.120.208.123
	8v2FvY5Keo.exe	Get hash	malicious	Browse	34.120.208.123
	J1iP4zusHy.exe	Get hash	malicious	Browse	34.120.208.123
	V0T6A5FI9C.exe	Get hash	malicious	Browse	34.120.208.123

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Mozilla\uninstall_ping_308046B0AF4A39CB_7924128a-3afe-49c1-80a5-51166342c3b7.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	7177
Entropy (8bit):	5.203357581298683
Encrypted:	false
SSDEEP:	192:1bUoSocobcbhbAbVbhb6bibRbMbtbVcmJA6cxWQSxDhNd/:1ZXNbcNshVuWF4JcLxWQSxDvd/
MD5:	5F782633D9C485322A21F07A520E73D1
SHA1:	E18BFC30FDC60F08A3E9E88788D09CBC8BC95B8B
SHA-256:	5446131B1A79F568730A570421991602D37628BA40F868FE7BF11E53627E6694
SHA-512:	335C6602144DE463795C9C8706B2B5A546955076733D7F7DB68620105037315AFAF173848BF6872374F86CFF6F7CFD1A2E81D9D267935D019DCBC14D9B227B9C
Malicious:	false
Preview:	{"type":"uninstall","id":"7924128a-3afe-49c1-80a5-51166342c3b7","creationDate":"2022-04-04T11:57:05.691Z","version":4,"application":{"architecture":"x86-64","buildId":"20210504152106","name":"Firefox","version":"88.0.1","displayVersion":"88.0.1","vendor":"Mozilla","platformVersion":"88.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"a814a2a5-d8e6-4632-93d9-b725653c1b75","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20210504152106","version":"88.0.1","vendor":"Mozilla","displayVersion":"88.0.1","platformVersion":"88.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"count":4,"cores":2,"vendor":"GenuineIntel","family":6,"model":85,"stepping":7,"l2

C:\ProgramData\Mozilla\uninstall_ping_308046B0AF4A39CB_7924128a-3afe-49c1-80a5-51166342c3b7.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	7177
Entropy (8bit):	5.203357581298683
Encrypted:	false
SSDEEP:	192:1bUoSocobcbhbAbVbhb6bibRbMbtbVcmJA6cxWQSxDhNd/:1ZXNbcNshVuWF4JcLxWQSxDvd/
MD5:	5F782633D9C485322A21F07A520E73D1
SHA1:	E18BFC30FDC60F08A3E9E88788D09CBC8BC95B8B
SHA-256:	5446131B1A79F568730A570421991602D37628BA40F868FE7BF11E53627E6694
SHA-512:	335C6602144DE463795C9C8706B2B5A546955076733D7F7DB68620105037315AFAF173848BF6872374F86CFF6F7CFD1A2E81D9D267935D019DCBC14D9B227B9C
Malicious:	false
Preview:	{"type":"uninstall","id":"7924128a-3afe-49c1-80a5-51166342c3b7","creationDate":"2022-04-04T11:57:05.691Z","version":4,"application":{"architecture":"x86-64","buildId":"20210504152106","name":"Firefox","version":"88.0.1","displayVersion":"88.0.1","vendor":"Mozilla","platformVersion":"88.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"a814a2a5-d8e6-4632-93d9-b725653c1b75","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20210504152106","version":"88.0.1","vendor":"Mozilla","displayVersion":"88.0.1","platformVersion":"88.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"count":4,"cores":2,"vendor":"GenuineIntel","family":6,"model":85,"stepping":7,"l2

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Refund Details.exe.log

Download File

Process:	C:\Users\user\Desktop\Refund Details.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	5.3978458972762455
Encrypted:	false
SSDEEP:	24:ML9E4Kn1qE4GaVO0E4Kw/FS1KDE4KGKz8Kh6+84xpsBT:MxHKn1qHGWO0HKSo1YHKG48o6+vxp2T
MD5:	D7579CD08FF82DFE3DB1701E960D6883
SHA1:	45033BA92C396AC079A26F3DC66B807B00818465
SHA-256:	C54E4B11786FDDA8B3A1506A156EB4529F2A7775183475D6AE552026D6851599
SHA-512:	93E2D887CF90538305043E3053AADA365A30F6DAB10BD8C7E0A273AB778714FA52BBEEFC08EA4EC298F6EA2582C12092DFCCDE7DCE00D3FD87004D82B7BB916F
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\e074a852d0b7a87fc8713d9727b9a1bb\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\2ac5ec60e76be4bef59376fe2193db84\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\489707f31fb2a94848b7b7c651db0330\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\5aa66136dfbf2cc6e3ba6b00dd4d2e9f\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\cache2\doomed\22562 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	175
Entropy (8bit):	5.319262324241609
Encrypted:	false
SSDEEP:	3:jJo8A4CHPfaDllZllWfDdM7GuHioK0MWfMM92CUUy72aTC8WXsAEqyMASxhaA9fE:B2yDxuBHeioTMWfMM92kJamkQoSxhLW/
MD5:	B3ACFFDD65880F4BAD22D79CF7C3603F
SHA1:	70BFD91A2B41155000565895E2262721FAA66F0B
SHA-256:	612F5138860B0397002321DBA452AC1BA1CC1088D4A461ADF873ED0E81CF427A
SHA-512:	2D76B77DEE4D5EA368AE14BF3FBF32B8A388795ED950676E9338F512F8BE8E46C6407438895B6E36140E60DDDE7E25E64513C2D6222635EC33AA5DD90B1F0891
Malicious:	false
Preview:	\|.l.........bJ..bJ..D!.U............a,:https://snippets.cdn.mozilla.net/6/Firefox/88.0.1/20210504152106/WINNT_x86_64-msvc/en-US/release/Windows_NT%2010.0/default/default/.....

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\cache2\doomed\29438

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.962390268717736
Encrypted:	false
SSDEEP:	3:OX44Y18RezllOuBMqEcldnX9XHWwrRzcSLYXqhXjOKf6TaxXA8AsO7WymqA8AsOZ:l8RaW8iclpJWw9LYX2TOKlmeO7WyoeOZ
MD5:	348415416CF1D459FF922C9F69C18F49
SHA1:	518B40075458ECDBA79C09B031A122566897A4E5
SHA-256:	CF4C03875D1094F021AE52E33B8B5EFDE1B93BD995F8BE3CD2F012F818BA6EF2
SHA-512:	97090815092E77587955B7F47D8643F4B26647582865A0AE08C2EA97F4D2DE7019C40D2E328336C60445D7C7EB98A86AADA0A16A41A8C9BFFF9FF43241448F0B
Malicious:	false
Preview:	.@.Y........bJ..bJ..D!.d.......D....O^partitionKey=%28https%2Cfacebook.com%29,:https://www.facebook.com/.necko:classified.1.net-response-time-onstart.33.net-response-time-onstop.33.....

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\cache2\entries\0999C553432185C954530B80972C1B492AB736B1

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	175
Entropy (8bit):	5.319262324241609
Encrypted:	false
SSDEEP:	3:jJo8A4CHPfaDllZllWfDdM7GuHioK0MWfMM92CUUy72aTC8WXsAEqyMASxhaA9fE:B2yDxuBHeioTMWfMM92kJamkQoSxhLW/
MD5:	B3ACFFDD65880F4BAD22D79CF7C3603F
SHA1:	70BFD91A2B41155000565895E2262721FAA66F0B
SHA-256:	612F5138860B0397002321DBA452AC1BA1CC1088D4A461ADF873ED0E81CF427A
SHA-512:	2D76B77DEE4D5EA368AE14BF3FBF32B8A388795ED950676E9338F512F8BE8E46C6407438895B6E36140E60DDDE7E25E64513C2D6222635EC33AA5DD90B1F0891
Malicious:	false
Preview:	\|.l.........bJ..bJ..D!.U............a,:https://snippets.cdn.mozilla.net/6/Firefox/88.0.1/20210504152106/WINNT_x86_64-msvc/en-US/release/Windows_NT%2010.0/default/default/.....

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	8617
Entropy (8bit):	6.104137045061487
Encrypted:	false
SSDEEP:	192:7IyhwyNqaJT8HaxaNiVaSxW68jjt8+RZFPP6n8RyXsCcW:7thjnJTPHaScFtLAnOmsCr
MD5:	63BDBDB99552DD38ECBE0BB9ED4F2B28
SHA1:	50555BB14DB4EBC39F446C98804697D949AAC797
SHA-256:	ED253490C49E7324059C997002C05DA7D1A05816FF4FA700F69EBD90E5383057
SHA-512:	35CD08DA72375983A4F3694D640C2D6AEA0D6841FF213AC75FE7EB94531A7EA3AE1FBD54C8EEDD181840F8F2AEBFCA377296BE20E36FBDEFE19736F6A2F3E836
Malicious:	false
Preview:	{"permissions":{},"data":{"attachment":{"hash":"281622d81cd32a41aa5e999261035b32305e831bdd7d0329707b34b7ecc60574","size":12130,"filename":"asrouter.ftl","location":"main-workspace/ms-language-packs/e6e33bb3-2687-4472-9c8e-704cfe811eed.ftl","mimetype":"application/octet-stream"},"id":"cfr-v1-en-US","last_modified":1614006637149}}.E%Ka.........bJ..bJ..D#U7`......q....:https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAABAAAAAAAAAAA///ADwAAAAEANgFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAYDMIIF/zCCA+egAwIBAgIQAzyzlZhv2/WO5YKmLDfWEjANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTIyMDQwMzAxMTgxNFoXDTIzMDQwMzAxMTgxNFowgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEw

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\cache2\entries\97AE667565B6120DDEBF42730CC21468FE5AC36E

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.061760689351129
Encrypted:	false
SSDEEP:	6:OG6KiLXDOLYX2qsH3X8sXWzdsDH+f2porCwFmPVGsDJ2IkrFm//l:pfiVmX8QuduH++aB7uJGpGl
MD5:	C2C828F755FCB28068CF79A6B390F14C
SHA1:	53F0A2EC5B9D6ECCF7AA65C4785D9FAF3CD7F6B5
SHA-256:	A335461C37414033F9F93357BFE805F7A0FFDE8B3083477F3A88322B9447276E
SHA-512:	1DC15F09D00446EFFB28DBE211524C0169C3F845DAA3B582BFC05182BF5395552A20822FDBB72C63B3E8629A00E8C00DB28E6FF58F778A8329A653FB86FEFFC9
Malicious:	false
Preview:	.#{........bJ..bJ..D#.........,....~predictor-origin,:https://www.facebook.com/.predictor::seen.1.predictor::resource-count.2.predictor::https://static.xx.fbcdn.net/.1,5,1649067536,4096.predictor::https://facebook.com/.1,2,1649067536,4096.....

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\cache2\entries\98E7F8D76509844398CCF67AC5DFA26D4F5053E5

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PEM certificate
Category:	dropped
Size (bytes):	13037
Entropy (8bit):	6.0481536251487515
Encrypted:	false
SSDEEP:	384:HXLu9fiGLm4pUfN6SUztzC8BDtL4xlIxlv:CBi8mCUf0SMu05
MD5:	C97170B07270363EC92039C407DFECFB
SHA1:	F24E85A94C65E0851846D03473AD94BCA714DFEC
SHA-256:	62667202F27F3962B5862FCD309BFB32C7FF0E4137FBF4D1CABA4908BE8D174F
SHA-512:	6C75B30C68F5FFAEB83C5F45925BFCC40DC23A74F9297A69F37E1EBFC6828A9959A06EF87625033DA34C0973434F6382FB11D28A75DE42BBB2A6D20DC1985FDB
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----.MIIDBTCCAougAwIBAgIIFn5aE8JedXAwCgYIKoZIzj0EAwMwgaMxCzAJBgNVBAYT.AlVTMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMS8wLQYDVQQLEyZNb3pp.bGxhIEFNTyBQcm9kdWN0aW9uIFNpZ25pbmcgU2VydmljZTFFMEMGA1UEAww8Q29u.dGVudCBTaWduaW5nIEludGVybWVkaWF0ZS9lbWFpbEFkZHJlc3M9Zm94c2VjQG1v.emlsbGEuY29tMB4XDTIxMDQxMjE1MDU1NloXDTIxMDcwMTE1MDU1NlowgakxCzAJ.BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFp.biBWaWV3MRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMRcwFQYDVQQLEw5D.bG91ZCBTZXJ2aWNlczE2MDQGA1UEAxMtcmVtb3RlLXNldHRpbmdzLmNvbnRlbnQt.c2lnbmF0dXJlLm1vemlsbGEub3JnMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE08Hf.rbfScSGwlh3hDbcnuQlnOA6X7x9s8Zia1dXyu2evbijUZc0vmOx92vrulbLwaDdw.MWBJsgZT5fzx1NOTHa+T3fnd/R0Ij72ytreK54nBEHE2CeOxy4BlC8U2qWJao4GD.MIGAMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSME.GDAWgBSgHUoXT4zCKzVF8WPx2nBwp8744TA4BgNVHREEMTAvgi1yZW1vdGUtc2V0.dGluZ3MuY29udGVudC1zaWduYXR1cmUubW96aWxsYS5vcmcwCgYIKoZIzj0EAwMD.aAAwZQIwVLbIXhDZCnzmrNx1t/u53ljRqjoaeM2UlIgy6GignmV/ok7QwQ4DVQ

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\startupCache\scriptCache-child-new.bin

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	2498423
Entropy (8bit):	5.131060721532733
Encrypted:	false
SSDEEP:	24576:3w9rGOSAjRz1nVVheWD1qqr9FlPvw7ACDbEzuyiyK+8lvTnagXlfexebSR0HnwIT:A9NPEkF5Qm2aw
MD5:	1B8EE481299EB66E466CE8297ED414C3
SHA1:	86390923DA3ADE97EDD5BB8C80944D62D96F848A
SHA-256:	BA0551754DAD9DA8BF18CC8644090D2B94FD0B056BA0426933704F2AA5563AEC
SHA-512:	FFFF254455B406C560F16BA2688F1D63F4BF691F173E3CD0755B5500180D9C625E81D7C2FEBFA19B78CFA91599E38861ECCDF89202D400087B046B75D2D079B0
Malicious:	false
Preview:	mozXDRcachev002......chrome://global/content/process-content.js.chrome://global/content/process-content.js....]....#.resource://gre/modules/XULStore.jsm8.jsloader/non-syntactic/resource/gre/modules/XULStore.jsm]....8...).resource://gre/modules/ComponentUtils.jsm>.jsloader/non-syntactic/resource/gre/modules/ComponentUtils.jsm&<.......(.resource://gre/modules/AsyncShutdown.jsm=.jsloader/non-syntactic/resource/gre/modules/AsyncShutdown.jsm"K.......6.resource://gre/modules/extensionProcessScriptLoader.js6.resource://gre/modules/extensionProcessScriptLoader.js....3....1.resource://gre/modules/ExtensionProcessScript.jsmF.jsloader/non-syntactic/resource/gre/modules/ExtensionProcessScript.jsm.....V...).resource://gre/modules/MessageChannel.jsm>.jsloader/non-syntactic/resource/gre/modules/MessageChannel.jsm.&.......).resource://gre/modules/ExtensionUtils.jsm>.jsloader/non-syntactic/resource/gre/modules/ExtensionUtils.jsm....?... .resource://gre/modules/Timer.jsm5.jsloader/non-syntactic/resou

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\startupCache\scriptCache-child.bin (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	2498423
Entropy (8bit):	5.131060721532733
Encrypted:	false
SSDEEP:	24576:3w9rGOSAjRz1nVVheWD1qqr9FlPvw7ACDbEzuyiyK+8lvTnagXlfexebSR0HnwIT:A9NPEkF5Qm2aw
MD5:	1B8EE481299EB66E466CE8297ED414C3
SHA1:	86390923DA3ADE97EDD5BB8C80944D62D96F848A
SHA-256:	BA0551754DAD9DA8BF18CC8644090D2B94FD0B056BA0426933704F2AA5563AEC
SHA-512:	FFFF254455B406C560F16BA2688F1D63F4BF691F173E3CD0755B5500180D9C625E81D7C2FEBFA19B78CFA91599E38861ECCDF89202D400087B046B75D2D079B0
Malicious:	false
Preview:	mozXDRcachev002......chrome://global/content/process-content.js.chrome://global/content/process-content.js....]....#.resource://gre/modules/XULStore.jsm8.jsloader/non-syntactic/resource/gre/modules/XULStore.jsm]....8...).resource://gre/modules/ComponentUtils.jsm>.jsloader/non-syntactic/resource/gre/modules/ComponentUtils.jsm&<.......(.resource://gre/modules/AsyncShutdown.jsm=.jsloader/non-syntactic/resource/gre/modules/AsyncShutdown.jsm"K.......6.resource://gre/modules/extensionProcessScriptLoader.js6.resource://gre/modules/extensionProcessScriptLoader.js....3....1.resource://gre/modules/ExtensionProcessScript.jsmF.jsloader/non-syntactic/resource/gre/modules/ExtensionProcessScript.jsm.....V...).resource://gre/modules/MessageChannel.jsm>.jsloader/non-syntactic/resource/gre/modules/MessageChannel.jsm.&.......).resource://gre/modules/ExtensionUtils.jsm>.jsloader/non-syntactic/resource/gre/modules/ExtensionUtils.jsm....?... .resource://gre/modules/Timer.jsm5.jsloader/non-syntactic/resou

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\startupCache\scriptCache-new.bin

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	7859524
Entropy (8bit):	5.219575623836962
Encrypted:	false
SSDEEP:	49152:8QdLG/jyHE9SM94KCAq21DDhM/eyLc1OnDHxW4bKjta4uLSiq2sh3oVT:iSM94Kg21DDhM/VLtbx7KjtaljdJ
MD5:	4DB5EE528B78AA5FC0E1EB0F17CEBD6E
SHA1:	F95BF2605AE1479B86DB5B640CD3F04F172E0355
SHA-256:	25FF0ECE0F21DEDFE882B6A9E1D51C8DAC41A00C152BD08B511A87F4A0F48B34
SHA-512:	43339B7B5B52DB8414D626961E9AEA0BC88D48F112A5AE302712E7E7D1F983ECFEE3B4729FE93F4A22EB635ED9BE2F13639A17040283AD80BACD294A3E8DB5CC
Malicious:	false
Preview:	mozXDRcachev002..v../.resource://gre/modules/MainProcessSingleton.jsmD.jsloader/non-syntactic/resource/gre/modules/MainProcessSingleton.jsm.........#.resource://gre/modules/Services.jsm8.jsloader/non-syntactic/resource/gre/modules/Services.jsm....a....1.resource://gre/modules/CustomElementsListener.jsmF.jsloader/non-syntactic/resource/gre/modules/CustomElementsListener.jsm`...K....#.resource:///modules/BrowserGlue.jsm;.jsloader/non-syntactic/resource/app/modules/BrowserGlue.jsm....i....%.resource://gre/modules/XPCOMUtils.jsm:.jsloader/non-syntactic/resource/gre/modules/XPCOMUtils.jsm.....N...'.resource://gre/modules/AppConstants.jsm<.jsloader/non-syntactic/resource/gre/modules/AppConstants.jsm....4......resource://gre/modules/TelemetryTimestamps.jsmC.jsloader/non-syntactic/resource/gre/modules/TelemetryTimestamps.jsm.........-.resource://gre/modules/ActorManagerParent.jsmB.jsloader/non-syntactic/resource/gre/modules/ActorManagerParent.jsm....jN...-.resource://gre/modules/EnterprisePoli

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\startupCache\scriptCache.bin (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	7859524
Entropy (8bit):	5.219575623836962
Encrypted:	false
SSDEEP:	49152:8QdLG/jyHE9SM94KCAq21DDhM/eyLc1OnDHxW4bKjta4uLSiq2sh3oVT:iSM94Kg21DDhM/VLtbx7KjtaljdJ
MD5:	4DB5EE528B78AA5FC0E1EB0F17CEBD6E
SHA1:	F95BF2605AE1479B86DB5B640CD3F04F172E0355
SHA-256:	25FF0ECE0F21DEDFE882B6A9E1D51C8DAC41A00C152BD08B511A87F4A0F48B34
SHA-512:	43339B7B5B52DB8414D626961E9AEA0BC88D48F112A5AE302712E7E7D1F983ECFEE3B4729FE93F4A22EB635ED9BE2F13639A17040283AD80BACD294A3E8DB5CC
Malicious:	false
Preview:	mozXDRcachev002..v../.resource://gre/modules/MainProcessSingleton.jsmD.jsloader/non-syntactic/resource/gre/modules/MainProcessSingleton.jsm.........#.resource://gre/modules/Services.jsm8.jsloader/non-syntactic/resource/gre/modules/Services.jsm....a....1.resource://gre/modules/CustomElementsListener.jsmF.jsloader/non-syntactic/resource/gre/modules/CustomElementsListener.jsm`...K....#.resource:///modules/BrowserGlue.jsm;.jsloader/non-syntactic/resource/app/modules/BrowserGlue.jsm....i....%.resource://gre/modules/XPCOMUtils.jsm:.jsloader/non-syntactic/resource/gre/modules/XPCOMUtils.jsm.....N...'.resource://gre/modules/AppConstants.jsm<.jsloader/non-syntactic/resource/gre/modules/AppConstants.jsm....4......resource://gre/modules/TelemetryTimestamps.jsmC.jsloader/non-syntactic/resource/gre/modules/TelemetryTimestamps.jsm.........-.resource://gre/modules/ActorManagerParent.jsmB.jsloader/non-syntactic/resource/gre/modules/ActorManagerParent.jsm....jN...-.resource://gre/modules/EnterprisePoli

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\startupCache\urlCache-new.bin

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	2438
Entropy (8bit):	4.819214573824827
Encrypted:	false
SSDEEP:	48:S2dXUzbkttISt3bqJtgtkt0IbFr9cHSW5caXBsyMJrBnq:S2dXUzb+Iq3bAcwfgsXJrBnq
MD5:	6D5A51AEBC26C101729F0BFA2918B08D
SHA1:	A894406153F50E4442A5635CDC934F44D9647F32
SHA-256:	2FE6CCD0D790705837968444E857723D717E75E12FEEC95EE6CF58ABB486693F
SHA-512:	D7BDCB2662B8AB069D45E7C5E46841CE3BF916CD6FBD8DD9F904F1BD90834567601BB78829EC3A95812731CBAD33274EDDBF214A2B4ED8B62EA0E56A6BBEA86E
Malicious:	false
Preview:	mozURLcachev002.r....].C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\xulstore.json.%.chrome/toolkit/content/global/xul.css...chrome/toolkit/skin/classic/global/tooltip.css...res/contenteditable.css.$.chrome/toolkit/res/counterstyles.css...res/designmode.css...chrome/toolkit/res/forms.css...chrome/toolkit/res/html.css...chrome/toolkit/res/mathml.css.-.chrome/toolkit/content/global/minimal-xul.css...chrome/toolkit/res/noframes.css...chrome/toolkit/res/noscript.css...chrome/toolkit/res/quirk.css.1.chrome/toolkit/skin/classic/global/scrollbars.css...res/svg.css...chrome/toolkit/res/ua.css.;.C:\Program Files\Mozilla Firefox\distribution\policies.json.3.chrome/browser/content/browser/built_in_addons.json.e.C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\addonStartup.json.lz4.0.chrome/en-US/locale/en-US/global/intl.properties.7.chrome/en-US/locale/en-US/global/aboutReader.properties.-.chrome/en-US/locale/branding/brand.properti

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\startupCache\urlCache.bin (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	2438
Entropy (8bit):	4.819214573824827
Encrypted:	false
SSDEEP:	48:S2dXUzbkttISt3bqJtgtkt0IbFr9cHSW5caXBsyMJrBnq:S2dXUzb+Iq3bAcwfgsXJrBnq
MD5:	6D5A51AEBC26C101729F0BFA2918B08D
SHA1:	A894406153F50E4442A5635CDC934F44D9647F32
SHA-256:	2FE6CCD0D790705837968444E857723D717E75E12FEEC95EE6CF58ABB486693F
SHA-512:	D7BDCB2662B8AB069D45E7C5E46841CE3BF916CD6FBD8DD9F904F1BD90834567601BB78829EC3A95812731CBAD33274EDDBF214A2B4ED8B62EA0E56A6BBEA86E
Malicious:	false
Preview:	mozURLcachev002.r....].C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\xulstore.json.%.chrome/toolkit/content/global/xul.css...chrome/toolkit/skin/classic/global/tooltip.css...res/contenteditable.css.$.chrome/toolkit/res/counterstyles.css...res/designmode.css...chrome/toolkit/res/forms.css...chrome/toolkit/res/html.css...chrome/toolkit/res/mathml.css.-.chrome/toolkit/content/global/minimal-xul.css...chrome/toolkit/res/noframes.css...chrome/toolkit/res/noscript.css...chrome/toolkit/res/quirk.css.1.chrome/toolkit/skin/classic/global/scrollbars.css...res/svg.css...chrome/toolkit/res/ua.css.;.C:\Program Files\Mozilla Firefox\distribution\policies.json.3.chrome/browser/content/browser/built_in_addons.json.e.C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\addonStartup.json.lz4.0.chrome/en-US/locale/en-US/global/intl.properties.7.chrome/en-US/locale/en-US/global/aboutReader.properties.-.chrome/en-US/locale/branding/brand.properti

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [IS0 14496-12:2003]
Category:	modified
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\SiteSecurityServiceState.txt

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	626
Entropy (8bit):	5.217056689971006
Encrypted:	false
SSDEEP:	12:MQiU4CbocQt314cCuUsZUHcQZ/cKlZL5wyZZr4cCuUxEboFhjUh0gQiUcaR:MLKC3JH2cMjCyZZrbTcFtqLqR
MD5:	F652EB8E632AEA6674460A6CEE58769A
SHA1:	EABC1852934A1F2898648C75F85AB98378361D63
SHA-256:	A74C083E533A923549DC90B78BDF1F149594B7C7585B36F47D7B5071761D9822
SHA-512:	3B0B349206CA547E63A22C623B8E684E81651D8BEA72EC124B622C0FEADE2D0B38359E141A355AEB754EF57851C4955B7175A68290885D5CCEB1E598FB7D3B19
Malicious:	false
Preview:	classify-client.services.mozilla.com:HSTS.0.18774.1653668948564,1,0,2.firefox.settings.services.mozilla.com:HSTS.1.19086.1653668962008,1,0,2.www.firefox.com^partitionKey=%28http%2Cmozilla.org%29:HSTS.0.18774.1653668950936,1,0,2.accounts.firefox.com:HSTS.0.18774.1653668950856,1,1,2.shavar.services.mozilla.com^firstPartyDomain=safebrowsing.86868755-6b82-4842-b301-72671a0db32e.mozilla:HSTS.1.19086.1653668950411,1,1,2.www.mozilla.org^partitionKey=%28http%2Cmozilla.org%29:HSTS.0.18774.1637857762968,1,1,2.normandy.cdn.mozilla.net:HSTS.0.18774.1653668948383,1,0,2.location.services.mozilla.com:HSTS.0.18774.1653668950086,1,1,2.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\addonStartup.json.lz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	2422
Entropy (8bit):	6.42159902961985
Encrypted:	false
SSDEEP:	48:P/Axkr/6ogYBejayxuG6zDa43YRUZ/HwhCVnyZcjNX7CgD:PWw/6oGjxwDb3YuZ/QhIsYlr
MD5:	003DF1AF81B7FD55F4B8812F9AF16988
SHA1:	311DD40D88128E312AD6CB0CC980C1D7B2BD1DD5
SHA-256:	312006E88D499F2F748FED931051D14BFF0E22A6DA1395231B325DE9ADF292E8
SHA-512:	642078FEA267FEA740DCD7B15E4050C6BBFFC77942E04B057EAE2B25A897596A375C46200F4ED1D4F97B6BB9A729871C74A217D0C327C990FBD42D7BCBE79FAF
Malicious:	false
Preview:	mozLz40..!....{"app-system-defaults":{"addon....doh-rollout@mozilla.org%..Gdependencies":[],"enabled":true,"lastModifiedTime":1620147305000,"loader":null,"path":r...".xpi","rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/....j. !/l..unInSafeMode...signedDate...telemetryKey..7%404...:2.0.0","version":"....},"formautofillh.T.s.........i.8.k...j.(.W..k..1i....`},"pic..#in...k.T.n..w...o.@.o...s.(.[..w..y..{..screenshotsv.T.r...q.@.j...l.(.V..g.!39V..J......},"webcompat-reporterp..Ofals..&.z...x.@.q.....(.]....=1.4.........{...4.)....p..q.I.h..h.1._.-21......startupData...pQ.astentL..!er...webRequest%..onBefore...[[{"incognito..EabId..!yp..."script"],"url..U"://v..-0...-testbed.herokuapp.com/shims_..Q.js",:.qexample .......Pexten ...../?..s...S.J/_2..@&_3U...static.adsafeprotected....vans-adapter-google-ima<..pagead2....syndication?...../js/adsby%..=...auth.9c9media.ca..V/main$..libs.cor.. ic...m/eluminate(...connect.facebook.net//sdk.js*...%..7all%.3www..t-analyt

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\addonStartup.json.lz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	2422
Entropy (8bit):	6.42159902961985
Encrypted:	false
SSDEEP:	48:P/Axkr/6ogYBejayxuG6zDa43YRUZ/HwhCVnyZcjNX7CgD:PWw/6oGjxwDb3YuZ/QhIsYlr
MD5:	003DF1AF81B7FD55F4B8812F9AF16988
SHA1:	311DD40D88128E312AD6CB0CC980C1D7B2BD1DD5
SHA-256:	312006E88D499F2F748FED931051D14BFF0E22A6DA1395231B325DE9ADF292E8
SHA-512:	642078FEA267FEA740DCD7B15E4050C6BBFFC77942E04B057EAE2B25A897596A375C46200F4ED1D4F97B6BB9A729871C74A217D0C327C990FBD42D7BCBE79FAF
Malicious:	false
Preview:	mozLz40..!....{"app-system-defaults":{"addon....doh-rollout@mozilla.org%..Gdependencies":[],"enabled":true,"lastModifiedTime":1620147305000,"loader":null,"path":r...".xpi","rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/....j. !/l..unInSafeMode...signedDate...telemetryKey..7%404...:2.0.0","version":"....},"formautofillh.T.s.........i.8.k...j.(.W..k..1i....`},"pic..#in...k.T.n..w...o.@.o...s.(.[..w..y..{..screenshotsv.T.r...q.@.j...l.(.V..g.!39V..J......},"webcompat-reporterp..Ofals..&.z...x.@.q.....(.]....=1.4.........{...4.)....p..q.I.h..h.1._.-21......startupData...pQ.astentL..!er...webRequest%..onBefore...[[{"incognito..EabId..!yp..."script"],"url..U"://v..-0...-testbed.herokuapp.com/shims_..Q.js",:.qexample .......Pexten ...../?..s...S.J/_2..@&_3U...static.adsafeprotected....vans-adapter-google-ima<..pagead2....syndication?...../js/adsby%..=...auth.9c9media.ca..V/main$..libs.cor.. ic...m/eluminate(...connect.facebook.net//sdk.js*...%..7all%.3www..t-analyt

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\cert9.db

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, last written using SQLite version 3034001
Category:	dropped
Size (bytes):	229376
Entropy (8bit):	0.5778546844197022
Encrypted:	false
SSDEEP:	384:m1zkVmvQhyn+Zoz67qxF8+Mg7cNlMMM0te:mbswcgMQ
MD5:	F6C45EBA3A929CF7FB32326676BDD644
SHA1:	9F98A1697AD169D969DE5505E19623EF6117F465
SHA-256:	EB6D4BA03FF8B7543843C6B0550C1950F709EF6995A10691CEF810A7CFE7F9A6
SHA-512:	F816DC0A48A293A0A94D163FC655BC47037BF11C84B0CB5DE89578F650BBE47088B37B17371A6F1A750D1B9986038ACC0FE4BD27B204F77BD6050FB1E760C2AE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................K......z..{...{.{j{*z.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\cert9.db-journal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	229944
Entropy (8bit):	0.45944186255415814
Encrypted:	false
SSDEEP:	384:7jK8+Mg7cNlMMM0PB1zkVmvQhyn+Zoz67u:5wcgM9P
MD5:	865129AACCEB0635025B81BFA3B047D8
SHA1:	3C92E499B0997B7921D50501A15CBBD1D8B0B45D
SHA-256:	5E1B78B3551F7261F218D466C3599A46D687889059059B46E4E2867461F1428F
SHA-512:	8BA4FD829DC126D1353C07867058CDCBBC21CAC79F65F62449B60364B27D2E8FD4A7A035CD83B8417B5219FAF13B39215B0FDEB89741F2DFACAF91498A2DFEB3
Malicious:	false
Preview:	.... .c.....D.'.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\cert_override.txt

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	477
Entropy (8bit):	5.737034118028876
Encrypted:	false
SSDEEP:	12:SgNXg8T+jrsbUTiLhjSsyfSP9fp5/fn1xPuyNYsv6fE+I2vXv:SbQYQjdP9p1a1kx+Z
MD5:	1E8EBB7705411BBDC7E7226C7005E7BD
SHA1:	E0D60AA8122A999D3F5188BEC7CD462C50C181B9
SHA-256:	8A357D96F2334E13129A6309033F9A4CF74591AAB46480E31786A6ED963BEB3D
SHA-512:	443924CBE2034C2A70916A7582853530D233E5D6C97E797483A28EFB0975CB1F129F352DD46226C5C37FE836DDDF33689DF1068C69AFA9A5E1E30896CC0B21CA
Malicious:	false
Preview:	# PSM Certificate Override Settings file..# This is a generated file! Do not edit...www.facebook.com:443.OID.2.16.840.1.101.3.4.2.1.00:A8:7E:09:4D:24:9D:74:0F:77:06:44:D4:04:FB:2C:07:D3:C7:2F:B0:94:70:81:C7:39:D3:2F:5F:AA:D5:FC.U.AAAAAAAAAAAAAAAQAAAAlQx3ezgfh4BGrkBIzjNfefkwgZIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMSowKAYDVQQKDCFUaGUgVW5pdmVyc2UgU2VjdXJpdHkgQ29tcGFueSBMdGQxKjAoBgNVBAMMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZA==..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\cookies.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\crashes\store.json.mozlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\crashes\store.json.mozlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\datareporting\aborted-session-ping (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	42472
Entropy (8bit):	5.257825775857997
Encrypted:	false
SSDEEP:	768:GTTIL//385YNxM/jsQfAfTIUfNshVuWF4J/D:GTTec5mrfTIUfNshVuWF4J7
MD5:	81D677D30E3A41204AA78D1792026B8A
SHA1:	2A7B96EEA7B9A714BBADED5469990635AB5D6494
SHA-256:	F4F33616EC2F3736798537E31F4094A4D76D9C42152740FF93567AD41836BEDF
SHA-512:	1C0B56F7417D86EBCBBA959FD22B10534B74590B85F2790768A59DE6411ACC0B6271C0E0B78419065260DBB29AA10A6AE819E1A35789865446991276BCC5D811
Malicious:	false
Preview:	{"type":"main","id":"d5c1c7b9-2c29-4b14-afb8-6901528e6762","creationDate":"2022-04-04T11:57:03.799Z","version":4,"application":{"architecture":"x86-64","buildId":"20210504152106","name":"Firefox","version":"88.0.1","displayVersion":"88.0.1","vendor":"Mozilla","platformVersion":"88.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"ver":4,"simpleMeasurements":{"totalTime":11856,"start":5895646,"main":5896343,"selectProfile":5896410,"afterProfileLocked":5896416,"startupCrashDetectionBegin":5898229,"startupCrashDetectionEnd":5956950,"firstPaint":5903047,"firstPaint2":5900835,"sessionRestoreInit":5898722,"sessionRestored":5907270,"createTopLevelWindow":5897204,"blankWindowShown":11793322,"AMI_startup_begin":11793346,"XPI_startup_begin":11793357,"XPI_bootstrap_addons_begin":11793397,"XPI_bootstrap_addons_end":11793425,"XPI_startup_end":11793426,"AMI_startup_end":11793426,"XPI_finalUIStartup":11793816,"sessionRestoreInitialized":11793818,"delayedStartupStarted":11799578,"delayedS

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\datareporting\aborted-session-ping.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	42472
Entropy (8bit):	5.257825775857997
Encrypted:	false
SSDEEP:	768:GTTIL//385YNxM/jsQfAfTIUfNshVuWF4J/D:GTTec5mrfTIUfNshVuWF4J7
MD5:	81D677D30E3A41204AA78D1792026B8A
SHA1:	2A7B96EEA7B9A714BBADED5469990635AB5D6494
SHA-256:	F4F33616EC2F3736798537E31F4094A4D76D9C42152740FF93567AD41836BEDF
SHA-512:	1C0B56F7417D86EBCBBA959FD22B10534B74590B85F2790768A59DE6411ACC0B6271C0E0B78419065260DBB29AA10A6AE819E1A35789865446991276BCC5D811
Malicious:	false
Preview:	{"type":"main","id":"d5c1c7b9-2c29-4b14-afb8-6901528e6762","creationDate":"2022-04-04T11:57:03.799Z","version":4,"application":{"architecture":"x86-64","buildId":"20210504152106","name":"Firefox","version":"88.0.1","displayVersion":"88.0.1","vendor":"Mozilla","platformVersion":"88.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"ver":4,"simpleMeasurements":{"totalTime":11856,"start":5895646,"main":5896343,"selectProfile":5896410,"afterProfileLocked":5896416,"startupCrashDetectionBegin":5898229,"startupCrashDetectionEnd":5956950,"firstPaint":5903047,"firstPaint2":5900835,"sessionRestoreInit":5898722,"sessionRestored":5907270,"createTopLevelWindow":5897204,"blankWindowShown":11793322,"AMI_startup_begin":11793346,"XPI_startup_begin":11793357,"XPI_bootstrap_addons_begin":11793397,"XPI_bootstrap_addons_end":11793425,"XPI_startup_end":11793426,"AMI_startup_end":11793426,"XPI_finalUIStartup":11793816,"sessionRestoreInitialized":11793818,"delayedStartupStarted":11799578,"delayedS

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\datareporting\archived\2022-04\1649073421381.da4d78e0-2aeb-47d0-86d7-421c4e2784ce.health.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	444
Entropy (8bit):	5.607659490638374
Encrypted:	false
SSDEEP:	12:v82Fgazit6gI6LuMVHkUQw8euzv/50UsHioRqOun:vtcFuGkdw8eo/52ioRDO
MD5:	6088067F34A5B6D4954CAA7C7BD6A6B7
SHA1:	4D289FD08309DA3DDAF1596D4CFCB4CD534A7611
SHA-256:	21949F93A36BE9E1229A0454502140D280CA4D62D42EE89F96E55383650E2578
SHA-512:	C5D6312B5DBB3D77D1EC52E656949CE5389F334A924618197FEBFEB1CE4F6858365D829AA23A3660831B20BD0C6F40EF7A87E333A70B9708365ED3BB15853281
Malicious:	false
Preview:	mozLz40......k{"type":"health","id":"da4d78e0-2aeb-47d0-86d7-421c4e2784ce","creationDate":"2022-04-04T11:57:01.381Z","version":4,"applic9...":{"architectur....x86-64","buildI....20210504152106","nam+.xFirefox_..."88.0.1","displayVy......vendor":"Mozilla","platform....xpcomAbi..._64-msvc....hannel":"release"},"payload.. os.....YWINNT..@10.02.@reas..."immediatY..sendFail....{"eUnreachable":1}},"client....a814a2a5-d8e6-4632-93d9-b725653c1b75"}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\datareporting\archived\2022-04\1649073421381.da4d78e0-2aeb-47d0-86d7-421c4e2784ce.health.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	444
Entropy (8bit):	5.607659490638374
Encrypted:	false
SSDEEP:	12:v82Fgazit6gI6LuMVHkUQw8euzv/50UsHioRqOun:vtcFuGkdw8eo/52ioRDO
MD5:	6088067F34A5B6D4954CAA7C7BD6A6B7
SHA1:	4D289FD08309DA3DDAF1596D4CFCB4CD534A7611
SHA-256:	21949F93A36BE9E1229A0454502140D280CA4D62D42EE89F96E55383650E2578
SHA-512:	C5D6312B5DBB3D77D1EC52E656949CE5389F334A924618197FEBFEB1CE4F6858365D829AA23A3660831B20BD0C6F40EF7A87E333A70B9708365ED3BB15853281
Malicious:	false
Preview:	mozLz40......k{"type":"health","id":"da4d78e0-2aeb-47d0-86d7-421c4e2784ce","creationDate":"2022-04-04T11:57:01.381Z","version":4,"applic9...":{"architectur....x86-64","buildI....20210504152106","nam+.xFirefox_..."88.0.1","displayVy......vendor":"Mozilla","platform....xpcomAbi..._64-msvc....hannel":"release"},"payload.. os.....YWINNT..@10.02.@reas..."immediatY..sendFail....{"eUnreachable":1}},"client....a814a2a5-d8e6-4632-93d9-b725653c1b75"}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\datareporting\archived\2022-04\1649073461468.4d4e9ed8-d41e-47c2-af5c-0d0eb3230cdd.event.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	3963
Entropy (8bit):	6.6449400396606615
Encrypted:	false
SSDEEP:	96:eRgPTgCfwjMkDtzUVvZY4GR4RWWsXOiFyi5zbtxGG:lgCoj5DtwV/Fs+ixRxGG
MD5:	8C73C45AE1CE55B4D1696121132F9D86
SHA1:	370ED8379906678297CD4BE48032E45B95DCC634
SHA-256:	B2B0F48903554D1D73CFCC71159D32193CB03B87697821E949B4B559469A757D
SHA-512:	73FC443C6FBD7620F98BC1FA7CAAEF24794E7DF24E2026BF4D4219135439FDDF16F0A4DED475F724047696702441EA55FF447CFEADBD2A17390D63CEFD62881C
Malicious:	false
Preview:	mozLz40......9{"type":"event","id":"4d4e9ed8-d41e-47c2-af5c-0d0eb3230cdd","creationDatC...2022-04-04T11:57:41.468Z","version":4,"applic9...":{"architecturE...x86-64","buildI....20210504152106","nam+.xFirefox_..."88.0.1","displayVy......vendor":"Mozilla","platform....xpcomAbi..._64-msvc....hannel":"release"},"payload..@reas..."shutdownh...rocessStartTimestamp":1649067480000,"ses-......6c0ac02b-3578-4714-8a9f-d5b58e6b387..8sub6...a4b34e6a-6240-4d77-927e-7c00bf89dc72","lostE...sCount":0,...s..0par....:[[5905349,"doh","st...,"rollback...ull"],[97953(.....(.u],"cont^.P54958....curity.ui.certerror...an.Xabout...#MOZILLA_PKIX_ERROR_MITM_DETECTED",{"has_sts":"fals..Ris_frA.....}],[5960505...1cli...advanced_butto.....;O7599...Pexcepz....@1]}}..1ent... a814a2a5-d8e6-4632-93d9-b725653c1b75","environm...{.........O...{ec8030f7-c20a-464f-9b0e-13a3a9e97384}"'..N......4. ........6...#.!..updaterAvailable":true'.Prtner ..distribu...!.."..............<..,..$or$..U.4orC...>..R..s":[]},"system....memoryM

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\datareporting\archived\2022-04\1649073461468.4d4e9ed8-d41e-47c2-af5c-0d0eb3230cdd.event.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	3963
Entropy (8bit):	6.6449400396606615
Encrypted:	false
SSDEEP:	96:eRgPTgCfwjMkDtzUVvZY4GR4RWWsXOiFyi5zbtxGG:lgCoj5DtwV/Fs+ixRxGG
MD5:	8C73C45AE1CE55B4D1696121132F9D86
SHA1:	370ED8379906678297CD4BE48032E45B95DCC634
SHA-256:	B2B0F48903554D1D73CFCC71159D32193CB03B87697821E949B4B559469A757D
SHA-512:	73FC443C6FBD7620F98BC1FA7CAAEF24794E7DF24E2026BF4D4219135439FDDF16F0A4DED475F724047696702441EA55FF447CFEADBD2A17390D63CEFD62881C
Malicious:	false
Preview:	mozLz40......9{"type":"event","id":"4d4e9ed8-d41e-47c2-af5c-0d0eb3230cdd","creationDatC...2022-04-04T11:57:41.468Z","version":4,"applic9...":{"architecturE...x86-64","buildI....20210504152106","nam+.xFirefox_..."88.0.1","displayVy......vendor":"Mozilla","platform....xpcomAbi..._64-msvc....hannel":"release"},"payload..@reas..."shutdownh...rocessStartTimestamp":1649067480000,"ses-......6c0ac02b-3578-4714-8a9f-d5b58e6b387..8sub6...a4b34e6a-6240-4d77-927e-7c00bf89dc72","lostE...sCount":0,...s..0par....:[[5905349,"doh","st...,"rollback...ull"],[97953(.....(.u],"cont^.P54958....curity.ui.certerror...an.Xabout...#MOZILLA_PKIX_ERROR_MITM_DETECTED",{"has_sts":"fals..Ris_frA.....}],[5960505...1cli...advanced_butto.....;O7599...Pexcepz....@1]}}..1ent... a814a2a5-d8e6-4632-93d9-b725653c1b75","environm...{.........O...{ec8030f7-c20a-464f-9b0e-13a3a9e97384}"'..N......4. ........6...#.!..updaterAvailable":true'.Prtner ..distribu...!.."..............<..,..$or$..U.4orC...>..R..s":[]},"system....memoryM

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\datareporting\archived\2022-04\1649073461470.c07646ef-d9d3-4d8c-811b-81063ab65053.health.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	5.6236861346121945
Encrypted:	false
SSDEEP:	12:vlcFgG1qpgI6ZHHMVHkUQw8euzv/50tWBQSi0Iun:vUwpKHGkdw8eo/5/aSi0IO
MD5:	89E495914020CDFEB611DAF2F6BCF61E
SHA1:	BF4438EE84DA39EECB08CFFAB5E0994F1DF30C26
SHA-256:	E0CA71575EE8D9244291D9D29C36A9596D5CB0D58D6DA809DB003A5E23EB1F57
SHA-512:	A017F1BC2FEB325BEDACE33509D47DE702086CB591D58F35481D5861565BF21DF067343515F8162FF03A09BF37815F195F5C3979D85AE48A34793B5A3221DDA5
Malicious:	false
Preview:	mozLz40......k{"type":"health","id":"c07646ef-d9d3-4d8c-811b-81063ab65053","creationDate":"2022-04-04T11:57:41.470Z","version":4,"applic9...":{"architectur....x86-64","buildI....20210504152106","nam+.xFirefox_..."88.0.1","displayVy......vendor":"Mozilla","platform....xpcomAbi..._64-msvc....hannel":"release"},"payload.. os.....YWINNT..@10.02.@reas...."shutdown","sendFail....{"eUnreachable":4}},"client....a814a2a5-d8e6-4632-93d9-b725653c1b75"}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\datareporting\archived\2022-04\1649073461470.c07646ef-d9d3-4d8c-811b-81063ab65053.health.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	5.6236861346121945
Encrypted:	false
SSDEEP:	12:vlcFgG1qpgI6ZHHMVHkUQw8euzv/50tWBQSi0Iun:vUwpKHGkdw8eo/5/aSi0IO
MD5:	89E495914020CDFEB611DAF2F6BCF61E
SHA1:	BF4438EE84DA39EECB08CFFAB5E0994F1DF30C26
SHA-256:	E0CA71575EE8D9244291D9D29C36A9596D5CB0D58D6DA809DB003A5E23EB1F57
SHA-512:	A017F1BC2FEB325BEDACE33509D47DE702086CB591D58F35481D5861565BF21DF067343515F8162FF03A09BF37815F195F5C3979D85AE48A34793B5A3221DDA5
Malicious:	false
Preview:	mozLz40......k{"type":"health","id":"c07646ef-d9d3-4d8c-811b-81063ab65053","creationDate":"2022-04-04T11:57:41.470Z","version":4,"applic9...":{"architectur....x86-64","buildI....20210504152106","nam+.xFirefox_..."88.0.1","displayVy......vendor":"Mozilla","platform....xpcomAbi..._64-msvc....hannel":"release"},"payload.. os.....YWINNT..@10.02.@reas...."shutdown","sendFail....{"eUnreachable":4}},"client....a814a2a5-d8e6-4632-93d9-b725653c1b75"}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\datareporting\archived\2022-04\1649073462515.02261d48-0564-4e3d-9859-ba76e838e396.main.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	16875
Entropy (8bit):	6.902852353523071
Encrypted:	false
SSDEEP:	384:N1rWS4ZrBLlD6UE/PMIB8KxksHIoo08XSMEaC9Z:N1v45LGUoBnxksH3o0+KZ
MD5:	66108694464D0FD1235EF1F1EA141857
SHA1:	19739BFDFE78247680B8C6CB0C07B4362767E9A1
SHA-256:	0539475CAEE92A0C6B9D1FC103D8CFA6D8586C704E646331E27D0DAB0978EFAF
SHA-512:	9E8E79D42725E8D3E78910BFE498D791946010C977860DB7ECD732BEE1FBD228B0D05790109AE9ACAAD813D1CD057346C8252D021DE29514E346EAA0234E2D5B
Malicious:	false
Preview:	mozLz40......i{"type":"main","id":"02261d48-0564-4e3d-9859-ba76e838e396","creationDate":"2022-04-04T11:57:42.515Z","version":4,"applic9...":{"architectur....x86-64","buildI...2021050415210x.0nam+.xFirefox_..."88.0.1","displayVy......vendor":"Mozilla","platform....xpcomAbi..._64-msvc....hannel":"release"},"payload..1ver....simpleMeasurements..ptotalTi....11895,"start":5895646,.......6343,"selectProfile'..6410,"after..dLocked...6T..upCrashDee.cionBegZ.O8229%.. EnH...956950,"firstPain..h903047...2..0083....essionRestoreIni3.`898722......b.S07270K...eTopLevelWindow...7204,"quitA8..5992460,"p...BeforeChang...995976,"blankN.PShownn.@7933..AAMI_u.Bup_b......~./XP..."57....bootstrap_addonsC..9&...eX..g.2425J........6.........finalUIS6.#upT..8.....Pializ...y..818,"delayed?.....!.=957!.bFinish".V800358..Interrupt...0Z..buggerAttac3..0d......VisibleReadBytes":4708......'.SWrite(.F2507z..S...O.o148859)...Q.0857....activeTicks":10..`rocess..`{"pare...{"scalar...networking.....ing_certs_task":....wi

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\datareporting\archived\2022-04\1649073462515.02261d48-0564-4e3d-9859-ba76e838e396.main.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	16875
Entropy (8bit):	6.902852353523071
Encrypted:	false
SSDEEP:	384:N1rWS4ZrBLlD6UE/PMIB8KxksHIoo08XSMEaC9Z:N1v45LGUoBnxksH3o0+KZ
MD5:	66108694464D0FD1235EF1F1EA141857
SHA1:	19739BFDFE78247680B8C6CB0C07B4362767E9A1
SHA-256:	0539475CAEE92A0C6B9D1FC103D8CFA6D8586C704E646331E27D0DAB0978EFAF
SHA-512:	9E8E79D42725E8D3E78910BFE498D791946010C977860DB7ECD732BEE1FBD228B0D05790109AE9ACAAD813D1CD057346C8252D021DE29514E346EAA0234E2D5B
Malicious:	false
Preview:	mozLz40......i{"type":"main","id":"02261d48-0564-4e3d-9859-ba76e838e396","creationDate":"2022-04-04T11:57:42.515Z","version":4,"applic9...":{"architectur....x86-64","buildI...2021050415210x.0nam+.xFirefox_..."88.0.1","displayVy......vendor":"Mozilla","platform....xpcomAbi..._64-msvc....hannel":"release"},"payload..1ver....simpleMeasurements..ptotalTi....11895,"start":5895646,.......6343,"selectProfile'..6410,"after..dLocked...6T..upCrashDee.cionBegZ.O8229%.. EnH...956950,"firstPain..h903047...2..0083....essionRestoreIni3.`898722......b.S07270K...eTopLevelWindow...7204,"quitA8..5992460,"p...BeforeChang...995976,"blankN.PShownn.@7933..AAMI_u.Bup_b......~./XP..."57....bootstrap_addonsC..9&...eX..g.2425J........6.........finalUIS6.#upT..8.....Pializ...y..818,"delayed?.....!.=957!.bFinish".V800358..Interrupt...0Z..buggerAttac3..0d......VisibleReadBytes":4708......'.SWrite(.F2507z..S...O.o148859)...Q.0857....activeTicks":10..`rocess..`{"pare...{"scalar...networking.....ing_certs_task":....wi

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\datareporting\glean\db\data.safe.bin

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	1447
Entropy (8bit):	4.123200911707807
Encrypted:	false
SSDEEP:	24:khcj1SWPq/gTACcl8/gTQ0q/gT9y6/S4n/QYp3/QKwbbnGlXFz8FsFBJe8qh:kCA/oTACc6oTOoT9HS2F9QfbbezaWJw
MD5:	E85F330C7E22B31F3184D89BCB574395
SHA1:	D5083B97E2A3EB29752DA402225E4D865E4D270C
SHA-256:	C8D5B3BA6C58C5477D037A9D5AA0CD3553A5235710408B855440D245412A8289
SHA-512:	B49DD79A4A70EBE0900D271ECC00B4A025460E2454CCA45E17D41354D4596B0B9A2B6088CAE42EE36EEEE2DB75FA43219B9DC32403A335E04650014B3D78D2A7
Malicious:	false
Preview:	.................ping....................metrics#fog.initialization.............................................metrics#glean.database.sizeM........D...................j.......................................q..........lX..?4.......metrics#glean.error.invalid_state/fog.initialization..................................user............(.......baseline#glean.validation.first_run_hour<........3...........#.......2021-05-27T09:29:10.047870900-07:00............glean_client_info#client_id9........0...........$.......92c9ed1b-e879-4f9b-8c54-c24c58e83fa3 .......glean_client_info#first_run_date<........3...........#.......2021-05-27T09:29:10.047870900-07:00............glean_internal_info#dirtybit......................'.......metrics#glean.validation.first_run_hour<........3...........#.......2021-05-27T09:29:10.047870900-07:00.............app....................glean_client_info#app_build#............................20210504152106........glean_client_info#app_channel.............................r

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\datareporting\session-state.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	161
Entropy (8bit):	4.905148016037787
Encrypted:	false
SSDEEP:	3:YWAqKsSVxdYcIAT63JBMf8R26zXXSWhzSXThJA2aqnLJrja/H5C:YWAqfSVxNIAT63J6fAdnjzSXVOanLFu4
MD5:	BC64F8474D893E7263F959570E7B1273
SHA1:	D12027BCF1C6BCFAFECB22054EACB2A960CDB76B
SHA-256:	A30EBF3DFEF08F54A90E7404AF1E7638398A6CA9BF96A3A4642032BCECE9FBFE
SHA-512:	E36B5B3F1A6F7156DF77F3F38BCE3E06BCDD6FA79CBC5A602C5AE75EB42A75529CA884A899D7D399FB183C41E308CBD7F992074152FB376501907FB9BD8465E7
Malicious:	false
Preview:	{"sessionId":"6c0ac02b-3578-4714-8a9f-d5b58e6b387a","subsessionId":"a4b34e6a-6240-4d77-927e-7c00bf89dc72","profileSubsessionCounter":3,"newProfilePingSent":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\datareporting\session-state.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	161
Entropy (8bit):	4.905148016037787
Encrypted:	false
SSDEEP:	3:YWAqKsSVxdYcIAT63JBMf8R26zXXSWhzSXThJA2aqnLJrja/H5C:YWAqfSVxNIAT63J6fAdnjzSXVOanLFu4
MD5:	BC64F8474D893E7263F959570E7B1273
SHA1:	D12027BCF1C6BCFAFECB22054EACB2A960CDB76B
SHA-256:	A30EBF3DFEF08F54A90E7404AF1E7638398A6CA9BF96A3A4642032BCECE9FBFE
SHA-512:	E36B5B3F1A6F7156DF77F3F38BCE3E06BCDD6FA79CBC5A602C5AE75EB42A75529CA884A899D7D399FB183C41E308CBD7F992074152FB376501907FB9BD8465E7
Malicious:	false
Preview:	{"sessionId":"6c0ac02b-3578-4714-8a9f-d5b58e6b387a","subsessionId":"a4b34e6a-6240-4d77-927e-7c00bf89dc72","profileSubsessionCounter":3,"newProfilePingSent":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\formhistory.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3034001
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.07359900544694019
Encrypted:	false
SSDEEP:	24:DLaVxExBWrkier5NzW6LlmProNpNmVIpPuVM7rBmxF/EzgvA:DGHMArt0pmcNptpGVM7rBw/v
MD5:	B7650A4376FF71B62E9FE5D4682FC79A
SHA1:	587B9DD53D3BA6E3C0BFE901896AC55E9CF77445
SHA-256:	39E2F0835980DB8EAB2C5CD0DD6D7C68551BBFEE0E9DDE958ED95F7D3B749CA9
SHA-512:	726F51BCBCBDB1B4DE1FAF190B8B7D4C95C6764BA4C51EF541A6B3E4D9C10C819D0D941A7B2C1E54C091A77016A51017A653A4B567C3A414A9EC3AE3E65A9FDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................K......z....~k}.\|o{.{wz...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\formhistory.sqlite-journal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	33288
Entropy (8bit):	0.4613769313845944
Encrypted:	false
SSDEEP:	24:7+tG6LicVxExBWrkier5NzW6LlmProNpNmVIpPuVM7rBmxF/Ezgv:7MG6RHMArt0pmcNptpGVM7rBw/vv
MD5:	D704733819D43C6A71BF5A9BB19EC845
SHA1:	6883D3179EA99BCA86E6273F994E57A88A7505BB
SHA-256:	53C667FDE93EBDCCE3B91FD00F8854C939FFD135D84D6188164050FD5BF46211
SHA-512:	898639B1A19175C9F57A660F17F89AB53F8808F9A4B49695C1C1E1C4A4BCC1A642F05FCC6776776E9B1BFA8AE200BC770C7A9CE7756E06FF89DF6D0BA41FFDD6
Malicious:	false
Preview:	.... .c......E......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................K......z....~k}.\|o{.{wz...........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\permissions.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 11, last written using SQLite version 3034001
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08814614798597824
Encrypted:	false
SSDEEP:	12:DBl/etxla0mwPxRymgObsCVR45wcYR4fmnsCVR4xNi4mV7vb5+:DLetmsh7Owd4+SNi95v0
MD5:	5ED9F76DC36035C728FB85B3D0121078
SHA1:	3956949C7BEB12F39470D288740CC531D99C5C0C
SHA-256:	CE8407D61902A24838320DED942E4D49E72934BA22F241C8396E9664EDBC09DA
SHA-512:	21887B88D816176D84FE1FCEF1B54442CB6A459289021771D7340BB0984D1B3AE90D657DC8674F65B2E25249DB19DB13EADCD4A7EE4C59C88CC16B90E98E418A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................K......~s..F~s........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\permissions.sqlite-journal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	66064
Entropy (8bit):	0.12036538841039322
Encrypted:	false
SSDEEP:	12:7+tJpAFjV7vb5+y6Bl/WSt8la0mwPxRymgObsCVR45wcYR4fmnsCVR45:7+tJpAFj5v0y6LNtjsh7Owd4+G
MD5:	A9D5A77413A6EE58EB4632827B6770BF
SHA1:	A461E4DE08C46D860F5B2A1F042CD8A6C5BBF7C7
SHA-256:	4F4FD822D57566B29AA9842C3E4ACE50B62A02165566F33835FA20D0027EBA0D
SHA-512:	1BABD199271F8F5285F9EC4852799A9D6FD143FD3BCA1F67E4C2AC00915593F63F90DD4F637EEE0CF0ED21FAFECCA60AE74663D07884E92839B6533ED45ABB19
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\places.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 54, last written using SQLite version 3034001
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03257269334574416
Encrypted:	false
SSDEEP:	96:Dcofp91cPADKpM12iMcyzbr4+4q2xfX7ZqxK24u4HjE4KgO50TrFVgd+4oCxTxP9:YYjcoBMcygNkZ4u4HjE4dPHgEeJp0
MD5:	6A75770B242E450C7AAE8483D0EA43E7
SHA1:	43C2EDFD4097BB4E1864F9E4CD5A8BE64110330B
SHA-256:	50A9C63E1498C2BDE1BF312D1E402E4297A22244EAABC8E5A1E07A7B22FE910C
SHA-512:	9689637D80BEC32E407BE17E3C65681521E209A05BCBF287CAB66A6BC9C0F54A7C3958179155E9471C616F7BA7D2E28F5E000ACA35C1B9B53E4C21A319444516
Malicious:	false
Preview:	SQLite format 3......@ .......%...............................6..................................K.....$j......}$\|.\|N{.{sz.z{z.yAx.x!w.v.wZu7tNt.s.s\r.rJq.p.q.p.o.o.o.m.mal&k.k.j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.05020425944432769
Encrypted:	false
SSDEEP:	6:GWF16n2DjF16n2JC89X3l/UFl/OpO8f8:BPMIPMYCsVcl/858
MD5:	D569E7235AF5B4F289E9F3B58C8CE09B
SHA1:	BB8982B39322333CCFF1E5268DBE5014A8770B89
SHA-256:	0C6600EFBB6E1858CBCE181E714966F4E0669F76CE4AF0FCE80CF671FF0784B2
SHA-512:	F5119D8FCD36D7ACE6654E106F41C9F6558A469CA2DC9350AB3756A0F4F40327EBF5921180FB6E26046D69A5EACAC0C87317D781D2B6A7E15109B454547CD46E
Malicious:	false
Preview:	..-......................(..K.......e..M..9.p~..-......................(..K.......e..M..9.p~........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	524704
Entropy (8bit):	0.137273312938459
Encrypted:	false
SSDEEP:	48:c+TIg+YKqL0uc70HpZzPwpqHulO4AgI9AOfOFUoIpKqL0uc70HpZzDvjkMIpR8sG:VeYiu/HyOgI9jOKniu/vjK24u1
MD5:	DC82B5AAE2A7F48B2A95C5DD809C6FC1
SHA1:	12628DBF4F70738906DD92896F8EFBB533DE83D0
SHA-256:	2D774641554B8E1035F783705CB288F8B249A7C14DF4A3D76182CDE951B95F50
SHA-512:	F5D33A880CC2037F0ED514E3D0F19F82DA6342BE285D475217608650D324037DD151296C4F4E14F81E62A8E77F7D38DA61FAED025309BCD0FA0FB6C1EDA7C31A
Malicious:	false
Preview:	7....-................e......}.=..............e..S../Z/.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	9299
Entropy (8bit):	5.299771545659499
Encrypted:	false
SSDEEP:	192:5OzTH8IXrqlWGwO5BpsL6gHc0HZwPvkw8YAtX:ttfM28wQtX
MD5:	B50EAF2BFD17FD94ABB4FCD869158822
SHA1:	FC42A4E80C99A43FF47B3498F3A97261048FB26B
SHA-256:	4737D9FC46B3111CF33A453D9C4B347333A6DCD0F96D74A55BAC9897E60F77C4
SHA-512:	64AB7C80038D36F4E06FDDBFFC304C2CAC538F5FDF510E83BA078258A43FD69ABE2F8EF718D43D160FE9513D34BF8D5255A514D62E06592DC29ED34F40692049
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 10);..user_pref("app.normandy.startupExperimentPrefs.browser.partnerlink.useAttributionURL", false);..user_pref("app.normandy.startupExperimentPrefs.browser.search.experiment", "unused");..user_pref("app.normandy.startupExperimentPrefs.browser.topsites.experiment.ebay-2020-1", false);..user_pref("app.normandy.startupExperimentPrefs.browser.topsites.useRemoteSetting", false);..user_pref("app.normandy.user_id", "95b885bd-0869-4fa8-9157-8d4073bc99a2");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.backgroundErr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	9299
Entropy (8bit):	5.299771545659499
Encrypted:	false
SSDEEP:	192:5OzTH8IXrqlWGwO5BpsL6gHc0HZwPvkw8YAtX:ttfM28wQtX
MD5:	B50EAF2BFD17FD94ABB4FCD869158822
SHA1:	FC42A4E80C99A43FF47B3498F3A97261048FB26B
SHA-256:	4737D9FC46B3111CF33A453D9C4B347333A6DCD0F96D74A55BAC9897E60F77C4
SHA-512:	64AB7C80038D36F4E06FDDBFFC304C2CAC538F5FDF510E83BA078258A43FD69ABE2F8EF718D43D160FE9513D34BF8D5255A514D62E06592DC29ED34F40692049
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 10);..user_pref("app.normandy.startupExperimentPrefs.browser.partnerlink.useAttributionURL", false);..user_pref("app.normandy.startupExperimentPrefs.browser.search.experiment", "unused");..user_pref("app.normandy.startupExperimentPrefs.browser.topsites.experiment.ebay-2020-1", false);..user_pref("app.normandy.startupExperimentPrefs.browser.topsites.useRemoteSetting", false);..user_pref("app.normandy.user_id", "95b885bd-0869-4fa8-9157-8d4073bc99a2");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.backgroundErr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\02261d48-0564-4e3d-9859-ba76e838e396 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	48804
Entropy (8bit):	5.260408496822985
Encrypted:	false
SSDEEP:	768:dDTyFkuQiyq9GsesFtOARp99KNshVuWF4J/D:dDTGv9BRp99KNshVuWF4J7
MD5:	15FBE18614E4D2B82519E6123603A447
SHA1:	371459583062CFF48E337CE2538EB886532A3DBE
SHA-256:	84D3F4051D841ED863404117A62FEA3866B113D749FFC931BD2AF4DE717527EC
SHA-512:	935E410C91C457AF5F533D4A4B272CE22A2E658F03BABB7FBCF83FCB454F60A557331471FEAD36E22484E1CA8ACD55FC1E3A6831B21922304BC5A8B6DB1C3521
Malicious:	false
Preview:	{"type":"main","id":"02261d48-0564-4e3d-9859-ba76e838e396","creationDate":"2022-04-04T11:57:42.515Z","version":4,"application":{"architecture":"x86-64","buildId":"20210504152106","name":"Firefox","version":"88.0.1","displayVersion":"88.0.1","vendor":"Mozilla","platformVersion":"88.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"ver":4,"simpleMeasurements":{"totalTime":11895,"start":5895646,"main":5896343,"selectProfile":5896410,"afterProfileLocked":5896416,"startupCrashDetectionBegin":5898229,"startupCrashDetectionEnd":5956950,"firstPaint":5903047,"firstPaint2":5900835,"sessionRestoreInit":5898722,"sessionRestored":5907270,"createTopLevelWindow":5897204,"quitApplication":5992460,"profileBeforeChange":5995976,"blankWindowShown":11793322,"AMI_startup_begin":11793346,"XPI_startup_begin":11793357,"XPI_bootstrap_addons_begin":11793397,"XPI_bootstrap_addons_end":11793425,"XPI_startup_end":11793426,"AMI_startup_end":11793426,"XPI_finalUIStartup":11793816,"sessionRestoreInitiali

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\02261d48-0564-4e3d-9859-ba76e838e396.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	48804
Entropy (8bit):	5.260408496822985
Encrypted:	false
SSDEEP:	768:dDTyFkuQiyq9GsesFtOARp99KNshVuWF4J/D:dDTGv9BRp99KNshVuWF4J7
MD5:	15FBE18614E4D2B82519E6123603A447
SHA1:	371459583062CFF48E337CE2538EB886532A3DBE
SHA-256:	84D3F4051D841ED863404117A62FEA3866B113D749FFC931BD2AF4DE717527EC
SHA-512:	935E410C91C457AF5F533D4A4B272CE22A2E658F03BABB7FBCF83FCB454F60A557331471FEAD36E22484E1CA8ACD55FC1E3A6831B21922304BC5A8B6DB1C3521
Malicious:	false
Preview:	{"type":"main","id":"02261d48-0564-4e3d-9859-ba76e838e396","creationDate":"2022-04-04T11:57:42.515Z","version":4,"application":{"architecture":"x86-64","buildId":"20210504152106","name":"Firefox","version":"88.0.1","displayVersion":"88.0.1","vendor":"Mozilla","platformVersion":"88.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"ver":4,"simpleMeasurements":{"totalTime":11895,"start":5895646,"main":5896343,"selectProfile":5896410,"afterProfileLocked":5896416,"startupCrashDetectionBegin":5898229,"startupCrashDetectionEnd":5956950,"firstPaint":5903047,"firstPaint2":5900835,"sessionRestoreInit":5898722,"sessionRestored":5907270,"createTopLevelWindow":5897204,"quitApplication":5992460,"profileBeforeChange":5995976,"blankWindowShown":11793322,"AMI_startup_begin":11793346,"XPI_startup_begin":11793357,"XPI_bootstrap_addons_begin":11793397,"XPI_bootstrap_addons_end":11793425,"XPI_startup_end":11793426,"AMI_startup_end":11793426,"XPI_finalUIStartup":11793816,"sessionRestoreInitiali

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\4d4e9ed8-d41e-47c2-af5c-0d0eb3230cdd (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	7855
Entropy (8bit):	5.23607641917698
Encrypted:	false
SSDEEP:	192:Qe+jzIRUoSocobcbhbAbVbhb6bibRbMbtbVcmJA6cxWQSxDhNd/:QDwXNbcNshVuWF4JcLxWQSxDvd/
MD5:	7EC2440670C63A81477A9666F122AEEF
SHA1:	24DDA2E4E385185AAE6F62585365AC8F4EE271BC
SHA-256:	F39DE8CE8E153DA6669B5AA2B5D1FBA2C193479BE09A009C92D3CA9D2B232590
SHA-512:	035475D41DE9F758774058AA93B9BCBEE4443A788CDF4E85FA072A036A4ABA453F1FB82636B50FBDC1D5CE9F2E1B821B10E38AB0102F6009A6DA8A6E5B0599D8
Malicious:	false
Preview:	{"type":"event","id":"4d4e9ed8-d41e-47c2-af5c-0d0eb3230cdd","creationDate":"2022-04-04T11:57:41.468Z","version":4,"application":{"architecture":"x86-64","buildId":"20210504152106","name":"Firefox","version":"88.0.1","displayVersion":"88.0.1","vendor":"Mozilla","platformVersion":"88.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"reason":"shutdown","processStartTimestamp":1649067480000,"sessionId":"6c0ac02b-3578-4714-8a9f-d5b58e6b387a","subsessionId":"a4b34e6a-6240-4d77-927e-7c00bf89dc72","lostEventsCount":0,"events":{"parent":[[5905349,"doh","state","rollback","null"],[97953,"doh","state","shutdown","null"]],"content":[[5954958,"security.ui.certerror","load","aboutcerterror","MOZILLA_PKIX_ERROR_MITM_DETECTED",{"has_sts":"false","is_frame":"false"}],[5960505,"security.ui.certerror","click","advanced_button","MOZILLA_PKIX_ERROR_MITM_DETECTED",{"has_sts":"false","is_frame":"false"}],[5967599,"security.ui.certerror","click","exception_button","MOZILLA_PKIX_ERROR_MITM_DETECTE

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\4d4e9ed8-d41e-47c2-af5c-0d0eb3230cdd.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	7855
Entropy (8bit):	5.23607641917698
Encrypted:	false
SSDEEP:	192:Qe+jzIRUoSocobcbhbAbVbhb6bibRbMbtbVcmJA6cxWQSxDhNd/:QDwXNbcNshVuWF4JcLxWQSxDvd/
MD5:	7EC2440670C63A81477A9666F122AEEF
SHA1:	24DDA2E4E385185AAE6F62585365AC8F4EE271BC
SHA-256:	F39DE8CE8E153DA6669B5AA2B5D1FBA2C193479BE09A009C92D3CA9D2B232590
SHA-512:	035475D41DE9F758774058AA93B9BCBEE4443A788CDF4E85FA072A036A4ABA453F1FB82636B50FBDC1D5CE9F2E1B821B10E38AB0102F6009A6DA8A6E5B0599D8
Malicious:	false
Preview:	{"type":"event","id":"4d4e9ed8-d41e-47c2-af5c-0d0eb3230cdd","creationDate":"2022-04-04T11:57:41.468Z","version":4,"application":{"architecture":"x86-64","buildId":"20210504152106","name":"Firefox","version":"88.0.1","displayVersion":"88.0.1","vendor":"Mozilla","platformVersion":"88.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"reason":"shutdown","processStartTimestamp":1649067480000,"sessionId":"6c0ac02b-3578-4714-8a9f-d5b58e6b387a","subsessionId":"a4b34e6a-6240-4d77-927e-7c00bf89dc72","lostEventsCount":0,"events":{"parent":[[5905349,"doh","state","rollback","null"],[97953,"doh","state","shutdown","null"]],"content":[[5954958,"security.ui.certerror","load","aboutcerterror","MOZILLA_PKIX_ERROR_MITM_DETECTED",{"has_sts":"false","is_frame":"false"}],[5960505,"security.ui.certerror","click","advanced_button","MOZILLA_PKIX_ERROR_MITM_DETECTED",{"has_sts":"false","is_frame":"false"}],[5967599,"security.ui.certerror","click","exception_button","MOZILLA_PKIX_ERROR_MITM_DETECTE

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\c07646ef-d9d3-4d8c-811b-81063ab65053 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	489
Entropy (8bit):	4.9816184732712
Encrypted:	false
SSDEEP:	12:YZFgG1qpgI6ZHHIVHlWwzlZFcVFDAQFWYzvZcDBuLZSqIun:YJwpKHSlJzlZWVFAQ4WZcD6ZSvO
MD5:	7B92B15C89C10CC5C35E23944EAF4F94
SHA1:	3B406B116C9F28541BAD9EF582E0213D24A2576B
SHA-256:	D7B5354A55AF72F4DDF6FF37519477EF4EC531901C38EF78A327159500EBD1F6
SHA-512:	1860AD6CDC460021D42BF88C9D00D65FA6D4DEAD12B6FF61333FF72DF88735EA446BC1108354DBAE10E83F61CA6C26FBEADDAD377D364CA22D24F7174D3AFACA
Malicious:	false
Preview:	{"type":"health","id":"c07646ef-d9d3-4d8c-811b-81063ab65053","creationDate":"2022-04-04T11:57:41.470Z","version":4,"application":{"architecture":"x86-64","buildId":"20210504152106","name":"Firefox","version":"88.0.1","displayVersion":"88.0.1","vendor":"Mozilla","platformVersion":"88.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"os":{"name":"WINNT","version":"10.0"},"reason":"shutdown","sendFailure":{"eUnreachable":4}},"clientId":"a814a2a5-d8e6-4632-93d9-b725653c1b75"}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\c07646ef-d9d3-4d8c-811b-81063ab65053.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	489
Entropy (8bit):	4.9816184732712
Encrypted:	false
SSDEEP:	12:YZFgG1qpgI6ZHHIVHlWwzlZFcVFDAQFWYzvZcDBuLZSqIun:YJwpKHSlJzlZWVFAQ4WZcD6ZSvO
MD5:	7B92B15C89C10CC5C35E23944EAF4F94
SHA1:	3B406B116C9F28541BAD9EF582E0213D24A2576B
SHA-256:	D7B5354A55AF72F4DDF6FF37519477EF4EC531901C38EF78A327159500EBD1F6
SHA-512:	1860AD6CDC460021D42BF88C9D00D65FA6D4DEAD12B6FF61333FF72DF88735EA446BC1108354DBAE10E83F61CA6C26FBEADDAD377D364CA22D24F7174D3AFACA
Malicious:	false
Preview:	{"type":"health","id":"c07646ef-d9d3-4d8c-811b-81063ab65053","creationDate":"2022-04-04T11:57:41.470Z","version":4,"application":{"architecture":"x86-64","buildId":"20210504152106","name":"Firefox","version":"88.0.1","displayVersion":"88.0.1","vendor":"Mozilla","platformVersion":"88.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"os":{"name":"WINNT","version":"10.0"},"reason":"shutdown","sendFailure":{"eUnreachable":4}},"clientId":"a814a2a5-d8e6-4632-93d9-b725653c1b75"}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\da4d78e0-2aeb-47d0-86d7-421c4e2784ce (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	490
Entropy (8bit):	4.936940734820901
Encrypted:	false
SSDEEP:	12:YZFgazit6gI6LuIVHlWwzlZFcVFDAQFWYzvZcyBuLZaIun:YVcFuSlJzlZWVFAQ4WZcy6ZfO
MD5:	273A1F6A223CEBB1F3FBAEE1FB981241
SHA1:	BECEA2A2E39994BE10B78D31A491B0AA1FEC4D79
SHA-256:	D5D3A329D45E85DFD6F007982B95B0ADAEE93B544403E9B557DE531A4950C842
SHA-512:	69B051772C0617CC7AED7787E73E9B9C6D8D6F1FA2FB9F4B4DFF55690CD734A1ED9FB2D06CBE0BFA85E1D332794B78386721FDB67DC5DF8D54DE965ED9CC6D56
Malicious:	false
Preview:	{"type":"health","id":"da4d78e0-2aeb-47d0-86d7-421c4e2784ce","creationDate":"2022-04-04T11:57:01.381Z","version":4,"application":{"architecture":"x86-64","buildId":"20210504152106","name":"Firefox","version":"88.0.1","displayVersion":"88.0.1","vendor":"Mozilla","platformVersion":"88.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"os":{"name":"WINNT","version":"10.0"},"reason":"immediate","sendFailure":{"eUnreachable":1}},"clientId":"a814a2a5-d8e6-4632-93d9-b725653c1b75"}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\da4d78e0-2aeb-47d0-86d7-421c4e2784ce.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	490
Entropy (8bit):	4.936940734820901
Encrypted:	false
SSDEEP:	12:YZFgazit6gI6LuIVHlWwzlZFcVFDAQFWYzvZcyBuLZaIun:YVcFuSlJzlZWVFAQ4WZcy6ZfO
MD5:	273A1F6A223CEBB1F3FBAEE1FB981241
SHA1:	BECEA2A2E39994BE10B78D31A491B0AA1FEC4D79
SHA-256:	D5D3A329D45E85DFD6F007982B95B0ADAEE93B544403E9B557DE531A4950C842
SHA-512:	69B051772C0617CC7AED7787E73E9B9C6D8D6F1FA2FB9F4B4DFF55690CD734A1ED9FB2D06CBE0BFA85E1D332794B78386721FDB67DC5DF8D54DE965ED9CC6D56
Malicious:	false
Preview:	{"type":"health","id":"da4d78e0-2aeb-47d0-86d7-421c4e2784ce","creationDate":"2022-04-04T11:57:01.381Z","version":4,"application":{"architecture":"x86-64","buildId":"20210504152106","name":"Firefox","version":"88.0.1","displayVersion":"88.0.1","vendor":"Mozilla","platformVersion":"88.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"os":{"name":"WINNT","version":"10.0"},"reason":"immediate","sendFailure":{"eUnreachable":1}},"clientId":"a814a2a5-d8e6-4632-93d9-b725653c1b75"}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\search.json.mozlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	180
Entropy (8bit):	5.359164509416579
Encrypted:	false
SSDEEP:	3:3fXs/TDAbSNtpYgElvkKApaBlxJVJAEHfe1TliyKIbhfOM6MsA4rlOROVmxSED1u:vXsbD2SNtSapaBlP7521T0yTbhfO/xgi
MD5:	EDC2299EBA84E99AF7C7438ECB7A6CF4
SHA1:	FD562C93796934560252CC8DF511B0A18BFFA47F
SHA-256:	CF230F5192B5F53B410CB948B49A0BE09FAD7E80B9125E0D4F348C12C12BC9B2
SHA-512:	D49D67555876385A3E41F104FD93164BD57A4BEA9ACAF4E82670617827E38C964E21789D5DE3E8064D245477A1820AF78240B61DB8B1FD146C91E31B7415B805
Malicious:	false
Preview:	mozLz40.b....A{"version":6,"engines":[{"_name":"Google","_isAppProvided":true,"_metaData":{}},8..Amazon.com<...Wikipedia (en)@..OBing6..@Duck../Go<..7],"...."useSavedOrder":false}}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\search.json.mozlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	180
Entropy (8bit):	5.359164509416579
Encrypted:	false
SSDEEP:	3:3fXs/TDAbSNtpYgElvkKApaBlxJVJAEHfe1TliyKIbhfOM6MsA4rlOROVmxSED1u:vXsbD2SNtSapaBlP7521T0yTbhfO/xgi
MD5:	EDC2299EBA84E99AF7C7438ECB7A6CF4
SHA1:	FD562C93796934560252CC8DF511B0A18BFFA47F
SHA-256:	CF230F5192B5F53B410CB948B49A0BE09FAD7E80B9125E0D4F348C12C12BC9B2
SHA-512:	D49D67555876385A3E41F104FD93164BD57A4BEA9ACAF4E82670617827E38C964E21789D5DE3E8064D245477A1820AF78240B61DB8B1FD146C91E31B7415B805
Malicious:	false
Preview:	mozLz40.b....A{"version":6,"engines":[{"_name":"Google","_isAppProvided":true,"_metaData":{}},8..Amazon.com<...Wikipedia (en)@..OBing6..@Duck../Go<..7],"...."useSavedOrder":false}}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	288
Entropy (8bit):	4.271085273892442
Encrypted:	false
SSDEEP:	6:Y9KQOy6Lb1BA+m2L69YsMH7uMHeWmeMOJiS0SeMOJiIHeMOcAJ6L2L6NpQ9:YoQOJs+RLVHXH7JiLJiIaxwqL0q
MD5:	E08EF355498AE2C73E75F5A7E60EADA5
SHA1:	C98B5AB80782513F6E72D95AB070E1ED7626C576
SHA-256:	D1A98A30522D1BF882574DF5ED2793BBA5C4FDF0381788BABEA0846F6946745C
SHA-512:	A0550E83ECD1CF632B4E54BF43744EE9F7C0A8DFCF9A043E018C00D4CA0BBA606CFCAAA469B204E7C9DFFEC1F79B91E16CD4F1C94FF512C45D3DD25B7174E859
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true,"quit-application-granted":true,"quit-application":true,"profile-change-net-teardown":true,"profile-change-teardown":true,"profile-before-change":true,"sessionstore-final-state-write-complete":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	288
Entropy (8bit):	4.271085273892442
Encrypted:	false
SSDEEP:	6:Y9KQOy6Lb1BA+m2L69YsMH7uMHeWmeMOJiS0SeMOJiIHeMOcAJ6L2L6NpQ9:YoQOJs+RLVHXH7JiLJiIaxwqL0q
MD5:	E08EF355498AE2C73E75F5A7E60EADA5
SHA1:	C98B5AB80782513F6E72D95AB070E1ED7626C576
SHA-256:	D1A98A30522D1BF882574DF5ED2793BBA5C4FDF0381788BABEA0846F6946745C
SHA-512:	A0550E83ECD1CF632B4E54BF43744EE9F7C0A8DFCF9A043E018C00D4CA0BBA606CFCAAA469B204E7C9DFFEC1F79B91E16CD4F1C94FF512C45D3DD25B7174E859
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true,"quit-application-granted":true,"quit-application":true,"profile-change-net-teardown":true,"profile-change-teardown":true,"profile-before-change":true,"sessionstore-final-state-write-complete":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	1785
Entropy (8bit):	6.52933774781897
Encrypted:	false
SSDEEP:	24:v2SUGsxeLuSKXaqHYH4cjWOmtW6GercT984VKHcO5ItsaI5RumEpHqRpAL:OpkzJKYpKJkPiQ84VKitsaIkhqbAL
MD5:	19E09A3B58B3A672AD56155C0CEE6F99
SHA1:	525A3642CB988CAC78F6BDBFFC7B05DF60F13664
SHA-256:	A68C09F1D41216C9669B833A465EA7CE576040DAF52514A8451194F919AF074E
SHA-512:	0C32906F526918933278D9E4D6073FEA8BC5DCA0635095E9C6DDC7045ADB9CDCD6662E713172DB41306E2E956DC56EA358C81AADF8C739C1169A5B29D2B982A2
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie...=url":"about:home","title":"New Tab","cacheKey":0,"ID":4100939033,"docshellUU...6"{b3dec25d-16c6-4870-96fe-f443498463b8}","resultPrincipalURI":null,"p...rToInherit_base64":"eyIwIjp7IjAiOiJtb3otbnVsbHByaW5jaXBhbDp7Y2UxNWQ2N2EtN2Q5NC00YjkzLWE2NTgtNzQwOTIxZjU3YWI3fSJ9fQ==","partitioned.....c..hasUserInteract....true,"triggeringA..$..z$.0fX0....docIdentifier":10737418241,"persistW.$},....https://www.facebook.com/...$...1..2...(.$@ferr....fo":"BBoSnxDOS9qmDeAnom1e0A...w..#EY.."EB...EA","origino..........1....loadReplace":false..qesState...s...H..."0>html>2","scrol...0,22500"}]9..../.!NDM0ZTAyNWQtOGE4ZC00MDhiLWE3MTMtYTUxZGZjNjAyOTkw..G...(...L.2....],"lastAccessed":1649073443059,"hidden...searchMode...userContextId2..attributs..{},"index...,..TypedValue":""..QClearA.Cimag`....aselect...,"_closedT..u],"busy....width":937,"height":694u.eeenX":...Y..Aizem..."maximized......BeforeMin...&..workspace...0..p1-01d9-...-00d8-e9

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	1785
Entropy (8bit):	6.52933774781897
Encrypted:	false
SSDEEP:	24:v2SUGsxeLuSKXaqHYH4cjWOmtW6GercT984VKHcO5ItsaI5RumEpHqRpAL:OpkzJKYpKJkPiQ84VKitsaIkhqbAL
MD5:	19E09A3B58B3A672AD56155C0CEE6F99
SHA1:	525A3642CB988CAC78F6BDBFFC7B05DF60F13664
SHA-256:	A68C09F1D41216C9669B833A465EA7CE576040DAF52514A8451194F919AF074E
SHA-512:	0C32906F526918933278D9E4D6073FEA8BC5DCA0635095E9C6DDC7045ADB9CDCD6662E713172DB41306E2E956DC56EA358C81AADF8C739C1169A5B29D2B982A2
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie...=url":"about:home","title":"New Tab","cacheKey":0,"ID":4100939033,"docshellUU...6"{b3dec25d-16c6-4870-96fe-f443498463b8}","resultPrincipalURI":null,"p...rToInherit_base64":"eyIwIjp7IjAiOiJtb3otbnVsbHByaW5jaXBhbDp7Y2UxNWQ2N2EtN2Q5NC00YjkzLWE2NTgtNzQwOTIxZjU3YWI3fSJ9fQ==","partitioned.....c..hasUserInteract....true,"triggeringA..$..z$.0fX0....docIdentifier":10737418241,"persistW.$},....https://www.facebook.com/...$...1..2...(.$@ferr....fo":"BBoSnxDOS9qmDeAnom1e0A...w..#EY.."EB...EA","origino..........1....loadReplace":false..qesState...s...H..."0>html>2","scrol...0,22500"}]9..../.!NDM0ZTAyNWQtOGE4ZC00MDhiLWE3MTMtYTUxZGZjNjAyOTkw..G...(...L.2....],"lastAccessed":1649073443059,"hidden...searchMode...userContextId2..attributs..{},"index...,..TypedValue":""..QClearA.Cimag`....aselect...,"_closedT..u],"busy....width":937,"height":694u.eeenX":...Y..Aizem..."maximized......BeforeMin...&..workspace...0..p1-01d9-...-00d8-e9

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\sessionstore.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	1796
Entropy (8bit):	6.539620627405057
Encrypted:	false
SSDEEP:	48:Cp0WzkYPua3Z4NKjG0KiZVhH2IAywKbAL:TT0ua3Z4klHFAB3L
MD5:	F3A2156CBCBD516BAE0C629BD01AEC72
SHA1:	A99D30A995333E82298D078E5AB5F06FC5D98AD5
SHA-256:	BDE3AEAA39EE4059DF3333BA9A2077F2AA73EF6D5A8723E14786883CB71B3F3C
SHA-512:	D4B4862730A5403582FF4C359A571FA4E51607F6EE6B18C2D649A3C4CA9B0AFDFC6F53CC3B8F91B66D573951FEC4F1E4F795BAB95D43D1DA21F8BC0C977D717A
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie...=url":"about:home","title":"New Tab","cacheKey":0,"ID":4100956813,"docshellUU...6"{b3dec25d-16c6-4870-96fe-f443498463b8}","resultPrincipalURI":null,"p...rToInherit_base64":"eyIwIjp7IjAiOiJtb3otbnVsbHByaW5jaXBhbDp7Y2UxNWQ2N2EtN2Q5NC00YjkzLWE2NTgtNzQwOTIxZjU3YWI3fSJ9fQ==","partitioned.....c..hasUserInteract....true,"triggeringA..$..z$.0fX0....docIdentifier":12884901889,"persistW.$},....https://www.facebook.com/...$...1...7...1.$@ferr....fo":"BBoSnxDOS9qmDeAnom1e0A...w..#EY.."EB...EA","originx..........1....loadReplace":false..qesState...s...Q..."0>html>2","scrol...0,22500"}]9..../.!NDM0ZTAyNWQtOGE4ZC00MDhiLWE3MTMtYTUxZGZjNjAyOTkw..G...(...K,90....],"lastAccessed":1649073454892,"hidden...searchMode...userContextId;..attribut\|..{},"index":2d..questedI...0?..TypedValue":""..QClear'.Cimags../.aselect...,"_closedT..u],"busy....width":937,"height":694..eeenX":...Y..Aizem..."maximized......BeforeMin...&..workspace&..0..p1

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\sessionstore.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	1796
Entropy (8bit):	6.539620627405057
Encrypted:	false
SSDEEP:	48:Cp0WzkYPua3Z4NKjG0KiZVhH2IAywKbAL:TT0ua3Z4klHFAB3L
MD5:	F3A2156CBCBD516BAE0C629BD01AEC72
SHA1:	A99D30A995333E82298D078E5AB5F06FC5D98AD5
SHA-256:	BDE3AEAA39EE4059DF3333BA9A2077F2AA73EF6D5A8723E14786883CB71B3F3C
SHA-512:	D4B4862730A5403582FF4C359A571FA4E51607F6EE6B18C2D649A3C4CA9B0AFDFC6F53CC3B8F91B66D573951FEC4F1E4F795BAB95D43D1DA21F8BC0C977D717A
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie...=url":"about:home","title":"New Tab","cacheKey":0,"ID":4100956813,"docshellUU...6"{b3dec25d-16c6-4870-96fe-f443498463b8}","resultPrincipalURI":null,"p...rToInherit_base64":"eyIwIjp7IjAiOiJtb3otbnVsbHByaW5jaXBhbDp7Y2UxNWQ2N2EtN2Q5NC00YjkzLWE2NTgtNzQwOTIxZjU3YWI3fSJ9fQ==","partitioned.....c..hasUserInteract....true,"triggeringA..$..z$.0fX0....docIdentifier":12884901889,"persistW.$},....https://www.facebook.com/...$...1...7...1.$@ferr....fo":"BBoSnxDOS9qmDeAnom1e0A...w..#EY.."EB...EA","originx..........1....loadReplace":false..qesState...s...Q..."0>html>2","scrol...0,22500"}]9..../.!NDM0ZTAyNWQtOGE4ZC00MDhiLWE3MTMtYTUxZGZjNjAyOTkw..G...(...K,90....],"lastAccessed":1649073454892,"hidden...searchMode...userContextId;..attribut\|..{},"index":2d..questedI...0?..TypedValue":""..QClear'.Cimags../.aselect...,"_closedT..u],"busy....width":937,"height":694..eeenX":...Y..Aizem..."maximized......BeforeMin...&..workspace&..0..p1

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 416, last written using SQLite version 3034001
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	3.9374074809518724
Encrypted:	false
SSDEEP:	768:f6S6CrAWSkvjUpjoPCUzpam2vqQzbmu6zh64K6sDMoH:f6S673wjARCuoI6G
MD5:	CB2EE1EDB24838E27868582DA742AF58
SHA1:	2120256B3760CF88246A1796F933001B125E3057
SHA-256:	16ABEC422FF5BEC969ECCD903CED63E4C18F47F97BBBD567DCFAFB495D46248A
SHA-512:	003478ADDEBD00627E23DBEEC9757BDE457A1F7E8F230BE2F5BE65DBE6DB6849CC4965427DAED187A6629566F8C17834D6B6D557865738BFCB3103765AE1727F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................K............;.......[..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................-...3....triggerfile_update_triggerfileCREATE TRIGGER file_update_trigger AFTER UPDATE ON file FOR EACH ROW WHEN NEW.refcount = 0 BEGIN DELETE FROM file WHERE id = OLD.id; END.Y...A#..Ytriggerobject_data_delete

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.03448893722889514
Encrypted:	false
SSDEEP:	3:Gtl9txlllbuKE5Cpjl41l9txlllbuKE5Cpj9nR9//pOl:GtTE5Ojl4TE5Oj9R9Xg
MD5:	7CBCAE8FBDC4757BA2FF965F6D278789
SHA1:	D2B4E38672D9BA5AA5123B1B4BCBD0B326307D67
SHA-256:	CA4C7E45703D2FD04424911D0F9477695D27D8B46EC563F9C1392CF0D27898C6
SHA-512:	AB57A6E5F08ECAB7BC55111534EBA76AF5F7EFABB2C4B340DF643A445DE0474813050BCB692CE1958C91AFD3A00E445058281E206A54D2ED07FAE81EF8AAF088
Malicious:	false
Preview:	..-.....................v.3\U..U...a......pR5...-.....................v.3\U..U...a......pR5.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 416, last written using SQLite version 3034001
Category:	dropped
Size (bytes):	983040
Entropy (8bit):	4.826692545258547
Encrypted:	false
SSDEEP:	12288:khhAybxxDPFSa+5d8D20q8jPERNKOnjQBd2vgjp:kXvcxdIqYPEnU
MD5:	42F985F08398B10E1DFF6BF490D8BC74
SHA1:	454425728B8DCAE33970ECDC41A2FDCD54AE03C1
SHA-256:	BDE887BD50370F710F6D7E7FBF78C964688CE61DBEEF064884CFB197197D63BD
SHA-512:	9D2CBB872BB6FFCC96BB3DB5051C8EE5EDFF14CE9BBD974EEE3B154FA734E553A99387E8AFCFDD12F3DBD14D539EA10E7277D95EEF05256051AFEE357A4E3E57
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................K............;.......[..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................-...3....triggerfile_update_triggerfileCREATE TRIGGER file_update_trigger AFTER UPDATE ON file FOR EACH ROW WHEN NEW.refcount = 0 BEGIN DELETE FROM file WHERE id = OLD.id; END.Y...A#..Ytriggerobject_data_delete

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	49472
Entropy (8bit):	5.159235985531704
Encrypted:	false
SSDEEP:	768:XJ6S6CrAWgrenyoDq+l4wD/AjUoxOH7sD4w9rqFfWflhIW3BDtGT4oxOB:XJ6S6b8yoDq+ywkQpH7Ex92FduxZpB
MD5:	72CC15C73A034E6AC7CE2F2C14350EC4
SHA1:	1CCACC84FEA131D7E6BC34E660B4210925CD4233
SHA-256:	A5A9BBC8BBFE7710736D6C11C6A40867BB9F992FA2D73EDE6DDB6A654130DC98
SHA-512:	B21AC67C96F2F9ED9E9CC7EC2CB0F45591E4A7F809EE41F7E00436075CA85909EE3828E7BAED097FAA5873F774347B61E5FF4ACB9EB00E3545C9D64B2FA4C87D
Malicious:	false
Preview:	7....-...........9...q....<....N.........9...q....4..37.SQLite format 3......@ ..........................................................................K............;.......[..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................-...3....triggerfile_update_triggerfileCREATE TRIGGER file_update_trigger AFTER UPDATE ON file FOR EACH ROW WHEN NEW.refcount = 0 BEGIN DELETE FROM file W

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\webappsstore.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\xulstore.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.502248084518804
Encrypted:	false
SSDEEP:	6:YGNTG/SJsAUv54rHItMHEHKgfQYV2fVH8qLO:YGNdciHmGEHKgfV2tH8aO
MD5:	A82FA3D775E7834800A70CFA5E34A924
SHA1:	C0A776B13A8878983B4E13D6E628322852BDF3C3
SHA-256:	B5D74ABAF4C4C9FD547DC7F1D6C1BA7AC971F9A9A8015190FFB6718C7C1F7541
SHA-512:	C04F28D36300ED8126784617C1F3571CBD9015D031D24909C47E87F3C1AB1841354BF03092E3C0A341971BF10C67742FD2CEC99150D0CA8B49348263C8ACFF67
Malicious:	false
Preview:	{"chrome://browser/content/browser.xhtml":{"main-window":{"screenX":"4","screenY":"4","width":"937","height":"694","sizemode":"maximized"},"sidebar-box":{"sidebarcommand":"","width":""},"sidebar-title":{"value":""}}}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\xulstore.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.502248084518804
Encrypted:	false
SSDEEP:	6:YGNTG/SJsAUv54rHItMHEHKgfQYV2fVH8qLO:YGNdciHmGEHKgfV2tH8aO
MD5:	A82FA3D775E7834800A70CFA5E34A924
SHA1:	C0A776B13A8878983B4E13D6E628322852BDF3C3
SHA-256:	B5D74ABAF4C4C9FD547DC7F1D6C1BA7AC971F9A9A8015190FFB6718C7C1F7541
SHA-512:	C04F28D36300ED8126784617C1F3571CBD9015D031D24909C47E87F3C1AB1841354BF03092E3C0A341971BF10C67742FD2CEC99150D0CA8B49348263C8ACFF67
Malicious:	false
Preview:	{"chrome://browser/content/browser.xhtml":{"main-window":{"screenX":"4","screenY":"4","width":"937","height":"694","sizemode":"maximized"},"sidebar-box":{"sidebarcommand":"","width":""},"sidebar-title":{"value":""}}}

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.669493570302698
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	Refund Details.exe
File size:	201728
MD5:	4f3781678b0516506da4919ae93a7968
SHA1:	cbf03b1da6c2caf820855ae3d9b1b0e89a0c2eb6
SHA256:	686481e1331a265e5c5630b85ae9d69c18c975fa1d63995c103cd91470d135ca
SHA512:	188fd7706f547dbeb1d504390be2e1ad09912e8434c7bb2f9df2bbb88d862d7983eb745d1f7019cebd36f447807cd7f6fa029bdcfba695b2afc62728e46b268a
SSDEEP:	3072:MK/U1VmhaH8EFvW+0OVE0/vk0RQYjBK5UNr20PKJM:y5xnE0/vk0RtjBK5UNrNKJ
TLSH:	6B144B89739031BED5B7C5719EB82D64EB64B876432B820B925705DE9D2D887CF103B3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....+ia.........."...................... .....@..... .......................`............@...@......@............... .....

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x140000000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61692B2E [Fri Oct 15 07:18:06 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x34000	0x4d0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x30a64	0x30c00	False	0.552353766026	data	6.68804523461	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x34000	0x4d0	0x600	False	0.372395833333	data	3.70018950024	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x340a0	0x23c	data
RT_MANIFEST	0x342e0	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright
Assembly Version	0.0.0.0
InternalName	OYton.exe
FileVersion	0.0.0.0
ProductVersion	0.0.0.0
FileDescription
OriginalFilename	OYton.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/04/22-03:17:55.103635	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	50936	1.1.1.1	192.168.2.2
04/04/22-03:18:31.136274	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	54032	1.1.1.1	192.168.2.2
04/04/22-03:18:31.359523	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	57882	1.1.1.1	192.168.2.2
04/04/22-03:18:38.247658	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	64526	1.1.1.1	192.168.2.2
04/04/22-03:18:56.268964	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	54918	1.1.1.1	192.168.2.2
04/04/22-03:18:56.877125	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	62743	1.1.1.1	192.168.2.2
04/04/22-03:18:57.480473	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	54857	1.1.1.1	192.168.2.2

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 4, 2022 03:17:54.709299088 CEST	49752	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:17:54.725425959 CEST	80	49752	34.107.221.82	192.168.2.2
Apr 4, 2022 03:17:54.725703001 CEST	49752	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:17:54.725909948 CEST	49752	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:17:54.741893053 CEST	80	49752	34.107.221.82	192.168.2.2
Apr 4, 2022 03:17:54.744627953 CEST	80	49752	34.107.221.82	192.168.2.2
Apr 4, 2022 03:17:54.810619116 CEST	49752	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:17:54.870446920 CEST	49754	443	192.168.2.2	35.244.181.201
Apr 4, 2022 03:17:54.870517969 CEST	443	49754	35.244.181.201	192.168.2.2
Apr 4, 2022 03:17:54.870732069 CEST	49754	443	192.168.2.2	35.244.181.201
Apr 4, 2022 03:17:54.870966911 CEST	49754	443	192.168.2.2	35.244.181.201
Apr 4, 2022 03:17:54.870990992 CEST	443	49754	35.244.181.201	192.168.2.2
Apr 4, 2022 03:17:54.923247099 CEST	443	49754	35.244.181.201	192.168.2.2
Apr 4, 2022 03:17:54.923387051 CEST	49754	443	192.168.2.2	35.244.181.201
Apr 4, 2022 03:17:55.074377060 CEST	49754	443	192.168.2.2	35.244.181.201
Apr 4, 2022 03:17:55.074424982 CEST	443	49754	35.244.181.201	192.168.2.2
Apr 4, 2022 03:17:55.074994087 CEST	443	49754	35.244.181.201	192.168.2.2
Apr 4, 2022 03:17:55.087605000 CEST	49754	443	192.168.2.2	35.244.181.201
Apr 4, 2022 03:17:55.087769032 CEST	49754	443	192.168.2.2	35.244.181.201
Apr 4, 2022 03:17:55.088077068 CEST	443	49754	35.244.181.201	192.168.2.2
Apr 4, 2022 03:17:55.088649988 CEST	49754	443	192.168.2.2	35.244.181.201
Apr 4, 2022 03:17:55.365521908 CEST	49752	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:17:55.383641958 CEST	80	49752	34.107.221.82	192.168.2.2
Apr 4, 2022 03:17:55.384687901 CEST	49752	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:17:55.385185957 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:17:55.403280973 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:17:55.403764009 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:17:55.404910088 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:17:55.422971964 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:17:55.423639059 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:17:55.532708883 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:17:56.086350918 CEST	49756	443	192.168.2.2	18.66.248.5
Apr 4, 2022 03:17:56.086385965 CEST	443	49756	18.66.248.5	192.168.2.2
Apr 4, 2022 03:17:56.086776018 CEST	49756	443	192.168.2.2	18.66.248.5
Apr 4, 2022 03:17:56.104861021 CEST	49756	443	192.168.2.2	18.66.248.5
Apr 4, 2022 03:17:56.104907990 CEST	443	49756	18.66.248.5	192.168.2.2
Apr 4, 2022 03:17:56.160773993 CEST	443	49756	18.66.248.5	192.168.2.2
Apr 4, 2022 03:17:56.161748886 CEST	49756	443	192.168.2.2	18.66.248.5
Apr 4, 2022 03:17:56.758093119 CEST	49756	443	192.168.2.2	18.66.248.5
Apr 4, 2022 03:17:56.758121967 CEST	443	49756	18.66.248.5	192.168.2.2
Apr 4, 2022 03:17:56.758290052 CEST	49756	443	192.168.2.2	18.66.248.5
Apr 4, 2022 03:17:56.758440971 CEST	443	49756	18.66.248.5	192.168.2.2
Apr 4, 2022 03:17:56.758585930 CEST	49756	443	192.168.2.2	18.66.248.5
Apr 4, 2022 03:18:04.382971048 CEST	49760	443	192.168.2.2	18.66.248.5
Apr 4, 2022 03:18:04.383038044 CEST	443	49760	18.66.248.5	192.168.2.2
Apr 4, 2022 03:18:04.383455992 CEST	49760	443	192.168.2.2	18.66.248.5
Apr 4, 2022 03:18:04.383747101 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:04.402241945 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:04.402339935 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:04.569725990 CEST	49760	443	192.168.2.2	18.66.248.5
Apr 4, 2022 03:18:04.569770098 CEST	443	49760	18.66.248.5	192.168.2.2
Apr 4, 2022 03:18:04.570498943 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:04.588763952 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:04.589061975 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:04.613876104 CEST	443	49760	18.66.248.5	192.168.2.2
Apr 4, 2022 03:18:04.614459038 CEST	49760	443	192.168.2.2	18.66.248.5
Apr 4, 2022 03:18:04.630475044 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:04.868944883 CEST	49760	443	192.168.2.2	18.66.248.5
Apr 4, 2022 03:18:04.869002104 CEST	443	49760	18.66.248.5	192.168.2.2
Apr 4, 2022 03:18:04.869142056 CEST	49760	443	192.168.2.2	18.66.248.5
Apr 4, 2022 03:18:04.869432926 CEST	443	49760	18.66.248.5	192.168.2.2
Apr 4, 2022 03:18:04.870471001 CEST	49760	443	192.168.2.2	18.66.248.5
Apr 4, 2022 03:18:05.425599098 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:05.443696976 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:06.278774023 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:06.297816992 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:06.339647055 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:06.965666056 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:06.983733892 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:06.984464884 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:07.025743008 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:07.068273067 CEST	49766	443	192.168.2.2	18.236.18.10
Apr 4, 2022 03:18:07.068341017 CEST	443	49766	18.236.18.10	192.168.2.2
Apr 4, 2022 03:18:07.068732023 CEST	49766	443	192.168.2.2	18.236.18.10
Apr 4, 2022 03:18:07.071213007 CEST	49766	443	192.168.2.2	18.236.18.10
Apr 4, 2022 03:18:07.071237087 CEST	443	49766	18.236.18.10	192.168.2.2
Apr 4, 2022 03:18:07.652003050 CEST	443	49766	18.236.18.10	192.168.2.2
Apr 4, 2022 03:18:07.652148962 CEST	49766	443	192.168.2.2	18.236.18.10
Apr 4, 2022 03:18:08.359029055 CEST	49766	443	192.168.2.2	18.236.18.10
Apr 4, 2022 03:18:08.359100103 CEST	443	49766	18.236.18.10	192.168.2.2
Apr 4, 2022 03:18:08.359118938 CEST	49766	443	192.168.2.2	18.236.18.10
Apr 4, 2022 03:18:08.359512091 CEST	443	49766	18.236.18.10	192.168.2.2
Apr 4, 2022 03:18:08.359788895 CEST	49766	443	192.168.2.2	18.236.18.10
Apr 4, 2022 03:18:10.813002110 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:10.831744909 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:10.873011112 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:13.767613888 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:13.786588907 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:13.828226089 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:13.895039082 CEST	49771	443	192.168.2.2	142.250.185.100
Apr 4, 2022 03:18:13.895090103 CEST	443	49771	142.250.185.100	192.168.2.2
Apr 4, 2022 03:18:13.895262003 CEST	49771	443	192.168.2.2	142.250.185.100
Apr 4, 2022 03:18:13.897960901 CEST	49771	443	192.168.2.2	142.250.185.100
Apr 4, 2022 03:18:13.897985935 CEST	443	49771	142.250.185.100	192.168.2.2
Apr 4, 2022 03:18:13.952702045 CEST	443	49771	142.250.185.100	192.168.2.2
Apr 4, 2022 03:18:13.953284979 CEST	49771	443	192.168.2.2	142.250.185.100
Apr 4, 2022 03:18:14.001950026 CEST	49771	443	192.168.2.2	142.250.185.100
Apr 4, 2022 03:18:14.001972914 CEST	443	49771	142.250.185.100	192.168.2.2
Apr 4, 2022 03:18:14.002069950 CEST	49771	443	192.168.2.2	142.250.185.100
Apr 4, 2022 03:18:14.002332926 CEST	443	49771	142.250.185.100	192.168.2.2
Apr 4, 2022 03:18:14.003242016 CEST	49771	443	192.168.2.2	142.250.185.100
Apr 4, 2022 03:18:14.313632965 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:14.332606077 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:14.374313116 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:14.597832918 CEST	49772	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:14.597893000 CEST	443	49772	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:14.598303080 CEST	49772	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:14.603719950 CEST	49772	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:14.603765965 CEST	443	49772	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:14.618762016 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:14.637350082 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:14.656841040 CEST	443	49772	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:14.657102108 CEST	49772	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:14.678294897 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:14.794792891 CEST	49772	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:14.794859886 CEST	443	49772	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:14.794881105 CEST	49772	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:14.795277119 CEST	443	49772	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:14.795558929 CEST	49773	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:14.795600891 CEST	443	49773	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:14.796335936 CEST	49772	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:14.796500921 CEST	49773	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:14.798680067 CEST	49773	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:14.798708916 CEST	443	49773	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:14.844965935 CEST	443	49773	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:14.845349073 CEST	49773	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:14.881963015 CEST	49773	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:14.881985903 CEST	443	49773	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:14.882376909 CEST	49773	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:14.882411003 CEST	443	49773	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:14.883466005 CEST	49773	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:15.174043894 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:15.187707901 CEST	49774	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:15.187772036 CEST	443	49774	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:15.188405037 CEST	49774	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:15.190670013 CEST	49774	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:15.190699100 CEST	443	49774	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:15.193243027 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:15.234519958 CEST	443	49774	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:15.234647036 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:15.235342979 CEST	49774	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:15.489895105 CEST	49774	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:15.489937067 CEST	443	49774	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:15.490020037 CEST	49774	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:15.490360022 CEST	443	49774	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:15.491364956 CEST	49774	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:15.517940998 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:15.536720037 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:15.578398943 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:15.796329021 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:15.815248013 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:15.856370926 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:16.526391029 CEST	49775	443	192.168.2.2	143.204.98.72
Apr 4, 2022 03:18:16.526457071 CEST	443	49775	143.204.98.72	192.168.2.2
Apr 4, 2022 03:18:16.527486086 CEST	49775	443	192.168.2.2	143.204.98.72
Apr 4, 2022 03:18:16.567439079 CEST	49775	443	192.168.2.2	143.204.98.72
Apr 4, 2022 03:18:16.567471981 CEST	443	49775	143.204.98.72	192.168.2.2
Apr 4, 2022 03:18:16.612068892 CEST	443	49775	143.204.98.72	192.168.2.2
Apr 4, 2022 03:18:16.612153053 CEST	49775	443	192.168.2.2	143.204.98.72
Apr 4, 2022 03:18:18.791286945 CEST	49779	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:18.791336060 CEST	443	49779	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:18.791635036 CEST	49779	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:22.209374905 CEST	49779	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:22.209429026 CEST	443	49779	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:22.253104925 CEST	443	49779	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:22.253931999 CEST	49779	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:23.252265930 CEST	49775	443	192.168.2.2	143.204.98.72
Apr 4, 2022 03:18:23.252284050 CEST	443	49775	143.204.98.72	192.168.2.2
Apr 4, 2022 03:18:23.252419949 CEST	49775	443	192.168.2.2	143.204.98.72
Apr 4, 2022 03:18:23.252685070 CEST	443	49775	143.204.98.72	192.168.2.2
Apr 4, 2022 03:18:23.253015041 CEST	49775	443	192.168.2.2	143.204.98.72
Apr 4, 2022 03:18:23.257728100 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:23.276401043 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:23.324043036 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:23.583847046 CEST	49779	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:23.583905935 CEST	443	49779	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:23.583930969 CEST	49779	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:23.584171057 CEST	443	49779	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:23.585046053 CEST	49779	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:23.857148886 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:23.875873089 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:23.926964998 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:30.847840071 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:30.862128973 CEST	49788	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:30.862181902 CEST	443	49788	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:30.862675905 CEST	49788	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:30.864846945 CEST	49788	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:30.864902020 CEST	443	49788	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:30.866458893 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:30.907649040 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:30.909681082 CEST	443	49788	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:30.913613081 CEST	49788	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:31.009248972 CEST	49788	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:31.009299994 CEST	443	49788	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:31.009387016 CEST	49788	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:31.009821892 CEST	443	49788	13.226.158.36	192.168.2.2
Apr 4, 2022 03:18:31.010663033 CEST	49788	443	192.168.2.2	13.226.158.36
Apr 4, 2022 03:18:31.017863035 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:31.036727905 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:31.040782928 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:31.060856104 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:31.072627068 CEST	49789	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.072674036 CEST	443	49789	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.073344946 CEST	49790	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.073400974 CEST	443	49790	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.073688984 CEST	49789	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.073843956 CEST	49790	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.073997974 CEST	49790	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.074016094 CEST	443	49790	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.074316025 CEST	49789	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.074345112 CEST	443	49789	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.074805975 CEST	49791	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.074834108 CEST	443	49791	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.075448990 CEST	49792	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.075470924 CEST	443	49792	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.075716019 CEST	49791	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.075854063 CEST	49792	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.075879097 CEST	49791	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.075900078 CEST	443	49791	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.075987101 CEST	49792	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.076003075 CEST	443	49792	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.076723099 CEST	49793	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.076751947 CEST	443	49793	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.077680111 CEST	49793	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.077878952 CEST	49793	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.077893972 CEST	443	49793	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.078694105 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:31.101723909 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:31.117897987 CEST	49794	443	192.168.2.2	54.191.212.31
Apr 4, 2022 03:18:31.117949963 CEST	443	49794	54.191.212.31	192.168.2.2
Apr 4, 2022 03:18:31.118359089 CEST	49794	443	192.168.2.2	54.191.212.31
Apr 4, 2022 03:18:31.119359016 CEST	443	49791	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.119723082 CEST	49791	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.120676994 CEST	49794	443	192.168.2.2	54.191.212.31
Apr 4, 2022 03:18:31.120697021 CEST	443	49794	54.191.212.31	192.168.2.2
Apr 4, 2022 03:18:31.121907949 CEST	443	49793	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.122759104 CEST	49793	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.125333071 CEST	49791	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.125350952 CEST	443	49791	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.125574112 CEST	443	49791	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.127398968 CEST	443	49792	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.127717018 CEST	49792	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.129142046 CEST	49793	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.129173994 CEST	443	49793	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.129365921 CEST	443	49790	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.129693031 CEST	49790	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.129782915 CEST	443	49793	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.130316973 CEST	443	49789	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.131546021 CEST	49789	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.135400057 CEST	49792	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.135416985 CEST	443	49792	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.135659933 CEST	443	49792	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.142750025 CEST	49789	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.142771006 CEST	443	49789	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.143057108 CEST	443	49789	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.148581982 CEST	49790	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.148677111 CEST	443	49790	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.148996115 CEST	443	49790	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.150818110 CEST	49791	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.151218891 CEST	443	49791	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.151683092 CEST	49791	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.152684927 CEST	49793	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.152972937 CEST	49793	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.153048038 CEST	49791	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.153079987 CEST	443	49791	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.153107882 CEST	443	49793	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.153707027 CEST	49793	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.165486097 CEST	49792	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.165703058 CEST	49792	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.165879011 CEST	443	49792	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.166673899 CEST	49792	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.168481112 CEST	49790	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.168597937 CEST	49790	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.168926001 CEST	443	49790	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.169678926 CEST	49790	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.170481920 CEST	49789	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.170990944 CEST	443	49789	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.171014071 CEST	49789	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.171032906 CEST	443	49789	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.171222925 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:31.190568924 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:31.212316990 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:31.231669903 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:31.231849909 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:31.272711039 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:31.379724979 CEST	443	49789	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:31.380024910 CEST	49789	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:31.703464031 CEST	443	49794	54.191.212.31	192.168.2.2
Apr 4, 2022 03:18:31.703815937 CEST	49794	443	192.168.2.2	54.191.212.31
Apr 4, 2022 03:18:31.709047079 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:31.715910912 CEST	49794	443	192.168.2.2	54.191.212.31
Apr 4, 2022 03:18:31.715962887 CEST	443	49794	54.191.212.31	192.168.2.2
Apr 4, 2022 03:18:31.716032028 CEST	49794	443	192.168.2.2	54.191.212.31
Apr 4, 2022 03:18:31.716248035 CEST	443	49794	54.191.212.31	192.168.2.2
Apr 4, 2022 03:18:31.716325045 CEST	49794	443	192.168.2.2	54.191.212.31
Apr 4, 2022 03:18:31.728050947 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:31.734195948 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:31.753026009 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:31.769742012 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:31.793754101 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:33.871486902 CEST	49796	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:33.871534109 CEST	443	49796	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:33.871932983 CEST	49796	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:33.872308016 CEST	49796	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:33.872332096 CEST	443	49796	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:33.911725044 CEST	443	49796	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:33.912014008 CEST	49796	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:33.916143894 CEST	49796	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:33.916635990 CEST	443	49796	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:33.957940102 CEST	49796	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:33.976283073 CEST	49796	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:33.976433039 CEST	49796	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:33.976913929 CEST	443	49796	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:33.977920055 CEST	49796	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:33.983165026 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:34.002049923 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:34.043952942 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:34.061606884 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:34.080245972 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:34.120951891 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:35.480103970 CEST	49798	443	192.168.2.2	108.157.4.26
Apr 4, 2022 03:18:35.480168104 CEST	443	49798	108.157.4.26	192.168.2.2
Apr 4, 2022 03:18:35.480292082 CEST	49798	443	192.168.2.2	108.157.4.26
Apr 4, 2022 03:18:35.482455969 CEST	49798	443	192.168.2.2	108.157.4.26
Apr 4, 2022 03:18:35.482487917 CEST	443	49798	108.157.4.26	192.168.2.2
Apr 4, 2022 03:18:35.525906086 CEST	443	49798	108.157.4.26	192.168.2.2
Apr 4, 2022 03:18:35.526081085 CEST	49798	443	192.168.2.2	108.157.4.26
Apr 4, 2022 03:18:35.539789915 CEST	49798	443	192.168.2.2	108.157.4.26
Apr 4, 2022 03:18:35.539834976 CEST	443	49798	108.157.4.26	192.168.2.2
Apr 4, 2022 03:18:35.539938927 CEST	49798	443	192.168.2.2	108.157.4.26
Apr 4, 2022 03:18:35.540457010 CEST	443	49798	108.157.4.26	192.168.2.2
Apr 4, 2022 03:18:35.541050911 CEST	49798	443	192.168.2.2	108.157.4.26
Apr 4, 2022 03:18:35.555179119 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:35.557383060 CEST	49799	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:35.557415962 CEST	443	49799	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:35.558180094 CEST	49799	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:35.558202982 CEST	49799	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:35.558208942 CEST	443	49799	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:35.573966980 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:35.587661982 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:35.597752094 CEST	443	49799	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:35.598071098 CEST	49799	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:35.603672028 CEST	49799	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:35.603702068 CEST	443	49799	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:35.604217052 CEST	443	49799	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:35.606213093 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:35.620696068 CEST	49799	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:35.620721102 CEST	49799	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:35.621087074 CEST	443	49799	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:35.622083902 CEST	49799	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:35.625041962 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:35.643728018 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:35.646694899 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:35.665247917 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:35.768079996 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:35.768142939 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:36.749396086 CEST	49800	443	192.168.2.2	35.164.251.155
Apr 4, 2022 03:18:36.749461889 CEST	443	49800	35.164.251.155	192.168.2.2
Apr 4, 2022 03:18:36.750163078 CEST	49800	443	192.168.2.2	35.164.251.155
Apr 4, 2022 03:18:36.752290964 CEST	49800	443	192.168.2.2	35.164.251.155
Apr 4, 2022 03:18:36.752319098 CEST	443	49800	35.164.251.155	192.168.2.2
Apr 4, 2022 03:18:37.321446896 CEST	443	49800	35.164.251.155	192.168.2.2
Apr 4, 2022 03:18:37.322227001 CEST	49800	443	192.168.2.2	35.164.251.155
Apr 4, 2022 03:18:37.376663923 CEST	49800	443	192.168.2.2	35.164.251.155
Apr 4, 2022 03:18:37.376719952 CEST	443	49800	35.164.251.155	192.168.2.2
Apr 4, 2022 03:18:37.376791954 CEST	49800	443	192.168.2.2	35.164.251.155
Apr 4, 2022 03:18:37.377141953 CEST	443	49800	35.164.251.155	192.168.2.2
Apr 4, 2022 03:18:37.378098965 CEST	49800	443	192.168.2.2	35.164.251.155
Apr 4, 2022 03:18:37.380357981 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:37.398974895 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:37.405193090 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:37.423738003 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:37.468203068 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:37.468611002 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:38.152607918 CEST	49801	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:38.152681112 CEST	443	49801	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:38.153301954 CEST	49801	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:38.153430939 CEST	49801	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:38.153450012 CEST	443	49801	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:38.160141945 CEST	49802	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:38.160202026 CEST	443	49802	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:38.161278009 CEST	49802	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:38.161422968 CEST	49802	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:38.161442041 CEST	443	49802	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:38.185054064 CEST	49803	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:38.185096979 CEST	443	49803	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:38.185276031 CEST	49803	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:38.187386036 CEST	49803	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:38.187402964 CEST	443	49803	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:38.197505951 CEST	443	49801	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:38.198291063 CEST	49801	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:38.201859951 CEST	443	49802	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:38.204144955 CEST	49802	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:38.211308002 CEST	49801	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:38.211325884 CEST	443	49801	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:38.212023020 CEST	443	49801	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:38.215987921 CEST	49801	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:38.216413021 CEST	443	49801	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:38.216556072 CEST	49801	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:38.216569901 CEST	443	49801	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:38.220590115 CEST	49802	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:38.220617056 CEST	443	49802	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:38.221268892 CEST	443	49802	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:38.225667953 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:38.226994991 CEST	49802	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:38.227132082 CEST	49802	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:38.227314949 CEST	443	49802	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:38.228272915 CEST	49802	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:38.237139940 CEST	443	49803	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:38.237292051 CEST	49803	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:38.244241953 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:38.282716990 CEST	49803	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:38.282746077 CEST	443	49803	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:38.282840014 CEST	49803	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:38.283067942 CEST	443	49803	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:38.283246040 CEST	49803	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:38.301760912 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:38.339833975 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:38.368360043 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:38.423718929 CEST	443	49801	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:38.424299002 CEST	49801	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:38.568394899 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:38.584405899 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:38.584496975 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:38.910691977 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:38.929414034 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:38.941072941 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:38.959887028 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:39.068434000 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:39.068443060 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:39.483545065 CEST	49804	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:39.483601093 CEST	443	49804	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:39.487418890 CEST	49804	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:39.487754107 CEST	49804	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:39.487781048 CEST	443	49804	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:39.528389931 CEST	443	49804	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:39.529408932 CEST	49804	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:39.544203043 CEST	49804	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:39.544229031 CEST	443	49804	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:39.544744968 CEST	443	49804	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:39.551071882 CEST	49804	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:39.551223993 CEST	49804	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:39.551769018 CEST	443	49804	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:39.552405119 CEST	49804	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:39.566920042 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:39.585580111 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:39.600591898 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:39.619369030 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:39.668483973 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:39.670295000 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:46.800446987 CEST	49808	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.800498009 CEST	443	49808	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:46.800779104 CEST	49809	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.800853014 CEST	443	49809	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:46.801053047 CEST	49808	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.801211119 CEST	49809	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.801387072 CEST	49808	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.801415920 CEST	443	49808	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:46.801553011 CEST	49809	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.801584959 CEST	443	49809	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:46.846134901 CEST	443	49809	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:46.846355915 CEST	443	49808	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:46.847047091 CEST	49808	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.847048998 CEST	49809	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.851288080 CEST	49809	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.851310015 CEST	443	49809	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:46.851866961 CEST	443	49809	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:46.855233908 CEST	49808	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.855247974 CEST	443	49808	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:46.855890989 CEST	443	49808	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:46.865852118 CEST	49809	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.866022110 CEST	49809	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.866270065 CEST	443	49809	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:46.867006063 CEST	49809	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.869596004 CEST	49808	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.869685888 CEST	49808	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.870034933 CEST	443	49808	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:46.870981932 CEST	49808	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.880213022 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:46.899277925 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:46.916448116 CEST	49810	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.916488886 CEST	443	49810	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:46.917233944 CEST	49810	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.917292118 CEST	49810	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.917305946 CEST	443	49810	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:46.941073895 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:46.960652113 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:46.960971117 CEST	443	49810	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:46.962054968 CEST	49810	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.965545893 CEST	49810	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.965575933 CEST	443	49810	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:46.966115952 CEST	443	49810	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:46.974253893 CEST	49810	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.974374056 CEST	49810	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.974916935 CEST	443	49810	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:46.976005077 CEST	49810	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:46.979568005 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:46.985416889 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:47.004147053 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:47.009165049 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:47.028100967 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:47.044008970 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:47.072015047 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:47.407599926 CEST	49811	443	192.168.2.2	35.81.85.200
Apr 4, 2022 03:18:47.407650948 CEST	443	49811	35.81.85.200	192.168.2.2
Apr 4, 2022 03:18:47.408065081 CEST	49811	443	192.168.2.2	35.81.85.200
Apr 4, 2022 03:18:47.410259962 CEST	49811	443	192.168.2.2	35.81.85.200
Apr 4, 2022 03:18:47.410288095 CEST	443	49811	35.81.85.200	192.168.2.2
Apr 4, 2022 03:18:47.996912003 CEST	443	49811	35.81.85.200	192.168.2.2
Apr 4, 2022 03:18:48.000252962 CEST	49811	443	192.168.2.2	35.81.85.200
Apr 4, 2022 03:18:48.013163090 CEST	49811	443	192.168.2.2	35.81.85.200
Apr 4, 2022 03:18:48.013192892 CEST	443	49811	35.81.85.200	192.168.2.2
Apr 4, 2022 03:18:48.013278008 CEST	49811	443	192.168.2.2	35.81.85.200
Apr 4, 2022 03:18:48.013794899 CEST	443	49811	35.81.85.200	192.168.2.2
Apr 4, 2022 03:18:48.014127016 CEST	49811	443	192.168.2.2	35.81.85.200
Apr 4, 2022 03:18:48.016947985 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:48.035564899 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:48.047334909 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:48.065912008 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:48.077079058 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:48.107141018 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:48.396321058 CEST	49812	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:48.396392107 CEST	443	49812	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:48.396639109 CEST	49812	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:48.396828890 CEST	49812	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:48.396847010 CEST	443	49812	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:48.398813009 CEST	49813	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:48.398854017 CEST	443	49813	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:48.399125099 CEST	49813	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:48.399291039 CEST	49813	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:48.399313927 CEST	443	49813	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:48.440215111 CEST	443	49812	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:48.441167116 CEST	49812	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:48.443701982 CEST	443	49813	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:48.444217920 CEST	49813	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:48.445923090 CEST	49812	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:48.445935965 CEST	443	49812	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:48.446280956 CEST	443	49812	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:48.450004101 CEST	49813	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:48.450021982 CEST	443	49813	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:48.450572968 CEST	443	49813	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:48.457180977 CEST	49812	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:48.457346916 CEST	49812	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:48.457578897 CEST	443	49812	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:48.457834005 CEST	49813	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:48.457958937 CEST	49813	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:48.458117962 CEST	49812	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:48.458134890 CEST	443	49813	34.120.208.123	192.168.2.2
Apr 4, 2022 03:18:48.459112883 CEST	49813	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:18:48.462718964 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:48.481367111 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:48.486948013 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:48.505639076 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:48.521130085 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:48.546159029 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:56.181195974 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.181241989 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.181651115 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.184560061 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.184583902 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.224334002 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.224431038 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.239464045 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.239480972 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.239636898 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.239661932 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.279692888 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.360815048 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.360840082 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.414879084 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.427130938 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.427311897 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.427372932 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.427428007 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.427464962 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.427481890 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.427498102 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.427789927 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.427798033 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.429125071 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.429788113 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.429800034 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.431444883 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.431510925 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.431777000 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.431792021 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.432782888 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.445384979 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.445478916 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.445856094 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.445868015 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.446084976 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.446149111 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.446822882 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.446834087 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.447933912 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.448800087 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.448812962 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.449561119 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.449624062 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.449789047 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.449799061 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.450790882 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.450867891 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.450932026 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.451807976 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.451822042 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.452140093 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.452222109 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.452811956 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.452826023 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.452965975 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.453790903 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.453803062 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.454052925 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.454123974 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.454787970 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.454797983 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.454936028 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.455004930 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.455787897 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.455800056 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.456017017 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.456096888 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.456837893 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.456850052 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.457797050 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.463522911 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.463787079 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.463814020 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.463830948 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.463845015 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.464703083 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.464761019 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.464809895 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.464818954 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.465379000 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.465424061 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.465800047 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.465809107 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.466191053 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.466793060 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.466805935 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.466933012 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.466988087 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.467633009 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.467703104 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.467823029 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.467838049 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.468272924 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.468303919 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.468796968 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.468808889 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.469003916 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.469034910 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.469789982 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.469799042 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.470174074 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.470215082 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.470242977 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.470796108 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.470808029 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.470942020 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.470978022 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.471646070 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.471782923 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.471801043 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.471970081 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.472012997 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.472673893 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.472721100 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.472749949 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.472773075 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.472780943 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.473458052 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.473503113 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.473535061 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.473788023 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.473794937 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.474407911 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.474458933 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.474503994 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.474541903 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.474817038 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.474823952 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.481772900 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.481823921 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.481857061 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.481910944 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.481941938 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.481976986 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.482007027 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.482738972 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.482805014 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.482815027 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.482836008 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.482846975 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.483530045 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.483592987 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.483630896 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.483833075 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.483844042 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.484241009 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.484280109 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.484388113 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.484838009 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.485450029 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.485469103 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.485493898 CEST	49814	443	192.168.2.2	157.240.20.35
Apr 4, 2022 03:18:56.485500097 CEST	443	49814	157.240.20.35	192.168.2.2
Apr 4, 2022 03:18:56.822222948 CEST	49815	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.822289944 CEST	443	49815	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.822700977 CEST	49816	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.822757959 CEST	443	49816	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.822828054 CEST	49815	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.823112965 CEST	49817	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.823147058 CEST	443	49817	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.823847055 CEST	49816	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.825246096 CEST	49817	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.825253963 CEST	49815	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.825283051 CEST	443	49815	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.825654984 CEST	49818	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.825675011 CEST	443	49818	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.825831890 CEST	49818	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.825994015 CEST	49819	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.826020002 CEST	443	49819	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.826124907 CEST	49819	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.826316118 CEST	49820	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.826370955 CEST	443	49820	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.826833963 CEST	49820	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.828577995 CEST	49816	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.828605890 CEST	443	49816	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.830579042 CEST	49817	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.830598116 CEST	443	49817	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.832578897 CEST	49819	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.832616091 CEST	443	49819	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.834574938 CEST	49818	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.834604025 CEST	443	49818	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.836797953 CEST	49820	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.836847067 CEST	443	49820	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.853148937 CEST	443	49815	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.853368998 CEST	49815	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.857968092 CEST	443	49816	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.858452082 CEST	49816	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.859466076 CEST	443	49817	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.859492064 CEST	443	49819	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.859800100 CEST	49819	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.859802008 CEST	49817	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.862570047 CEST	443	49818	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.862852097 CEST	49818	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.865067959 CEST	443	49820	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.865840912 CEST	49820	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.866981983 CEST	49815	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.867125988 CEST	49815	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.867301941 CEST	443	49815	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.867832899 CEST	49815	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.877748966 CEST	49819	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.877870083 CEST	49819	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.878150940 CEST	443	49819	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.878835917 CEST	49819	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.884530067 CEST	49818	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.884756088 CEST	49818	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.884943008 CEST	443	49818	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.885873079 CEST	49818	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.891663074 CEST	49820	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.891772985 CEST	49820	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.892069101 CEST	443	49820	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.892838001 CEST	49820	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.894938946 CEST	49816	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.895113945 CEST	49816	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.895534039 CEST	443	49816	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.895848989 CEST	49816	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.900209904 CEST	49817	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.900316000 CEST	49817	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.900655985 CEST	443	49817	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.900844097 CEST	49817	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.957175016 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:56.976392984 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:56.994051933 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:56.996709108 CEST	49821	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.996732950 CEST	443	49821	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.996952057 CEST	49821	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.996963024 CEST	49822	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.996988058 CEST	443	49822	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.997221947 CEST	49823	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.997231960 CEST	443	49823	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.997447968 CEST	49824	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.997463942 CEST	443	49824	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.997673988 CEST	49825	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.997684002 CEST	443	49825	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.997880936 CEST	49822	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.997893095 CEST	49823	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.997905016 CEST	49824	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.998624086 CEST	49825	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.998637915 CEST	49826	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:56.998701096 CEST	443	49826	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:56.998900890 CEST	49826	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.000785112 CEST	49825	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.000808001 CEST	443	49825	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.002684116 CEST	49824	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.002701998 CEST	443	49824	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.004709005 CEST	49823	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.004723072 CEST	443	49823	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.006671906 CEST	49822	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.006696939 CEST	443	49822	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.008723021 CEST	49821	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.008738041 CEST	443	49821	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.011008024 CEST	49826	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.011051893 CEST	443	49826	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.012994051 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:57.016871929 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:57.029273033 CEST	443	49824	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.029366016 CEST	49824	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.030745983 CEST	443	49825	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.030925989 CEST	49825	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.033660889 CEST	443	49823	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.033874035 CEST	443	49822	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.033947945 CEST	49823	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.034634113 CEST	443	49821	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.034873009 CEST	49822	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.035311937 CEST	49821	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.039845943 CEST	443	49826	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.040888071 CEST	49826	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.044208050 CEST	49824	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.044337034 CEST	49824	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.044498920 CEST	443	49824	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.044872999 CEST	49824	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.045211077 CEST	49827	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.045242071 CEST	443	49827	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.045886993 CEST	49827	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.048429966 CEST	49827	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.048449993 CEST	443	49827	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.053574085 CEST	49825	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.053678989 CEST	49825	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.053900957 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:57.054182053 CEST	443	49825	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.054497004 CEST	49828	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.054558992 CEST	443	49828	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.054835081 CEST	49825	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.054889917 CEST	49828	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.058024883 CEST	49828	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.058059931 CEST	443	49828	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.065964937 CEST	49826	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.066107988 CEST	49826	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.066452026 CEST	443	49826	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.066739082 CEST	49829	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.066776037 CEST	443	49829	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.066852093 CEST	49826	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.067872047 CEST	49829	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.070043087 CEST	49829	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.070071936 CEST	443	49829	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.075216055 CEST	443	49827	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.076129913 CEST	49827	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.084187984 CEST	443	49828	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.084932089 CEST	49828	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.090924025 CEST	49822	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.091053009 CEST	49822	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.091206074 CEST	443	49822	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.091840029 CEST	49822	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.093679905 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:57.097877026 CEST	443	49829	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.098856926 CEST	49829	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.103065968 CEST	49828	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.103195906 CEST	49828	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.103394032 CEST	443	49828	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.103864908 CEST	49828	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.107587099 CEST	49827	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.107697964 CEST	49827	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.108019114 CEST	443	49827	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.108870983 CEST	49827	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.109221935 CEST	49823	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.109332085 CEST	49823	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.109488010 CEST	443	49823	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.109920025 CEST	49823	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.112492085 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:57.114240885 CEST	49821	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.114408970 CEST	49821	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.114588976 CEST	443	49821	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.115353107 CEST	49821	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.122140884 CEST	49829	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.122523069 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:57.122695923 CEST	443	49829	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.122838020 CEST	49829	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.123270035 CEST	49829	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.123298883 CEST	443	49829	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.124612093 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:57.125236988 CEST	49830	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.125278950 CEST	443	49830	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.125842094 CEST	49831	443	192.168.2.2	157.240.17.35
Apr 4, 2022 03:18:57.125868082 CEST	443	49831	157.240.17.35	192.168.2.2
Apr 4, 2022 03:18:57.125885010 CEST	49830	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.126948118 CEST	49831	443	192.168.2.2	157.240.17.35
Apr 4, 2022 03:18:57.128356934 CEST	49830	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.128386021 CEST	443	49830	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.131232977 CEST	49831	443	192.168.2.2	157.240.17.35
Apr 4, 2022 03:18:57.131261110 CEST	443	49831	157.240.17.35	192.168.2.2
Apr 4, 2022 03:18:57.141129017 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:57.143414021 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:57.148588896 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:57.153954983 CEST	443	49830	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.154870987 CEST	49830	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.159574986 CEST	443	49831	157.240.17.35	192.168.2.2
Apr 4, 2022 03:18:57.160476923 CEST	49831	443	192.168.2.2	157.240.17.35
Apr 4, 2022 03:18:57.167184114 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:57.167896986 CEST	49830	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.168082952 CEST	49830	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.168214083 CEST	443	49830	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.168845892 CEST	49830	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.176589966 CEST	49831	443	192.168.2.2	157.240.17.35
Apr 4, 2022 03:18:57.176739931 CEST	49831	443	192.168.2.2	157.240.17.35
Apr 4, 2022 03:18:57.176877022 CEST	443	49831	157.240.17.35	192.168.2.2
Apr 4, 2022 03:18:57.178545952 CEST	49831	443	192.168.2.2	157.240.17.35
Apr 4, 2022 03:18:57.183880091 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:57.188648939 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:57.207525015 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:57.208878994 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:57.217696905 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:57.236308098 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:57.247834921 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:57.275871992 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:57.364274025 CEST	49832	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.364322901 CEST	443	49832	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.364924908 CEST	49832	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.367727041 CEST	49832	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.367753983 CEST	443	49832	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.373311043 CEST	49833	443	192.168.2.2	157.240.17.35
Apr 4, 2022 03:18:57.373359919 CEST	443	49833	157.240.17.35	192.168.2.2
Apr 4, 2022 03:18:57.373923063 CEST	49833	443	192.168.2.2	157.240.17.35
Apr 4, 2022 03:18:57.376549006 CEST	49833	443	192.168.2.2	157.240.17.35
Apr 4, 2022 03:18:57.376578093 CEST	443	49833	157.240.17.35	192.168.2.2
Apr 4, 2022 03:18:57.393501043 CEST	443	49832	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.393901110 CEST	49832	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.402996063 CEST	443	49833	157.240.17.35	192.168.2.2
Apr 4, 2022 03:18:57.403887033 CEST	49833	443	192.168.2.2	157.240.17.35
Apr 4, 2022 03:18:57.416384935 CEST	49832	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.416507959 CEST	49832	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.416819096 CEST	443	49832	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:57.417860985 CEST	49832	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:57.418385029 CEST	49833	443	192.168.2.2	157.240.17.35
Apr 4, 2022 03:18:57.418512106 CEST	49833	443	192.168.2.2	157.240.17.35
Apr 4, 2022 03:18:57.418705940 CEST	443	49833	157.240.17.35	192.168.2.2
Apr 4, 2022 03:18:57.418874025 CEST	49833	443	192.168.2.2	157.240.17.35
Apr 4, 2022 03:18:57.421139002 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:57.441102982 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:57.449404955 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:57.468733072 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:57.482872963 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:57.509922981 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:58.364595890 CEST	49835	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:58.364645004 CEST	443	49835	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:58.365024090 CEST	49835	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:58.368371010 CEST	49835	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:58.368398905 CEST	443	49835	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:58.397648096 CEST	443	49835	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:58.397898912 CEST	49835	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:58.405349016 CEST	49835	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:58.405483961 CEST	49835	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:58.405858040 CEST	443	49835	157.240.17.15	192.168.2.2
Apr 4, 2022 03:18:58.406975985 CEST	49835	443	192.168.2.2	157.240.17.15
Apr 4, 2022 03:18:58.432085037 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:58.451036930 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:58.460485935 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:58.479181051 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:18:58.491983891 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:18:58.520030975 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:08.100024939 CEST	49838	443	192.168.2.2	35.155.98.26
Apr 4, 2022 03:19:08.100081921 CEST	443	49838	35.155.98.26	192.168.2.2
Apr 4, 2022 03:19:08.100799084 CEST	49838	443	192.168.2.2	35.155.98.26
Apr 4, 2022 03:19:08.189491034 CEST	49838	443	192.168.2.2	35.155.98.26
Apr 4, 2022 03:19:08.189548969 CEST	443	49838	35.155.98.26	192.168.2.2
Apr 4, 2022 03:19:08.452815056 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:08.470915079 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:08.480834961 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:08.498819113 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:08.779911041 CEST	443	49838	35.155.98.26	192.168.2.2
Apr 4, 2022 03:19:08.780909061 CEST	49838	443	192.168.2.2	35.155.98.26
Apr 4, 2022 03:19:08.815645933 CEST	49838	443	192.168.2.2	35.155.98.26
Apr 4, 2022 03:19:08.815690994 CEST	443	49838	35.155.98.26	192.168.2.2
Apr 4, 2022 03:19:08.815907955 CEST	49838	443	192.168.2.2	35.155.98.26
Apr 4, 2022 03:19:08.816004038 CEST	443	49838	35.155.98.26	192.168.2.2
Apr 4, 2022 03:19:08.816822052 CEST	49838	443	192.168.2.2	35.155.98.26
Apr 4, 2022 03:19:08.824295044 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:08.842267990 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:08.844811916 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:08.853331089 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:08.871284008 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:08.871867895 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:08.885814905 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:08.912842989 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:18.847660065 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:18.866301060 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:18.873732090 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:18.892033100 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:20.452053070 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:20.452105999 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:20.470282078 CEST	80	49755	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:20.470629930 CEST	80	49761	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:20.470829964 CEST	49761	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:20.470840931 CEST	49755	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:30.621870995 CEST	49839	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:30.621917963 CEST	443	49839	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:30.622164965 CEST	49839	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:30.693437099 CEST	49839	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:30.693465948 CEST	443	49839	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:30.732929945 CEST	443	49839	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:30.733690977 CEST	49839	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:31.371119022 CEST	49839	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:31.371155024 CEST	443	49839	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:31.371781111 CEST	443	49839	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:31.371906042 CEST	49839	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:31.375092030 CEST	49839	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:31.375169992 CEST	49839	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:31.375253916 CEST	443	49839	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:31.603894949 CEST	443	49839	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:31.603971958 CEST	443	49839	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:31.604048014 CEST	49839	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:31.604115009 CEST	49839	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:31.604561090 CEST	49839	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:31.604578018 CEST	443	49839	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:31.604609013 CEST	49839	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:31.604721069 CEST	49839	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:31.989470005 CEST	49841	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:31.989522934 CEST	443	49841	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:31.989633083 CEST	49841	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:31.990199089 CEST	49841	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:31.990223885 CEST	443	49841	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:32.030143976 CEST	443	49841	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:32.030831099 CEST	49841	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:32.032311916 CEST	49841	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:32.032331944 CEST	443	49841	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:32.032742977 CEST	49841	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:32.032754898 CEST	443	49841	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:32.268098116 CEST	443	49841	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:32.268187046 CEST	49841	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:32.268208981 CEST	443	49841	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:32.268237114 CEST	443	49841	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:32.268282890 CEST	49841	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:32.268309116 CEST	49841	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:32.268332958 CEST	49841	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:32.268357038 CEST	443	49841	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:32.268405914 CEST	49841	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:32.268461943 CEST	49841	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:32.675812006 CEST	49842	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:32.675873995 CEST	443	49842	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:32.676131010 CEST	49842	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:32.676666021 CEST	49842	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:32.676692963 CEST	443	49842	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:32.712862015 CEST	443	49842	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:32.714401007 CEST	49842	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:32.714427948 CEST	49842	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:32.714679956 CEST	49842	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:32.714720964 CEST	443	49842	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:32.714790106 CEST	49842	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:32.714826107 CEST	443	49842	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:32.968333960 CEST	443	49842	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:32.968441963 CEST	443	49842	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:32.968928099 CEST	49842	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:32.989118099 CEST	49842	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:32.989166975 CEST	443	49842	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:32.989238024 CEST	49842	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:32.989835978 CEST	49842	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:46.707568884 CEST	49853	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:46.725866079 CEST	80	49853	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:46.726207972 CEST	49853	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:46.726412058 CEST	49853	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:46.744512081 CEST	80	49853	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:46.745017052 CEST	80	49853	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:46.787103891 CEST	49853	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:46.820827961 CEST	49854	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:46.822263956 CEST	49855	443	192.168.2.2	35.244.181.201
Apr 4, 2022 03:19:46.822310925 CEST	443	49855	35.244.181.201	192.168.2.2
Apr 4, 2022 03:19:46.823039055 CEST	49855	443	192.168.2.2	35.244.181.201
Apr 4, 2022 03:19:46.823342085 CEST	49855	443	192.168.2.2	35.244.181.201
Apr 4, 2022 03:19:46.823357105 CEST	443	49855	35.244.181.201	192.168.2.2
Apr 4, 2022 03:19:46.839243889 CEST	80	49854	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:46.840034008 CEST	49854	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:46.840327978 CEST	49854	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:46.858601093 CEST	80	49854	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:46.859003067 CEST	80	49854	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:46.865278006 CEST	443	49855	35.244.181.201	192.168.2.2
Apr 4, 2022 03:19:46.866080999 CEST	49855	443	192.168.2.2	35.244.181.201
Apr 4, 2022 03:19:46.870455027 CEST	49855	443	192.168.2.2	35.244.181.201
Apr 4, 2022 03:19:46.870470047 CEST	443	49855	35.244.181.201	192.168.2.2
Apr 4, 2022 03:19:46.871064901 CEST	443	49855	35.244.181.201	192.168.2.2
Apr 4, 2022 03:19:46.898510933 CEST	49855	443	192.168.2.2	35.244.181.201
Apr 4, 2022 03:19:46.898602009 CEST	49855	443	192.168.2.2	35.244.181.201
Apr 4, 2022 03:19:46.899041891 CEST	443	49855	35.244.181.201	192.168.2.2
Apr 4, 2022 03:19:46.900017977 CEST	49855	443	192.168.2.2	35.244.181.201
Apr 4, 2022 03:19:46.900096893 CEST	49854	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:46.918162107 CEST	49854	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:46.918179989 CEST	49853	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:46.936136007 CEST	80	49854	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:46.936214924 CEST	80	49853	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:46.937169075 CEST	49854	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:46.937172890 CEST	49853	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:46.945852995 CEST	49860	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:46.963887930 CEST	80	49860	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:46.964155912 CEST	49860	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:46.964248896 CEST	49860	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:46.982073069 CEST	80	49860	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:46.982650995 CEST	80	49860	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:47.023108006 CEST	49860	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.043452978 CEST	49861	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.059866905 CEST	80	49861	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:47.060055017 CEST	49861	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.060270071 CEST	49861	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.076514959 CEST	80	49861	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:47.079236031 CEST	80	49861	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:47.121054888 CEST	49861	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.197912931 CEST	49860	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.216454983 CEST	80	49860	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:47.221010923 CEST	49861	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.239784956 CEST	80	49861	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:47.257083893 CEST	49860	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.280319929 CEST	49860	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.281059027 CEST	49861	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.299084902 CEST	80	49860	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:47.303674936 CEST	49861	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.322734118 CEST	80	49861	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:47.340109110 CEST	49860	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.357656002 CEST	49860	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.363059998 CEST	49861	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.376353025 CEST	80	49860	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:47.396347046 CEST	49861	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.415265083 CEST	80	49861	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:47.417126894 CEST	49860	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.424877882 CEST	49860	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.443247080 CEST	80	49860	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:47.456048965 CEST	49861	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.484077930 CEST	49860	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.488800049 CEST	49861	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.507695913 CEST	80	49861	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:47.548073053 CEST	49861	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.551959038 CEST	49860	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.571022987 CEST	80	49860	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:47.587332964 CEST	49861	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.606230974 CEST	80	49861	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:47.613080978 CEST	49860	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.639347076 CEST	49860	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.647231102 CEST	49861	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.658061981 CEST	80	49860	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:47.666414022 CEST	49876	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.666450024 CEST	443	49876	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.667121887 CEST	49876	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.667480946 CEST	49876	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.667503119 CEST	443	49876	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.676618099 CEST	49877	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.676645041 CEST	443	49877	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.677088022 CEST	49877	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.677222013 CEST	49877	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.677234888 CEST	443	49877	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.700125933 CEST	49860	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.702346087 CEST	49878	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.702406883 CEST	443	49878	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.703128099 CEST	49878	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.703365088 CEST	49878	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.703389883 CEST	443	49878	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.709178925 CEST	443	49876	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.710131884 CEST	49876	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.714129925 CEST	49876	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.714147091 CEST	443	49876	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.714777946 CEST	443	49876	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.717492104 CEST	49876	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.717608929 CEST	49876	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.717807055 CEST	443	49876	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.718101025 CEST	49876	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.718844891 CEST	443	49877	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.719108105 CEST	49877	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.722815990 CEST	49877	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.722826958 CEST	443	49877	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.723433971 CEST	443	49877	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.727617025 CEST	49877	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.727746010 CEST	49877	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.727956057 CEST	443	49877	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.728612900 CEST	49877	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.733283043 CEST	49879	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.733308077 CEST	443	49879	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.734132051 CEST	49879	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.734405041 CEST	49879	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.734416962 CEST	443	49879	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.746180058 CEST	443	49878	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.746974945 CEST	49878	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.750526905 CEST	49878	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.750560045 CEST	443	49878	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.751146078 CEST	443	49878	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.756102085 CEST	49878	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.756318092 CEST	49878	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.756464005 CEST	443	49878	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.757108927 CEST	49878	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.762485027 CEST	49880	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.762516022 CEST	443	49880	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.763101101 CEST	49880	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.763264894 CEST	49880	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.763277054 CEST	443	49880	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.775137901 CEST	49861	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.777236938 CEST	443	49879	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.778388977 CEST	49879	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.781361103 CEST	49879	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.781380892 CEST	443	49879	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.781863928 CEST	443	49879	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.784436941 CEST	49879	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.784713984 CEST	443	49879	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.784826040 CEST	49879	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.784842014 CEST	443	49879	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.785201073 CEST	49879	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.793977976 CEST	80	49861	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:47.800678015 CEST	49860	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.803338051 CEST	443	49880	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.804006100 CEST	49880	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.807867050 CEST	49880	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.807879925 CEST	443	49880	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.808090925 CEST	443	49880	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.811105013 CEST	49880	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.811305046 CEST	443	49880	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.811363935 CEST	49880	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.811377048 CEST	443	49880	34.120.208.123	192.168.2.2
Apr 4, 2022 03:19:47.811548948 CEST	49880	443	192.168.2.2	34.120.208.123
Apr 4, 2022 03:19:47.819374084 CEST	80	49860	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:47.830122948 CEST	49861	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.848901033 CEST	80	49861	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:47.861119032 CEST	49860	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.890141010 CEST	49861	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.951006889 CEST	49860	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.969712019 CEST	80	49860	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:47.976875067 CEST	49861	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:47.995760918 CEST	80	49861	34.107.221.82	192.168.2.2
Apr 4, 2022 03:19:48.010215998 CEST	49860	80	192.168.2.2	34.107.221.82
Apr 4, 2022 03:19:48.036153078 CEST	49861	80	192.168.2.2	34.107.221.82

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 4, 2022 03:17:54.623733997 CEST	49266	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:17:54.640391111 CEST	53	49266	1.1.1.1	192.168.2.2
Apr 4, 2022 03:17:54.714121103 CEST	64342	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:17:54.731062889 CEST	53	64342	1.1.1.1	192.168.2.2
Apr 4, 2022 03:17:54.789763927 CEST	52653	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:17:54.789824009 CEST	55370	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:17:54.806005955 CEST	53	55370	1.1.1.1	192.168.2.2
Apr 4, 2022 03:17:54.806065083 CEST	53	52653	1.1.1.1	192.168.2.2
Apr 4, 2022 03:17:54.821567059 CEST	53499	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:17:54.829984903 CEST	63053	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:17:54.838083982 CEST	53	53499	1.1.1.1	192.168.2.2
Apr 4, 2022 03:17:54.838135004 CEST	63367	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:17:54.846461058 CEST	53	63053	1.1.1.1	192.168.2.2
Apr 4, 2022 03:17:54.850255013 CEST	53888	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:17:54.854408979 CEST	53	63367	1.1.1.1	192.168.2.2
Apr 4, 2022 03:17:54.870430946 CEST	53	53888	1.1.1.1	192.168.2.2
Apr 4, 2022 03:17:55.072032928 CEST	50936	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:17:55.103635073 CEST	53	50936	1.1.1.1	192.168.2.2
Apr 4, 2022 03:17:55.109371901 CEST	60336	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:17:55.126072884 CEST	53	60336	1.1.1.1	192.168.2.2
Apr 4, 2022 03:17:55.420032024 CEST	62866	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:17:55.436583042 CEST	53	62866	1.1.1.1	192.168.2.2
Apr 4, 2022 03:17:55.919554949 CEST	50009	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:17:55.936096907 CEST	53	50009	1.1.1.1	192.168.2.2
Apr 4, 2022 03:17:56.006035089 CEST	64163	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:17:56.022530079 CEST	53	64163	1.1.1.1	192.168.2.2
Apr 4, 2022 03:17:56.028245926 CEST	65428	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:17:56.044682980 CEST	53	65428	1.1.1.1	192.168.2.2
Apr 4, 2022 03:17:56.058660984 CEST	50541	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:17:56.075804949 CEST	53	50541	1.1.1.1	192.168.2.2
Apr 4, 2022 03:17:56.102669954 CEST	49951	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:17:56.130785942 CEST	53	49951	1.1.1.1	192.168.2.2
Apr 4, 2022 03:17:56.171096087 CEST	62088	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:17:56.187921047 CEST	53	62088	1.1.1.1	192.168.2.2
Apr 4, 2022 03:17:56.374176979 CEST	58778	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:17:56.391297102 CEST	53	58778	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:04.568553925 CEST	60534	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:04.585191011 CEST	53	60534	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:04.864782095 CEST	63060	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:04.881643057 CEST	53	63060	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:04.910099030 CEST	64484	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:04.926681995 CEST	53	64484	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:04.939286947 CEST	59019	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:04.955868006 CEST	53	59019	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:06.283605099 CEST	60395	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:06.299905062 CEST	53	60395	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:06.368393898 CEST	55217	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:06.385008097 CEST	53	55217	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:06.418441057 CEST	55476	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:06.435105085 CEST	53	55476	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:06.637875080 CEST	49869	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:06.638068914 CEST	64105	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:06.638747931 CEST	50039	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:06.654542923 CEST	53	49869	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:06.654586077 CEST	53	64105	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:06.655164957 CEST	53	50039	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:06.969757080 CEST	56615	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:06.974127054 CEST	52422	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:06.986043930 CEST	53	56615	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:06.994030952 CEST	53	52422	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:07.075104952 CEST	64804	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:07.076670885 CEST	58505	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:07.091891050 CEST	53	64804	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:07.093213081 CEST	53	58505	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:07.094199896 CEST	49985	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:07.095669985 CEST	60940	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:07.110826969 CEST	53	49985	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:07.112246990 CEST	53	60940	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:07.144596100 CEST	64751	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:07.144665956 CEST	58814	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:07.161195993 CEST	53	64751	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:07.161367893 CEST	53	58814	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:11.580470085 CEST	57838	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:11.590192080 CEST	54884	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:11.590538979 CEST	54628	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:11.596831083 CEST	53	57838	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:11.599420071 CEST	61028	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:11.606468916 CEST	53	54884	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:11.606833935 CEST	53	54628	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:11.616278887 CEST	53	61028	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:11.702675104 CEST	60514	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:11.719278097 CEST	53	60514	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:11.839056015 CEST	63048	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:11.855297089 CEST	53	63048	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:13.770129919 CEST	52527	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:13.786612034 CEST	53	52527	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:13.798191071 CEST	63779	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:13.814723015 CEST	53	63779	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:13.817503929 CEST	55994	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:13.821674109 CEST	55832	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:13.833997965 CEST	53	55994	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:13.838197947 CEST	53	55832	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:13.919125080 CEST	63077	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:13.928231955 CEST	59702	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:13.935870886 CEST	53	63077	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:13.944569111 CEST	53	59702	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:13.994851112 CEST	56467	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:14.011599064 CEST	53	56467	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:14.024843931 CEST	52872	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:14.049506903 CEST	53	52872	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:14.320041895 CEST	52664	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:14.336579084 CEST	53	52664	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:14.501137018 CEST	63884	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:14.508589029 CEST	64027	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:14.525842905 CEST	53	64027	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:14.531210899 CEST	53	63884	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:14.609239101 CEST	64802	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:14.609551907 CEST	50988	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:14.611530066 CEST	51797	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:14.615546942 CEST	61215	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:14.625646114 CEST	53	64802	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:14.625674009 CEST	53	50988	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:14.627849102 CEST	53	51797	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:14.636107922 CEST	53	61215	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:14.704020977 CEST	57364	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:14.704467058 CEST	52409	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:14.720621109 CEST	53	57364	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:14.732964993 CEST	53	52409	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:14.770240068 CEST	60177	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:14.786923885 CEST	53	60177	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:14.800369978 CEST	52647	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:14.816884995 CEST	53	52647	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:14.822592974 CEST	59209	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:14.838928938 CEST	53	59209	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:14.884512901 CEST	53460	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:14.900806904 CEST	53	53460	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:15.089276075 CEST	60252	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:15.105745077 CEST	53	60252	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:15.285110950 CEST	52624	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:15.301601887 CEST	53	52624	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:15.455338001 CEST	64789	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:15.455987930 CEST	51686	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:15.466521978 CEST	65509	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:15.471889973 CEST	53	64789	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:15.472140074 CEST	53	51686	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:15.483395100 CEST	53	65509	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:15.495812893 CEST	59234	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:15.512309074 CEST	53	59234	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:15.515441895 CEST	61704	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:15.524107933 CEST	50942	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:15.532294989 CEST	53	61704	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:15.540467024 CEST	53	50942	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:15.978745937 CEST	53579	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:15.983946085 CEST	53946	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:15.986243963 CEST	52404	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:15.995398998 CEST	53	53579	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:16.000484943 CEST	53	53946	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:16.002603054 CEST	53	52404	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:16.570060968 CEST	64276	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:16.570988894 CEST	51067	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:16.586898088 CEST	53	64276	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:16.587292910 CEST	53	51067	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:16.589848042 CEST	59088	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:16.590384960 CEST	53776	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:16.606333971 CEST	53	59088	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:16.607068062 CEST	53	53776	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:18.791771889 CEST	52860	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:18.808751106 CEST	53	52860	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:23.302783012 CEST	59117	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:23.319370985 CEST	53	59117	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:23.592502117 CEST	57521	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:23.609035015 CEST	53	57521	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:23.665824890 CEST	52221	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:23.682349920 CEST	53	52221	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:23.837914944 CEST	51026	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:23.854324102 CEST	53	51026	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:24.270553112 CEST	49228	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:24.287487030 CEST	53	49228	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:24.909367085 CEST	64561	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:24.925915003 CEST	53	64561	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:24.995548964 CEST	60832	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:25.012582064 CEST	53	60832	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:25.056421041 CEST	52105	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:25.072781086 CEST	53	52105	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.047678947 CEST	51325	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.048118114 CEST	55326	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.049633026 CEST	59684	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.050026894 CEST	59305	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.064300060 CEST	53	51325	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.064377069 CEST	53	55326	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.066545010 CEST	53	59684	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.066579103 CEST	53	59305	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.084209919 CEST	62563	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.086803913 CEST	62015	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.087990999 CEST	62764	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.100205898 CEST	50819	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.107606888 CEST	53	62764	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.109932899 CEST	54032	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.116729021 CEST	53	50819	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.136274099 CEST	53	54032	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.144910097 CEST	53	63442	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.146414995 CEST	53	62563	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.158482075 CEST	51597	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.160043001 CEST	51442	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.160546064 CEST	62218	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.174278975 CEST	51332	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.188803911 CEST	53	51597	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.190606117 CEST	53	51332	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.191605091 CEST	53	62218	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.210422039 CEST	55479	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.213135004 CEST	59491	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.213594913 CEST	63127	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.213799000 CEST	55565	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.215395927 CEST	52263	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.227695942 CEST	53	55479	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.230283022 CEST	53	63127	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.230283022 CEST	50350	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.230329037 CEST	53	55565	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.234893084 CEST	53	52263	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.244693041 CEST	53	59491	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.247633934 CEST	53	50350	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.248951912 CEST	52697	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.267355919 CEST	53	52697	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.273233891 CEST	60740	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.290491104 CEST	53	60740	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.293612003 CEST	65145	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.295110941 CEST	62480	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.310165882 CEST	53	65145	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.311630964 CEST	63735	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.311631918 CEST	53	62480	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.313370943 CEST	56615	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.329571009 CEST	53	63735	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.329880953 CEST	53	56615	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.343029976 CEST	57882	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.343154907 CEST	64205	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.359478951 CEST	53	64205	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.359523058 CEST	53	57882	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.361970901 CEST	63679	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.363656998 CEST	61691	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.379638910 CEST	53	63679	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.380660057 CEST	53	61691	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.382180929 CEST	64910	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.386573076 CEST	53	51442	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.390017033 CEST	51948	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.399632931 CEST	53	64910	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.423655033 CEST	53	51948	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.425277948 CEST	55908	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.443695068 CEST	53	55908	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.709866047 CEST	56692	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.726473093 CEST	53	56692	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.728698969 CEST	64996	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.732986927 CEST	60835	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.735405922 CEST	59258	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.745001078 CEST	53	64996	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.746905088 CEST	60060	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.749622107 CEST	53	60835	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.751996040 CEST	53	59258	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.763734102 CEST	53	60060	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:31.773442984 CEST	51141	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:31.790489912 CEST	53	51141	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:33.921633005 CEST	54557	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:33.938129902 CEST	53	54557	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:33.970911026 CEST	60126	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:33.985368013 CEST	65024	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:33.987390995 CEST	53	60126	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:34.001852989 CEST	53	65024	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:34.060090065 CEST	50011	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:34.060265064 CEST	54923	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:34.060421944 CEST	55100	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:34.076512098 CEST	53	54923	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:34.076565981 CEST	53	50011	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:34.076864004 CEST	53	55100	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:34.109532118 CEST	59355	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:34.125982046 CEST	53	59355	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:34.155900955 CEST	59110	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:34.158060074 CEST	49382	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:34.172286987 CEST	53	59110	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:34.174527884 CEST	53	49382	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:35.557311058 CEST	58130	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:35.573740959 CEST	53	58130	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:35.576407909 CEST	62579	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:35.587841988 CEST	59336	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:35.587975025 CEST	49621	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:35.592595100 CEST	53	62579	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:35.594400883 CEST	62626	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:35.604310036 CEST	53	59336	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:35.604341030 CEST	53	49621	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:35.611166000 CEST	53	62626	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:35.616316080 CEST	51873	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:35.625511885 CEST	61338	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:35.632451057 CEST	53	51873	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:35.641941071 CEST	63982	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:35.642611980 CEST	53	61338	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:35.648606062 CEST	63470	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:35.649188042 CEST	60307	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:35.651560068 CEST	64458	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:35.658312082 CEST	53	63982	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:35.664891005 CEST	53	63470	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:35.665360928 CEST	53	60307	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:35.667809010 CEST	53	64458	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:35.667896032 CEST	51869	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:35.684247971 CEST	53	51869	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:35.685859919 CEST	49641	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:35.702214003 CEST	53	49641	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:35.706765890 CEST	49743	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:35.723290920 CEST	53	49743	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:36.731693983 CEST	61021	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:36.748131990 CEST	53	61021	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:36.751091003 CEST	57604	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:36.767560005 CEST	53	57604	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:36.769156933 CEST	64978	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:36.785804987 CEST	53	64978	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:36.787580013 CEST	54611	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:36.803946018 CEST	53	54611	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:37.381978989 CEST	56390	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:37.398895979 CEST	53	56390	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:37.402529001 CEST	56178	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:37.402779102 CEST	59129	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:37.403465986 CEST	57818	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:37.418798923 CEST	53	56178	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:37.419151068 CEST	53	59129	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:37.419836044 CEST	53	57818	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:37.423310041 CEST	52189	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:37.439753056 CEST	53	52189	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:37.441927910 CEST	50727	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:37.458566904 CEST	53	50727	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:38.165426970 CEST	51871	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:38.181904078 CEST	53	51871	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:38.190047026 CEST	56311	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:38.193335056 CEST	62672	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:38.206285954 CEST	53	56311	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:38.209439993 CEST	53	62672	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:38.221524954 CEST	64526	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:38.222117901 CEST	64928	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:38.228674889 CEST	52148	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:38.238475084 CEST	53	64928	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:38.245107889 CEST	53	52148	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:38.247658014 CEST	53	64526	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:38.271589994 CEST	57151	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:38.277772903 CEST	58224	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:38.294226885 CEST	53	58224	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:38.295505047 CEST	56791	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:38.296415091 CEST	61546	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:38.297566891 CEST	53	57151	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:38.298662901 CEST	52427	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:38.306936979 CEST	56682	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:38.339791059 CEST	53	56791	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:38.339807987 CEST	53	61546	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:38.339819908 CEST	53	52427	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:38.339852095 CEST	53	56682	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:38.353291035 CEST	57156	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:38.370183945 CEST	53	57156	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:38.912297010 CEST	51559	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:38.928813934 CEST	53	51559	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:38.931930065 CEST	53066	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:38.936975956 CEST	64645	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:38.938041925 CEST	63590	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:38.948367119 CEST	53	53066	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:38.953321934 CEST	53	64645	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:38.954329014 CEST	53	63590	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:38.977384090 CEST	51668	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:38.993679047 CEST	53	51668	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:39.040235043 CEST	61620	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:39.056962967 CEST	53	61620	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:39.555502892 CEST	52721	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:39.568622112 CEST	54125	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:39.572254896 CEST	53	52721	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:39.573887110 CEST	50512	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:39.585037947 CEST	53	54125	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:39.589013100 CEST	62664	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:39.590353966 CEST	53	50512	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:39.590872049 CEST	50452	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:39.591923952 CEST	53447	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:39.605515957 CEST	53	62664	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:39.607265949 CEST	53	50452	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:39.608133078 CEST	53	53447	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:39.611588955 CEST	53386	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:39.628566980 CEST	53	53386	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:39.631459951 CEST	51301	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:39.648240089 CEST	53	51301	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:46.193675041 CEST	59739	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:46.210645914 CEST	53	59739	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:46.215974092 CEST	63731	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:46.232871056 CEST	53	63731	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:46.237519979 CEST	55895	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:46.254508018 CEST	53	55895	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:46.846795082 CEST	55848	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:46.863265038 CEST	53	55848	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:46.882508993 CEST	52706	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:46.899049997 CEST	53	52706	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:46.910531998 CEST	60930	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:46.912141085 CEST	55223	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:46.927587032 CEST	53	60930	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:46.928538084 CEST	53	55223	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:46.943551064 CEST	51610	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:46.944659948 CEST	51390	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:46.945389986 CEST	53635	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:46.945878029 CEST	51990	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:46.959935904 CEST	53	51610	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:46.960983038 CEST	53	51390	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:46.961853981 CEST	53	53635	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:46.962004900 CEST	53	51990	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:46.967782021 CEST	59465	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:46.968179941 CEST	62175	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:46.984242916 CEST	53	59465	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:46.984922886 CEST	53	62175	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:47.010859966 CEST	62081	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:47.017925978 CEST	65334	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:47.018439054 CEST	60891	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:47.027494907 CEST	53	62081	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:47.034394979 CEST	53	65334	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:47.034512043 CEST	53	60891	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:47.038405895 CEST	56454	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:47.055327892 CEST	53	56454	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:47.057101965 CEST	55079	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:47.074074984 CEST	53	55079	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:47.076030970 CEST	63204	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:47.092498064 CEST	53	63204	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:47.389620066 CEST	50580	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:47.406282902 CEST	53	50580	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:47.422310114 CEST	52540	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:47.438776016 CEST	53	52540	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:47.440707922 CEST	59676	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:47.457573891 CEST	53	59676	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:47.458921909 CEST	50797	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:47.475256920 CEST	53	50797	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:48.018462896 CEST	51202	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:48.035022020 CEST	53	51202	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:48.043900013 CEST	62569	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:48.045109034 CEST	52249	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:48.045969009 CEST	64675	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:48.060425997 CEST	53	62569	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:48.061271906 CEST	53	52249	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:48.062244892 CEST	53	64675	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:48.063574076 CEST	64781	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:48.079781055 CEST	53	64781	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:48.082540989 CEST	64243	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:48.098906994 CEST	53	64243	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:48.444154024 CEST	49821	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:48.461051941 CEST	53	49821	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:48.464529037 CEST	60121	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:48.464894056 CEST	61766	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:48.480865955 CEST	53	60121	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:48.481205940 CEST	53	61766	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:48.485568047 CEST	62250	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:48.485842943 CEST	51731	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:48.485863924 CEST	61599	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:48.502003908 CEST	53	62250	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:48.502151966 CEST	53	51731	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:48.502216101 CEST	53	61599	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:48.506903887 CEST	61128	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:48.523340940 CEST	53	61128	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:48.525624037 CEST	56763	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:48.542133093 CEST	53	56763	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:56.183123112 CEST	60267	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:56.199717045 CEST	53	60267	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:56.202459097 CEST	57824	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:56.234766960 CEST	53	57824	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:56.242763996 CEST	54918	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:56.268964052 CEST	53	54918	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:56.277081966 CEST	55963	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:56.295356989 CEST	53	55963	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:56.784687996 CEST	53160	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:56.820209026 CEST	53	53160	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:56.827389956 CEST	53961	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:56.844125032 CEST	53	53961	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:56.846987009 CEST	62743	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:56.849306107 CEST	58370	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:56.877125025 CEST	53	62743	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:56.879038095 CEST	53	58370	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:56.948985100 CEST	55201	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:56.955315113 CEST	54676	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:56.959412098 CEST	57890	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:56.960892916 CEST	63139	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:56.972224951 CEST	53	54676	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:56.976560116 CEST	53	57890	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:56.977365971 CEST	53	63139	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:56.994446039 CEST	53	55201	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:56.994721889 CEST	51033	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:56.995032072 CEST	57850	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:56.995217085 CEST	52606	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:56.995780945 CEST	58833	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.003401995 CEST	50334	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.011027098 CEST	53	51033	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.011411905 CEST	53	57850	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.011441946 CEST	53	52606	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.012257099 CEST	53	58833	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.013611078 CEST	53876	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.015714884 CEST	57024	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.016613960 CEST	51286	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.029889107 CEST	53	53876	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.032248974 CEST	53	57024	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.032923937 CEST	53	51286	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.046830893 CEST	53	50334	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.088578939 CEST	57076	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.092348099 CEST	62441	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.104912996 CEST	53	57076	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.108798027 CEST	53	62441	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.118349075 CEST	64664	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.120471001 CEST	50548	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.121558905 CEST	55152	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.134560108 CEST	53	64664	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.136852026 CEST	53	50548	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.137868881 CEST	53	55152	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.147633076 CEST	65003	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.147666931 CEST	60383	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.153532028 CEST	62560	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.163925886 CEST	53	60383	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.163952112 CEST	53	65003	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.169923067 CEST	53	62560	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.186739922 CEST	62098	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.203546047 CEST	53	62098	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.206280947 CEST	59708	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.211608887 CEST	64723	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.211637974 CEST	52569	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.222656965 CEST	56149	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.223521948 CEST	53	59708	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.226080894 CEST	62102	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.227962017 CEST	53	64723	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.227984905 CEST	53	52569	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.238902092 CEST	53	56149	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.242311954 CEST	53	62102	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.380912066 CEST	64084	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.410659075 CEST	57488	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.423286915 CEST	49491	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.424098969 CEST	53	64084	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.427090883 CEST	53	57488	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.427201033 CEST	57136	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.429651976 CEST	58962	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.439821005 CEST	53	49491	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.445833921 CEST	53	58962	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.445889950 CEST	53	57136	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.447418928 CEST	51473	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.449043036 CEST	54227	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.450809002 CEST	54857	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.454587936 CEST	52012	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.454763889 CEST	57847	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.463825941 CEST	53	51473	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.465245008 CEST	53	54227	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.468875885 CEST	55001	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.471050024 CEST	53	57847	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.471236944 CEST	53	52012	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.475657940 CEST	54839	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.480473042 CEST	53	54857	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.482430935 CEST	52553	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.485246897 CEST	53	55001	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.487297058 CEST	56257	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:57.492050886 CEST	53	54839	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.504049063 CEST	53	56257	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:57.512833118 CEST	53	52553	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:58.316905975 CEST	59703	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:58.362508059 CEST	53	59703	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:58.371690989 CEST	59436	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:58.403549910 CEST	53	59436	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:58.408273935 CEST	65113	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:58.425183058 CEST	53	65113	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:58.427498102 CEST	63390	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:58.427551031 CEST	52113	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:58.433623075 CEST	58518	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:58.444091082 CEST	53	63390	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:58.450195074 CEST	53	58518	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:58.454039097 CEST	63190	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:58.458646059 CEST	53	52113	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:58.462102890 CEST	55282	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:58.470621109 CEST	53	63190	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:58.473185062 CEST	62026	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:58.473346949 CEST	63753	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:58.478672981 CEST	53	55282	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:58.489706993 CEST	53	62026	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:58.489752054 CEST	53	63753	1.1.1.1	192.168.2.2
Apr 4, 2022 03:18:58.495917082 CEST	60326	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:18:58.512873888 CEST	53	60326	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:08.080224991 CEST	64430	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:08.097690105 CEST	53	64430	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:08.198544979 CEST	54604	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:08.215173006 CEST	53	54604	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:08.244343042 CEST	62085	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:08.261142969 CEST	53	62085	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:08.265052080 CEST	56145	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:08.281730890 CEST	53	56145	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:08.823046923 CEST	52594	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:08.839543104 CEST	53	52594	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:08.847547054 CEST	51399	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:08.851311922 CEST	56352	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:08.852500916 CEST	62633	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:08.864109993 CEST	53	51399	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:08.867202997 CEST	49338	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:08.867826939 CEST	53	56352	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:08.868758917 CEST	53	62633	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:08.870043039 CEST	65431	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:08.884022951 CEST	53	49338	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:08.885651112 CEST	51915	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:08.886549950 CEST	53	65431	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:08.902510881 CEST	53	51915	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.649662018 CEST	58563	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.666810036 CEST	53	58563	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.708916903 CEST	54315	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.725809097 CEST	53	54315	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.738620996 CEST	63804	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.752382994 CEST	61301	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.755311966 CEST	53	63804	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.756982088 CEST	60971	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.767724037 CEST	51608	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.769316912 CEST	53	61301	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.771332979 CEST	50224	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.773787022 CEST	53	60971	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.784565926 CEST	53	51608	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.788028955 CEST	53	50224	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.790179014 CEST	62618	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.813395023 CEST	51718	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.813900948 CEST	54363	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.821137905 CEST	53	62618	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.824767113 CEST	50374	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.825314045 CEST	63459	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.830101013 CEST	53	51718	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.833586931 CEST	53	54363	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.841072083 CEST	53	50374	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.841644049 CEST	53	63459	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.847501993 CEST	58515	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.848773003 CEST	49791	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.863835096 CEST	53	58515	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.868897915 CEST	53	49791	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.884896040 CEST	63959	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.886152983 CEST	56405	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.886415005 CEST	54108	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.901660919 CEST	53	63959	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.902404070 CEST	53	56405	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.903094053 CEST	53	54108	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.913036108 CEST	58571	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.914200068 CEST	63060	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.914741993 CEST	55936	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.931353092 CEST	53	63060	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.931401014 CEST	53	55936	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.941515923 CEST	53	58571	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.948005915 CEST	55745	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.948457956 CEST	60701	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.952740908 CEST	52453	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.964313030 CEST	53	55745	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.965154886 CEST	53	60701	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.969052076 CEST	53	52453	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.972656965 CEST	65369	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.973977089 CEST	61150	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:46.989078999 CEST	53	65369	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:46.990603924 CEST	53	61150	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.006244898 CEST	52884	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.008801937 CEST	52965	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.009385109 CEST	56152	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.022949934 CEST	53	52884	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.025235891 CEST	53	52965	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.025535107 CEST	53	56152	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.057802916 CEST	49363	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.058695078 CEST	64468	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.075072050 CEST	53	49363	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.075109959 CEST	53	64468	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.078596115 CEST	65135	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.080609083 CEST	57636	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.094990015 CEST	53	65135	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.096594095 CEST	58379	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.097157955 CEST	53	57636	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.109963894 CEST	51384	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.113008022 CEST	53	58379	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.113702059 CEST	63042	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.126182079 CEST	53	51384	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.130325079 CEST	53	63042	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.140466928 CEST	56010	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.145793915 CEST	60629	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.146034956 CEST	53043	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.157378912 CEST	53	56010	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.162326097 CEST	53	53043	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.162508965 CEST	53	60629	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.195599079 CEST	56765	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.196441889 CEST	62792	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.198091984 CEST	63919	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.212384939 CEST	53	56765	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.213068962 CEST	53	62792	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.214487076 CEST	53	63919	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.214593887 CEST	50100	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.215637922 CEST	63613	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.217426062 CEST	55603	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.220460892 CEST	58902	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.221395016 CEST	49336	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.230727911 CEST	53	50100	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.232422113 CEST	53	63613	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.233578920 CEST	53	55603	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.236752033 CEST	53	58902	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.237814903 CEST	53	49336	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.241245985 CEST	56692	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.257580042 CEST	53	56692	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.265532970 CEST	60537	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.281908989 CEST	53	60537	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.302814960 CEST	60633	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.303335905 CEST	57657	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.306072950 CEST	51476	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.319210052 CEST	53	60633	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.319659948 CEST	53	57657	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.322323084 CEST	53	51476	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.325505018 CEST	64892	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.342044115 CEST	53	64892	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.361721039 CEST	58054	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.364268064 CEST	60211	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.378175974 CEST	53	58054	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.380981922 CEST	53	60211	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.393534899 CEST	59988	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.394030094 CEST	50510	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.394491911 CEST	50220	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.394642115 CEST	56437	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.399250984 CEST	57343	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.410105944 CEST	53	59988	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.410213947 CEST	53	50510	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.410630941 CEST	53	50220	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.410918951 CEST	53	56437	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.415640116 CEST	53	57343	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.427727938 CEST	58323	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.444298029 CEST	53	58323	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.454991102 CEST	56750	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.455423117 CEST	56995	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.455431938 CEST	57577	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.471260071 CEST	53	56750	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.471524000 CEST	53	57577	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.471959114 CEST	53	56995	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.474370956 CEST	53781	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.474703074 CEST	51213	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.490688086 CEST	53	53781	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.492307901 CEST	62722	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.503319979 CEST	53	51213	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.508662939 CEST	53	62722	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.512660027 CEST	56716	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.525654078 CEST	60874	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.529424906 CEST	53	56716	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.542074919 CEST	53	60874	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.544908047 CEST	51437	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.561254978 CEST	53	51437	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.564949036 CEST	58814	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.575627089 CEST	54585	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.575710058 CEST	51423	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.581554890 CEST	53	58814	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.583290100 CEST	62306	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.591959000 CEST	53	51423	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.591991901 CEST	53	54585	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.592201948 CEST	52129	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.599539995 CEST	53	62306	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.608467102 CEST	53	52129	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.621437073 CEST	61662	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.638217926 CEST	53	61662	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.641288996 CEST	63801	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.641407967 CEST	62902	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.658102036 CEST	53	63801	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.658129930 CEST	53	62902	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.662431002 CEST	64139	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.662662983 CEST	64718	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.662827015 CEST	59261	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.678890944 CEST	53	64139	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.679033995 CEST	53	64718	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.679064035 CEST	53	59261	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.686126947 CEST	57358	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.690103054 CEST	62236	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.702513933 CEST	53	57358	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.704823971 CEST	56975	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.706415892 CEST	53	62236	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.708425999 CEST	60510	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.721136093 CEST	53	56975	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.724729061 CEST	53	60510	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.777033091 CEST	64735	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.777743101 CEST	55671	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.793526888 CEST	53	64735	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.794109106 CEST	53	55671	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.798187017 CEST	52727	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.798296928 CEST	59355	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.814673901 CEST	53	59355	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.814718962 CEST	53	52727	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.816633940 CEST	63882	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.822922945 CEST	52829	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.826014042 CEST	50665	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.833074093 CEST	53	63882	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.835870028 CEST	59933	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.838829994 CEST	57108	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.839159012 CEST	53	52829	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.842416048 CEST	53	50665	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.852329016 CEST	53	59933	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.855202913 CEST	53	57108	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.952490091 CEST	63636	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.968863010 CEST	53	63636	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.971602917 CEST	59525	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.973303080 CEST	59065	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.973340034 CEST	59468	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:47.988034010 CEST	53	59525	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.989713907 CEST	53	59065	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.989743948 CEST	53	59468	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:47.991544008 CEST	61293	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:48.008758068 CEST	53	61293	1.1.1.1	192.168.2.2
Apr 4, 2022 03:19:48.011456966 CEST	51635	53	192.168.2.2	1.1.1.1
Apr 4, 2022 03:19:48.028076887 CEST	53	51635	1.1.1.1	192.168.2.2

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 4, 2022 03:17:54.623733997 CEST	192.168.2.2	1.1.1.1	0x4e17	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:54.714121103 CEST	192.168.2.2	1.1.1.1	0x90bb	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:54.789763927 CEST	192.168.2.2	1.1.1.1	0x6e61	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:54.789824009 CEST	192.168.2.2	1.1.1.1	0xc720	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:54.821567059 CEST	192.168.2.2	1.1.1.1	0xb32a	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:17:54.829984903 CEST	192.168.2.2	1.1.1.1	0xfb9d	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:54.838135004 CEST	192.168.2.2	1.1.1.1	0xc6d	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:54.850255013 CEST	192.168.2.2	1.1.1.1	0xadc6	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:55.072032928 CEST	192.168.2.2	1.1.1.1	0x53e2	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:55.109371901 CEST	192.168.2.2	1.1.1.1	0x675	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:17:55.420032024 CEST	192.168.2.2	1.1.1.1	0xf18	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:55.919554949 CEST	192.168.2.2	1.1.1.1	0xbeb4	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:56.006035089 CEST	192.168.2.2	1.1.1.1	0x62ad	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:56.028245926 CEST	192.168.2.2	1.1.1.1	0x2b2f	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:17:56.058660984 CEST	192.168.2.2	1.1.1.1	0xf7cf	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:56.102669954 CEST	192.168.2.2	1.1.1.1	0xb05	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:56.171096087 CEST	192.168.2.2	1.1.1.1	0xc3f5	Standard query (0)	d2nxq2uap88usk.cloudfront.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:56.374176979 CEST	192.168.2.2	1.1.1.1	0xed2f	Standard query (0)	d2nxq2uap88usk.cloudfront.net	28	IN (0x0001)
Apr 4, 2022 03:18:04.568553925 CEST	192.168.2.2	1.1.1.1	0xea69	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:04.864782095 CEST	192.168.2.2	1.1.1.1	0x62d2	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:04.910099030 CEST	192.168.2.2	1.1.1.1	0x8662	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:04.939286947 CEST	192.168.2.2	1.1.1.1	0x26fc	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:06.283605099 CEST	192.168.2.2	1.1.1.1	0x30e0	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:06.368393898 CEST	192.168.2.2	1.1.1.1	0x4dc7	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:06.418441057 CEST	192.168.2.2	1.1.1.1	0x140	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:06.637875080 CEST	192.168.2.2	1.1.1.1	0xcddd	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:06.638068914 CEST	192.168.2.2	1.1.1.1	0x76bb	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:06.638747931 CEST	192.168.2.2	1.1.1.1	0x629c	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:06.969757080 CEST	192.168.2.2	1.1.1.1	0x977e	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:06.974127054 CEST	192.168.2.2	1.1.1.1	0xfa42	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:07.075104952 CEST	192.168.2.2	1.1.1.1	0xea63	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:07.076670885 CEST	192.168.2.2	1.1.1.1	0x4b76	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:07.094199896 CEST	192.168.2.2	1.1.1.1	0xca19	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:07.095669985 CEST	192.168.2.2	1.1.1.1	0xa196	Standard query (0)	shavar.prod.mozaws.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:07.144596100 CEST	192.168.2.2	1.1.1.1	0x2592	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:07.144665956 CEST	192.168.2.2	1.1.1.1	0xf254	Standard query (0)	shavar.prod.mozaws.net	28	IN (0x0001)
Apr 4, 2022 03:18:11.580470085 CEST	192.168.2.2	1.1.1.1	0xf2d1	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:11.590192080 CEST	192.168.2.2	1.1.1.1	0xdaa2	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:11.590538979 CEST	192.168.2.2	1.1.1.1	0x4aa7	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:11.599420071 CEST	192.168.2.2	1.1.1.1	0x7695	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:11.702675104 CEST	192.168.2.2	1.1.1.1	0xcc19	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:11.839056015 CEST	192.168.2.2	1.1.1.1	0xd71f	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:13.770129919 CEST	192.168.2.2	1.1.1.1	0x9b74	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:13.798191071 CEST	192.168.2.2	1.1.1.1	0xd54e	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:13.817503929 CEST	192.168.2.2	1.1.1.1	0xd217	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:13.821674109 CEST	192.168.2.2	1.1.1.1	0x340d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:13.919125080 CEST	192.168.2.2	1.1.1.1	0x4621	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:13.928231955 CEST	192.168.2.2	1.1.1.1	0x539	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:13.994851112 CEST	192.168.2.2	1.1.1.1	0xa4d0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.024843931 CEST	192.168.2.2	1.1.1.1	0x2ae9	Standard query (0)	www.google.com	28	IN (0x0001)
Apr 4, 2022 03:18:14.320041895 CEST	192.168.2.2	1.1.1.1	0x8a9a	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.501137018 CEST	192.168.2.2	1.1.1.1	0x3f7f	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.508589029 CEST	192.168.2.2	1.1.1.1	0x3a33	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.609239101 CEST	192.168.2.2	1.1.1.1	0x259f	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.609551907 CEST	192.168.2.2	1.1.1.1	0x3a2f	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.611530066 CEST	192.168.2.2	1.1.1.1	0x287b	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.615546942 CEST	192.168.2.2	1.1.1.1	0x216	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.704020977 CEST	192.168.2.2	1.1.1.1	0xca55	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:14.704467058 CEST	192.168.2.2	1.1.1.1	0xe2b3	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.770240068 CEST	192.168.2.2	1.1.1.1	0x4988	Standard query (0)	firefox.settings.services.mozilla.com	28	IN (0x0001)
Apr 4, 2022 03:18:14.800369978 CEST	192.168.2.2	1.1.1.1	0xd220	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.822592974 CEST	192.168.2.2	1.1.1.1	0xe3ca	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.884512901 CEST	192.168.2.2	1.1.1.1	0x97f9	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:15.089276075 CEST	192.168.2.2	1.1.1.1	0xe15c	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:15.285110950 CEST	192.168.2.2	1.1.1.1	0xbda3	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:15.455338001 CEST	192.168.2.2	1.1.1.1	0xe97c	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:15.455987930 CEST	192.168.2.2	1.1.1.1	0xb265	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:15.466521978 CEST	192.168.2.2	1.1.1.1	0x8ad4	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:15.495812893 CEST	192.168.2.2	1.1.1.1	0xcfaa	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:15.515441895 CEST	192.168.2.2	1.1.1.1	0x3601	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:15.524107933 CEST	192.168.2.2	1.1.1.1	0x69eb	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:15.978745937 CEST	192.168.2.2	1.1.1.1	0x7768	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:15.983946085 CEST	192.168.2.2	1.1.1.1	0x6131	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:15.986243963 CEST	192.168.2.2	1.1.1.1	0xd0d4	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:16.570060968 CEST	192.168.2.2	1.1.1.1	0xd40	Standard query (0)	d228z91au11ukj.cloudfront.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:16.570988894 CEST	192.168.2.2	1.1.1.1	0x9782	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:16.589848042 CEST	192.168.2.2	1.1.1.1	0xb368	Standard query (0)	d228z91au11ukj.cloudfront.net	28	IN (0x0001)
Apr 4, 2022 03:18:16.590384960 CEST	192.168.2.2	1.1.1.1	0xdd20	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:18.791771889 CEST	192.168.2.2	1.1.1.1	0xc765	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:23.302783012 CEST	192.168.2.2	1.1.1.1	0x101e	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:23.592502117 CEST	192.168.2.2	1.1.1.1	0x7b78	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:23.665824890 CEST	192.168.2.2	1.1.1.1	0x7bcc	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:23.837914944 CEST	192.168.2.2	1.1.1.1	0x79a0	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:24.270553112 CEST	192.168.2.2	1.1.1.1	0xbfd6	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:24.909367085 CEST	192.168.2.2	1.1.1.1	0x55ff	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:24.995548964 CEST	192.168.2.2	1.1.1.1	0xee38	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:25.056421041 CEST	192.168.2.2	1.1.1.1	0x345a	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:31.047678947 CEST	192.168.2.2	1.1.1.1	0x36bd	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.048118114 CEST	192.168.2.2	1.1.1.1	0xa9cf	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.049633026 CEST	192.168.2.2	1.1.1.1	0x6b4c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.050026894 CEST	192.168.2.2	1.1.1.1	0xec4b	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.084209919 CEST	192.168.2.2	1.1.1.1	0xbd73	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.086803913 CEST	192.168.2.2	1.1.1.1	0xac6d	Standard query (0)	www.ebay.de	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.087990999 CEST	192.168.2.2	1.1.1.1	0xee56	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.100205898 CEST	192.168.2.2	1.1.1.1	0xea9b	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.109932899 CEST	192.168.2.2	1.1.1.1	0x2f5d	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.158482075 CEST	192.168.2.2	1.1.1.1	0xbbc9	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)
Apr 4, 2022 03:18:31.160043001 CEST	192.168.2.2	1.1.1.1	0x6aa3	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.160546064 CEST	192.168.2.2	1.1.1.1	0xbebc	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.174278975 CEST	192.168.2.2	1.1.1.1	0x23c0	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.210422039 CEST	192.168.2.2	1.1.1.1	0x617a	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.213135004 CEST	192.168.2.2	1.1.1.1	0x592d	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)
Apr 4, 2022 03:18:31.213594913 CEST	192.168.2.2	1.1.1.1	0xba50	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.213799000 CEST	192.168.2.2	1.1.1.1	0x2b89	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.215395927 CEST	192.168.2.2	1.1.1.1	0x5d96	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.230283022 CEST	192.168.2.2	1.1.1.1	0x4855	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.248951912 CEST	192.168.2.2	1.1.1.1	0xd1c6	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)
Apr 4, 2022 03:18:31.273233891 CEST	192.168.2.2	1.1.1.1	0xedb1	Standard query (0)	www.mozorg.moz.works	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.293612003 CEST	192.168.2.2	1.1.1.1	0x7efa	Standard query (0)	prod.ingestion-edge.prod.dataops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.295110941 CEST	192.168.2.2	1.1.1.1	0xa313	Standard query (0)	www.mozorg.moz.works	28	IN (0x0001)
Apr 4, 2022 03:18:31.311630964 CEST	192.168.2.2	1.1.1.1	0x9f6e	Standard query (0)	prod.ingestion-edge.prod.dataops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:31.313370943 CEST	192.168.2.2	1.1.1.1	0x724a	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.343029976 CEST	192.168.2.2	1.1.1.1	0xee70	Standard query (0)	autopush.prod.mozaws.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.343154907 CEST	192.168.2.2	1.1.1.1	0x3318	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.361970901 CEST	192.168.2.2	1.1.1.1	0x51db	Standard query (0)	autopush.prod.mozaws.net	28	IN (0x0001)
Apr 4, 2022 03:18:31.363656998 CEST	192.168.2.2	1.1.1.1	0xf41c	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.382180929 CEST	192.168.2.2	1.1.1.1	0x1692	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:31.390017033 CEST	192.168.2.2	1.1.1.1	0x2ff7	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.425277948 CEST	192.168.2.2	1.1.1.1	0x4144	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)
Apr 4, 2022 03:18:31.709866047 CEST	192.168.2.2	1.1.1.1	0x258e	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.728698969 CEST	192.168.2.2	1.1.1.1	0x70ae	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.732986927 CEST	192.168.2.2	1.1.1.1	0x5e8	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.735405922 CEST	192.168.2.2	1.1.1.1	0x4062	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.746905088 CEST	192.168.2.2	1.1.1.1	0x8e56	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.773442984 CEST	192.168.2.2	1.1.1.1	0x37b8	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:33.921633005 CEST	192.168.2.2	1.1.1.1	0x7b85	Standard query (0)	prod.ingestion-edge.prod.dataops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:33.970911026 CEST	192.168.2.2	1.1.1.1	0xdcb6	Standard query (0)	prod.ingestion-edge.prod.dataops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:33.985368013 CEST	192.168.2.2	1.1.1.1	0xdee0	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:34.060090065 CEST	192.168.2.2	1.1.1.1	0x90eb	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:34.060265064 CEST	192.168.2.2	1.1.1.1	0x5e81	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:34.060421944 CEST	192.168.2.2	1.1.1.1	0xbc9d	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:34.109532118 CEST	192.168.2.2	1.1.1.1	0x2ddd	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:34.155900955 CEST	192.168.2.2	1.1.1.1	0xf7e7	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:34.158060074 CEST	192.168.2.2	1.1.1.1	0xa44d	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:35.557311058 CEST	192.168.2.2	1.1.1.1	0xbb01	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.576407909 CEST	192.168.2.2	1.1.1.1	0xe444	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.587841988 CEST	192.168.2.2	1.1.1.1	0xe298	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.587975025 CEST	192.168.2.2	1.1.1.1	0x1b84	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.594400883 CEST	192.168.2.2	1.1.1.1	0x8f45	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.616316080 CEST	192.168.2.2	1.1.1.1	0xf0a1	Standard query (0)	prod.ingestion-edge.prod.dataops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.625511885 CEST	192.168.2.2	1.1.1.1	0x27bd	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:35.641941071 CEST	192.168.2.2	1.1.1.1	0x22cf	Standard query (0)	prod.ingestion-edge.prod.dataops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:35.648606062 CEST	192.168.2.2	1.1.1.1	0xaecd	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.649188042 CEST	192.168.2.2	1.1.1.1	0x3c3c	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.651560068 CEST	192.168.2.2	1.1.1.1	0x2a38	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.667896032 CEST	192.168.2.2	1.1.1.1	0x2a26	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.685859919 CEST	192.168.2.2	1.1.1.1	0xdbe4	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.706765890 CEST	192.168.2.2	1.1.1.1	0xb078	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:36.731693983 CEST	192.168.2.2	1.1.1.1	0x5031	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:36.751091003 CEST	192.168.2.2	1.1.1.1	0xcc01	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:36.769156933 CEST	192.168.2.2	1.1.1.1	0x5914	Standard query (0)	autopush.prod.mozaws.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:36.787580013 CEST	192.168.2.2	1.1.1.1	0xd2fb	Standard query (0)	autopush.prod.mozaws.net	28	IN (0x0001)
Apr 4, 2022 03:18:37.381978989 CEST	192.168.2.2	1.1.1.1	0x6cc1	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:37.402529001 CEST	192.168.2.2	1.1.1.1	0x1517	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:37.402779102 CEST	192.168.2.2	1.1.1.1	0x1dd7	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:37.403465986 CEST	192.168.2.2	1.1.1.1	0x5170	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:37.423310041 CEST	192.168.2.2	1.1.1.1	0x7da4	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:37.441927910 CEST	192.168.2.2	1.1.1.1	0x1072	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:38.165426970 CEST	192.168.2.2	1.1.1.1	0x2d0e	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.190047026 CEST	192.168.2.2	1.1.1.1	0x701b	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.193335056 CEST	192.168.2.2	1.1.1.1	0xf494	Standard query (0)	prod.ingestion-edge.prod.dataops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.221524954 CEST	192.168.2.2	1.1.1.1	0x163b	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.222117901 CEST	192.168.2.2	1.1.1.1	0xf8ec	Standard query (0)	prod.ingestion-edge.prod.dataops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:38.228674889 CEST	192.168.2.2	1.1.1.1	0x9b98	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.271589994 CEST	192.168.2.2	1.1.1.1	0x8cb3	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)
Apr 4, 2022 03:18:38.277772903 CEST	192.168.2.2	1.1.1.1	0x4d8c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.295505047 CEST	192.168.2.2	1.1.1.1	0x18b7	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.296415091 CEST	192.168.2.2	1.1.1.1	0x138e	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.298662901 CEST	192.168.2.2	1.1.1.1	0x572d	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.306936979 CEST	192.168.2.2	1.1.1.1	0xf7b8	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.353291035 CEST	192.168.2.2	1.1.1.1	0x7389	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:38.912297010 CEST	192.168.2.2	1.1.1.1	0x99a5	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.931930065 CEST	192.168.2.2	1.1.1.1	0xfc91	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.936975956 CEST	192.168.2.2	1.1.1.1	0x55b3	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.938041925 CEST	192.168.2.2	1.1.1.1	0xf9c2	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.977384090 CEST	192.168.2.2	1.1.1.1	0x47de	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:39.040235043 CEST	192.168.2.2	1.1.1.1	0x3b01	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:39.555502892 CEST	192.168.2.2	1.1.1.1	0x52c9	Standard query (0)	prod.ingestion-edge.prod.dataops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:39.568622112 CEST	192.168.2.2	1.1.1.1	0xfd24	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:39.573887110 CEST	192.168.2.2	1.1.1.1	0x8f00	Standard query (0)	prod.ingestion-edge.prod.dataops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:39.589013100 CEST	192.168.2.2	1.1.1.1	0x8d44	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:39.590872049 CEST	192.168.2.2	1.1.1.1	0xebb8	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:39.591923952 CEST	192.168.2.2	1.1.1.1	0xbc95	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:39.611588955 CEST	192.168.2.2	1.1.1.1	0x4f6d	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:39.631459951 CEST	192.168.2.2	1.1.1.1	0xc776	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:46.193675041 CEST	192.168.2.2	1.1.1.1	0x74ca	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.215974092 CEST	192.168.2.2	1.1.1.1	0x5518	Standard query (0)	prod-tp.sumo.mozit.cloud	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.237519979 CEST	192.168.2.2	1.1.1.1	0xfad3	Standard query (0)	prod-tp.sumo.mozit.cloud	28	IN (0x0001)
Apr 4, 2022 03:18:46.846795082 CEST	192.168.2.2	1.1.1.1	0x2c0d	Standard query (0)	prod.ingestion-edge.prod.dataops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.882508993 CEST	192.168.2.2	1.1.1.1	0xf2f5	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.910531998 CEST	192.168.2.2	1.1.1.1	0x5664	Standard query (0)	prod.ingestion-edge.prod.dataops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.912141085 CEST	192.168.2.2	1.1.1.1	0xdc1a	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.943551064 CEST	192.168.2.2	1.1.1.1	0x94e7	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.944659948 CEST	192.168.2.2	1.1.1.1	0xaa60	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.945389986 CEST	192.168.2.2	1.1.1.1	0xe9e8	Standard query (0)	prod.ingestion-edge.prod.dataops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:46.945878029 CEST	192.168.2.2	1.1.1.1	0xaef0	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.967782021 CEST	192.168.2.2	1.1.1.1	0xdddc	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.968179941 CEST	192.168.2.2	1.1.1.1	0x44eb	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:47.010859966 CEST	192.168.2.2	1.1.1.1	0xcbfe	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:47.017925978 CEST	192.168.2.2	1.1.1.1	0xdbed	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:47.018439054 CEST	192.168.2.2	1.1.1.1	0x75d4	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:47.038405895 CEST	192.168.2.2	1.1.1.1	0xd5ec	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:47.057101965 CEST	192.168.2.2	1.1.1.1	0x49a7	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:47.076030970 CEST	192.168.2.2	1.1.1.1	0x3fbf	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:47.389620066 CEST	192.168.2.2	1.1.1.1	0xf860	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:47.422310114 CEST	192.168.2.2	1.1.1.1	0x6406	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:47.440707922 CEST	192.168.2.2	1.1.1.1	0x9fae	Standard query (0)	autopush.prod.mozaws.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:47.458921909 CEST	192.168.2.2	1.1.1.1	0xad25	Standard query (0)	autopush.prod.mozaws.net	28	IN (0x0001)
Apr 4, 2022 03:18:48.018462896 CEST	192.168.2.2	1.1.1.1	0x798d	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.043900013 CEST	192.168.2.2	1.1.1.1	0x7aa3	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.045109034 CEST	192.168.2.2	1.1.1.1	0x9fab	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.045969009 CEST	192.168.2.2	1.1.1.1	0x2a5c	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.063574076 CEST	192.168.2.2	1.1.1.1	0x269d	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.082540989 CEST	192.168.2.2	1.1.1.1	0x5d4c	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:48.444154024 CEST	192.168.2.2	1.1.1.1	0x9ae7	Standard query (0)	prod.ingestion-edge.prod.dataops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.464529037 CEST	192.168.2.2	1.1.1.1	0x4b0e	Standard query (0)	prod.ingestion-edge.prod.dataops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:48.464894056 CEST	192.168.2.2	1.1.1.1	0xe27c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.485568047 CEST	192.168.2.2	1.1.1.1	0xb8e	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.485842943 CEST	192.168.2.2	1.1.1.1	0xd86	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.485863924 CEST	192.168.2.2	1.1.1.1	0x133b	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.506903887 CEST	192.168.2.2	1.1.1.1	0x3fe3	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.525624037 CEST	192.168.2.2	1.1.1.1	0x3a5a	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:56.183123112 CEST	192.168.2.2	1.1.1.1	0xe9d8	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:56.202459097 CEST	192.168.2.2	1.1.1.1	0x1e6	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:56.242763996 CEST	192.168.2.2	1.1.1.1	0xdbd9	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:56.277081966 CEST	192.168.2.2	1.1.1.1	0x21ee	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)
Apr 4, 2022 03:18:56.784687996 CEST	192.168.2.2	1.1.1.1	0x6936	Standard query (0)	static.xx.fbcdn.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:56.827389956 CEST	192.168.2.2	1.1.1.1	0xb8d5	Standard query (0)	static.xx.fbcdn.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:56.846987009 CEST	192.168.2.2	1.1.1.1	0x62cc	Standard query (0)	scontent.xx.fbcdn.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:56.849306107 CEST	192.168.2.2	1.1.1.1	0x5037	Standard query (0)	facebook.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:56.948985100 CEST	192.168.2.2	1.1.1.1	0x659	Standard query (0)	static.xx.fbcdn.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:56.955315113 CEST	192.168.2.2	1.1.1.1	0x6718	Standard query (0)	scontent.xx.fbcdn.net	28	IN (0x0001)
Apr 4, 2022 03:18:56.959412098 CEST	192.168.2.2	1.1.1.1	0x22ff	Standard query (0)	facebook.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:56.960892916 CEST	192.168.2.2	1.1.1.1	0x61ba	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:56.994721889 CEST	192.168.2.2	1.1.1.1	0x6662	Standard query (0)	facebook.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:56.995032072 CEST	192.168.2.2	1.1.1.1	0x5b8e	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:56.995217085 CEST	192.168.2.2	1.1.1.1	0xd205	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:56.995780945 CEST	192.168.2.2	1.1.1.1	0x5038	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.003401995 CEST	192.168.2.2	1.1.1.1	0xcfe6	Standard query (0)	static.xx.fbcdn.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.013611078 CEST	192.168.2.2	1.1.1.1	0xeeb6	Standard query (0)	facebook.com	28	IN (0x0001)
Apr 4, 2022 03:18:57.015714884 CEST	192.168.2.2	1.1.1.1	0x8667	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.016613960 CEST	192.168.2.2	1.1.1.1	0xd1eb	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.088578939 CEST	192.168.2.2	1.1.1.1	0x89dc	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:57.092348099 CEST	192.168.2.2	1.1.1.1	0x879	Standard query (0)	scontent.xx.fbcdn.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.118349075 CEST	192.168.2.2	1.1.1.1	0x42e8	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.120471001 CEST	192.168.2.2	1.1.1.1	0x34e2	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.121558905 CEST	192.168.2.2	1.1.1.1	0xac37	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.147633076 CEST	192.168.2.2	1.1.1.1	0x4ea2	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.147666931 CEST	192.168.2.2	1.1.1.1	0xbec6	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.153532028 CEST	192.168.2.2	1.1.1.1	0x2d96	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.186739922 CEST	192.168.2.2	1.1.1.1	0xe1cd	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.206280947 CEST	192.168.2.2	1.1.1.1	0x5826	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.211608887 CEST	192.168.2.2	1.1.1.1	0x704	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.211637974 CEST	192.168.2.2	1.1.1.1	0x10a7	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.222656965 CEST	192.168.2.2	1.1.1.1	0xb7de	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.226080894 CEST	192.168.2.2	1.1.1.1	0x29e6	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:57.380912066 CEST	192.168.2.2	1.1.1.1	0xbefb	Standard query (0)	static.xx.fbcdn.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.410659075 CEST	192.168.2.2	1.1.1.1	0xcdb4	Standard query (0)	facebook.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.423286915 CEST	192.168.2.2	1.1.1.1	0x4914	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.427201033 CEST	192.168.2.2	1.1.1.1	0x40eb	Standard query (0)	static.xx.fbcdn.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.429651976 CEST	192.168.2.2	1.1.1.1	0x1d91	Standard query (0)	facebook.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.447418928 CEST	192.168.2.2	1.1.1.1	0x9337	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.449043036 CEST	192.168.2.2	1.1.1.1	0xfb8f	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.450809002 CEST	192.168.2.2	1.1.1.1	0xd017	Standard query (0)	scontent.xx.fbcdn.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.454587936 CEST	192.168.2.2	1.1.1.1	0x3aa2	Standard query (0)	facebook.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.454763889 CEST	192.168.2.2	1.1.1.1	0xc69c	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.468875885 CEST	192.168.2.2	1.1.1.1	0xf587	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.475657940 CEST	192.168.2.2	1.1.1.1	0x757c	Standard query (0)	facebook.com	28	IN (0x0001)
Apr 4, 2022 03:18:57.482430935 CEST	192.168.2.2	1.1.1.1	0x24a2	Standard query (0)	scontent.xx.fbcdn.net	28	IN (0x0001)
Apr 4, 2022 03:18:57.487297058 CEST	192.168.2.2	1.1.1.1	0x2a60	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:18:58.316905975 CEST	192.168.2.2	1.1.1.1	0xb81d	Standard query (0)	static.xx.fbcdn.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:58.371690989 CEST	192.168.2.2	1.1.1.1	0xa98e	Standard query (0)	static.xx.fbcdn.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:58.408273935 CEST	192.168.2.2	1.1.1.1	0xbcff	Standard query (0)	scontent.xx.fbcdn.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:58.427498102 CEST	192.168.2.2	1.1.1.1	0xa1bd	Standard query (0)	scontent.xx.fbcdn.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:58.427551031 CEST	192.168.2.2	1.1.1.1	0xbb5e	Standard query (0)	scontent.xx.fbcdn.net	28	IN (0x0001)
Apr 4, 2022 03:18:58.433623075 CEST	192.168.2.2	1.1.1.1	0xf4f5	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:58.454039097 CEST	192.168.2.2	1.1.1.1	0x7d3c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:58.462102890 CEST	192.168.2.2	1.1.1.1	0xafe1	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:58.473185062 CEST	192.168.2.2	1.1.1.1	0x884a	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:58.473346949 CEST	192.168.2.2	1.1.1.1	0xa9ad	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:58.495917082 CEST	192.168.2.2	1.1.1.1	0xf2b9	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:19:08.080224991 CEST	192.168.2.2	1.1.1.1	0xe110	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:08.198544979 CEST	192.168.2.2	1.1.1.1	0xfc6a	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:08.244343042 CEST	192.168.2.2	1.1.1.1	0xb55f	Standard query (0)	autopush.prod.mozaws.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:08.265052080 CEST	192.168.2.2	1.1.1.1	0xd38d	Standard query (0)	autopush.prod.mozaws.net	28	IN (0x0001)
Apr 4, 2022 03:19:08.823046923 CEST	192.168.2.2	1.1.1.1	0x1b9c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:08.847547054 CEST	192.168.2.2	1.1.1.1	0x237c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:08.851311922 CEST	192.168.2.2	1.1.1.1	0x603a	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:08.852500916 CEST	192.168.2.2	1.1.1.1	0x9fd1	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:08.867202997 CEST	192.168.2.2	1.1.1.1	0xf65a	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:08.870043039 CEST	192.168.2.2	1.1.1.1	0x2d5c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:08.885651112 CEST	192.168.2.2	1.1.1.1	0x3e48	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:19:46.649662018 CEST	192.168.2.2	1.1.1.1	0x8c61	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.708916903 CEST	192.168.2.2	1.1.1.1	0x56da	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.738620996 CEST	192.168.2.2	1.1.1.1	0x6ea7	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.752382994 CEST	192.168.2.2	1.1.1.1	0x3852	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.756982088 CEST	192.168.2.2	1.1.1.1	0x72c5	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:19:46.767724037 CEST	192.168.2.2	1.1.1.1	0xc2a7	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.771332979 CEST	192.168.2.2	1.1.1.1	0xe7c0	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.790179014 CEST	192.168.2.2	1.1.1.1	0xbef2	Standard query (0)	prod-tp.sumo.mozit.cloud	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.813395023 CEST	192.168.2.2	1.1.1.1	0xe622	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.813900948 CEST	192.168.2.2	1.1.1.1	0x8d2b	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.824767113 CEST	192.168.2.2	1.1.1.1	0xac	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.825314045 CEST	192.168.2.2	1.1.1.1	0x2892	Standard query (0)	prod-tp.sumo.mozit.cloud	28	IN (0x0001)
Apr 4, 2022 03:19:46.847501993 CEST	192.168.2.2	1.1.1.1	0x3806	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.848773003 CEST	192.168.2.2	1.1.1.1	0x662	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.884896040 CEST	192.168.2.2	1.1.1.1	0xee7f	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.886152983 CEST	192.168.2.2	1.1.1.1	0x9839	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.886415005 CEST	192.168.2.2	1.1.1.1	0xe8dd	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.913036108 CEST	192.168.2.2	1.1.1.1	0x17d4	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.914200068 CEST	192.168.2.2	1.1.1.1	0xdad5	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:19:46.914741993 CEST	192.168.2.2	1.1.1.1	0x983e	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.948005915 CEST	192.168.2.2	1.1.1.1	0xe62	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.948457956 CEST	192.168.2.2	1.1.1.1	0xb1e5	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.952740908 CEST	192.168.2.2	1.1.1.1	0xff59	Standard query (0)	firefox.settings.services.mozilla.com	28	IN (0x0001)
Apr 4, 2022 03:19:46.972656965 CEST	192.168.2.2	1.1.1.1	0xaa07	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:19:46.973977089 CEST	192.168.2.2	1.1.1.1	0xd74a	Standard query (0)	shavar.prod.mozaws.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.006244898 CEST	192.168.2.2	1.1.1.1	0x9b27	Standard query (0)	shavar.prod.mozaws.net	28	IN (0x0001)
Apr 4, 2022 03:19:47.008801937 CEST	192.168.2.2	1.1.1.1	0x28c0	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.009385109 CEST	192.168.2.2	1.1.1.1	0xd712	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.057802916 CEST	192.168.2.2	1.1.1.1	0xefb5	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.058695078 CEST	192.168.2.2	1.1.1.1	0x2b03	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.078596115 CEST	192.168.2.2	1.1.1.1	0x39a1	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.080609083 CEST	192.168.2.2	1.1.1.1	0x1d76	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.096594095 CEST	192.168.2.2	1.1.1.1	0xa906	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.109963894 CEST	192.168.2.2	1.1.1.1	0x85f7	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.113702059 CEST	192.168.2.2	1.1.1.1	0x6203	Standard query (0)	autopush.prod.mozaws.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.140466928 CEST	192.168.2.2	1.1.1.1	0xe765	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:19:47.145793915 CEST	192.168.2.2	1.1.1.1	0x6a83	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.146034956 CEST	192.168.2.2	1.1.1.1	0x304a	Standard query (0)	autopush.prod.mozaws.net	28	IN (0x0001)
Apr 4, 2022 03:19:47.195599079 CEST	192.168.2.2	1.1.1.1	0xd09b	Standard query (0)	normandy-cdn.services.mozilla.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.196441889 CEST	192.168.2.2	1.1.1.1	0x1924	Standard query (0)	www.mozorg.moz.works	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.198091984 CEST	192.168.2.2	1.1.1.1	0x90e7	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.214593887 CEST	192.168.2.2	1.1.1.1	0xdc5c	Standard query (0)	normandy-cdn.services.mozilla.com	28	IN (0x0001)
Apr 4, 2022 03:19:47.215637922 CEST	192.168.2.2	1.1.1.1	0x1b31	Standard query (0)	www.mozorg.moz.works	28	IN (0x0001)
Apr 4, 2022 03:19:47.217426062 CEST	192.168.2.2	1.1.1.1	0x67e8	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.220460892 CEST	192.168.2.2	1.1.1.1	0xbe28	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.221395016 CEST	192.168.2.2	1.1.1.1	0xd413	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.241245985 CEST	192.168.2.2	1.1.1.1	0x166f	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.265532970 CEST	192.168.2.2	1.1.1.1	0xde82	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:19:47.302814960 CEST	192.168.2.2	1.1.1.1	0x4dca	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.303335905 CEST	192.168.2.2	1.1.1.1	0x18db	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.306072950 CEST	192.168.2.2	1.1.1.1	0x969d	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.325505018 CEST	192.168.2.2	1.1.1.1	0xbaed	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.361721039 CEST	192.168.2.2	1.1.1.1	0xfae5	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.364268064 CEST	192.168.2.2	1.1.1.1	0xd48d	Standard query (0)	locprod2-elb-us-west-2.prod.mozaws.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.393534899 CEST	192.168.2.2	1.1.1.1	0xebd9	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.394030094 CEST	192.168.2.2	1.1.1.1	0xcaa5	Standard query (0)	locprod2-elb-us-west-2.prod.mozaws.net	28	IN (0x0001)
Apr 4, 2022 03:19:47.394491911 CEST	192.168.2.2	1.1.1.1	0xded	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:19:47.394642115 CEST	192.168.2.2	1.1.1.1	0xef0b	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.399250984 CEST	192.168.2.2	1.1.1.1	0xdbe4	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.427727938 CEST	192.168.2.2	1.1.1.1	0xa3b6	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.454991102 CEST	192.168.2.2	1.1.1.1	0xafad	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.455423117 CEST	192.168.2.2	1.1.1.1	0xdecd	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.455431938 CEST	192.168.2.2	1.1.1.1	0x25ec	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.474370956 CEST	192.168.2.2	1.1.1.1	0xc85c	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.474703074 CEST	192.168.2.2	1.1.1.1	0x39a9	Standard query (0)	d228z91au11ukj.cloudfront.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.492307901 CEST	192.168.2.2	1.1.1.1	0xf846	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:19:47.512660027 CEST	192.168.2.2	1.1.1.1	0x5774	Standard query (0)	d228z91au11ukj.cloudfront.net	28	IN (0x0001)
Apr 4, 2022 03:19:47.525654078 CEST	192.168.2.2	1.1.1.1	0xb6c1	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.544908047 CEST	192.168.2.2	1.1.1.1	0x3bba	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.564949036 CEST	192.168.2.2	1.1.1.1	0x9651	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.575627089 CEST	192.168.2.2	1.1.1.1	0x1467	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.575710058 CEST	192.168.2.2	1.1.1.1	0xf0e2	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.583290100 CEST	192.168.2.2	1.1.1.1	0x1c00	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:19:47.592201948 CEST	192.168.2.2	1.1.1.1	0xd3ad	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.621437073 CEST	192.168.2.2	1.1.1.1	0x725c	Standard query (0)	www.mozorg.moz.works	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.641288996 CEST	192.168.2.2	1.1.1.1	0xae5f	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.641407967 CEST	192.168.2.2	1.1.1.1	0x6fae	Standard query (0)	www.mozorg.moz.works	28	IN (0x0001)
Apr 4, 2022 03:19:47.662431002 CEST	192.168.2.2	1.1.1.1	0x63ae	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.662662983 CEST	192.168.2.2	1.1.1.1	0xd0ae	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.662827015 CEST	192.168.2.2	1.1.1.1	0xba17	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.686126947 CEST	192.168.2.2	1.1.1.1	0xedc4	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.690103054 CEST	192.168.2.2	1.1.1.1	0x3be5	Standard query (0)	prod.ingestion-edge.prod.dataops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.704823971 CEST	192.168.2.2	1.1.1.1	0xa495	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:19:47.708425999 CEST	192.168.2.2	1.1.1.1	0xb5a1	Standard query (0)	prod.ingestion-edge.prod.dataops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:19:47.777033091 CEST	192.168.2.2	1.1.1.1	0x90a	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.777743101 CEST	192.168.2.2	1.1.1.1	0x9e43	Standard query (0)	prod.ingestion-edge.prod.dataops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.798187017 CEST	192.168.2.2	1.1.1.1	0xc5d5	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.798296928 CEST	192.168.2.2	1.1.1.1	0xb39c	Standard query (0)	prod.ingestion-edge.prod.dataops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:19:47.816633940 CEST	192.168.2.2	1.1.1.1	0x3c8e	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.822922945 CEST	192.168.2.2	1.1.1.1	0x518e	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.826014042 CEST	192.168.2.2	1.1.1.1	0xbbda	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.835870028 CEST	192.168.2.2	1.1.1.1	0xada5	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)
Apr 4, 2022 03:19:47.838829994 CEST	192.168.2.2	1.1.1.1	0xf89f	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.952490091 CEST	192.168.2.2	1.1.1.1	0xbea2	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.971602917 CEST	192.168.2.2	1.1.1.1	0xc0b9	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.973303080 CEST	192.168.2.2	1.1.1.1	0x7a71	Standard query (0)	example.org	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.973340034 CEST	192.168.2.2	1.1.1.1	0x3c49	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.991544008 CEST	192.168.2.2	1.1.1.1	0xa254	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:48.011456966 CEST	192.168.2.2	1.1.1.1	0x5c16	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 4, 2022 03:17:54.640391111 CEST	1.1.1.1	192.168.2.2	0x4e17	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:17:54.640391111 CEST	1.1.1.1	192.168.2.2	0x4e17	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:17:54.640391111 CEST	1.1.1.1	192.168.2.2	0x4e17	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:54.731062889 CEST	1.1.1.1	192.168.2.2	0x90bb	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:17:54.731062889 CEST	1.1.1.1	192.168.2.2	0x90bb	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:17:54.731062889 CEST	1.1.1.1	192.168.2.2	0x90bb	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:54.806005955 CEST	1.1.1.1	192.168.2.2	0xc720	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:54.806065083 CEST	1.1.1.1	192.168.2.2	0x6e61	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:54.838083982 CEST	1.1.1.1	192.168.2.2	0xb32a	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:17:54.846461058 CEST	1.1.1.1	192.168.2.2	0xfb9d	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:54.854408979 CEST	1.1.1.1	192.168.2.2	0xc6d	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:54.854408979 CEST	1.1.1.1	192.168.2.2	0xc6d	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:54.866404057 CEST	1.1.1.1	192.168.2.2	0x23fc	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:17:54.866404057 CEST	1.1.1.1	192.168.2.2	0x23fc	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:54.870430946 CEST	1.1.1.1	192.168.2.2	0xadc6	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:54.901185989 CEST	1.1.1.1	192.168.2.2	0x8531	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:17:54.901185989 CEST	1.1.1.1	192.168.2.2	0x8531	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:55.103635073 CEST	1.1.1.1	192.168.2.2	0x53e2	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:55.436583042 CEST	1.1.1.1	192.168.2.2	0xf18	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:17:55.436583042 CEST	1.1.1.1	192.168.2.2	0xf18	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:17:55.436583042 CEST	1.1.1.1	192.168.2.2	0xf18	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:55.936096907 CEST	1.1.1.1	192.168.2.2	0xbeb4	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:17:55.936096907 CEST	1.1.1.1	192.168.2.2	0xbeb4	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:17:55.936096907 CEST	1.1.1.1	192.168.2.2	0xbeb4	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:56.022530079 CEST	1.1.1.1	192.168.2.2	0x62ad	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:56.044682980 CEST	1.1.1.1	192.168.2.2	0x2b2f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:17:56.075804949 CEST	1.1.1.1	192.168.2.2	0xf7cf	No error (0)	content-signature-2.cdn.mozilla.net	d2nxq2uap88usk.cloudfront.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:17:56.075804949 CEST	1.1.1.1	192.168.2.2	0xf7cf	No error (0)	d2nxq2uap88usk.cloudfront.net		18.66.248.5	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:56.075804949 CEST	1.1.1.1	192.168.2.2	0xf7cf	No error (0)	d2nxq2uap88usk.cloudfront.net		18.66.248.112	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:56.075804949 CEST	1.1.1.1	192.168.2.2	0xf7cf	No error (0)	d2nxq2uap88usk.cloudfront.net		18.66.248.105	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:56.075804949 CEST	1.1.1.1	192.168.2.2	0xf7cf	No error (0)	d2nxq2uap88usk.cloudfront.net		18.66.248.40	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:56.130785942 CEST	1.1.1.1	192.168.2.2	0xb05	No error (0)	content-signature-2.cdn.mozilla.net	d2nxq2uap88usk.cloudfront.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:17:56.130785942 CEST	1.1.1.1	192.168.2.2	0xb05	No error (0)	d2nxq2uap88usk.cloudfront.net		18.66.248.40	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:56.130785942 CEST	1.1.1.1	192.168.2.2	0xb05	No error (0)	d2nxq2uap88usk.cloudfront.net		18.66.248.112	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:56.130785942 CEST	1.1.1.1	192.168.2.2	0xb05	No error (0)	d2nxq2uap88usk.cloudfront.net		18.66.248.5	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:56.130785942 CEST	1.1.1.1	192.168.2.2	0xb05	No error (0)	d2nxq2uap88usk.cloudfront.net		18.66.248.105	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:56.187921047 CEST	1.1.1.1	192.168.2.2	0xc3f5	No error (0)	d2nxq2uap88usk.cloudfront.net		18.66.248.112	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:56.187921047 CEST	1.1.1.1	192.168.2.2	0xc3f5	No error (0)	d2nxq2uap88usk.cloudfront.net		18.66.248.105	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:56.187921047 CEST	1.1.1.1	192.168.2.2	0xc3f5	No error (0)	d2nxq2uap88usk.cloudfront.net		18.66.248.40	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:56.187921047 CEST	1.1.1.1	192.168.2.2	0xc3f5	No error (0)	d2nxq2uap88usk.cloudfront.net		18.66.248.5	A (IP address)	IN (0x0001)
Apr 4, 2022 03:17:56.391297102 CEST	1.1.1.1	192.168.2.2	0xed2f	No error (0)	d2nxq2uap88usk.cloudfront.net			28	IN (0x0001)
Apr 4, 2022 03:17:56.391297102 CEST	1.1.1.1	192.168.2.2	0xed2f	No error (0)	d2nxq2uap88usk.cloudfront.net			28	IN (0x0001)
Apr 4, 2022 03:17:56.391297102 CEST	1.1.1.1	192.168.2.2	0xed2f	No error (0)	d2nxq2uap88usk.cloudfront.net			28	IN (0x0001)
Apr 4, 2022 03:17:56.391297102 CEST	1.1.1.1	192.168.2.2	0xed2f	No error (0)	d2nxq2uap88usk.cloudfront.net			28	IN (0x0001)
Apr 4, 2022 03:17:56.391297102 CEST	1.1.1.1	192.168.2.2	0xed2f	No error (0)	d2nxq2uap88usk.cloudfront.net			28	IN (0x0001)
Apr 4, 2022 03:17:56.391297102 CEST	1.1.1.1	192.168.2.2	0xed2f	No error (0)	d2nxq2uap88usk.cloudfront.net			28	IN (0x0001)
Apr 4, 2022 03:17:56.391297102 CEST	1.1.1.1	192.168.2.2	0xed2f	No error (0)	d2nxq2uap88usk.cloudfront.net			28	IN (0x0001)
Apr 4, 2022 03:17:56.391297102 CEST	1.1.1.1	192.168.2.2	0xed2f	No error (0)	d2nxq2uap88usk.cloudfront.net			28	IN (0x0001)
Apr 4, 2022 03:18:04.585191011 CEST	1.1.1.1	192.168.2.2	0xea69	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:04.585191011 CEST	1.1.1.1	192.168.2.2	0xea69	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:04.585191011 CEST	1.1.1.1	192.168.2.2	0xea69	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:04.881643057 CEST	1.1.1.1	192.168.2.2	0x62d2	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:04.881643057 CEST	1.1.1.1	192.168.2.2	0x62d2	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:04.881643057 CEST	1.1.1.1	192.168.2.2	0x62d2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:04.926681995 CEST	1.1.1.1	192.168.2.2	0x8662	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:04.955868006 CEST	1.1.1.1	192.168.2.2	0x26fc	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:06.299905062 CEST	1.1.1.1	192.168.2.2	0x30e0	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:06.299905062 CEST	1.1.1.1	192.168.2.2	0x30e0	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:06.299905062 CEST	1.1.1.1	192.168.2.2	0x30e0	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:06.385008097 CEST	1.1.1.1	192.168.2.2	0x4dc7	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:06.385008097 CEST	1.1.1.1	192.168.2.2	0x4dc7	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:06.385008097 CEST	1.1.1.1	192.168.2.2	0x4dc7	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:06.435105085 CEST	1.1.1.1	192.168.2.2	0x140	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:06.654542923 CEST	1.1.1.1	192.168.2.2	0xcddd	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:06.654542923 CEST	1.1.1.1	192.168.2.2	0xcddd	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:06.654586077 CEST	1.1.1.1	192.168.2.2	0x76bb	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:06.655164957 CEST	1.1.1.1	192.168.2.2	0x629c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:06.986043930 CEST	1.1.1.1	192.168.2.2	0x977e	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:06.986043930 CEST	1.1.1.1	192.168.2.2	0x977e	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:06.986043930 CEST	1.1.1.1	192.168.2.2	0x977e	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:06.994030952 CEST	1.1.1.1	192.168.2.2	0xfa42	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:06.994030952 CEST	1.1.1.1	192.168.2.2	0xfa42	No error (0)	shavar.prod.mozaws.net		18.236.18.10	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:06.994030952 CEST	1.1.1.1	192.168.2.2	0xfa42	No error (0)	shavar.prod.mozaws.net		54.185.174.195	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:06.994030952 CEST	1.1.1.1	192.168.2.2	0xfa42	No error (0)	shavar.prod.mozaws.net		52.36.215.253	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:06.994030952 CEST	1.1.1.1	192.168.2.2	0xfa42	No error (0)	shavar.prod.mozaws.net		52.24.149.180	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:06.994030952 CEST	1.1.1.1	192.168.2.2	0xfa42	No error (0)	shavar.prod.mozaws.net		52.40.173.137	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:06.994030952 CEST	1.1.1.1	192.168.2.2	0xfa42	No error (0)	shavar.prod.mozaws.net		34.218.137.180	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:07.091891050 CEST	1.1.1.1	192.168.2.2	0xea63	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:07.091891050 CEST	1.1.1.1	192.168.2.2	0xea63	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:07.091891050 CEST	1.1.1.1	192.168.2.2	0xea63	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:07.093213081 CEST	1.1.1.1	192.168.2.2	0x4b76	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:07.093213081 CEST	1.1.1.1	192.168.2.2	0x4b76	No error (0)	shavar.prod.mozaws.net		34.218.137.180	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:07.093213081 CEST	1.1.1.1	192.168.2.2	0x4b76	No error (0)	shavar.prod.mozaws.net		18.236.18.10	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:07.093213081 CEST	1.1.1.1	192.168.2.2	0x4b76	No error (0)	shavar.prod.mozaws.net		54.185.174.195	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:07.093213081 CEST	1.1.1.1	192.168.2.2	0x4b76	No error (0)	shavar.prod.mozaws.net		52.24.149.180	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:07.093213081 CEST	1.1.1.1	192.168.2.2	0x4b76	No error (0)	shavar.prod.mozaws.net		52.40.173.137	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:07.093213081 CEST	1.1.1.1	192.168.2.2	0x4b76	No error (0)	shavar.prod.mozaws.net		52.36.215.253	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:07.110826969 CEST	1.1.1.1	192.168.2.2	0xca19	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:07.112246990 CEST	1.1.1.1	192.168.2.2	0xa196	No error (0)	shavar.prod.mozaws.net		54.185.174.195	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:07.112246990 CEST	1.1.1.1	192.168.2.2	0xa196	No error (0)	shavar.prod.mozaws.net		52.40.173.137	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:07.112246990 CEST	1.1.1.1	192.168.2.2	0xa196	No error (0)	shavar.prod.mozaws.net		34.218.137.180	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:07.112246990 CEST	1.1.1.1	192.168.2.2	0xa196	No error (0)	shavar.prod.mozaws.net		52.24.149.180	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:07.112246990 CEST	1.1.1.1	192.168.2.2	0xa196	No error (0)	shavar.prod.mozaws.net		52.36.215.253	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:07.112246990 CEST	1.1.1.1	192.168.2.2	0xa196	No error (0)	shavar.prod.mozaws.net		18.236.18.10	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:07.161195993 CEST	1.1.1.1	192.168.2.2	0x2592	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:11.596831083 CEST	1.1.1.1	192.168.2.2	0xf2d1	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:11.596831083 CEST	1.1.1.1	192.168.2.2	0xf2d1	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:11.596831083 CEST	1.1.1.1	192.168.2.2	0xf2d1	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:11.606468916 CEST	1.1.1.1	192.168.2.2	0xdaa2	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:11.606468916 CEST	1.1.1.1	192.168.2.2	0xdaa2	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:11.606833935 CEST	1.1.1.1	192.168.2.2	0x4aa7	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:11.616278887 CEST	1.1.1.1	192.168.2.2	0x7695	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:11.616278887 CEST	1.1.1.1	192.168.2.2	0x7695	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:11.616278887 CEST	1.1.1.1	192.168.2.2	0x7695	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:11.719278097 CEST	1.1.1.1	192.168.2.2	0xcc19	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:11.855297089 CEST	1.1.1.1	192.168.2.2	0xd71f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:13.786612034 CEST	1.1.1.1	192.168.2.2	0x9b74	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:13.786612034 CEST	1.1.1.1	192.168.2.2	0x9b74	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:13.786612034 CEST	1.1.1.1	192.168.2.2	0x9b74	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:13.814723015 CEST	1.1.1.1	192.168.2.2	0xd54e	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:13.814723015 CEST	1.1.1.1	192.168.2.2	0xd54e	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:13.814723015 CEST	1.1.1.1	192.168.2.2	0xd54e	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:13.833997965 CEST	1.1.1.1	192.168.2.2	0xd217	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:13.838197947 CEST	1.1.1.1	192.168.2.2	0x340d	No error (0)	www.google.com		142.250.185.100	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:13.935870886 CEST	1.1.1.1	192.168.2.2	0x4621	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:13.944569111 CEST	1.1.1.1	192.168.2.2	0x539	No error (0)	www.google.com		142.250.185.228	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.011599064 CEST	1.1.1.1	192.168.2.2	0xa4d0	No error (0)	www.google.com		142.250.185.100	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.049506903 CEST	1.1.1.1	192.168.2.2	0x2ae9	No error (0)	www.google.com			28	IN (0x0001)
Apr 4, 2022 03:18:14.336579084 CEST	1.1.1.1	192.168.2.2	0x8a9a	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:14.336579084 CEST	1.1.1.1	192.168.2.2	0x8a9a	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:14.336579084 CEST	1.1.1.1	192.168.2.2	0x8a9a	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.525842905 CEST	1.1.1.1	192.168.2.2	0x3a33	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:14.525842905 CEST	1.1.1.1	192.168.2.2	0x3a33	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:14.525842905 CEST	1.1.1.1	192.168.2.2	0x3a33	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.531210899 CEST	1.1.1.1	192.168.2.2	0x3f7f	No error (0)	firefox.settings.services.mozilla.com		13.226.158.36	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.531210899 CEST	1.1.1.1	192.168.2.2	0x3f7f	No error (0)	firefox.settings.services.mozilla.com		13.226.158.76	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.531210899 CEST	1.1.1.1	192.168.2.2	0x3f7f	No error (0)	firefox.settings.services.mozilla.com		13.226.158.100	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.531210899 CEST	1.1.1.1	192.168.2.2	0x3f7f	No error (0)	firefox.settings.services.mozilla.com		13.226.158.43	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.625646114 CEST	1.1.1.1	192.168.2.2	0x259f	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.625674009 CEST	1.1.1.1	192.168.2.2	0x3a2f	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.625674009 CEST	1.1.1.1	192.168.2.2	0x3a2f	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.627849102 CEST	1.1.1.1	192.168.2.2	0x287b	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.636107922 CEST	1.1.1.1	192.168.2.2	0x216	No error (0)	firefox.settings.services.mozilla.com		13.226.158.36	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.636107922 CEST	1.1.1.1	192.168.2.2	0x216	No error (0)	firefox.settings.services.mozilla.com		13.226.158.43	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.636107922 CEST	1.1.1.1	192.168.2.2	0x216	No error (0)	firefox.settings.services.mozilla.com		13.226.158.76	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.636107922 CEST	1.1.1.1	192.168.2.2	0x216	No error (0)	firefox.settings.services.mozilla.com		13.226.158.100	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.720621109 CEST	1.1.1.1	192.168.2.2	0xca55	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:14.732964993 CEST	1.1.1.1	192.168.2.2	0xe2b3	No error (0)	firefox.settings.services.mozilla.com		13.226.158.100	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.732964993 CEST	1.1.1.1	192.168.2.2	0xe2b3	No error (0)	firefox.settings.services.mozilla.com		13.226.158.76	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.732964993 CEST	1.1.1.1	192.168.2.2	0xe2b3	No error (0)	firefox.settings.services.mozilla.com		13.226.158.43	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.732964993 CEST	1.1.1.1	192.168.2.2	0xe2b3	No error (0)	firefox.settings.services.mozilla.com		13.226.158.36	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.816884995 CEST	1.1.1.1	192.168.2.2	0xd220	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:14.816884995 CEST	1.1.1.1	192.168.2.2	0xd220	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:14.816884995 CEST	1.1.1.1	192.168.2.2	0xd220	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.838928938 CEST	1.1.1.1	192.168.2.2	0xe3ca	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:14.838928938 CEST	1.1.1.1	192.168.2.2	0xe3ca	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:14.838928938 CEST	1.1.1.1	192.168.2.2	0xe3ca	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:14.900806904 CEST	1.1.1.1	192.168.2.2	0x97f9	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:15.105745077 CEST	1.1.1.1	192.168.2.2	0xe15c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:15.301601887 CEST	1.1.1.1	192.168.2.2	0xbda3	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:15.301601887 CEST	1.1.1.1	192.168.2.2	0xbda3	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:15.301601887 CEST	1.1.1.1	192.168.2.2	0xbda3	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:15.471889973 CEST	1.1.1.1	192.168.2.2	0xe97c	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:15.471889973 CEST	1.1.1.1	192.168.2.2	0xe97c	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:15.472140074 CEST	1.1.1.1	192.168.2.2	0xb265	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:15.483395100 CEST	1.1.1.1	192.168.2.2	0x8ad4	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:15.483395100 CEST	1.1.1.1	192.168.2.2	0x8ad4	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:15.483395100 CEST	1.1.1.1	192.168.2.2	0x8ad4	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:15.512309074 CEST	1.1.1.1	192.168.2.2	0xcfaa	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:15.532294989 CEST	1.1.1.1	192.168.2.2	0x3601	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:15.540467024 CEST	1.1.1.1	192.168.2.2	0x69eb	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:15.540467024 CEST	1.1.1.1	192.168.2.2	0x69eb	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:15.540467024 CEST	1.1.1.1	192.168.2.2	0x69eb	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:15.995398998 CEST	1.1.1.1	192.168.2.2	0x7768	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:15.995398998 CEST	1.1.1.1	192.168.2.2	0x7768	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:15.995398998 CEST	1.1.1.1	192.168.2.2	0x7768	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:16.000484943 CEST	1.1.1.1	192.168.2.2	0x6131	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:16.002603054 CEST	1.1.1.1	192.168.2.2	0xd0d4	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:16.002603054 CEST	1.1.1.1	192.168.2.2	0xd0d4	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:16.290857077 CEST	1.1.1.1	192.168.2.2	0xd2c5	No error (0)	d228z91au11ukj.cloudfront.net		143.204.98.72	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:16.290857077 CEST	1.1.1.1	192.168.2.2	0xd2c5	No error (0)	d228z91au11ukj.cloudfront.net		143.204.98.74	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:16.290857077 CEST	1.1.1.1	192.168.2.2	0xd2c5	No error (0)	d228z91au11ukj.cloudfront.net		143.204.98.70	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:16.290857077 CEST	1.1.1.1	192.168.2.2	0xd2c5	No error (0)	d228z91au11ukj.cloudfront.net		143.204.98.12	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:16.544269085 CEST	1.1.1.1	192.168.2.2	0x5c47	No error (0)	d228z91au11ukj.cloudfront.net		108.157.4.26	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:16.544269085 CEST	1.1.1.1	192.168.2.2	0x5c47	No error (0)	d228z91au11ukj.cloudfront.net		108.157.4.58	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:16.544269085 CEST	1.1.1.1	192.168.2.2	0x5c47	No error (0)	d228z91au11ukj.cloudfront.net		108.157.4.8	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:16.544269085 CEST	1.1.1.1	192.168.2.2	0x5c47	No error (0)	d228z91au11ukj.cloudfront.net		108.157.4.36	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:16.586898088 CEST	1.1.1.1	192.168.2.2	0xd40	No error (0)	d228z91au11ukj.cloudfront.net		13.32.121.15	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:16.586898088 CEST	1.1.1.1	192.168.2.2	0xd40	No error (0)	d228z91au11ukj.cloudfront.net		13.32.121.49	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:16.586898088 CEST	1.1.1.1	192.168.2.2	0xd40	No error (0)	d228z91au11ukj.cloudfront.net		13.32.121.85	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:16.586898088 CEST	1.1.1.1	192.168.2.2	0xd40	No error (0)	d228z91au11ukj.cloudfront.net		13.32.121.112	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:16.587292910 CEST	1.1.1.1	192.168.2.2	0x9782	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:16.587292910 CEST	1.1.1.1	192.168.2.2	0x9782	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:16.587292910 CEST	1.1.1.1	192.168.2.2	0x9782	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:16.607068062 CEST	1.1.1.1	192.168.2.2	0xdd20	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:18.808751106 CEST	1.1.1.1	192.168.2.2	0xc765	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:23.319370985 CEST	1.1.1.1	192.168.2.2	0x101e	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:23.319370985 CEST	1.1.1.1	192.168.2.2	0x101e	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:23.319370985 CEST	1.1.1.1	192.168.2.2	0x101e	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:23.609035015 CEST	1.1.1.1	192.168.2.2	0x7b78	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:23.609035015 CEST	1.1.1.1	192.168.2.2	0x7b78	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:23.609035015 CEST	1.1.1.1	192.168.2.2	0x7b78	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:23.682349920 CEST	1.1.1.1	192.168.2.2	0x7bcc	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:23.854324102 CEST	1.1.1.1	192.168.2.2	0x79a0	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:24.287487030 CEST	1.1.1.1	192.168.2.2	0xbfd6	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:24.287487030 CEST	1.1.1.1	192.168.2.2	0xbfd6	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:24.287487030 CEST	1.1.1.1	192.168.2.2	0xbfd6	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:24.925915003 CEST	1.1.1.1	192.168.2.2	0x55ff	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:24.925915003 CEST	1.1.1.1	192.168.2.2	0x55ff	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:24.925915003 CEST	1.1.1.1	192.168.2.2	0x55ff	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:25.012582064 CEST	1.1.1.1	192.168.2.2	0xee38	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:25.072781086 CEST	1.1.1.1	192.168.2.2	0x345a	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:31.064300060 CEST	1.1.1.1	192.168.2.2	0x36bd	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.064377069 CEST	1.1.1.1	192.168.2.2	0xa9cf	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:31.064377069 CEST	1.1.1.1	192.168.2.2	0xa9cf	No error (0)	autopush.prod.mozaws.net		54.191.212.31	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.066545010 CEST	1.1.1.1	192.168.2.2	0x6b4c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:31.066545010 CEST	1.1.1.1	192.168.2.2	0x6b4c	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:31.066545010 CEST	1.1.1.1	192.168.2.2	0x6b4c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.066579103 CEST	1.1.1.1	192.168.2.2	0xec4b	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.066579103 CEST	1.1.1.1	192.168.2.2	0xec4b	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.067632914 CEST	1.1.1.1	192.168.2.2	0xb1a1	No error (0)	telemetry-incoming.r53-2.services.mozilla.com	prod.ingestion-edge.prod.dataops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:31.067632914 CEST	1.1.1.1	192.168.2.2	0xb1a1	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.103612900 CEST	1.1.1.1	192.168.2.2	0xac6d	No error (0)	www.ebay.de	ipv4.slot11847.ebay.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:31.107606888 CEST	1.1.1.1	192.168.2.2	0xee56	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:31.107606888 CEST	1.1.1.1	192.168.2.2	0xee56	No error (0)	star-mini.c10r.facebook.com		157.240.17.35	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.116729021 CEST	1.1.1.1	192.168.2.2	0xea9b	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:31.116729021 CEST	1.1.1.1	192.168.2.2	0xea9b	No error (0)	autopush.prod.mozaws.net		54.191.212.31	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.136274099 CEST	1.1.1.1	192.168.2.2	0x2f5d	No error (0)	star-mini.c10r.facebook.com		157.240.17.35	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.146414995 CEST	1.1.1.1	192.168.2.2	0xbd73	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:31.146414995 CEST	1.1.1.1	192.168.2.2	0xbd73	No error (0)	youtube-ui.l.google.com		216.58.215.238	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.146414995 CEST	1.1.1.1	192.168.2.2	0xbd73	No error (0)	youtube-ui.l.google.com		172.217.168.14	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.146414995 CEST	1.1.1.1	192.168.2.2	0xbd73	No error (0)	youtube-ui.l.google.com		172.217.168.46	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.146414995 CEST	1.1.1.1	192.168.2.2	0xbd73	No error (0)	youtube-ui.l.google.com		172.217.168.78	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.146414995 CEST	1.1.1.1	192.168.2.2	0xbd73	No error (0)	youtube-ui.l.google.com		142.250.203.110	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.188803911 CEST	1.1.1.1	192.168.2.2	0xbbc9	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)
Apr 4, 2022 03:18:31.190606117 CEST	1.1.1.1	192.168.2.2	0x23c0	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:31.190606117 CEST	1.1.1.1	192.168.2.2	0x23c0	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:31.190606117 CEST	1.1.1.1	192.168.2.2	0x23c0	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.191605091 CEST	1.1.1.1	192.168.2.2	0xbebc	No error (0)	youtube-ui.l.google.com		216.58.215.238	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.191605091 CEST	1.1.1.1	192.168.2.2	0xbebc	No error (0)	youtube-ui.l.google.com		172.217.168.14	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.191605091 CEST	1.1.1.1	192.168.2.2	0xbebc	No error (0)	youtube-ui.l.google.com		172.217.168.46	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.191605091 CEST	1.1.1.1	192.168.2.2	0xbebc	No error (0)	youtube-ui.l.google.com		172.217.168.78	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.191605091 CEST	1.1.1.1	192.168.2.2	0xbebc	No error (0)	youtube-ui.l.google.com		142.250.203.110	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.227695942 CEST	1.1.1.1	192.168.2.2	0x617a	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:31.227695942 CEST	1.1.1.1	192.168.2.2	0x617a	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.227695942 CEST	1.1.1.1	192.168.2.2	0x617a	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.227695942 CEST	1.1.1.1	192.168.2.2	0x617a	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.227695942 CEST	1.1.1.1	192.168.2.2	0x617a	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.230283022 CEST	1.1.1.1	192.168.2.2	0xba50	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.230329037 CEST	1.1.1.1	192.168.2.2	0x2b89	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.230329037 CEST	1.1.1.1	192.168.2.2	0x2b89	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.234893084 CEST	1.1.1.1	192.168.2.2	0x5d96	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:31.234893084 CEST	1.1.1.1	192.168.2.2	0x5d96	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:31.234893084 CEST	1.1.1.1	192.168.2.2	0x5d96	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.244693041 CEST	1.1.1.1	192.168.2.2	0x592d	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)
Apr 4, 2022 03:18:31.244693041 CEST	1.1.1.1	192.168.2.2	0x592d	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)
Apr 4, 2022 03:18:31.244693041 CEST	1.1.1.1	192.168.2.2	0x592d	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)
Apr 4, 2022 03:18:31.244693041 CEST	1.1.1.1	192.168.2.2	0x592d	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)
Apr 4, 2022 03:18:31.247633934 CEST	1.1.1.1	192.168.2.2	0x4855	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.247633934 CEST	1.1.1.1	192.168.2.2	0x4855	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.247633934 CEST	1.1.1.1	192.168.2.2	0x4855	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.247633934 CEST	1.1.1.1	192.168.2.2	0x4855	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.264919043 CEST	1.1.1.1	192.168.2.2	0x587c	No error (0)	www.mozorg.moz.works		108.157.3.185	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.290491104 CEST	1.1.1.1	192.168.2.2	0xedb1	No error (0)	www.mozorg.moz.works		108.157.3.185	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.291651011 CEST	1.1.1.1	192.168.2.2	0xa8e8	No error (0)	telemetry-incoming.r53-2.services.mozilla.com	prod.ingestion-edge.prod.dataops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:31.291651011 CEST	1.1.1.1	192.168.2.2	0xa8e8	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.310165882 CEST	1.1.1.1	192.168.2.2	0x7efa	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.329880953 CEST	1.1.1.1	192.168.2.2	0x724a	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:31.329880953 CEST	1.1.1.1	192.168.2.2	0x724a	No error (0)	autopush.prod.mozaws.net		52.35.74.102	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.359478951 CEST	1.1.1.1	192.168.2.2	0x3318	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:31.359478951 CEST	1.1.1.1	192.168.2.2	0x3318	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:31.359478951 CEST	1.1.1.1	192.168.2.2	0x3318	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.359523058 CEST	1.1.1.1	192.168.2.2	0xee70	No error (0)	autopush.prod.mozaws.net		44.228.106.27	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.380660057 CEST	1.1.1.1	192.168.2.2	0xf41c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.386573076 CEST	1.1.1.1	192.168.2.2	0x6aa3	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:31.386573076 CEST	1.1.1.1	192.168.2.2	0x6aa3	No error (0)	dyna.wikimedia.org		91.198.174.192	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.399632931 CEST	1.1.1.1	192.168.2.2	0x1692	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:31.423655033 CEST	1.1.1.1	192.168.2.2	0x2ff7	No error (0)	dyna.wikimedia.org		91.198.174.192	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.443695068 CEST	1.1.1.1	192.168.2.2	0x4144	No error (0)	dyna.wikimedia.org			28	IN (0x0001)
Apr 4, 2022 03:18:31.726473093 CEST	1.1.1.1	192.168.2.2	0x258e	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:31.726473093 CEST	1.1.1.1	192.168.2.2	0x258e	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:31.726473093 CEST	1.1.1.1	192.168.2.2	0x258e	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.745001078 CEST	1.1.1.1	192.168.2.2	0x70ae	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:31.745001078 CEST	1.1.1.1	192.168.2.2	0x70ae	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:31.745001078 CEST	1.1.1.1	192.168.2.2	0x70ae	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.749622107 CEST	1.1.1.1	192.168.2.2	0x5e8	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.751996040 CEST	1.1.1.1	192.168.2.2	0x4062	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.751996040 CEST	1.1.1.1	192.168.2.2	0x4062	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.763734102 CEST	1.1.1.1	192.168.2.2	0x8e56	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:31.790489912 CEST	1.1.1.1	192.168.2.2	0x37b8	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:33.891258955 CEST	1.1.1.1	192.168.2.2	0xfb7b	No error (0)	telemetry-incoming.r53-2.services.mozilla.com	prod.ingestion-edge.prod.dataops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:33.891258955 CEST	1.1.1.1	192.168.2.2	0xfb7b	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:33.918055058 CEST	1.1.1.1	192.168.2.2	0x5a95	No error (0)	telemetry-incoming.r53-2.services.mozilla.com	prod.ingestion-edge.prod.dataops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:33.918055058 CEST	1.1.1.1	192.168.2.2	0x5a95	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:33.938129902 CEST	1.1.1.1	192.168.2.2	0x7b85	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:34.001852989 CEST	1.1.1.1	192.168.2.2	0xdee0	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:34.001852989 CEST	1.1.1.1	192.168.2.2	0xdee0	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:34.001852989 CEST	1.1.1.1	192.168.2.2	0xdee0	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:34.076512098 CEST	1.1.1.1	192.168.2.2	0x5e81	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:34.076565981 CEST	1.1.1.1	192.168.2.2	0x90eb	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:34.076565981 CEST	1.1.1.1	192.168.2.2	0x90eb	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:34.076864004 CEST	1.1.1.1	192.168.2.2	0xbc9d	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:34.076864004 CEST	1.1.1.1	192.168.2.2	0xbc9d	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:34.076864004 CEST	1.1.1.1	192.168.2.2	0xbc9d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:34.125982046 CEST	1.1.1.1	192.168.2.2	0x2ddd	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:34.172286987 CEST	1.1.1.1	192.168.2.2	0xf7e7	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:34.172286987 CEST	1.1.1.1	192.168.2.2	0xf7e7	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:34.172286987 CEST	1.1.1.1	192.168.2.2	0xf7e7	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:34.174527884 CEST	1.1.1.1	192.168.2.2	0xa44d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:35.573740959 CEST	1.1.1.1	192.168.2.2	0xbb01	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:35.573740959 CEST	1.1.1.1	192.168.2.2	0xbb01	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:35.573740959 CEST	1.1.1.1	192.168.2.2	0xbb01	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.575289965 CEST	1.1.1.1	192.168.2.2	0x5bd4	No error (0)	telemetry-incoming.r53-2.services.mozilla.com	prod.ingestion-edge.prod.dataops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:35.575289965 CEST	1.1.1.1	192.168.2.2	0x5bd4	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.592595100 CEST	1.1.1.1	192.168.2.2	0xe444	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:35.592595100 CEST	1.1.1.1	192.168.2.2	0xe444	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:35.592595100 CEST	1.1.1.1	192.168.2.2	0xe444	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.602700949 CEST	1.1.1.1	192.168.2.2	0x1502	No error (0)	telemetry-incoming.r53-2.services.mozilla.com	prod.ingestion-edge.prod.dataops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:35.602700949 CEST	1.1.1.1	192.168.2.2	0x1502	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.604310036 CEST	1.1.1.1	192.168.2.2	0xe298	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.604310036 CEST	1.1.1.1	192.168.2.2	0xe298	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.604341030 CEST	1.1.1.1	192.168.2.2	0x1b84	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.611166000 CEST	1.1.1.1	192.168.2.2	0x8f45	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.632451057 CEST	1.1.1.1	192.168.2.2	0xf0a1	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.642611980 CEST	1.1.1.1	192.168.2.2	0x27bd	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:35.664891005 CEST	1.1.1.1	192.168.2.2	0xaecd	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:35.664891005 CEST	1.1.1.1	192.168.2.2	0xaecd	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:35.664891005 CEST	1.1.1.1	192.168.2.2	0xaecd	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.665360928 CEST	1.1.1.1	192.168.2.2	0x3c3c	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.665360928 CEST	1.1.1.1	192.168.2.2	0x3c3c	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.667809010 CEST	1.1.1.1	192.168.2.2	0x2a38	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.684247971 CEST	1.1.1.1	192.168.2.2	0x2a26	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:35.684247971 CEST	1.1.1.1	192.168.2.2	0x2a26	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:35.684247971 CEST	1.1.1.1	192.168.2.2	0x2a26	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.702214003 CEST	1.1.1.1	192.168.2.2	0xdbe4	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:35.723290920 CEST	1.1.1.1	192.168.2.2	0xb078	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:36.748131990 CEST	1.1.1.1	192.168.2.2	0x5031	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:36.748131990 CEST	1.1.1.1	192.168.2.2	0x5031	No error (0)	autopush.prod.mozaws.net		35.164.251.155	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:36.767560005 CEST	1.1.1.1	192.168.2.2	0xcc01	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:36.767560005 CEST	1.1.1.1	192.168.2.2	0xcc01	No error (0)	autopush.prod.mozaws.net		54.191.212.31	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:36.785804987 CEST	1.1.1.1	192.168.2.2	0x5914	No error (0)	autopush.prod.mozaws.net		44.228.106.27	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:37.398895979 CEST	1.1.1.1	192.168.2.2	0x6cc1	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:37.398895979 CEST	1.1.1.1	192.168.2.2	0x6cc1	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:37.398895979 CEST	1.1.1.1	192.168.2.2	0x6cc1	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:37.418798923 CEST	1.1.1.1	192.168.2.2	0x1517	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:37.419151068 CEST	1.1.1.1	192.168.2.2	0x1dd7	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:37.419151068 CEST	1.1.1.1	192.168.2.2	0x1dd7	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:37.419151068 CEST	1.1.1.1	192.168.2.2	0x1dd7	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:37.419836044 CEST	1.1.1.1	192.168.2.2	0x5170	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:37.419836044 CEST	1.1.1.1	192.168.2.2	0x5170	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:37.439753056 CEST	1.1.1.1	192.168.2.2	0x7da4	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:37.458566904 CEST	1.1.1.1	192.168.2.2	0x1072	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:38.171118021 CEST	1.1.1.1	192.168.2.2	0xbdba	No error (0)	telemetry-incoming.r53-2.services.mozilla.com	prod.ingestion-edge.prod.dataops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:38.171118021 CEST	1.1.1.1	192.168.2.2	0xbdba	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.181904078 CEST	1.1.1.1	192.168.2.2	0x2d0e	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:38.181904078 CEST	1.1.1.1	192.168.2.2	0x2d0e	No error (0)	star-mini.c10r.facebook.com		157.240.20.35	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.190527916 CEST	1.1.1.1	192.168.2.2	0xf456	No error (0)	telemetry-incoming.r53-2.services.mozilla.com	prod.ingestion-edge.prod.dataops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:38.190527916 CEST	1.1.1.1	192.168.2.2	0xf456	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.206285954 CEST	1.1.1.1	192.168.2.2	0x701b	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:38.206285954 CEST	1.1.1.1	192.168.2.2	0x701b	No error (0)	star-mini.c10r.facebook.com		157.240.20.35	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.209439993 CEST	1.1.1.1	192.168.2.2	0xf494	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.245107889 CEST	1.1.1.1	192.168.2.2	0x9b98	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:38.245107889 CEST	1.1.1.1	192.168.2.2	0x9b98	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:38.245107889 CEST	1.1.1.1	192.168.2.2	0x9b98	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.247658014 CEST	1.1.1.1	192.168.2.2	0x163b	No error (0)	star-mini.c10r.facebook.com		157.240.17.35	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.294226885 CEST	1.1.1.1	192.168.2.2	0x4d8c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:38.294226885 CEST	1.1.1.1	192.168.2.2	0x4d8c	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:38.294226885 CEST	1.1.1.1	192.168.2.2	0x4d8c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.297566891 CEST	1.1.1.1	192.168.2.2	0x8cb3	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)
Apr 4, 2022 03:18:38.339791059 CEST	1.1.1.1	192.168.2.2	0x18b7	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.339791059 CEST	1.1.1.1	192.168.2.2	0x18b7	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.339807987 CEST	1.1.1.1	192.168.2.2	0x138e	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.339819908 CEST	1.1.1.1	192.168.2.2	0x572d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.339852095 CEST	1.1.1.1	192.168.2.2	0xf7b8	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:38.339852095 CEST	1.1.1.1	192.168.2.2	0xf7b8	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:38.339852095 CEST	1.1.1.1	192.168.2.2	0xf7b8	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.370183945 CEST	1.1.1.1	192.168.2.2	0x7389	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:38.928813934 CEST	1.1.1.1	192.168.2.2	0x99a5	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:38.928813934 CEST	1.1.1.1	192.168.2.2	0x99a5	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:38.928813934 CEST	1.1.1.1	192.168.2.2	0x99a5	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.948367119 CEST	1.1.1.1	192.168.2.2	0xfc91	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:38.948367119 CEST	1.1.1.1	192.168.2.2	0xfc91	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:38.948367119 CEST	1.1.1.1	192.168.2.2	0xfc91	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.953321934 CEST	1.1.1.1	192.168.2.2	0x55b3	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.953321934 CEST	1.1.1.1	192.168.2.2	0x55b3	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.954329014 CEST	1.1.1.1	192.168.2.2	0xf9c2	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:38.993679047 CEST	1.1.1.1	192.168.2.2	0x47de	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:39.056962967 CEST	1.1.1.1	192.168.2.2	0x3b01	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:39.516028881 CEST	1.1.1.1	192.168.2.2	0xe45a	No error (0)	telemetry-incoming.r53-2.services.mozilla.com	prod.ingestion-edge.prod.dataops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:39.516028881 CEST	1.1.1.1	192.168.2.2	0xe45a	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:39.534890890 CEST	1.1.1.1	192.168.2.2	0x23be	No error (0)	telemetry-incoming.r53-2.services.mozilla.com	prod.ingestion-edge.prod.dataops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:39.534890890 CEST	1.1.1.1	192.168.2.2	0x23be	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:39.572254896 CEST	1.1.1.1	192.168.2.2	0x52c9	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:39.585037947 CEST	1.1.1.1	192.168.2.2	0xfd24	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:39.585037947 CEST	1.1.1.1	192.168.2.2	0xfd24	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:39.585037947 CEST	1.1.1.1	192.168.2.2	0xfd24	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:39.605515957 CEST	1.1.1.1	192.168.2.2	0x8d44	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:39.605515957 CEST	1.1.1.1	192.168.2.2	0x8d44	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:39.605515957 CEST	1.1.1.1	192.168.2.2	0x8d44	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:39.607265949 CEST	1.1.1.1	192.168.2.2	0xebb8	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:39.607265949 CEST	1.1.1.1	192.168.2.2	0xebb8	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:39.608133078 CEST	1.1.1.1	192.168.2.2	0xbc95	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:39.628566980 CEST	1.1.1.1	192.168.2.2	0x4f6d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:39.648240089 CEST	1.1.1.1	192.168.2.2	0xc776	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:46.210645914 CEST	1.1.1.1	192.168.2.2	0x74ca	No error (0)	support.mozilla.org	prod-tp.sumo.mozit.cloud		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:46.210645914 CEST	1.1.1.1	192.168.2.2	0x74ca	No error (0)	prod-tp.sumo.mozit.cloud		54.148.60.204	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.210645914 CEST	1.1.1.1	192.168.2.2	0x74ca	No error (0)	prod-tp.sumo.mozit.cloud		44.236.6.166	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.232871056 CEST	1.1.1.1	192.168.2.2	0x5518	No error (0)	prod-tp.sumo.mozit.cloud		54.148.60.204	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.232871056 CEST	1.1.1.1	192.168.2.2	0x5518	No error (0)	prod-tp.sumo.mozit.cloud		44.236.6.166	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.820799112 CEST	1.1.1.1	192.168.2.2	0xc2e2	No error (0)	telemetry-incoming.r53-2.services.mozilla.com	prod.ingestion-edge.prod.dataops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:46.820799112 CEST	1.1.1.1	192.168.2.2	0xc2e2	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.842689037 CEST	1.1.1.1	192.168.2.2	0xc6fa	No error (0)	telemetry-incoming.r53-2.services.mozilla.com	prod.ingestion-edge.prod.dataops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:46.842689037 CEST	1.1.1.1	192.168.2.2	0xc6fa	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.863265038 CEST	1.1.1.1	192.168.2.2	0x2c0d	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.879636049 CEST	1.1.1.1	192.168.2.2	0x1d8d	No error (0)	telemetry-incoming.r53-2.services.mozilla.com	prod.ingestion-edge.prod.dataops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:46.879636049 CEST	1.1.1.1	192.168.2.2	0x1d8d	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.899049997 CEST	1.1.1.1	192.168.2.2	0xf2f5	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:46.899049997 CEST	1.1.1.1	192.168.2.2	0xf2f5	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:46.899049997 CEST	1.1.1.1	192.168.2.2	0xf2f5	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.927587032 CEST	1.1.1.1	192.168.2.2	0x5664	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.928538084 CEST	1.1.1.1	192.168.2.2	0xdc1a	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:46.928538084 CEST	1.1.1.1	192.168.2.2	0xdc1a	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:46.928538084 CEST	1.1.1.1	192.168.2.2	0xdc1a	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.959935904 CEST	1.1.1.1	192.168.2.2	0x94e7	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.959935904 CEST	1.1.1.1	192.168.2.2	0x94e7	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.960983038 CEST	1.1.1.1	192.168.2.2	0xaa60	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.962004900 CEST	1.1.1.1	192.168.2.2	0xaef0	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.984242916 CEST	1.1.1.1	192.168.2.2	0xdddc	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:46.984242916 CEST	1.1.1.1	192.168.2.2	0xdddc	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:46.984242916 CEST	1.1.1.1	192.168.2.2	0xdddc	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:46.984922886 CEST	1.1.1.1	192.168.2.2	0x44eb	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:47.027494907 CEST	1.1.1.1	192.168.2.2	0xcbfe	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:47.027494907 CEST	1.1.1.1	192.168.2.2	0xcbfe	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:47.027494907 CEST	1.1.1.1	192.168.2.2	0xcbfe	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:47.034394979 CEST	1.1.1.1	192.168.2.2	0xdbed	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:47.034512043 CEST	1.1.1.1	192.168.2.2	0x75d4	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:47.034512043 CEST	1.1.1.1	192.168.2.2	0x75d4	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:47.055327892 CEST	1.1.1.1	192.168.2.2	0xd5ec	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:47.055327892 CEST	1.1.1.1	192.168.2.2	0xd5ec	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:47.055327892 CEST	1.1.1.1	192.168.2.2	0xd5ec	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:47.074074984 CEST	1.1.1.1	192.168.2.2	0x49a7	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:47.092498064 CEST	1.1.1.1	192.168.2.2	0x3fbf	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:47.406282902 CEST	1.1.1.1	192.168.2.2	0xf860	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:47.406282902 CEST	1.1.1.1	192.168.2.2	0xf860	No error (0)	autopush.prod.mozaws.net		35.81.85.200	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:47.438776016 CEST	1.1.1.1	192.168.2.2	0x6406	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:47.438776016 CEST	1.1.1.1	192.168.2.2	0x6406	No error (0)	autopush.prod.mozaws.net		35.164.251.155	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:47.457573891 CEST	1.1.1.1	192.168.2.2	0x9fae	No error (0)	autopush.prod.mozaws.net		52.89.15.44	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.035022020 CEST	1.1.1.1	192.168.2.2	0x798d	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:48.035022020 CEST	1.1.1.1	192.168.2.2	0x798d	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:48.035022020 CEST	1.1.1.1	192.168.2.2	0x798d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.060425997 CEST	1.1.1.1	192.168.2.2	0x7aa3	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.060425997 CEST	1.1.1.1	192.168.2.2	0x7aa3	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.061271906 CEST	1.1.1.1	192.168.2.2	0x9fab	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:48.061271906 CEST	1.1.1.1	192.168.2.2	0x9fab	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:48.061271906 CEST	1.1.1.1	192.168.2.2	0x9fab	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.062244892 CEST	1.1.1.1	192.168.2.2	0x2a5c	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.079781055 CEST	1.1.1.1	192.168.2.2	0x269d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.098906994 CEST	1.1.1.1	192.168.2.2	0x5d4c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:48.414556980 CEST	1.1.1.1	192.168.2.2	0xb079	No error (0)	telemetry-incoming.r53-2.services.mozilla.com	prod.ingestion-edge.prod.dataops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:48.414556980 CEST	1.1.1.1	192.168.2.2	0xb079	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.438667059 CEST	1.1.1.1	192.168.2.2	0xfee4	No error (0)	telemetry-incoming.r53-2.services.mozilla.com	prod.ingestion-edge.prod.dataops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:48.438667059 CEST	1.1.1.1	192.168.2.2	0xfee4	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.461051941 CEST	1.1.1.1	192.168.2.2	0x9ae7	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.481205940 CEST	1.1.1.1	192.168.2.2	0xe27c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:48.481205940 CEST	1.1.1.1	192.168.2.2	0xe27c	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:48.481205940 CEST	1.1.1.1	192.168.2.2	0xe27c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.502003908 CEST	1.1.1.1	192.168.2.2	0xb8e	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.502003908 CEST	1.1.1.1	192.168.2.2	0xb8e	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.502151966 CEST	1.1.1.1	192.168.2.2	0xd86	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.502216101 CEST	1.1.1.1	192.168.2.2	0x133b	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:48.502216101 CEST	1.1.1.1	192.168.2.2	0x133b	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:48.502216101 CEST	1.1.1.1	192.168.2.2	0x133b	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.523340940 CEST	1.1.1.1	192.168.2.2	0x3fe3	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:48.542133093 CEST	1.1.1.1	192.168.2.2	0x3a5a	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:56.199717045 CEST	1.1.1.1	192.168.2.2	0xe9d8	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:56.199717045 CEST	1.1.1.1	192.168.2.2	0xe9d8	No error (0)	star-mini.c10r.facebook.com		31.13.92.36	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:56.234766960 CEST	1.1.1.1	192.168.2.2	0x1e6	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:56.234766960 CEST	1.1.1.1	192.168.2.2	0x1e6	No error (0)	star-mini.c10r.facebook.com		157.240.17.35	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:56.268964052 CEST	1.1.1.1	192.168.2.2	0xdbd9	No error (0)	star-mini.c10r.facebook.com		157.240.17.35	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:56.295356989 CEST	1.1.1.1	192.168.2.2	0x21ee	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)
Apr 4, 2022 03:18:56.820209026 CEST	1.1.1.1	192.168.2.2	0x6936	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:56.820209026 CEST	1.1.1.1	192.168.2.2	0x6936	No error (0)	scontent.xx.fbcdn.net		157.240.17.15	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:56.844125032 CEST	1.1.1.1	192.168.2.2	0xb8d5	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:56.844125032 CEST	1.1.1.1	192.168.2.2	0xb8d5	No error (0)	scontent.xx.fbcdn.net		157.240.17.15	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:56.877125025 CEST	1.1.1.1	192.168.2.2	0x62cc	No error (0)	scontent.xx.fbcdn.net		157.240.17.15	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:56.879038095 CEST	1.1.1.1	192.168.2.2	0x5037	No error (0)	facebook.com		157.240.17.35	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:56.972224951 CEST	1.1.1.1	192.168.2.2	0x6718	No error (0)	scontent.xx.fbcdn.net			28	IN (0x0001)
Apr 4, 2022 03:18:56.976560116 CEST	1.1.1.1	192.168.2.2	0x22ff	No error (0)	facebook.com		157.240.17.35	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:56.977365971 CEST	1.1.1.1	192.168.2.2	0x61ba	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:56.977365971 CEST	1.1.1.1	192.168.2.2	0x61ba	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:56.977365971 CEST	1.1.1.1	192.168.2.2	0x61ba	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:56.994446039 CEST	1.1.1.1	192.168.2.2	0x659	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:56.994446039 CEST	1.1.1.1	192.168.2.2	0x659	No error (0)	scontent.xx.fbcdn.net		157.240.17.15	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.011027098 CEST	1.1.1.1	192.168.2.2	0x6662	No error (0)	facebook.com		31.13.92.36	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.011411905 CEST	1.1.1.1	192.168.2.2	0x5b8e	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:57.011411905 CEST	1.1.1.1	192.168.2.2	0x5b8e	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:57.011411905 CEST	1.1.1.1	192.168.2.2	0x5b8e	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.011441946 CEST	1.1.1.1	192.168.2.2	0xd205	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.011441946 CEST	1.1.1.1	192.168.2.2	0xd205	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.012257099 CEST	1.1.1.1	192.168.2.2	0x5038	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.029889107 CEST	1.1.1.1	192.168.2.2	0xeeb6	No error (0)	facebook.com			28	IN (0x0001)
Apr 4, 2022 03:18:57.032248974 CEST	1.1.1.1	192.168.2.2	0x8667	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:57.032248974 CEST	1.1.1.1	192.168.2.2	0x8667	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:57.032248974 CEST	1.1.1.1	192.168.2.2	0x8667	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.032923937 CEST	1.1.1.1	192.168.2.2	0xd1eb	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.046830893 CEST	1.1.1.1	192.168.2.2	0xcfe6	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:57.046830893 CEST	1.1.1.1	192.168.2.2	0xcfe6	No error (0)	scontent.xx.fbcdn.net		157.240.17.15	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.104912996 CEST	1.1.1.1	192.168.2.2	0x89dc	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:57.108798027 CEST	1.1.1.1	192.168.2.2	0x879	No error (0)	scontent.xx.fbcdn.net		31.13.92.14	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.134560108 CEST	1.1.1.1	192.168.2.2	0x42e8	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.136852026 CEST	1.1.1.1	192.168.2.2	0x34e2	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.136852026 CEST	1.1.1.1	192.168.2.2	0x34e2	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.137868881 CEST	1.1.1.1	192.168.2.2	0xac37	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:57.137868881 CEST	1.1.1.1	192.168.2.2	0xac37	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:57.137868881 CEST	1.1.1.1	192.168.2.2	0xac37	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.163925886 CEST	1.1.1.1	192.168.2.2	0xbec6	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.163925886 CEST	1.1.1.1	192.168.2.2	0xbec6	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.163952112 CEST	1.1.1.1	192.168.2.2	0x4ea2	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.169923067 CEST	1.1.1.1	192.168.2.2	0x2d96	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:57.169923067 CEST	1.1.1.1	192.168.2.2	0x2d96	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:57.169923067 CEST	1.1.1.1	192.168.2.2	0x2d96	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.203546047 CEST	1.1.1.1	192.168.2.2	0xe1cd	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:57.203546047 CEST	1.1.1.1	192.168.2.2	0xe1cd	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:57.203546047 CEST	1.1.1.1	192.168.2.2	0xe1cd	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.223521948 CEST	1.1.1.1	192.168.2.2	0x5826	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.227962017 CEST	1.1.1.1	192.168.2.2	0x704	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.227984905 CEST	1.1.1.1	192.168.2.2	0x10a7	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.227984905 CEST	1.1.1.1	192.168.2.2	0x10a7	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.238902092 CEST	1.1.1.1	192.168.2.2	0xb7de	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:57.238902092 CEST	1.1.1.1	192.168.2.2	0xb7de	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:57.238902092 CEST	1.1.1.1	192.168.2.2	0xb7de	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.242311954 CEST	1.1.1.1	192.168.2.2	0x29e6	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:57.424098969 CEST	1.1.1.1	192.168.2.2	0xbefb	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:57.424098969 CEST	1.1.1.1	192.168.2.2	0xbefb	No error (0)	scontent.xx.fbcdn.net		157.240.17.15	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.427090883 CEST	1.1.1.1	192.168.2.2	0xcdb4	No error (0)	facebook.com		157.240.236.35	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.439821005 CEST	1.1.1.1	192.168.2.2	0x4914	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:57.439821005 CEST	1.1.1.1	192.168.2.2	0x4914	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:57.439821005 CEST	1.1.1.1	192.168.2.2	0x4914	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.445833921 CEST	1.1.1.1	192.168.2.2	0x1d91	No error (0)	facebook.com		157.240.236.35	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.445889950 CEST	1.1.1.1	192.168.2.2	0x40eb	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:57.445889950 CEST	1.1.1.1	192.168.2.2	0x40eb	No error (0)	scontent.xx.fbcdn.net		157.240.17.15	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.463825941 CEST	1.1.1.1	192.168.2.2	0x9337	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:57.463825941 CEST	1.1.1.1	192.168.2.2	0x9337	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:57.463825941 CEST	1.1.1.1	192.168.2.2	0x9337	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.465245008 CEST	1.1.1.1	192.168.2.2	0xfb8f	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.471050024 CEST	1.1.1.1	192.168.2.2	0xc69c	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.471050024 CEST	1.1.1.1	192.168.2.2	0xc69c	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.471236944 CEST	1.1.1.1	192.168.2.2	0x3aa2	No error (0)	facebook.com		157.240.17.35	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.480473042 CEST	1.1.1.1	192.168.2.2	0xd017	No error (0)	scontent.xx.fbcdn.net		157.240.17.15	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.485246897 CEST	1.1.1.1	192.168.2.2	0xf587	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:57.492050886 CEST	1.1.1.1	192.168.2.2	0x757c	No error (0)	facebook.com			28	IN (0x0001)
Apr 4, 2022 03:18:57.504049063 CEST	1.1.1.1	192.168.2.2	0x2a60	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:18:57.512833118 CEST	1.1.1.1	192.168.2.2	0x24a2	No error (0)	scontent.xx.fbcdn.net			28	IN (0x0001)
Apr 4, 2022 03:18:58.362508059 CEST	1.1.1.1	192.168.2.2	0xb81d	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:58.362508059 CEST	1.1.1.1	192.168.2.2	0xb81d	No error (0)	scontent.xx.fbcdn.net		157.240.17.15	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:58.403549910 CEST	1.1.1.1	192.168.2.2	0xa98e	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:58.403549910 CEST	1.1.1.1	192.168.2.2	0xa98e	No error (0)	scontent.xx.fbcdn.net		157.240.17.15	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:58.425183058 CEST	1.1.1.1	192.168.2.2	0xbcff	No error (0)	scontent.xx.fbcdn.net		31.13.92.14	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:58.444091082 CEST	1.1.1.1	192.168.2.2	0xa1bd	No error (0)	scontent.xx.fbcdn.net		31.13.92.14	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:58.450195074 CEST	1.1.1.1	192.168.2.2	0xf4f5	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:58.450195074 CEST	1.1.1.1	192.168.2.2	0xf4f5	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:58.450195074 CEST	1.1.1.1	192.168.2.2	0xf4f5	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:58.458646059 CEST	1.1.1.1	192.168.2.2	0xbb5e	No error (0)	scontent.xx.fbcdn.net			28	IN (0x0001)
Apr 4, 2022 03:18:58.470621109 CEST	1.1.1.1	192.168.2.2	0x7d3c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:58.470621109 CEST	1.1.1.1	192.168.2.2	0x7d3c	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:18:58.470621109 CEST	1.1.1.1	192.168.2.2	0x7d3c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:58.478672981 CEST	1.1.1.1	192.168.2.2	0xafe1	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:58.478672981 CEST	1.1.1.1	192.168.2.2	0xafe1	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:58.489706993 CEST	1.1.1.1	192.168.2.2	0x884a	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:58.489752054 CEST	1.1.1.1	192.168.2.2	0xa9ad	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:18:58.512873888 CEST	1.1.1.1	192.168.2.2	0xf2b9	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:19:08.097690105 CEST	1.1.1.1	192.168.2.2	0xe110	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:08.097690105 CEST	1.1.1.1	192.168.2.2	0xe110	No error (0)	autopush.prod.mozaws.net		35.155.98.26	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:08.215173006 CEST	1.1.1.1	192.168.2.2	0xfc6a	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:08.215173006 CEST	1.1.1.1	192.168.2.2	0xfc6a	No error (0)	autopush.prod.mozaws.net		35.82.230.35	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:08.261142969 CEST	1.1.1.1	192.168.2.2	0xb55f	No error (0)	autopush.prod.mozaws.net		52.89.111.63	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:08.839543104 CEST	1.1.1.1	192.168.2.2	0x1b9c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:08.839543104 CEST	1.1.1.1	192.168.2.2	0x1b9c	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:08.839543104 CEST	1.1.1.1	192.168.2.2	0x1b9c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:08.864109993 CEST	1.1.1.1	192.168.2.2	0x237c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:08.864109993 CEST	1.1.1.1	192.168.2.2	0x237c	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:08.864109993 CEST	1.1.1.1	192.168.2.2	0x237c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:08.867826939 CEST	1.1.1.1	192.168.2.2	0x603a	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:08.868758917 CEST	1.1.1.1	192.168.2.2	0x9fd1	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:08.868758917 CEST	1.1.1.1	192.168.2.2	0x9fd1	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:08.884022951 CEST	1.1.1.1	192.168.2.2	0xf65a	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:08.886549950 CEST	1.1.1.1	192.168.2.2	0x2d5c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:08.886549950 CEST	1.1.1.1	192.168.2.2	0x2d5c	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:08.886549950 CEST	1.1.1.1	192.168.2.2	0x2d5c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:08.902510881 CEST	1.1.1.1	192.168.2.2	0x3e48	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:19:30.580595970 CEST	1.1.1.1	192.168.2.2	0x7c1	No error (0)	telemetry-incoming.r53-2.services.mozilla.com	prod.ingestion-edge.prod.dataops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:30.580595970 CEST	1.1.1.1	192.168.2.2	0x7c1	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.666810036 CEST	1.1.1.1	192.168.2.2	0x8c61	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:46.666810036 CEST	1.1.1.1	192.168.2.2	0x8c61	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:46.666810036 CEST	1.1.1.1	192.168.2.2	0x8c61	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.670217991 CEST	1.1.1.1	192.168.2.2	0x13f0	No error (0)	locprod2-elb-us-west-2.prod.mozaws.net		35.161.134.161	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.670217991 CEST	1.1.1.1	192.168.2.2	0x13f0	No error (0)	locprod2-elb-us-west-2.prod.mozaws.net		52.40.22.163	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.670217991 CEST	1.1.1.1	192.168.2.2	0x13f0	No error (0)	locprod2-elb-us-west-2.prod.mozaws.net		54.148.72.145	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.670217991 CEST	1.1.1.1	192.168.2.2	0x13f0	No error (0)	locprod2-elb-us-west-2.prod.mozaws.net		35.160.240.234	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.670217991 CEST	1.1.1.1	192.168.2.2	0x13f0	No error (0)	locprod2-elb-us-west-2.prod.mozaws.net		54.148.18.111	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.670217991 CEST	1.1.1.1	192.168.2.2	0x13f0	No error (0)	locprod2-elb-us-west-2.prod.mozaws.net		35.161.154.128	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.671515942 CEST	1.1.1.1	192.168.2.2	0xe5a6	No error (0)	www.mozorg.moz.works		108.157.3.185	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.725809097 CEST	1.1.1.1	192.168.2.2	0x56da	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:46.725809097 CEST	1.1.1.1	192.168.2.2	0x56da	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:46.725809097 CEST	1.1.1.1	192.168.2.2	0x56da	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.755311966 CEST	1.1.1.1	192.168.2.2	0x6ea7	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.769316912 CEST	1.1.1.1	192.168.2.2	0x3852	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.773787022 CEST	1.1.1.1	192.168.2.2	0x72c5	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:19:46.784565926 CEST	1.1.1.1	192.168.2.2	0xc2a7	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.784565926 CEST	1.1.1.1	192.168.2.2	0xc2a7	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.788028955 CEST	1.1.1.1	192.168.2.2	0xe7c0	No error (0)	support.mozilla.org	prod-tp.sumo.mozit.cloud		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:46.788028955 CEST	1.1.1.1	192.168.2.2	0xe7c0	No error (0)	prod-tp.sumo.mozit.cloud		44.236.6.166	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.788028955 CEST	1.1.1.1	192.168.2.2	0xe7c0	No error (0)	prod-tp.sumo.mozit.cloud		54.148.60.204	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.817953110 CEST	1.1.1.1	192.168.2.2	0x70e5	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:46.817953110 CEST	1.1.1.1	192.168.2.2	0x70e5	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.821137905 CEST	1.1.1.1	192.168.2.2	0xbef2	No error (0)	prod-tp.sumo.mozit.cloud		44.236.6.166	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.821137905 CEST	1.1.1.1	192.168.2.2	0xbef2	No error (0)	prod-tp.sumo.mozit.cloud		54.148.60.204	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.830101013 CEST	1.1.1.1	192.168.2.2	0xe622	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.833586931 CEST	1.1.1.1	192.168.2.2	0x8d2b	No error (0)	firefox.settings.services.mozilla.com		13.226.158.43	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.833586931 CEST	1.1.1.1	192.168.2.2	0x8d2b	No error (0)	firefox.settings.services.mozilla.com		13.226.158.36	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.833586931 CEST	1.1.1.1	192.168.2.2	0x8d2b	No error (0)	firefox.settings.services.mozilla.com		13.226.158.76	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.833586931 CEST	1.1.1.1	192.168.2.2	0x8d2b	No error (0)	firefox.settings.services.mozilla.com		13.226.158.100	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.841072083 CEST	1.1.1.1	192.168.2.2	0xac	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:46.841072083 CEST	1.1.1.1	192.168.2.2	0xac	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:46.841072083 CEST	1.1.1.1	192.168.2.2	0xac	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.845022917 CEST	1.1.1.1	192.168.2.2	0x5988	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:46.845022917 CEST	1.1.1.1	192.168.2.2	0x5988	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.863835096 CEST	1.1.1.1	192.168.2.2	0x3806	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.868897915 CEST	1.1.1.1	192.168.2.2	0x662	No error (0)	firefox.settings.services.mozilla.com		13.226.158.43	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.868897915 CEST	1.1.1.1	192.168.2.2	0x662	No error (0)	firefox.settings.services.mozilla.com		13.226.158.76	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.868897915 CEST	1.1.1.1	192.168.2.2	0x662	No error (0)	firefox.settings.services.mozilla.com		13.226.158.100	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.868897915 CEST	1.1.1.1	192.168.2.2	0x662	No error (0)	firefox.settings.services.mozilla.com		13.226.158.36	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.901660919 CEST	1.1.1.1	192.168.2.2	0xee7f	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.902404070 CEST	1.1.1.1	192.168.2.2	0x9839	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:46.902404070 CEST	1.1.1.1	192.168.2.2	0x9839	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:46.902404070 CEST	1.1.1.1	192.168.2.2	0x9839	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.903094053 CEST	1.1.1.1	192.168.2.2	0xe8dd	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:46.903094053 CEST	1.1.1.1	192.168.2.2	0xe8dd	No error (0)	shavar.prod.mozaws.net		34.218.137.180	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.903094053 CEST	1.1.1.1	192.168.2.2	0xe8dd	No error (0)	shavar.prod.mozaws.net		52.40.173.137	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.903094053 CEST	1.1.1.1	192.168.2.2	0xe8dd	No error (0)	shavar.prod.mozaws.net		54.185.174.195	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.903094053 CEST	1.1.1.1	192.168.2.2	0xe8dd	No error (0)	shavar.prod.mozaws.net		52.36.215.253	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.903094053 CEST	1.1.1.1	192.168.2.2	0xe8dd	No error (0)	shavar.prod.mozaws.net		18.236.18.10	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.903094053 CEST	1.1.1.1	192.168.2.2	0xe8dd	No error (0)	shavar.prod.mozaws.net		52.24.149.180	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.931401014 CEST	1.1.1.1	192.168.2.2	0x983e	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:46.931401014 CEST	1.1.1.1	192.168.2.2	0x983e	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:46.931401014 CEST	1.1.1.1	192.168.2.2	0x983e	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.941515923 CEST	1.1.1.1	192.168.2.2	0x17d4	No error (0)	firefox.settings.services.mozilla.com		13.226.158.76	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.941515923 CEST	1.1.1.1	192.168.2.2	0x17d4	No error (0)	firefox.settings.services.mozilla.com		13.226.158.36	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.941515923 CEST	1.1.1.1	192.168.2.2	0x17d4	No error (0)	firefox.settings.services.mozilla.com		13.226.158.100	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.941515923 CEST	1.1.1.1	192.168.2.2	0x17d4	No error (0)	firefox.settings.services.mozilla.com		13.226.158.43	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.964313030 CEST	1.1.1.1	192.168.2.2	0xe62	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.965154886 CEST	1.1.1.1	192.168.2.2	0xb1e5	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:46.965154886 CEST	1.1.1.1	192.168.2.2	0xb1e5	No error (0)	shavar.prod.mozaws.net		52.24.149.180	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.965154886 CEST	1.1.1.1	192.168.2.2	0xb1e5	No error (0)	shavar.prod.mozaws.net		52.40.173.137	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.965154886 CEST	1.1.1.1	192.168.2.2	0xb1e5	No error (0)	shavar.prod.mozaws.net		52.36.215.253	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.965154886 CEST	1.1.1.1	192.168.2.2	0xb1e5	No error (0)	shavar.prod.mozaws.net		54.185.174.195	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.965154886 CEST	1.1.1.1	192.168.2.2	0xb1e5	No error (0)	shavar.prod.mozaws.net		34.218.137.180	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.965154886 CEST	1.1.1.1	192.168.2.2	0xb1e5	No error (0)	shavar.prod.mozaws.net		18.236.18.10	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.989078999 CEST	1.1.1.1	192.168.2.2	0xaa07	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:19:46.990603924 CEST	1.1.1.1	192.168.2.2	0xd74a	No error (0)	shavar.prod.mozaws.net		34.218.137.180	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.990603924 CEST	1.1.1.1	192.168.2.2	0xd74a	No error (0)	shavar.prod.mozaws.net		54.185.174.195	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.990603924 CEST	1.1.1.1	192.168.2.2	0xd74a	No error (0)	shavar.prod.mozaws.net		52.36.215.253	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.990603924 CEST	1.1.1.1	192.168.2.2	0xd74a	No error (0)	shavar.prod.mozaws.net		52.40.173.137	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.990603924 CEST	1.1.1.1	192.168.2.2	0xd74a	No error (0)	shavar.prod.mozaws.net		18.236.18.10	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:46.990603924 CEST	1.1.1.1	192.168.2.2	0xd74a	No error (0)	shavar.prod.mozaws.net		52.24.149.180	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.025235891 CEST	1.1.1.1	192.168.2.2	0x28c0	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.025235891 CEST	1.1.1.1	192.168.2.2	0x28c0	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.025535107 CEST	1.1.1.1	192.168.2.2	0xd712	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.075072050 CEST	1.1.1.1	192.168.2.2	0xefb5	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.075072050 CEST	1.1.1.1	192.168.2.2	0xefb5	No error (0)	autopush.prod.mozaws.net		35.160.51.228	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.075109959 CEST	1.1.1.1	192.168.2.2	0x2b03	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.075109959 CEST	1.1.1.1	192.168.2.2	0x2b03	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.075109959 CEST	1.1.1.1	192.168.2.2	0x2b03	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.094990015 CEST	1.1.1.1	192.168.2.2	0x39a1	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.094990015 CEST	1.1.1.1	192.168.2.2	0x39a1	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.094990015 CEST	1.1.1.1	192.168.2.2	0x39a1	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.097157955 CEST	1.1.1.1	192.168.2.2	0x1d76	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.097157955 CEST	1.1.1.1	192.168.2.2	0x1d76	No error (0)	autopush.prod.mozaws.net		35.162.162.226	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.113008022 CEST	1.1.1.1	192.168.2.2	0xa906	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.113008022 CEST	1.1.1.1	192.168.2.2	0xa906	No error (0)	normandy-cdn.services.mozilla.com		18.66.248.38	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.113008022 CEST	1.1.1.1	192.168.2.2	0xa906	No error (0)	normandy-cdn.services.mozilla.com		18.66.248.114	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.113008022 CEST	1.1.1.1	192.168.2.2	0xa906	No error (0)	normandy-cdn.services.mozilla.com		18.66.248.89	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.113008022 CEST	1.1.1.1	192.168.2.2	0xa906	No error (0)	normandy-cdn.services.mozilla.com		18.66.248.122	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.126182079 CEST	1.1.1.1	192.168.2.2	0x85f7	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.130325079 CEST	1.1.1.1	192.168.2.2	0x6203	No error (0)	autopush.prod.mozaws.net		15.254.11.108	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.157378912 CEST	1.1.1.1	192.168.2.2	0xe765	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:19:47.162508965 CEST	1.1.1.1	192.168.2.2	0x6a83	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.162508965 CEST	1.1.1.1	192.168.2.2	0x6a83	No error (0)	normandy-cdn.services.mozilla.com		18.66.248.114	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.162508965 CEST	1.1.1.1	192.168.2.2	0x6a83	No error (0)	normandy-cdn.services.mozilla.com		18.66.248.38	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.162508965 CEST	1.1.1.1	192.168.2.2	0x6a83	No error (0)	normandy-cdn.services.mozilla.com		18.66.248.89	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.162508965 CEST	1.1.1.1	192.168.2.2	0x6a83	No error (0)	normandy-cdn.services.mozilla.com		18.66.248.122	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.193109989 CEST	1.1.1.1	192.168.2.2	0x9544	No error (0)	www.mozorg.moz.works		18.65.35.185	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.212384939 CEST	1.1.1.1	192.168.2.2	0xd09b	No error (0)	normandy-cdn.services.mozilla.com		52.84.108.93	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.212384939 CEST	1.1.1.1	192.168.2.2	0xd09b	No error (0)	normandy-cdn.services.mozilla.com		52.84.108.124	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.212384939 CEST	1.1.1.1	192.168.2.2	0xd09b	No error (0)	normandy-cdn.services.mozilla.com		52.84.108.99	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.212384939 CEST	1.1.1.1	192.168.2.2	0xd09b	No error (0)	normandy-cdn.services.mozilla.com		52.84.108.4	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.213068962 CEST	1.1.1.1	192.168.2.2	0x1924	No error (0)	www.mozorg.moz.works		108.157.3.185	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.214487076 CEST	1.1.1.1	192.168.2.2	0x90e7	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.214487076 CEST	1.1.1.1	192.168.2.2	0x90e7	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.214487076 CEST	1.1.1.1	192.168.2.2	0x90e7	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.233578920 CEST	1.1.1.1	192.168.2.2	0x67e8	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.233578920 CEST	1.1.1.1	192.168.2.2	0x67e8	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.233578920 CEST	1.1.1.1	192.168.2.2	0x67e8	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.236752033 CEST	1.1.1.1	192.168.2.2	0xbe28	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.236752033 CEST	1.1.1.1	192.168.2.2	0xbe28	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.237814903 CEST	1.1.1.1	192.168.2.2	0xd413	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.257580042 CEST	1.1.1.1	192.168.2.2	0x166f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.281908989 CEST	1.1.1.1	192.168.2.2	0xde82	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:19:47.319210052 CEST	1.1.1.1	192.168.2.2	0x4dca	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.319659948 CEST	1.1.1.1	192.168.2.2	0x18db	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.319659948 CEST	1.1.1.1	192.168.2.2	0x18db	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.322323084 CEST	1.1.1.1	192.168.2.2	0x969d	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.322323084 CEST	1.1.1.1	192.168.2.2	0x969d	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.322323084 CEST	1.1.1.1	192.168.2.2	0x969d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.342044115 CEST	1.1.1.1	192.168.2.2	0xbaed	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.342044115 CEST	1.1.1.1	192.168.2.2	0xbaed	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.342044115 CEST	1.1.1.1	192.168.2.2	0xbaed	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.361927986 CEST	1.1.1.1	192.168.2.2	0x8954	No error (0)	locprod2-elb-us-west-2.prod.mozaws.net		35.161.134.161	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.361927986 CEST	1.1.1.1	192.168.2.2	0x8954	No error (0)	locprod2-elb-us-west-2.prod.mozaws.net		52.40.22.163	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.361927986 CEST	1.1.1.1	192.168.2.2	0x8954	No error (0)	locprod2-elb-us-west-2.prod.mozaws.net		54.148.72.145	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.361927986 CEST	1.1.1.1	192.168.2.2	0x8954	No error (0)	locprod2-elb-us-west-2.prod.mozaws.net		54.148.18.111	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.361927986 CEST	1.1.1.1	192.168.2.2	0x8954	No error (0)	locprod2-elb-us-west-2.prod.mozaws.net		35.160.240.234	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.361927986 CEST	1.1.1.1	192.168.2.2	0x8954	No error (0)	locprod2-elb-us-west-2.prod.mozaws.net		35.161.154.128	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.378175974 CEST	1.1.1.1	192.168.2.2	0xfae5	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.380981922 CEST	1.1.1.1	192.168.2.2	0xd48d	No error (0)	locprod2-elb-us-west-2.prod.mozaws.net		54.148.72.145	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.380981922 CEST	1.1.1.1	192.168.2.2	0xd48d	No error (0)	locprod2-elb-us-west-2.prod.mozaws.net		54.148.18.111	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.380981922 CEST	1.1.1.1	192.168.2.2	0xd48d	No error (0)	locprod2-elb-us-west-2.prod.mozaws.net		35.161.134.161	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.380981922 CEST	1.1.1.1	192.168.2.2	0xd48d	No error (0)	locprod2-elb-us-west-2.prod.mozaws.net		52.40.22.163	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.380981922 CEST	1.1.1.1	192.168.2.2	0xd48d	No error (0)	locprod2-elb-us-west-2.prod.mozaws.net		35.160.240.234	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.380981922 CEST	1.1.1.1	192.168.2.2	0xd48d	No error (0)	locprod2-elb-us-west-2.prod.mozaws.net		35.161.154.128	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.410105944 CEST	1.1.1.1	192.168.2.2	0xebd9	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.410630941 CEST	1.1.1.1	192.168.2.2	0xded	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:19:47.410918951 CEST	1.1.1.1	192.168.2.2	0xef0b	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.410918951 CEST	1.1.1.1	192.168.2.2	0xef0b	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.415640116 CEST	1.1.1.1	192.168.2.2	0xdbe4	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.415640116 CEST	1.1.1.1	192.168.2.2	0xdbe4	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.415640116 CEST	1.1.1.1	192.168.2.2	0xdbe4	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.444298029 CEST	1.1.1.1	192.168.2.2	0xa3b6	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.444298029 CEST	1.1.1.1	192.168.2.2	0xa3b6	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.444298029 CEST	1.1.1.1	192.168.2.2	0xa3b6	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.446557999 CEST	1.1.1.1	192.168.2.2	0x4671	No error (0)	d228z91au11ukj.cloudfront.net		108.157.4.8	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.446557999 CEST	1.1.1.1	192.168.2.2	0x4671	No error (0)	d228z91au11ukj.cloudfront.net		108.157.4.36	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.446557999 CEST	1.1.1.1	192.168.2.2	0x4671	No error (0)	d228z91au11ukj.cloudfront.net		108.157.4.58	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.446557999 CEST	1.1.1.1	192.168.2.2	0x4671	No error (0)	d228z91au11ukj.cloudfront.net		108.157.4.26	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.471260071 CEST	1.1.1.1	192.168.2.2	0xafad	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.471260071 CEST	1.1.1.1	192.168.2.2	0xafad	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.471524000 CEST	1.1.1.1	192.168.2.2	0x25ec	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.471959114 CEST	1.1.1.1	192.168.2.2	0xdecd	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.471959114 CEST	1.1.1.1	192.168.2.2	0xdecd	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.471959114 CEST	1.1.1.1	192.168.2.2	0xdecd	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.472321033 CEST	1.1.1.1	192.168.2.2	0xf0e3	No error (0)	d228z91au11ukj.cloudfront.net		52.85.47.77	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.472321033 CEST	1.1.1.1	192.168.2.2	0xf0e3	No error (0)	d228z91au11ukj.cloudfront.net		52.85.47.120	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.472321033 CEST	1.1.1.1	192.168.2.2	0xf0e3	No error (0)	d228z91au11ukj.cloudfront.net		52.85.47.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.472321033 CEST	1.1.1.1	192.168.2.2	0xf0e3	No error (0)	d228z91au11ukj.cloudfront.net		52.85.47.52	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.490688086 CEST	1.1.1.1	192.168.2.2	0xc85c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.503319979 CEST	1.1.1.1	192.168.2.2	0x39a9	No error (0)	d228z91au11ukj.cloudfront.net		13.32.121.112	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.503319979 CEST	1.1.1.1	192.168.2.2	0x39a9	No error (0)	d228z91au11ukj.cloudfront.net		13.32.121.49	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.503319979 CEST	1.1.1.1	192.168.2.2	0x39a9	No error (0)	d228z91au11ukj.cloudfront.net		13.32.121.85	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.503319979 CEST	1.1.1.1	192.168.2.2	0x39a9	No error (0)	d228z91au11ukj.cloudfront.net		13.32.121.15	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.508662939 CEST	1.1.1.1	192.168.2.2	0xf846	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:19:47.542074919 CEST	1.1.1.1	192.168.2.2	0xb6c1	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.542074919 CEST	1.1.1.1	192.168.2.2	0xb6c1	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.542074919 CEST	1.1.1.1	192.168.2.2	0xb6c1	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.561254978 CEST	1.1.1.1	192.168.2.2	0x3bba	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.561254978 CEST	1.1.1.1	192.168.2.2	0x3bba	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.561254978 CEST	1.1.1.1	192.168.2.2	0x3bba	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.581554890 CEST	1.1.1.1	192.168.2.2	0x9651	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.591959000 CEST	1.1.1.1	192.168.2.2	0xf0e2	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.591959000 CEST	1.1.1.1	192.168.2.2	0xf0e2	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.591991901 CEST	1.1.1.1	192.168.2.2	0x1467	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.599014997 CEST	1.1.1.1	192.168.2.2	0x4b51	No error (0)	www.mozorg.moz.works		143.204.212.88	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.599539995 CEST	1.1.1.1	192.168.2.2	0x1c00	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:19:47.608467102 CEST	1.1.1.1	192.168.2.2	0xd3ad	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.608467102 CEST	1.1.1.1	192.168.2.2	0xd3ad	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.608467102 CEST	1.1.1.1	192.168.2.2	0xd3ad	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.619288921 CEST	1.1.1.1	192.168.2.2	0x2221	No error (0)	www.mozorg.moz.works		108.157.3.185	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.638217926 CEST	1.1.1.1	192.168.2.2	0x725c	No error (0)	www.mozorg.moz.works		143.204.212.88	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.658102036 CEST	1.1.1.1	192.168.2.2	0xae5f	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.658102036 CEST	1.1.1.1	192.168.2.2	0xae5f	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.658102036 CEST	1.1.1.1	192.168.2.2	0xae5f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.665532112 CEST	1.1.1.1	192.168.2.2	0xc009	No error (0)	telemetry-incoming.r53-2.services.mozilla.com	prod.ingestion-edge.prod.dataops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.665532112 CEST	1.1.1.1	192.168.2.2	0xc009	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.678890944 CEST	1.1.1.1	192.168.2.2	0x63ae	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.679033995 CEST	1.1.1.1	192.168.2.2	0xd0ae	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.679033995 CEST	1.1.1.1	192.168.2.2	0xd0ae	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.679064035 CEST	1.1.1.1	192.168.2.2	0xba17	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.679064035 CEST	1.1.1.1	192.168.2.2	0xba17	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.679064035 CEST	1.1.1.1	192.168.2.2	0xba17	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.684545040 CEST	1.1.1.1	192.168.2.2	0x7230	No error (0)	telemetry-incoming.r53-2.services.mozilla.com	prod.ingestion-edge.prod.dataops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.684545040 CEST	1.1.1.1	192.168.2.2	0x7230	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.702513933 CEST	1.1.1.1	192.168.2.2	0xedc4	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.706415892 CEST	1.1.1.1	192.168.2.2	0x3be5	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.721136093 CEST	1.1.1.1	192.168.2.2	0xa495	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:19:47.751816034 CEST	1.1.1.1	192.168.2.2	0xfe56	No error (0)	telemetry-incoming.r53-2.services.mozilla.com	prod.ingestion-edge.prod.dataops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.751816034 CEST	1.1.1.1	192.168.2.2	0xfe56	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.775615931 CEST	1.1.1.1	192.168.2.2	0xbc81	No error (0)	telemetry-incoming.r53-2.services.mozilla.com	prod.ingestion-edge.prod.dataops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.775615931 CEST	1.1.1.1	192.168.2.2	0xbc81	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.793526888 CEST	1.1.1.1	192.168.2.2	0x90a	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.793526888 CEST	1.1.1.1	192.168.2.2	0x90a	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.793526888 CEST	1.1.1.1	192.168.2.2	0x90a	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.794109106 CEST	1.1.1.1	192.168.2.2	0x9e43	No error (0)	prod.ingestion-edge.prod.dataops.mozgcp.net		34.120.208.123	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.814718962 CEST	1.1.1.1	192.168.2.2	0xc5d5	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.814718962 CEST	1.1.1.1	192.168.2.2	0xc5d5	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.814718962 CEST	1.1.1.1	192.168.2.2	0xc5d5	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.833074093 CEST	1.1.1.1	192.168.2.2	0x3c8e	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.839159012 CEST	1.1.1.1	192.168.2.2	0x518e	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.842416048 CEST	1.1.1.1	192.168.2.2	0xbbda	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.842416048 CEST	1.1.1.1	192.168.2.2	0xbbda	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.852329016 CEST	1.1.1.1	192.168.2.2	0xada5	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)
Apr 4, 2022 03:19:47.855202913 CEST	1.1.1.1	192.168.2.2	0xf89f	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.855202913 CEST	1.1.1.1	192.168.2.2	0xf89f	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.855202913 CEST	1.1.1.1	192.168.2.2	0xf89f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.968863010 CEST	1.1.1.1	192.168.2.2	0xbea2	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.968863010 CEST	1.1.1.1	192.168.2.2	0xbea2	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.968863010 CEST	1.1.1.1	192.168.2.2	0xbea2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.988034010 CEST	1.1.1.1	192.168.2.2	0xc0b9	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.988034010 CEST	1.1.1.1	192.168.2.2	0xc0b9	No error (0)	detectportal.prod.mozaws.net	prod.detectportal.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 03:19:47.988034010 CEST	1.1.1.1	192.168.2.2	0xc0b9	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.989713907 CEST	1.1.1.1	192.168.2.2	0x7a71	No error (0)	example.org		93.184.216.34	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.989743948 CEST	1.1.1.1	192.168.2.2	0x3c49	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:47.989743948 CEST	1.1.1.1	192.168.2.2	0x3c49	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:48.008758068 CEST	1.1.1.1	192.168.2.2	0xa254	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)
Apr 4, 2022 03:19:48.028076887 CEST	1.1.1.1	192.168.2.2	0x5c16	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)

HTTP Request Dependency Graph

www.facebook.com

incoming.telemetry.mozilla.org

detectportal.firefox.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.2	49814	157.240.20.35	443	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.2	49839	34.120.208.123	443	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.2	49861	34.107.221.82	80	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	kBytes transferred	Direction	Data
Apr 4, 2022 03:19:47.060270071 CEST	8834	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:19:47.079236031 CEST	8834	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57449 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:19:47.221010923 CEST	8851	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:19:47.239784956 CEST	8856	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57449 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:19:47.303674936 CEST	8867	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:19:47.322734118 CEST	8867	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57449 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:19:47.396347046 CEST	8875	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:19:47.415265083 CEST	8880	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57449 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:19:47.488800049 CEST	8884	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:19:47.507695913 CEST	8892	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57449 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:19:47.587332964 CEST	8896	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:19:47.606230974 CEST	8898	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57449 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:19:47.775137901 CEST	8929	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:19:47.793977976 CEST	8934	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57449 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:19:47.830122948 CEST	8940	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:19:47.848901033 CEST	8941	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57449 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:19:47.976875067 CEST	8947	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:19:47.995760918 CEST	8948	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57449 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.2	49841	34.120.208.123	443	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.2	49842	34.120.208.123	443	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.2	49752	34.107.221.82	80	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	kBytes transferred	Direction	Data
Apr 4, 2022 03:17:54.725909948 CEST	201	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:17:54.744627953 CEST	202	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57336 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.2	49755	34.107.221.82	80	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	kBytes transferred	Direction	Data
Apr 4, 2022 03:17:55.404910088 CEST	212	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:17:55.423639059 CEST	213	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57337 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:05.425599098 CEST	237	OUT	Data Raw: 00 Data Ascii:
Apr 4, 2022 03:18:06.965666056 CEST	248	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:06.984464884 CEST	248	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57348 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:13.767613888 CEST	304	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:13.786588907 CEST	304	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57355 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:14.618762016 CEST	313	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:14.637350082 CEST	314	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57356 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:15.517940998 CEST	332	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:15.536720037 CEST	332	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57357 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:23.257728100 CEST	408	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:23.276401043 CEST	408	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57365 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:30.847840071 CEST	3558	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:30.866458893 CEST	3559	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57372 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:31.040782928 CEST	4065	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:31.060856104 CEST	4066	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57373 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:31.212316990 CEST	4094	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:31.231849909 CEST	4095	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57373 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:31.734195948 CEST	7837	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:31.753026009 CEST	7838	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57373 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:34.061606884 CEST	7846	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:34.080245972 CEST	7846	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57376 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:35.587661982 CEST	7861	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:35.606213093 CEST	7866	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57377 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:35.646694899 CEST	7867	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:35.665247917 CEST	7868	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57377 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:37.405193090 CEST	7876	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:37.423738003 CEST	7877	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57379 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:38.301760912 CEST	7896	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:38.339833975 CEST	7896	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57380 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:38.584405899 CEST	7897	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57380 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:38.941072941 CEST	7899	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:38.959887028 CEST	7899	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57380 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:39.600591898 CEST	7907	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:39.619369030 CEST	7908	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57381 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:46.960652113 CEST	8482	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:46.979568005 CEST	8487	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57388 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:47.009165049 CEST	8488	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:47.028100967 CEST	8489	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57389 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:48.047334909 CEST	8497	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:48.065912008 CEST	8497	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57390 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:48.486948013 CEST	8510	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:48.505639076 CEST	8510	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57390 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:56.994051933 CEST	8669	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:57.012994051 CEST	8675	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57399 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:57.122523069 CEST	8716	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:57.141129017 CEST	8719	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57399 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:57.148588896 CEST	8720	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:57.167184114 CEST	8728	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57399 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:57.217696905 CEST	8730	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:57.236308098 CEST	8731	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57399 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:57.449404955 CEST	8743	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:57.468733072 CEST	8744	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57399 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:58.460485935 CEST	8759	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:18:58.479181051 CEST	8760	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57400 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:19:08.480834961 CEST	8763	OUT	Data Raw: 00 Data Ascii:
Apr 4, 2022 03:19:08.853331089 CEST	8768	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:19:08.871867895 CEST	8769	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57410 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:19:18.873732090 CEST	8770	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.2	49761	34.107.221.82	80	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	kBytes transferred	Direction	Data
Apr 4, 2022 03:18:04.570498943 CEST	227	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:04.589061975 CEST	227	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57346 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:06.278774023 CEST	246	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:06.297816992 CEST	246	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57348 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:10.813002110 CEST	290	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:10.831744909 CEST	290	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57352 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:14.313632965 CEST	311	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:14.332606077 CEST	311	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57356 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:15.174043894 CEST	325	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:15.193243027 CEST	326	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57357 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:15.796329021 CEST	333	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:15.815248013 CEST	333	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57357 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:23.857148886 CEST	410	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:23.875873089 CEST	410	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57365 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:31.017863035 CEST	4064	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:31.036727905 CEST	4065	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57373 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:31.171222925 CEST	4093	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:31.190568924 CEST	4093	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57373 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:31.709047079 CEST	7835	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:31.728050947 CEST	7836	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57373 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:33.983165026 CEST	7844	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:34.002049923 CEST	7845	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57375 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:35.555179119 CEST	7859	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:35.573966980 CEST	7860	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57377 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:35.625041962 CEST	7866	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:35.643728018 CEST	7867	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57377 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:37.380357981 CEST	7875	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:37.398974895 CEST	7876	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57379 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:38.225667953 CEST	7889	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:38.244241953 CEST	7894	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57380 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:38.910691977 CEST	7898	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:38.929414034 CEST	7898	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57380 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:39.566920042 CEST	7906	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:39.585580111 CEST	7906	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57381 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:46.880213022 CEST	8444	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:46.899277925 CEST	8445	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57388 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:46.985416889 CEST	8487	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:47.004147053 CEST	8487	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57388 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:48.016947985 CEST	8496	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:48.035564899 CEST	8496	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57390 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:48.462718964 CEST	8508	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:48.481367111 CEST	8509	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57390 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:56.957175016 CEST	8668	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:56.976392984 CEST	8669	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57398 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:57.093679905 CEST	8711	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:57.112492085 CEST	8716	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57399 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:57.124612093 CEST	8717	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:57.143414021 CEST	8719	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57399 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:57.188648939 CEST	8729	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:57.207525015 CEST	8730	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57399 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:57.421139002 CEST	8742	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:57.441102982 CEST	8743	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57399 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:18:58.432085037 CEST	8758	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:18:58.451036930 CEST	8758	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57400 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:19:08.452815056 CEST	8763	OUT	Data Raw: 00 Data Ascii:
Apr 4, 2022 03:19:08.824295044 CEST	8767	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:19:08.844811916 CEST	8768	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57410 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:19:18.847660065 CEST	8770	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.2	49853	34.107.221.82	80	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	kBytes transferred	Direction	Data
Apr 4, 2022 03:19:46.726412058 CEST	8804	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:19:46.745017052 CEST	8805	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57448 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.2	49854	34.107.221.82	80	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	kBytes transferred	Direction	Data
Apr 4, 2022 03:19:46.840327978 CEST	8809	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Apr 4, 2022 03:19:46.859003067 CEST	8810	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57448 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.2	49860	34.107.221.82	80	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	kBytes transferred	Direction	Data
Apr 4, 2022 03:19:46.964248896 CEST	8831	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:19:46.982650995 CEST	8832	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57448 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:19:47.197912931 CEST	8848	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:19:47.216454983 CEST	8851	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57449 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:19:47.280319929 CEST	8865	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:19:47.299084902 CEST	8866	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57449 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:19:47.357656002 CEST	8873	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:19:47.376353025 CEST	8874	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57449 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:19:47.424877882 CEST	8881	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:19:47.443247080 CEST	8881	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57449 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:19:47.551959038 CEST	8894	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:19:47.571022987 CEST	8894	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57449 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:19:47.639347076 CEST	8902	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:19:47.658061981 CEST	8907	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57449 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:19:47.800678015 CEST	8935	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:19:47.819374084 CEST	8940	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57449 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Apr 4, 2022 03:19:47.951006889 CEST	8946	OUT	GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Apr 4, 2022 03:19:47.969712019 CEST	8946	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 03 Apr 2022 09:22:18 GMT Cache-Control: public, must-revalidate, max-age=0, s-maxage=86400 Age: 57449 Content-Type: text/plain Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.2	49814	157.240.20.35	443	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-04 01:18:56 UTC	0	OUT	GET / HTTP/1.1 Host: www.facebook.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1
2022-04-04 01:18:56 UTC	0	IN	HTTP/1.1 200 OK Vary: Accept-Encoding x-fb-rlafr: 0 document-policy: force-load-at-top cross-origin-opener-policy: same-origin-allow-popups Pragma: no-cache Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT X-Content-Type-Options: nosniff X-XSS-Protection: 0 content-security-policy-report-only: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com:* wss://.fbcdn.net attachment.fbsbx.com blob: .cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ .fbsbx.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data:;frame-src .facebook.com .fbsbx.com fbsbx.com data: .fbcdn.net;worker-src blob: .facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
2022-04-04 01:18:56 UTC	1	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 3b 73 74 79 6c 65 2d 73 72 63 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 64 61 74 61 3a 20 2a 2e 66 61 63 65 62 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src .fbcdn.net data: *.faceb
2022-04-04 01:18:56 UTC	3	IN	Data Raw: 62 66 64 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 20 63 6c 61 73 73 3d 22 6e 6f 5f 6a 73 22 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 6f 72 69 67 69 6e 22 20 Data Ascii: bfd7<!DOCTYPE html><html lang="en" id="facebook" class="no_js"><head><meta charset="utf-8" /><meta name="referrer" content="origin-when-crossorigin"
2022-04-04 01:18:56 UTC	3	IN	Data Raw: 69 64 3d 22 6d 65 74 61 5f 72 65 66 65 72 72 65 72 22 20 2f 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 6d 4b 6d 76 35 44 65 67 22 3e 77 69 6e 64 6f 77 2e 5f 63 73 74 61 72 74 3d 2b 6e 65 77 20 44 61 74 65 28 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 6d 4b 6d 76 35 44 65 67 22 3e 66 75 6e 63 74 69 6f 6e 20 65 6e 76 46 6c 75 73 68 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 62 5b 63 5d 3d 61 5b 63 5d 7d 77 69 6e 64 6f 77 2e 72 65 71 75 69 72 65 4c 61 7a 79 3f 77 69 6e 64 6f 77 2e 72 65 71 75 69 72 65 4c 61 7a 79 28 5b 22 45 6e 76 22 5d 2c 62 29 3a 28 77 69 6e 64 6f 77 2e 45 6e 76 3d 77 69 6e 64 6f 77 2e 45 6e 76 7c 7c 7b 7d 2c 62 28 77 69 6e 64 6f 77 2e 45 6e 76 Data Ascii: id="meta_referrer" /><script nonce="mKmv5Deg">window._cstart=+new Date();</script><script nonce="mKmv5Deg">function envFlush(a){function b(b){for(var c in a)b[c]=a[c]}window.requireLazy?window.requireLazy(["Env"],b):(window.Env=window.Env\|\|{},b(window.Env
2022-04-04 01:18:56 UTC	4	IN	Data Raw: 74 68 69 73 2e 69 73 5f 64 65 74 61 69 6c 65 64 5f 70 72 6f 66 69 6c 65 72 3d 61 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 2c 43 61 76 61 6c 72 79 4c 6f 67 67 65 72 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 54 54 49 45 76 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 74 74 69 5f 65 76 65 6e 74 3d 61 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 2c 43 61 76 61 6c 72 79 4c 6f 67 67 65 72 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 56 61 6c 75 65 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 64 3d 64 3f 74 68 69 73 2e 70 69 67 67 79 5f 76 61 6c 75 65 73 3a 74 68 69 73 2e 76 61 6c 75 65 73 3b 28 74 79 70 65 6f 66 20 64 5b 61 5d 3d 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 7c 7c 63 29 26 26 28 64 5b 61 5d 3d 62 29 3b 72 65 74 75 72 6e 20 74 68 69 Data Ascii: this.is_detailed_profiler=a;return this},CavalryLogger.prototype.setTTIEvent=function(a){this.tti_event=a;return this},CavalryLogger.prototype.setValue=function(a,b,c,d){d=d?this.piggy_values:this.values;(typeof d[a]==="undefined"\|\|c)&&(d[a]=b);return thi
2022-04-04 01:18:56 UTC	6	IN	Data Raw: 29 7d 2c 43 61 76 61 6c 72 79 4c 6f 67 67 65 72 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 65 61 73 75 72 65 52 65 73 6f 75 72 63 65 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 43 61 76 61 6c 72 79 4c 6f 67 67 65 72 2e 70 72 6f 74 6f 74 79 70 65 2e 70 72 6f 66 69 6c 65 45 61 72 6c 79 52 65 73 6f 75 72 63 65 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 43 61 76 61 6c 72 79 4c 6f 67 67 65 72 2e 67 65 74 42 6f 6f 74 6c 6f 61 64 65 72 4d 65 74 72 69 63 73 46 72 6f 6d 41 6c 6c 4c 6f 67 67 65 72 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 43 61 76 61 6c 72 79 4c 6f 67 67 65 72 2e 73 74 61 72 74 5f 6a 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 43 61 76 61 6c 72 79 4c 6f 67 67 65 72 2e 73 74 61 72 74 5f 6a 73 5f 73 63 72 69 70 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b Data Ascii: )},CavalryLogger.prototype.measureResources=function(){},CavalryLogger.prototype.profileEarlyResources=function(){},CavalryLogger.getBootloaderMetricsFromAllLoggers=function(){},CavalryLogger.start_js=function(){},CavalryLogger.start_js_script=function(){
2022-04-04 01:18:56 UTC	7	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 43 61 76 61 6c 72 79 4c 6f 67 67 65 72 2e 67 65 74 49 6e 73 74 61 6e 63 65 28 29 2e 73 74 6f 70 57 61 74 63 68 28 22 6a 73 5f 65 78 65 63 2f 22 2b 61 5b 62 5d 29 7d 2c 43 61 76 61 6c 72 79 4c 6f 67 67 65 72 2e 73 74 61 72 74 5f 6a 73 5f 73 63 72 69 70 74 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 61 7c 7c 21 61 2e 64 61 74 61 73 65 74 29 72 65 74 75 72 6e 3b 43 61 76 61 6c 72 79 4c 6f 67 67 65 72 2e 73 74 61 72 74 5f 6a 73 28 5b 61 2e 64 61 74 61 73 65 74 2e 62 6f 6f 74 6c 6f 61 64 65 72 48 61 73 68 7c 7c 61 2e 64 61 74 61 73 65 74 2e 62 6f 6f 74 6c 6f 61 64 65 72 48 61 73 68 43 6c 69 65 6e 74 5d 29 7d 2c 43 61 76 61 6c 72 79 4c 6f Data Ascii: function(a){for(var b=0;b<a.length;++b)CavalryLogger.getInstance().stopWatch("js_exec/"+a[b])},CavalryLogger.start_js_script=function(a){if(!a\|\|!a.dataset)return;CavalryLogger.start_js([a.dataset.bootloaderHash\|\|a.dataset.bootloaderHashClient])},CavalryLo
2022-04-04 01:18:56 UTC	9	IN	Data Raw: 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6c 64 2b 6a 73 6f 6e 22 20 6e 6f 6e 63 65 3d 22 6d 4b 6d 76 35 44 65 67 22 3e 7b 22 5c 75 30 30 34 30 63 6f 6e 74 65 78 74 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 73 63 68 65 6d 61 2e 6f 72 67 22 2c 22 5c 75 30 30 34 30 74 79 70 65 22 3a 22 57 65 62 53 69 74 65 22 2c 22 6e 61 6d 65 22 3a 22 46 61 63 65 62 6f 6f 6b 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 63 61 6e 6f 6e 69 63 61 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 22 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 Data Ascii: type="application/ld+json" nonce="mKmv5Deg">{"\u0040context":"http:\/\/schema.org","\u0040type":"WebSite","name":"Facebook","url":"https:\/\/www.facebook.com\/"}</script><link rel="canonical" href="https://www.facebook.com/" /><link rel="shortcut icon" hr
2022-04-04 01:18:56 UTC	10	IN	Data Raw: 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 74 2f 6c 2f 30 2c 63 72 6f 73 73 2f 6c 61 4a 72 4d 4f 51 43 6c 49 57 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 64 61 74 61 2d 62 6f 6f 74 6c 6f 61 64 65 72 2d 68 61 73 68 3d 22 72 65 64 2b 34 4b 37 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 2f 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 4d 2f 72 2f 46 77 56 67 5a 6b 44 6a 6f 6b 53 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 64 61 74 61 2d 62 Data Ascii: eet" href="https://static.xx.fbcdn.net/rsrc.php/v3/yt/l/0,cross/laJrMOQClIW.css?_nc_x=Ij3Wp8lg5Kz" data-bootloader-hash="red+4K7" crossorigin="anonymous" /><script src="https://static.xx.fbcdn.net/rsrc.php/v3/yM/r/FwVgZkDjokS.js?_nc_x=Ij3Wp8lg5Kz" data-b
2022-04-04 01:18:56 UTC	12	IN	Data Raw: 65 2c 22 68 61 73 68 22 3a 22 41 54 34 63 58 33 37 6f 51 63 6f 36 44 77 68 55 33 32 49 22 7d 7d 2c 22 71 70 6c 44 61 74 61 22 3a 7b 22 37 37 35 38 22 3a 7b 22 72 22 3a 31 7d 7d 7d 29 7d 29 3b 72 65 71 75 69 72 65 4c 61 7a 79 28 5b 22 54 69 6d 65 53 6c 69 63 65 49 6d 70 6c 22 2c 22 53 65 72 76 65 72 4a 53 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 54 69 6d 65 53 6c 69 63 65 2c 53 65 72 76 65 72 4a 53 29 7b 28 6e 65 77 20 53 65 72 76 65 72 4a 53 28 29 29 2e 68 61 6e 64 6c 65 28 7b 22 64 65 66 69 6e 65 22 3a 5b 5b 22 55 52 4c 46 72 61 67 6d 65 6e 74 50 72 65 6c 75 64 65 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 22 68 61 73 68 74 61 67 52 65 64 69 72 65 63 74 22 3a 74 72 75 65 2c 22 66 72 61 67 42 6c 61 63 6b 6c 69 73 74 22 3a 5b 22 6e 6f 6e 63 65 22 2c 22 61 63 63 65 73 Data Ascii: e,"hash":"AT4cX37oQco6DwhU32I"}},"qplData":{"7758":{"r":1}}})});requireLazy(["TimeSliceImpl","ServerJS"],function(TimeSlice,ServerJS){(new ServerJS()).handle({"define":[["URLFragmentPreludeConfig",[],{"hashtagRedirect":true,"fragBlacklist":["nonce","acces
2022-04-04 01:18:56 UTC	13	IN	Data Raw: 53 49 4e 45 53 53 5f 50 45 52 53 4f 4e 5f 41 43 43 4f 55 4e 54 22 3a 66 61 6c 73 65 2c 22 48 41 53 5f 53 45 43 4f 4e 44 41 52 59 5f 42 55 53 49 4e 45 53 53 5f 50 45 52 53 4f 4e 22 3a 66 61 6c 73 65 2c 22 49 53 5f 46 41 43 45 42 4f 4f 4b 5f 57 4f 52 4b 5f 41 43 43 4f 55 4e 54 22 3a 66 61 6c 73 65 2c 22 49 53 5f 4d 45 53 53 45 4e 47 45 52 5f 4f 4e 4c 59 5f 55 53 45 52 22 3a 66 61 6c 73 65 2c 22 49 53 5f 44 45 41 43 54 49 56 41 54 45 44 5f 41 4c 4c 4f 57 45 44 5f 4f 4e 5f 4d 45 53 53 45 4e 47 45 52 22 3a 66 61 6c 73 65 2c 22 49 53 5f 4d 45 53 53 45 4e 47 45 52 5f 43 41 4c 4c 5f 47 55 45 53 54 5f 55 53 45 52 22 3a 66 61 6c 73 65 2c 22 49 53 5f 57 4f 52 4b 5f 4d 45 53 53 45 4e 47 45 52 5f 43 41 4c 4c 5f 47 55 45 53 54 5f 55 53 45 52 22 3a 66 61 6c 73 65 2c 22 Data Ascii: SINESS_PERSON_ACCOUNT":false,"HAS_SECONDARY_BUSINESS_PERSON":false,"IS_FACEBOOK_WORK_ACCOUNT":false,"IS_MESSENGER_ONLY_USER":false,"IS_DEACTIVATED_ALLOWED_ON_MESSENGER":false,"IS_MESSENGER_CALL_GUEST_USER":false,"IS_WORK_MESSENGER_CALL_GUEST_USER":false,"
2022-04-04 01:18:56 UTC	14	IN	Data Raw: 65 64 69 61 74 65 47 4b 22 2c 5b 5d 2c 7b 22 77 77 77 5f 61 6c 77 61 79 73 5f 75 73 65 5f 70 6f 6c 79 66 69 6c 6c 5f 73 65 74 69 6d 6d 65 64 69 61 74 65 22 3a 66 61 6c 73 65 7d 2c 32 31 39 30 5d 2c 5b 22 4b 53 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 22 6b 69 6c 6c 65 64 22 3a 7b 22 5f 5f 73 65 74 22 3a 5b 22 4d 4f 42 49 4c 49 5a 45 52 5f 53 45 4c 46 5f 53 45 52 56 45 5f 4f 57 4e 45 52 53 48 49 50 5f 52 45 53 4f 4c 56 45 52 22 2c 22 4d 4c 48 55 42 5f 46 4c 4f 57 5f 41 55 54 4f 52 45 46 52 45 53 48 5f 53 45 41 52 43 48 22 2c 22 4e 45 4b 4f 5f 44 49 53 41 42 4c 45 5f 43 52 45 41 54 45 5f 46 4f 52 5f 53 41 50 22 2c 22 45 4f 5f 44 49 53 41 42 4c 45 5f 53 59 53 54 45 4d 5f 53 45 52 49 41 4c 5f 4e 55 4d 42 45 52 5f 46 52 45 45 5f 54 59 50 49 4e 47 5f 49 4e 5f 43 50 Data Ascii: ediateGK",[],{"www_always_use_polyfill_setimmediate":false},2190],["KSConfig",[],{"killed":{"__set":["MOBILIZER_SELF_SERVE_OWNERSHIP_RESOLVER","MLHUB_FLOW_AUTOREFRESH_SEARCH","NEKO_DISABLE_CREATE_FOR_SAP","EO_DISABLE_SYSTEM_SERIAL_NUMBER_FREE_TYPING_IN_CP
2022-04-04 01:18:56 UTC	16	IN	Data Raw: 4e 47 5f 43 41 4e 44 49 44 41 54 45 5f 50 4f 52 54 41 4c 5f 41 43 43 4f 55 4e 54 5f 44 45 4c 45 54 49 4f 4e 5f 43 41 52 44 22 5d 7d 2c 22 6b 6f 22 3a 7b 22 5f 5f 73 65 74 22 3a 5b 22 38 48 34 62 51 6d 45 69 75 4c 54 22 2c 22 33 4f 73 4c 76 6e 53 48 4e 54 74 22 2c 22 31 47 37 77 4a 36 62 4a 74 39 4b 22 2c 22 39 4e 70 6b 47 59 77 7a 72 50 47 22 2c 22 33 6f 68 35 4d 77 38 36 55 53 6a 22 2c 22 38 4e 41 63 65 45 79 39 4a 5a 6f 22 2c 22 37 46 4f 49 7a 6f 73 36 58 4a 58 22 2c 22 72 66 38 4a 45 50 47 67 4f 69 22 2c 22 34 6a 33 36 53 56 7a 76 50 33 77 22 2c 22 34 4e 53 71 33 5a 43 34 53 63 45 22 2c 22 35 33 67 43 78 4b 71 32 38 31 47 22 2c 22 33 79 7a 7a 77 42 59 37 4e 70 6a 22 2c 22 31 6f 6e 7a 49 76 30 6a 48 36 48 22 2c 22 38 50 6c 4b 75 6f 77 61 66 65 38 22 2c Data Ascii: NG_CANDIDATE_PORTAL_ACCOUNT_DELETION_CARD"]},"ko":{"__set":["8H4bQmEiuLT","3OsLvnSHNTt","1G7wJ6bJt9K","9NpkGYwzrPG","3oh5Mw86USj","8NAceEy9JZo","7FOIzos6XJX","rf8JEPGgOi","4j36SVzvP3w","4NSq3ZC4ScE","53gCxKq281G","3yzzwBY7Npj","1onzIv0jH6H","8PlKuowafe8",
2022-04-04 01:18:56 UTC	17	IN	Data Raw: 3a 5b 5d 7d 2c 22 6e 6f 43 6f 6f 6b 69 65 73 22 3a 66 61 6c 73 65 2c 22 73 68 6f 75 6c 64 53 68 6f 77 43 6f 6f 6b 69 65 42 61 6e 6e 65 72 22 3a 66 61 6c 73 65 7d 2c 34 33 32 38 5d 2c 5b 22 54 72 75 73 74 65 64 54 79 70 65 73 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 22 75 73 65 54 72 75 73 74 65 64 54 79 70 65 73 22 3a 66 61 6c 73 65 2c 22 72 65 70 6f 72 74 4f 6e 6c 79 22 3a 66 61 6c 73 65 7d 2c 34 35 34 38 5d 2c 5b 22 57 65 62 43 6f 6e 6e 65 63 74 69 6f 6e 43 6c 61 73 73 53 65 72 76 65 72 47 75 65 73 73 22 2c 5b 5d 2c 7b 22 63 6f 6e 6e 65 63 74 69 6f 6e 43 6c 61 73 73 22 3a 22 45 58 43 45 4c 4c 45 4e 54 22 7d 2c 34 37 30 35 5d 2c 5b 22 43 6f 6d 65 74 41 6c 74 70 61 79 4a 73 53 64 6b 49 66 72 61 6d 65 41 6c 6c 6f 77 65 64 44 6f 6d 61 69 6e 73 22 2c 5b 5d 2c 7b Data Ascii: :[]},"noCookies":false,"shouldShowCookieBanner":false},4328],["TrustedTypesConfig",[],{"useTrustedTypes":false,"reportOnly":false},4548],["WebConnectionClassServerGuess",[],{"connectionClass":"EXCELLENT"},4705],["CometAltpayJsSdkIframeAllowedDomains",[],{
2022-04-04 01:18:56 UTC	19	IN	Data Raw: 6e 66 6f 22 3a 7b 22 70 72 69 6d 61 72 79 47 72 6f 75 70 53 69 7a 65 22 3a 33 2c 22 73 65 63 6f 6e 64 61 72 79 47 72 6f 75 70 53 69 7a 65 22 3a 33 7d 2c 22 6e 75 6d 62 65 72 69 6e 67 53 79 73 74 65 6d 44 61 74 61 22 3a 6e 75 6c 6c 7d 2c 35 34 5d 2c 5b 22 53 65 73 73 69 6f 6e 4e 61 6d 65 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 22 73 65 65 64 22 3a 22 32 77 41 49 22 7d 2c 37 35 37 5d 2c 5b 22 5a 65 72 6f 43 61 74 65 67 6f 72 79 48 65 61 64 65 72 22 2c 5b 5d 2c 7b 7d 2c 31 31 32 37 5d 2c 5b 22 5a 65 72 6f 52 65 77 72 69 74 65 52 75 6c 65 73 22 2c 5b 5d 2c 7b 22 72 65 77 72 69 74 65 5f 72 75 6c 65 73 22 3a 7b 7d 2c 22 77 68 69 74 65 6c 69 73 74 22 3a 7b 22 5c 2f 68 72 5c 2f 72 22 3a 31 2c 22 5c 2f 68 72 5c 2f 70 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 75 6e 73 75 Data Ascii: nfo":{"primaryGroupSize":3,"secondaryGroupSize":3},"numberingSystemData":null},54],["SessionNameConfig",[],{"seed":"2wAI"},757],["ZeroCategoryHeader",[],{},1127],["ZeroRewriteRules",[],{"rewrite_rules":{},"whitelist":{"\/hr\/r":1,"\/hr\/p":1,"\/zero\/unsu
2022-04-04 01:18:56 UTC	20	IN	Data Raw: 69 2e 70 68 70 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 66 62 6c 69 74 65 5c 2f 63 6f 6e 66 69 67 5c 2f 22 3a 31 2c 22 5c 2f 68 72 5c 2f 7a 73 68 5c 2f 77 63 5c 2f 22 3a 31 2c 22 5c 2f 61 6a 61 78 5c 2f 62 6f 6f 74 6c 6f 61 64 65 72 2d 65 6e 64 70 6f 69 6e 74 5c 2f 22 3a 31 2c 22 5c 2f 6d 6f 62 69 6c 65 5c 2f 7a 65 72 6f 5c 2f 63 61 72 72 69 65 72 5f 70 61 67 65 5c 2f 22 3a 31 2c 22 5c 2f 6d 6f 62 69 6c 65 5c 2f 7a 65 72 6f 5c 2f 63 61 72 72 69 65 72 5f 70 61 67 65 5c 2f 65 64 75 63 61 74 69 6f 6e 5f 70 61 67 65 5c 2f 22 3a 31 2c 22 5c 2f 6d 6f 62 69 6c 65 5c 2f 7a 65 72 6f 5c 2f 63 61 72 72 69 65 72 5f 70 61 67 65 5c 2f 66 65 61 74 75 72 65 5f 73 77 69 74 63 68 5c 2f 22 3a 31 2c 22 5c 2f 6d 6f 62 69 6c 65 5c 2f 7a 65 72 6f 5c 2f 63 61 72 72 69 65 72 5f 70 Data Ascii: i.php":1,"\/zero\/fblite\/config\/":1,"\/hr\/zsh\/wc\/":1,"\/ajax\/bootloader-endpoint\/":1,"\/mobile\/zero\/carrier_page\/":1,"\/mobile\/zero\/carrier_page\/education_page\/":1,"\/mobile\/zero\/carrier_page\/feature_switch\/":1,"\/mobile\/zero\/carrier_p
2022-04-04 01:18:56 UTC	22	IN	Data Raw: 65 67 5c 2f 22 3a 31 2c 22 5c 2f 72 65 67 69 73 74 72 61 74 69 6f 6e 5c 2f 6c 6f 67 5c 2f 22 3a 31 2c 22 5c 2f 74 65 72 6d 73 5c 2f 22 3a 31 2c 22 5c 2f 66 31 32 33 5c 2f 22 3a 31 2c 22 5c 2f 65 78 70 65 72 74 5c 2f 22 3a 31 2c 22 5c 2f 65 78 70 65 72 74 73 5c 2f 22 3a 31 2c 22 5c 2f 74 65 72 6d 73 5c 2f 69 6e 64 65 78 2e 70 68 70 22 3a 31 2c 22 5c 2f 74 65 72 6d 73 2e 70 68 70 22 3a 31 2c 22 5c 2f 73 72 72 5c 2f 22 3a 31 2c 22 5c 2f 6d 73 69 74 65 5c 2f 72 65 64 69 72 65 63 74 5c 2f 22 3a 31 2c 22 5c 2f 66 62 73 5c 2f 70 69 78 65 6c 5c 2f 22 3a 31 2c 22 5c 2f 63 6f 6e 74 61 63 74 70 6f 69 6e 74 5c 2f 70 72 65 63 6f 6e 66 69 72 6d 61 74 69 6f 6e 5c 2f 22 3a 31 2c 22 5c 2f 63 6f 6e 74 61 63 74 70 6f 69 6e 74 5c 2f 63 6c 69 66 66 5c 2f 22 3a 31 2c 22 5c 2f Data Ascii: eg\/":1,"\/registration\/log\/":1,"\/terms\/":1,"\/f123\/":1,"\/expert\/":1,"\/experts\/":1,"\/terms\/index.php":1,"\/terms.php":1,"\/srr\/":1,"\/msite\/redirect\/":1,"\/fbs\/pixel\/":1,"\/contactpoint\/preconfirmation\/":1,"\/contactpoint\/cliff\/":1,"\/
2022-04-04 01:18:56 UTC	23	IN	Data Raw: 6f 66 69 6c 65 72 49 6d 70 6c 22 2c 22 41 61 31 79 70 62 63 4e 5a 35 58 44 6a 49 69 55 70 45 73 68 53 68 75 47 2d 50 6a 72 73 36 68 56 46 39 6f 4b 57 48 44 66 78 6a 76 57 47 30 63 67 49 35 67 4d 79 6f 6b 78 70 4b 43 65 6d 6f 70 55 35 36 39 72 35 6f 6b 7a 51 48 4f 69 6a 39 64 4f 2d 6e 37 66 4d 4a 5f 4c 63 35 77 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 37 31 37 38 32 32 22 2c 5b 22 54 69 6d 65 53 6c 69 63 65 49 6d 70 6c 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 54 69 6d 65 53 6c 69 63 65 49 6d 70 6c 22 2c 22 41 61 31 79 70 62 63 4e 5a 35 58 44 6a 49 69 55 70 45 73 68 53 68 75 47 2d 50 6a 72 73 36 68 56 46 39 6f 4b 57 48 44 66 78 6a 76 57 47 30 63 67 49 35 67 4d 79 6f 6b 78 70 4b 43 65 6d 6f 70 55 35 36 39 72 35 6f 6b 7a 51 48 4f 69 6a 39 64 4f 2d 6e 37 66 4d 4a Data Ascii: ofilerImpl","Aa1ypbcNZ5XDjIiUpEshShuG-Pjrs6hVF9oKWHDfxjvWG0cgI5gMyokxpKCemopU569r5okzQHOij9dO-n7fMJ_Lc5w"]},-1],["cr:717822",["TimeSliceImpl"],{"__rc":["TimeSliceImpl","Aa1ypbcNZ5XDjIiUpEshShuG-Pjrs6hVF9oKWHDfxjvWG0cgI5gMyokxpKCemopU569r5okzQHOij9dO-n7fMJ
2022-04-04 01:18:56 UTC	25	IN	Data Raw: 61 6c 43 6f 6d 70 6c 65 74 69 6f 6e 22 2c 22 41 61 33 68 4b 38 57 49 35 73 76 77 41 61 6f 31 72 6c 39 43 78 39 43 35 62 64 73 7a 4c 30 67 6a 63 74 63 35 6c 64 2d 55 62 6b 72 50 65 34 32 46 72 59 78 53 45 41 71 73 34 4e 4e 61 34 35 62 67 54 30 61 56 49 6f 65 79 38 46 61 55 58 2d 30 5a 71 5f 4f 32 38 58 54 6a 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 30 39 34 39 30 37 22 2c 5b 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 6e 75 6c 6c 2c 22 41 61 32 4c 43 58 35 55 65 4d 61 77 33 51 62 34 38 50 74 4c 77 67 68 7a 51 44 62 50 31 4a 6d 57 52 75 77 76 6e 6b 66 4f 69 31 6e 39 61 7a 44 49 63 4f 78 38 67 49 73 54 6b 6e 31 45 4e 39 51 48 42 73 47 63 6c 5f 42 53 4a 6c 71 51 52 4c 77 67 5f 43 41 48 32 69 41 22 5d 7d 2c 2d 31 5d 2c 5b 22 45 76 65 6e 74 43 6f 6e 66 69 67 22 2c 5b 5d Data Ascii: alCompletion","Aa3hK8WI5svwAao1rl9Cx9C5bdszL0gjctc5ld-UbkrPe42FrYxSEAqs4NNa45bgT0aVIoey8FaUX-0Zq_O28XTj"]},-1],["cr:1094907",[],{"__rc":[null,"Aa2LCX5UeMaw3Qb48PtLwghzQDbP1JmWRuwvnkfOi1n9azDIcOx8gIsTkn1EN9QHBsGcl_BSJlqQRLwg_CAH2iA"]},-1],["EventConfig",[]
2022-04-04 01:18:56 UTC	26	IN	Data Raw: 5b 22 55 52 4c 46 72 61 67 6d 65 6e 74 50 72 65 6c 75 64 65 22 5d 2c 5b 22 50 72 69 6d 65 72 22 5d 2c 5b 22 42 69 67 50 69 70 65 22 5d 2c 5b 22 42 6f 6f 74 6c 6f 61 64 65 72 22 5d 2c 5b 22 54 69 6d 65 53 6c 69 63 65 22 5d 2c 5b 22 41 73 79 6e 63 52 65 71 75 65 73 74 22 5d 2c 5b 22 42 61 6e 7a 61 69 53 63 75 62 61 5f 44 45 50 52 45 43 41 54 45 44 22 5d 2c 5b 22 56 69 73 75 61 6c 43 6f 6d 70 6c 65 74 69 6f 6e 47 61 74 69 6e 67 22 5d 2c 5b 22 46 62 74 4c 6f 67 67 69 6e 67 22 5d 2c 5b 22 49 6e 74 6c 51 74 45 76 65 6e 74 46 61 6c 63 6f 45 76 65 6e 74 22 5d 2c 5b 22 52 65 71 75 69 72 65 44 65 66 65 72 72 65 64 52 65 66 65 72 65 6e 63 65 22 2c 22 75 6e 62 6c 6f 63 6b 22 2c 5b 5d 2c 5b 5b 22 41 73 79 6e 63 52 65 71 75 65 73 74 22 2c 22 42 61 6e 7a 61 69 53 63 75 Data Ascii: ["URLFragmentPrelude"],["Primer"],["BigPipe"],["Bootloader"],["TimeSlice"],["AsyncRequest"],["BanzaiScuba_DEPRECATED"],["VisualCompletionGating"],["FbtLogging"],["IntlQtEventFalcoEvent"],["RequireDeferredReference","unblock",[],[["AsyncRequest","BanzaiScu
2022-04-04 01:18:56 UTC	28	IN	Data Raw: 73 73 3d 22 5f 36 61 20 5f 33 62 63 73 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 5f 36 61 20 6d 72 6d 20 75 69 50 6f 70 6f 76 65 72 22 20 69 64 3d 22 75 5f 30 5f 38 5f 69 61 22 3e 3c 61 20 72 6f 6c 65 3d 22 62 75 74 74 6f 6e 22 20 63 6c 61 73 73 3d 22 5f 34 32 66 74 20 5f 34 6a 79 30 20 5f 35 35 70 69 20 5f 32 61 67 66 20 5f 34 6f 5f 34 20 5f 33 5f 73 32 20 5f 36 33 78 62 20 5f 70 20 5f 34 6a 79 33 20 5f 34 6a 79 31 20 73 65 6c 65 63 74 65 64 20 5f 35 31 73 79 22 20 68 72 65 66 3d 22 23 22 20 73 74 79 6c 65 3d 22 6d 61 78 2d 77 69 64 74 68 3a 32 30 30 70 78 3b 22 20 61 72 69 61 2d 68 61 73 70 6f 70 75 70 3d 22 74 72 75 65 22 20 74 61 62 69 6e 64 65 78 3d 22 2d 31 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 3d 22 66 61 6c 73 65 22 20 72 Data Ascii: ss="_6a _3bcs"></div><div class="_6a mrm uiPopover" id="u_0_8_ia"><a role="button" class="_42ft _4jy0 _55pi _2agf _4o_4 _3_s2 _63xb _p _4jy3 _4jy1 selected _51sy" href="#" style="max-width:200px;" aria-haspopup="true" tabindex="-1" aria-expanded="false" r
2022-04-04 01:18:56 UTC	29	IN	Data Raw: 3c 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 5f 36 6c 75 78 22 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 63 6c 61 73 73 3d 22 69 6e 70 75 74 74 65 78 74 20 5f 35 35 72 31 20 5f 36 6c 75 79 22 20 6e 61 6d 65 3d 22 65 6d 61 69 6c 22 20 69 64 3d 22 65 6d 61 69 6c 22 20 64 61 74 61 2d 74 65 73 74 69 64 3d 22 72 6f 79 61 6c 5f 65 6d 61 69 6c 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 45 6d 61 69 6c 20 6f 72 20 70 68 6f 6e 65 20 6e 75 6d 62 65 72 22 20 61 75 74 6f 66 6f 63 75 73 3d 22 31 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 45 6d 61 69 6c 20 6f 72 20 70 68 6f 6e 65 20 6e 75 6d 62 65 72 22 20 2f 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 5f 36 6c 75 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 5f 36 6c 75 79 20 5f 35 Data Ascii: <div><div class="_6lux"><input type="text" class="inputtext _55r1 _6luy" name="email" id="email" data-testid="royal_email" placeholder="Email or phone number" autofocus="1" aria-label="Email or phone number" /></div><div class="_6lux"><div class="_6luy _5
2022-04-04 01:18:56 UTC	31	IN	Data Raw: 65 3d 72 65 67 69 73 74 72 61 74 69 6f 6e 5f 66 6f 72 6d 22 20 63 6c 61 73 73 3d 22 5f 38 65 73 68 22 3e 43 72 65 61 74 65 20 61 20 50 61 67 65 3c 2f 61 3e 20 66 6f 72 20 61 20 63 65 6c 65 62 72 69 74 79 2c 20 62 72 61 6e 64 20 6f 72 20 62 75 73 69 6e 65 73 73 2e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 5f 39 35 6b 65 20 5f 38 6f 70 79 22 3e 3c 64 69 76 20 69 64 3d 22 70 61 67 65 46 6f 6f 74 65 72 22 20 64 61 74 61 2d 72 65 66 65 72 72 65 72 3d 22 70 61 67 65 5f 66 6f 6f 74 65 72 22 20 64 61 74 61 2d 74 65 73 74 69 64 3d 22 70 61 67 65 5f 66 6f 6f 74 65 72 22 3e 3c 75 6c 20 63 6c 61 73 73 3d 22 Data Ascii: e=registration_form" class="_8esh">Create a Page</a> for a celebrity, brand or business.</div></div></div></div></div></div></div><div class=""><div class="_95ke _8opy"><div id="pageFooter" data-referrer="page_footer" data-testid="page_footer"><ul class="
2022-04-04 01:18:56 UTC	32	IN	Data Raw: 50 6f 72 74 75 67 61 6c 29 22 3e 50 6f 72 74 75 67 75 c3 aa 73 20 28 50 6f 72 74 75 67 61 6c 29 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 5f 73 76 34 22 20 64 69 72 3d 22 6c 74 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 71 2d 61 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 22 20 6f 6e 63 6c 69 63 6b 3d 22 72 65 71 75 69 72 65 28 26 71 75 6f 74 3b 49 6e 74 6c 55 74 69 6c 73 26 71 75 6f 74 3b 29 2e 73 65 74 43 6f 6f 6b 69 65 4c 6f 63 61 6c 65 28 26 71 75 6f 74 3b 73 71 5f 41 4c 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 65 6e 5f 55 53 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 71 2d 61 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 77 77 77 5f 6c Data Ascii: Portugal)">Portugus (Portugal)</a></li><li><a class="_sv4" dir="ltr" href="https://sq-al.facebook.com/" onclick="require("IntlUtils").setCookieLocale("sq_AL", "en_US", "https:\/\/sq-al.facebook.com\/", "www_l
2022-04-04 01:18:56 UTC	34	IN	Data Raw: 22 20 64 69 72 3d 22 6c 74 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 7a 68 2d 63 6e 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 22 20 6f 6e 63 6c 69 63 6b 3d 22 72 65 71 75 69 72 65 28 26 71 75 6f 74 3b 49 6e 74 6c 55 74 69 6c 73 26 71 75 6f 74 3b 29 2e 73 65 74 43 6f 6f 6b 69 65 4c 6f 63 61 6c 65 28 26 71 75 6f 74 3b 7a 68 5f 43 4e 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 65 6e 5f 55 53 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 7a 68 2d 63 6e 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 77 77 77 5f 6c 69 73 74 5f 73 65 6c 65 63 74 6f 72 26 71 75 6f 74 3b 2c 20 39 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 20 74 69 74 6c 65 3d 22 53 69 6d 70 6c 69 66 69 65 64 20 43 68 Data Ascii: " dir="ltr" href="https://zh-cn.facebook.com/" onclick="require("IntlUtils").setCookieLocale("zh_CN", "en_US", "https:\/\/zh-cn.facebook.com\/", "www_list_selector", 9); return false;" title="Simplified Ch
2022-04-04 01:18:56 UTC	35	IN	Data Raw: 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6f 63 75 6c 75 73 2e 63 6f 6d 2f 22 20 74 69 74 6c 65 3d 22 4c 65 61 72 6e 20 6d 6f 72 65 20 61 62 6f 75 74 20 4f 63 75 6c 75 73 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 4f 63 75 6c 75 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 72 74 61 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 22 20 74 69 74 6c 65 3d 22 4c 65 61 72 6e 20 6d 6f 72 65 20 61 62 6f 75 74 20 46 61 63 65 62 6f 6f 6b 20 50 6f 72 74 61 6c 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 50 6f 72 74 61 6c 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 6c 2e 70 68 70 3f 75 3d 68 74 74 70 73 25 33 Data Ascii: "https://www.oculus.com/" title="Learn more about Oculus" target="_blank">Oculus</a></li><li><a href="https://portal.facebook.com/" title="Learn more about Facebook Portal" target="_blank">Portal</a></li><li><a href="https://l.facebook.com/l.php?u=https%3
2022-04-04 01:18:56 UTC	36	IN	Data Raw: 3d 73 69 74 65 5f 66 6f 6f 74 65 72 22 20 74 69 74 6c 65 3d 22 43 72 65 61 74 65 20 61 20 70 61 67 65 22 3e 43 72 65 61 74 65 20 50 61 67 65 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 76 65 6c 6f 70 65 72 73 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 3f 72 65 66 3d 70 66 22 20 74 69 74 6c 65 3d 22 44 65 76 65 6c 6f 70 20 6f 6e 20 6f 75 72 20 70 6c 61 74 66 6f 72 6d 2e 22 3e 44 65 76 65 6c 6f 70 65 72 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 63 61 72 65 65 72 73 2f 3f 72 65 66 3d 70 66 22 20 74 69 74 6c 65 3d 22 4d 61 6b 65 20 79 6f 75 72 20 6e 65 78 74 20 63 61 72 65 65 72 20 6d 6f 76 65 20 74 6f 20 6f 75 72 20 61 77 65 73 6f 6d 65 20 63 6f 6d 70 61 6e 79 2e 22 3e 43 61 72 Data Ascii: =site_footer" title="Create a page">Create Page</a></li><li><a href="https://developers.facebook.com/?ref=pf" title="Develop on our platform.">Developers</a></li><li><a href="/careers/?ref=pf" title="Make your next career move to our awesome company.">Car
2022-04-04 01:18:56 UTC	38	IN	Data Raw: 44 61 74 61 22 3a 7b 22 38 37 35 32 33 31 22 3a 7b 22 75 72 69 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 79 44 5c 2f 72 5c 2f 64 34 5a 49 56 58 2d 35 43 2d 62 2e 69 63 6f 22 7d 7d 2c 22 63 6c 70 44 61 74 61 22 3a 7b 22 31 37 34 36 33 39 37 22 3a 7b 22 72 22 3a 31 2c 22 73 22 3a 31 7d 7d 2c 22 67 6b 78 44 61 74 61 22 3a 7b 22 34 31 36 36 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 37 79 72 62 35 51 75 51 39 32 37 33 36 75 33 50 34 22 7d 2c 22 36 37 37 37 36 32 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 22 41 54 36 65 39 4d 76 52 79 58 70 61 63 77 4f 59 4d 2d 41 22 7d 2c 22 31 39 30 38 31 33 35 22 3a Data Ascii: Data":{"875231":{"uri":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/yD\/r\/d4ZIVX-5C-b.ico"}},"clpData":{"1746397":{"r":1,"s":1}},"gkxData":{"4166":{"result":false,"hash":"AT7yrb5QuQ92736u3P4"},"677762":{"result":true,"hash":"AT6e9MvRyXpacwOYM-A"},"1908135":
2022-04-04 01:18:56 UTC	39	IN	Data Raw: 5a 39 30 6f 22 7d 2c 22 31 39 30 36 38 37 31 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 36 64 49 42 69 56 76 39 62 55 44 58 6c 6d 67 70 55 22 7d 2c 22 31 39 38 35 39 34 35 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 22 41 54 36 36 4f 6f 35 6c 59 5f 5f 35 77 55 54 70 7a 6a 63 22 7d 2c 22 35 35 34 31 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 22 41 54 37 30 56 2d 51 5f 7a 66 45 79 6b 7a 6e 4f 6f 41 41 22 7d 2c 22 31 30 39 39 38 39 33 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 35 6b 6c 79 32 4c 53 5a 56 5f 44 4b 47 52 70 42 38 22 7d 7d 2c 22 71 65 78 44 61 74 61 22 3a 7b 22 36 34 34 22 3a 7b 22 72 22 3a 6e 75 6c 6c 7d 2c Data Ascii: Z90o"},"1906871":{"result":false,"hash":"AT6dIBiVv9bUDXlmgpU"},"1985945":{"result":true,"hash":"AT66Oo5lY__5wUTpzjc"},"5541":{"result":true,"hash":"AT70V-Q_zfEykznOoAA"},"1099893":{"result":false,"hash":"AT5kly2LSZV_DKGRpB8"}},"qexData":{"644":{"r":null},
2022-04-04 01:18:56 UTC	41	IN	Data Raw: 4b 7a 22 7d 2c 22 56 59 58 2b 55 63 31 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 6a 5c 2f 72 5c 2f 79 6c 51 5a 47 6a 74 6f 54 5a 53 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 7d 2c 22 30 30 41 77 73 36 4b 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 55 5c 2f 72 5c 2f 42 77 6c 6b 52 76 37 42 34 49 48 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 7d 2c 22 5c 2f 47 72 34 43 45 52 22 3a 7b 22 74 79 70 Data Ascii: Kz"},"VYX+Uc1":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yj\/r\/ylQZGjtoTZS.js?_nc_x=Ij3Wp8lg5Kz"},"00Aws6K":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yU\/r\/BwlkRv7B4IH.js?_nc_x=Ij3Wp8lg5Kz"},"\/Gr4CER":{"typ
2022-04-04 01:18:56 UTC	42	IN	Data Raw: 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 35 5c 2f 72 5c 2f 72 75 42 49 66 41 79 4f 71 46 74 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 7d 2c 22 55 66 71 36 59 57 58 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 6a 5c 2f 72 5c 2f 2d 6a 59 37 53 71 62 5a 53 7a 79 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 7d 2c 22 35 36 56 43 68 39 48 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 Data Ascii: cdn.net\/rsrc.php\/v3\/y5\/r\/ruBIfAyOqFt.js?_nc_x=Ij3Wp8lg5Kz"},"Ufq6YWX":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yj\/r\/-jY7SqbZSzy.js?_nc_x=Ij3Wp8lg5Kz"},"56VCh9H":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3
2022-04-04 01:18:56 UTC	44	IN	Data Raw: 6e 5f 55 53 5c 2f 66 62 31 66 6d 55 44 72 67 63 6d 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 7d 2c 22 6d 44 79 61 62 74 69 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 34 5c 2f 72 5c 2f 6d 45 7a 61 67 44 4a 57 55 53 7a 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 7d 2c 22 6f 33 7a 43 7a 7a 5c 2f 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 4c 6c 35 34 5c 2f 79 6a 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 62 68 Data Ascii: n_US\/fb1fmUDrgcm.js?_nc_x=Ij3Wp8lg5Kz"},"mDyabti":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/y4\/r\/mEzagDJWUSz.js?_nc_x=Ij3Wp8lg5Kz"},"o3zCzz\/":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iLl54\/yj\/l\/en_US\/bh
2022-04-04 01:18:56 UTC	45	IN	Data Raw: 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 7d 2c 22 66 6c 4e 44 30 48 53 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 64 42 71 34 5c 2f 79 53 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 2d 42 4e 75 31 56 54 4b 4b 73 77 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 7d 2c 22 51 5c 2f 50 73 75 33 78 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 4b 7a 52 34 5c 2f 79 78 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 57 6b 51 72 6c 73 65 2d 55 63 48 2e 6a 73 3f Data Ascii: x=Ij3Wp8lg5Kz"},"flND0HS":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3idBq4\/yS\/l\/en_US\/-BNu1VTKKsw.js?_nc_x=Ij3Wp8lg5Kz"},"Q\/Psu3x":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iKzR4\/yx\/l\/en_US\/WkQrlse-UcH.js?
2022-04-04 01:18:56 UTC	47	IN	Data Raw: 55 53 5c 2f 2d 66 38 30 33 68 6c 4e 41 6d 7a 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 7d 2c 22 69 38 39 47 78 50 54 22 3a 7b 22 74 79 70 65 22 3a 22 63 73 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 51 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 57 6e 54 35 68 38 75 4a 61 4f 35 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 7d 2c 22 34 35 67 32 7a 47 7a 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 71 5c 2f 72 5c 2f 67 31 71 6f 31 72 Data Ascii: US\/-f803hlNAmz.js?_nc_x=Ij3Wp8lg5Kz"},"i89GxPT":{"type":"css","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yQ\/l\/0,cross\/WnT5h8uJaO5.css?_nc_x=Ij3Wp8lg5Kz"},"45g2zGz":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yq\/r\/g1qo1r
2022-04-04 01:18:56 UTC	48	IN	Data Raw: 33 57 70 38 6c 67 35 4b 7a 22 7d 2c 22 54 75 69 50 63 49 4f 22 3a 7b 22 74 79 70 65 22 3a 22 63 73 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 77 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 51 38 59 2d 42 6e 69 48 4a 53 38 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 7d 2c 22 46 78 41 53 6e 68 68 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 70 2d 74 34 5c 2f 79 6a 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 67 52 75 51 7a 4b 67 45 49 58 31 2e 6a 73 3f 5f 6e 63 5f 78 3d Data Ascii: 3Wp8lg5Kz"},"TuiPcIO":{"type":"css","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yw\/l\/0,cross\/Q8Y-BniHJS8.css?_nc_x=Ij3Wp8lg5Kz"},"FxASnhh":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3ip-t4\/yj\/l\/en_US\/gRuQzKgEIX1.js?_nc_x=
2022-04-04 01:18:56 UTC	50	IN	Data Raw: 58 66 5a 72 76 42 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 7d 2c 22 6f 36 56 53 47 44 4d 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 48 5c 2f 72 5c 2f 30 6e 33 6d 43 4f 47 38 52 42 49 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 7d 2c 22 70 42 5a 41 34 46 39 22 3a 7b 22 74 79 70 65 22 3a 22 63 73 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 39 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 32 74 77 70 46 38 58 4a 66 5a 6a 2e 63 73 73 Data Ascii: XfZrvB.css?_nc_x=Ij3Wp8lg5Kz"},"o6VSGDM":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yH\/r\/0n3mCOG8RBI.js?_nc_x=Ij3Wp8lg5Kz"},"pBZA4F9":{"type":"css","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/y9\/l\/0,cross\/2twpF8XJfZj.css
2022-04-04 01:18:56 UTC	51	IN	Data Raw: 33 57 70 38 6c 67 35 4b 7a 22 7d 2c 22 41 74 74 41 6e 4e 42 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 33 5c 2f 72 5c 2f 32 4f 73 4b 48 70 4a 4c 69 62 5f 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 7d 2c 22 69 4b 6d 73 4c 62 2b 22 3a 7b 22 74 79 70 65 22 3a 22 63 73 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 43 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 4d 6d 47 5a 43 2d 4a 30 58 39 38 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 Data Ascii: 3Wp8lg5Kz"},"AttAnNB":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/y3\/r\/2OsKHpJLib_.js?_nc_x=Ij3Wp8lg5Kz"},"iKmsLb+":{"type":"css","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yC\/l\/0,cross\/MmGZC-J0X98.css?_nc_x=Ij3Wp8lg5Kz"
2022-04-04 01:18:56 UTC	53	IN	Data Raw: 4e 61 52 6f 76 32 5a 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 77 4d 73 34 5c 2f 79 69 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 69 65 63 65 74 37 32 36 44 6d 51 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 7d 2c 22 7a 42 53 42 4b 34 30 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 68 59 5a 34 5c 2f 79 37 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 57 35 67 69 65 57 41 67 52 4f 53 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 Data Ascii: NaRov2Z":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iwMs4\/yi\/l\/en_US\/iecet726DmQ.js?_nc_x=Ij3Wp8lg5Kz"},"zBSBK40":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3ihYZ4\/y7\/l\/en_US\/W5gieWAgROS.js?_nc_x=Ij3Wp8lg5Kz"
2022-04-04 01:18:56 UTC	54	IN	Data Raw: 57 70 38 6c 67 35 4b 7a 22 7d 2c 22 68 49 65 6b 2b 62 47 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 59 5c 2f 72 5c 2f 44 5a 5f 56 42 6c 73 79 2d 64 43 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 7d 2c 22 6a 4c 33 79 47 6d 58 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 50 5c 2f 72 5c 2f 6a 67 61 41 4f 4c 48 72 44 4a 39 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 7d 2c 22 78 49 77 64 41 75 62 22 3a Data Ascii: Wp8lg5Kz"},"hIek+bG":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yY\/r\/DZ_VBlsy-dC.js?_nc_x=Ij3Wp8lg5Kz"},"jL3yGmX":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yP\/r\/jgaAOLHrDJ9.js?_nc_x=Ij3Wp8lg5Kz"},"xIwdAub":
2022-04-04 01:18:56 UTC	55	IN	Data Raw: 63 22 3a 31 2c 22 64 22 3a 31 7d 7d 2c 22 63 6f 6d 70 4d 61 70 22 3a 7b 22 44 6f 63 6b 22 3a 7b 22 72 22 3a 5b 22 77 35 67 58 6e 54 49 22 2c 22 30 67 42 42 49 6d 30 22 2c 22 38 50 6c 79 54 55 76 22 2c 22 53 4a 74 39 62 35 38 22 2c 22 57 57 38 66 71 56 6e 22 2c 22 56 4a 42 42 79 55 66 22 2c 22 66 6f 78 6f 58 72 6e 22 2c 22 37 78 69 65 53 31 34 22 2c 22 69 34 75 6c 41 71 53 22 2c 22 53 6c 33 47 67 38 79 22 5d 2c 22 62 65 22 3a 31 7d 2c 22 57 65 62 53 70 65 65 64 49 6e 74 65 72 61 63 74 69 6f 6e 73 54 79 70 65 64 4c 6f 67 67 65 72 22 3a 7b 22 72 22 3a 5b 22 54 55 78 56 36 38 53 22 2c 22 69 34 75 6c 41 71 53 22 2c 22 56 59 58 2b 55 63 31 22 5d 2c 22 72 64 73 22 3a 7b 22 6d 22 3a 5b 22 42 61 6e 7a 61 69 53 63 75 62 61 5f 44 45 50 52 45 43 41 54 45 44 22 5d 7d Data Ascii: c":1,"d":1}},"compMap":{"Dock":{"r":["w5gXnTI","0gBBIm0","8PlyTUv","SJt9b58","WW8fqVn","VJBByUf","foxoXrn","7xieS14","i4ulAqS","Sl3Gg8y"],"be":1},"WebSpeedInteractionsTypedLogger":{"r":["TUxV68S","i4ulAqS","VYX+Uc1"],"rds":{"m":["BanzaiScuba_DEPRECATED"]}
2022-04-04 01:18:56 UTC	57	IN	Data Raw: 42 49 6d 30 22 5d 2c 22 62 65 22 3a 31 7d 2c 22 50 68 6f 74 6f 53 6e 6f 77 6c 69 66 74 22 3a 7b 22 72 22 3a 5b 22 72 65 64 2b 34 4b 37 22 2c 22 72 33 6e 2b 6e 4e 54 22 2c 22 77 35 67 58 6e 54 49 22 2c 22 35 51 74 37 30 66 41 22 2c 22 37 35 64 32 57 5c 2f 68 22 2c 22 36 70 74 4a 6c 74 37 22 2c 22 68 33 41 39 36 52 4d 22 2c 22 39 4d 30 57 53 4b 32 22 2c 22 4f 34 37 66 6c 71 51 22 2c 22 30 56 59 37 41 4b 61 22 0d 0a 31 61 38 64 0d 0a 2c 22 32 43 62 44 52 4a 4c 22 2c 22 65 4c 66 65 67 4e 38 22 2c 22 6d 67 38 4a 2b 55 52 22 2c 22 52 77 4e 47 46 74 38 22 2c 22 49 79 68 6c 74 76 55 22 2c 22 6d 44 79 61 62 74 69 22 2c 22 5c 2f 41 4e 38 42 74 35 22 2c 22 6f 33 7a 43 7a 7a 5c 2f 22 2c 22 7a 56 45 4e 36 73 6e 22 2c 22 30 67 42 42 49 6d 30 22 2c 22 6a 5a 57 6e 4a 4d Data Ascii: BIm0"],"be":1},"PhotoSnowlift":{"r":["red+4K7","r3n+nNT","w5gXnTI","5Qt70fA","75d2W\/h","6ptJlt7","h3A96RM","9M0WSK2","O47flqQ","0VY7AKa"1a8d,"2CbDRJL","eLfegN8","mg8J+UR","RwNGFt8","IyhltvU","mDyabti","\/AN8Bt5","o3zCzz\/","zVEN6sn","0gBBIm0","jZWnJM
2022-04-04 01:18:56 UTC	58	IN	Data Raw: 6f 78 6f 58 72 6e 22 2c 22 72 62 52 30 32 4c 77 22 2c 22 56 59 58 2b 55 63 31 22 2c 22 49 55 71 66 71 5c 2f 63 22 2c 22 41 74 74 41 6e 4e 42 22 2c 22 52 41 6a 6b 4f 72 56 22 2c 22 69 4b 6d 73 4c 62 2b 22 2c 22 79 45 47 4e 48 4f 62 22 2c 22 37 78 69 65 53 31 34 22 2c 22 6a 4b 58 76 31 73 32 22 2c 22 53 6c 34 69 62 6a 5a 22 2c 22 34 4d 68 73 33 36 48 22 2c 22 54 58 6b 72 46 48 62 22 2c 22 69 34 75 6c 41 71 53 22 2c 22 44 41 72 59 64 49 45 22 2c 22 31 79 49 4c 49 62 73 22 2c 22 7a 50 4a 71 6f 49 44 22 2c 22 78 58 72 36 6f 6d 64 22 2c 22 58 5c 2f 71 75 6a 46 34 22 2c 22 4f 51 63 6a 54 43 38 22 2c 22 7a 50 4c 67 49 47 54 22 2c 22 56 4a 31 73 70 58 49 22 2c 22 53 76 43 41 79 5a 36 22 2c 22 34 35 67 32 7a 47 7a 22 2c 22 53 6c 33 47 67 38 79 22 2c 22 30 70 56 51 Data Ascii: oxoXrn","rbR02Lw","VYX+Uc1","IUqfq\/c","AttAnNB","RAjkOrV","iKmsLb+","yEGNHOb","7xieS14","jKXv1s2","Sl4ibjZ","4Mhs36H","TXkrFHb","i4ulAqS","DArYdIE","1yILIbs","zPJqoID","xXr6omd","X\/qujF4","OQcjTC8","zPLgIGT","VJ1spXI","SvCAyZ6","45g2zGz","Sl3Gg8y","0pVQ
2022-04-04 01:18:56 UTC	60	IN	Data Raw: 2c 22 30 67 42 42 49 6d 30 22 2c 22 6a 5a 57 6e 4a 4d 4c 22 2c 22 38 50 6c 79 54 55 76 22 2c 22 53 4a 74 39 62 35 38 22 2c 22 57 57 38 66 71 56 6e 22 2c 22 61 46 39 69 50 48 64 22 2c 22 30 30 41 77 73 36 4b 22 2c 22 5c 2f 47 72 34 43 45 52 22 2c 22 56 4a 42 42 79 55 66 22 2c 22 34 77 53 76 78 45 70 22 2c 22 66 6f 78 6f 58 72 6e 22 2c 22 72 62 52 30 32 4c 77 22 2c 22 56 59 58 2b 55 63 31 22 2c 22 37 78 69 65 53 31 34 22 2c 22 69 34 75 6c 41 71 53 22 2c 22 44 41 72 59 64 49 45 22 2c 22 53 6c 33 47 67 38 79 22 2c 22 30 70 56 51 6a 4d 59 22 2c 22 64 74 42 48 66 4e 6e 22 2c 22 55 66 71 36 59 57 58 22 5d 2c 22 72 64 73 22 3a 7b 22 6d 22 3a 5b 22 46 62 74 4c 6f 67 67 69 6e 67 22 2c 22 49 6e 74 6c 51 74 45 76 65 6e 74 46 61 6c 63 6f 45 76 65 6e 74 22 2c 22 42 61 Data Ascii: ,"0gBBIm0","jZWnJML","8PlyTUv","SJt9b58","WW8fqVn","aF9iPHd","00Aws6K","\/Gr4CER","VJBByUf","4wSvxEp","foxoXrn","rbR02Lw","VYX+Uc1","7xieS14","i4ulAqS","DArYdIE","Sl3Gg8y","0pVQjMY","dtBHfNn","Ufq6YWX"],"rds":{"m":["FbtLogging","IntlQtEventFalcoEvent","Ba
2022-04-04 01:18:56 UTC	61	IN	Data Raw: 22 3a 7b 22 72 22 3a 5b 22 77 35 67 58 6e 54 49 22 2c 22 53 4a 74 39 62 35 38 22 2c 22 5c 2f 47 72 34 43 45 52 22 2c 22 6f 45 34 44 6f 66 54 22 2c 22 66 6f 78 6f 58 72 6e 22 2c 22 30 67 42 42 49 6d 30 22 5d 2c 22 62 65 22 3a 31 7d 2c 22 51 50 4c 49 6e 73 70 65 63 74 6f 72 22 3a 7b 22 72 22 3a 5b 22 56 76 56 46 77 38 6e 22 5d 2c 22 62 65 22 3a 31 7d 2c 22 52 65 61 63 74 44 4f 4d 22 3a 7b 22 72 22 3a 5b 22 68 33 41 39 36 52 4d 22 2c 22 56 59 58 2b 55 63 31 22 2c 22 64 74 42 48 66 4e 6e 22 2c 22 66 6f 78 6f 58 72 6e 22 2c 22 30 67 42 42 49 6d 30 22 5d 2c 22 62 65 22 3a 31 7d 2c 22 43 6f 6e 74 65 78 74 75 61 6c 4c 61 79 65 72 49 6e 6c 69 6e 65 54 61 62 4f 72 64 65 72 22 3a 7b 22 72 22 3a 5b 22 77 35 67 58 6e 54 49 22 2c 22 33 66 62 56 67 4d 42 22 2c 22 30 67 Data Ascii: ":{"r":["w5gXnTI","SJt9b58","\/Gr4CER","oE4DofT","foxoXrn","0gBBIm0"],"be":1},"QPLInspector":{"r":["VvVFw8n"],"be":1},"ReactDOM":{"r":["h3A96RM","VYX+Uc1","dtBHfNn","foxoXrn","0gBBIm0"],"be":1},"ContextualLayerInlineTabOrder":{"r":["w5gXnTI","3fbVgMB","0g
2022-04-04 01:18:56 UTC	63	IN	Data Raw: 31 7d 2c 22 52 65 61 63 74 22 3a 7b 22 72 22 3a 5b 22 68 33 41 39 36 52 4d 22 2c 22 56 59 58 2b 55 63 31 22 5d 2c 22 62 65 22 3a 31 7d 7d 7d 29 7d 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 72 65 71 75 69 72 65 4c 61 7a 79 28 5b 22 49 6e 69 74 69 61 6c 4a 53 4c 6f 61 64 65 72 22 5d 2c 20 66 75 6e 63 74 69 6f 6e 28 49 6e 69 74 69 61 6c 4a 53 4c 6f 61 64 65 72 29 20 7b 49 6e 69 74 69 61 6c 4a 53 4c 6f 61 64 65 72 2e 6c 6f 61 64 4f 6e 44 4f 4d 43 6f 6e 74 65 6e 74 52 65 61 64 79 28 5b 22 57 57 38 66 71 56 6e 22 2c 22 31 52 76 5c 2f 2b 58 7a 22 2c 22 5c 2f 47 72 34 43 45 52 22 2c 22 37 78 69 65 53 31 34 22 2c 22 77 35 67 58 6e 54 49 22 2c 22 5c 2f 41 4e 38 42 74 35 22 2c 22 53 4a 74 39 62 35 38 22 2c 22 56 4a 42 42 79 55 66 22 2c 22 69 34 75 Data Ascii: 1},"React":{"r":["h3A96RM","VYX+Uc1"],"be":1}}})});</script><script>requireLazy(["InitialJSLoader"], function(InitialJSLoader) {InitialJSLoader.loadOnDOMContentReady(["WW8fqVn","1Rv\/+Xz","\/Gr4CER","7xieS14","w5gXnTI","\/AN8Bt5","SJt9b58","VJBByUf","i4u
2022-04-04 01:18:56 UTC	64	IN	Data Raw: 69 6e 73 22 3a 5b 22 61 64 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 22 2c 22 61 64 73 2d 65 6e 63 72 79 70 74 69 6f 6e 2d 75 72 6c 2d 65 78 61 6d 70 6c 65 2e 63 6f 6d 22 2c 22 62 73 2e 73 65 72 76 69 6e 67 2d 73 79 73 2e 63 6f 6d 22 2c 22 61 64 2e 61 74 64 6d 74 2e 63 6f 6d 22 2c 22 61 64 66 6f 72 6d 2e 6e 65 74 22 2c 22 61 64 31 33 2e 61 64 66 61 72 6d 31 2e 61 64 69 74 69 6f 6e 2e 63 6f 6d 22 2c 22 69 6c 6f 76 65 6d 79 66 72 65 65 64 6f 6d 73 2e 63 6f 6d 22 2c 22 73 65 63 75 72 65 2e 61 64 6e 78 73 2e 63 6f 6d 22 5d 2c 22 69 73 5f 6d 6f 62 69 6c 65 5f 64 65 76 69 63 65 22 3a 66 61 6c 73 65 7d 2c 32 37 5d 5d 2c 22 69 6e 73 74 61 6e 63 65 73 22 3a 5b 5b 22 5f 5f 69 6e 73 74 5f 35 62 34 64 30 63 30 30 5f 30 5f 30 5f 77 72 22 2c 5b 22 4d 65 6e 75 22 Data Ascii: ins":["ad.doubleclick.net","ads-encryption-url-example.com","bs.serving-sys.com","ad.atdmt.com","adform.net","ad13.adfarm1.adition.com","ilovemyfreedoms.com","secure.adnxs.com"],"is_mobile_device":false},27]],"instances":[["__inst_5b4d0c00_0_0_wr",["Menu"
2022-04-04 01:18:56 UTC	66	IN	Data Raw: 5b 22 5f 5f 69 6e 73 74 5f 65 35 61 64 32 34 33 64 5f 30 5f 30 5f 32 7a 22 2c 5b 22 50 6f 70 6f 76 65 72 4d 65 6e 75 22 2c 22 5f 5f 69 6e 73 74 5f 31 64 65 31 34 36 64 63 5f 30 5f 31 5f 37 2b 22 2c 22 5f 5f 65 6c 65 6d 5f 65 63 37 37 61 66 62 64 5f 30 5f 31 5f 71 45 22 2c 22 5f 5f 69 6e 73 74 5f 35 62 34 64 30 63 30 30 5f 30 5f 31 5f 41 6f 22 5d 2c 5b 7b 22 5f 5f 6d 22 3a 22 5f 5f 69 6e 73 74 5f 31 64 65 31 34 36 64 63 5f 30 5f 31 5f 37 2b 22 7d 2c 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 65 63 37 37 61 66 62 64 5f 30 5f 31 5f 71 45 22 7d 2c 7b 22 5f 5f 6d 22 3a 22 5f 5f 69 6e 73 74 5f 35 62 34 64 30 63 30 30 5f 30 5f 31 5f 41 6f 22 7d 2c 5b 5d 5d 2c 32 5d 2c 5b 22 5f 5f 69 6e 73 74 5f 65 35 61 64 32 34 33 64 5f 30 5f 31 5f 41 37 22 2c 5b 22 50 6f 70 Data Ascii: ["__inst_e5ad243d_0_0_2z",["PopoverMenu","__inst_1de146dc_0_1_7+","__elem_ec77afbd_0_1_qE","__inst_5b4d0c00_0_1_Ao"],[{"__m":"__inst_1de146dc_0_1_7+"},{"__m":"__elem_ec77afbd_0_1_qE"},{"__m":"__inst_5b4d0c00_0_1_Ao"},[]],2],["__inst_e5ad243d_0_1_A7",["Pop
2022-04-04 01:18:56 UTC	67	IN	Data Raw: 65 6d 5f 31 64 65 31 34 36 64 63 5f 30 5f 31 5f 33 6f 22 7d 2c 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 65 63 37 37 61 66 62 64 5f 30 5f 31 5f 71 45 22 7d 2c 5b 7b 22 5f 5f 6d 22 3a 22 43 6f 6e 74 65 78 74 75 61 6c 4c 61 79 65 72 41 75 74 6f 46 6c 69 70 22 7d 2c 7b 22 5f 5f 6d 22 3a 22 43 6f 6e 74 65 78 74 75 61 6c 44 69 61 6c 6f 67 41 72 72 6f 77 22 7d 5d 2c 7b 22 61 6c 69 67 6e 68 22 3a 22 72 69 67 68 74 22 2c 22 70 6f 73 69 74 69 6f 6e 22 3a 22 62 65 6c 6f 77 22 7d 5d 2c 32 5d 2c 5b 22 5f 5f 69 6e 73 74 5f 30 32 31 38 32 30 31 35 5f 30 5f 30 5f 79 31 22 2c 5b 22 53 65 6c 65 63 74 61 62 6c 65 4d 65 6e 75 22 2c 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 34 5f 78 6d 22 Data Ascii: em_1de146dc_0_1_3o"},{"__m":"__elem_ec77afbd_0_1_qE"},[{"__m":"ContextualLayerAutoFlip"},{"__m":"ContextualDialogArrow"}],{"alignh":"right","position":"below"}],2],["__inst_02182015_0_0_y1",["SelectableMenu","MenuSelectableItem","__markup_3310c079_0_4_xm"
2022-04-04 01:18:56 UTC	68	IN	Data Raw: 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 64 65 5f 44 45 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 36 5f 56 78 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 44 65 75 74 73 63 68 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 65 6e Data Ascii: e":"","className":"headerItem"},{"class":"headerItem","value":"de_DE","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_6_Vx"},"label":"Deutsch","title":"","className":"headerItem"},{"class":"headerItem","value":"en
2022-04-04 01:18:56 UTC	70	IN	Data Raw: 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 64 5f 31 79 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 4d 61 67 79 61 72 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 6e 6c 5f 4e 4c 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 65 5f 68 4d 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 4e 65 64 65 72 6c 61 6e 64 73 22 Data Ascii: },"markup":{"__m":"__markup_3310c079_0_d_1y"},"label":"Magyar","title":"","className":"headerItem"},{"class":"headerItem","value":"nl_NL","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_e_hM"},"label":"Nederlands"
2022-04-04 01:18:56 UTC	71	IN	Data Raw: 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 73 76 5f 53 45 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 6c 5f 4e 46 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 53 76 65 6e 73 6b 61 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 76 69 5f 56 4e 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 Data Ascii: rItem","value":"sv_SE","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_l_NF"},"label":"Svenska","title":"","className":"headerItem"},{"class":"headerItem","value":"vi_VN","selected":false,"ctor":{"__m":"MenuSelect
2022-04-04 01:18:56 UTC	73	IN	Data Raw: 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 73 5f 45 72 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 5c 75 30 36 32 37 5c 75 30 36 34 34 5c 75 30 36 33 39 5c 75 30 36 33 31 5c 75 30 36 32 38 5c 75 30 36 34 61 5c 75 30 36 32 39 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 68 69 5f 49 4e 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 Data Ascii: ,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_s_Er"},"label":"\u0627\u0644\u0639\u0631\u0628\u064a\u0629","title":"","className":"headerItem"},{"class":"headerItem","value":"hi_IN","selected":false,"ctor":{"__m":"MenuSelectable
2022-04-04 01:18:56 UTC	74	IN	Data Raw: 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 7a 5f 74 6c 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 5c 75 64 35 35 63 5c 75 61 64 36 64 5c 75 63 35 62 34 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 5d 2c 7b 22 69 64 22 3a 22 75 5f 30 5f 65 5f 43 2b 22 2c 22 62 65 68 61 76 69 6f 72 73 22 3a 5b 7b 22 5f 5f 6d 22 3a 22 58 55 49 4d 65 6e 75 57 69 74 68 53 71 75 61 72 65 43 6f 72 6e 65 72 22 7d 5d 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 5f 35 37 64 69 22 2c 22 6d 61 78 68 65 69 67 68 74 22 3a 35 30 30 2c 22 74 68 65 6d 65 22 3a Data Ascii: ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_z_tl"},"label":"\ud55c\uad6d\uc5b4","title":"","className":"headerItem"}],{"id":"u_0_e_C+","behaviors":[{"__m":"XUIMenuWithSquareCorner"}],"className":"_57di","maxheight":500,"theme":
2022-04-04 01:18:56 UTC	75	IN	Data Raw: 67 41 72 72 6f 77 22 7d 2c 7b 22 5f 5f 6d 22 3a 22 43 6f 6e 74 65 78 74 75 61 6c 4c 61 79 65 72 50 6f 73 69 74 69 6f 6e 43 6c 61 73 73 4f 6e 43 6f 6e 74 65 78 74 22 7d 5d 2c 7b 22 61 6c 69 67 6e 68 22 3a 22 6c 65 66 74 22 2c 22 70 6f 73 69 74 69 6f 6e 22 3a 22 62 65 6c 6f 77 22 7d 5d 2c 32 5d 5d 2c 22 6d 61 72 6b 75 70 22 3a 5b 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 30 5f 73 4e 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 4b 65 79 62 6f 61 72 64 20 73 68 6f 72 74 63 75 74 20 68 65 6c 70 2e 2e 2e 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 31 5f 38 70 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 41 63 63 65 73 73 69 62 69 6c 69 74 79 20 48 65 6c 70 20 43 65 6e 74 65 72 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d Data Ascii: gArrow"},{"__m":"ContextualLayerPositionClassOnContext"}],{"alignh":"left","position":"below"}],2]],"markup":[["__markup_3310c079_0_0_sN",{"__html":"Keyboard shortcut help..."},1],["__markup_3310c079_0_1_8p",{"__html":"Accessibility Help Center"},1],["__m
2022-04-04 01:18:56 UTC	77	IN	Data Raw: 6b 20 50 72 6f 64 75 63 74 73 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 6f 32 5c 22 3e 5c 75 30 30 33 43 69 20 63 6c 61 73 73 3d 5c 22 69 6d 67 20 73 70 5f 64 48 4f 2d 55 71 4b 53 74 7a 66 20 73 78 5f 32 36 63 34 37 63 5c 22 3e 5c 75 30 30 33 43 5c 2f 69 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 6f 34 5c 22 3e 50 72 6f 76 69 64 65 20 61 20 73 61 66 65 72 20 65 78 70 65 72 69 65 6e 63 65 20 62 79 20 75 73 69 6e 67 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 77 65 20 72 65 63 65 69 76 65 20 66 72 6f 6d 20 63 6f 6f 6b 69 65 73 20 6f 6e 20 61 6e 64 20 6f 66 66 20 46 61 63 65 62 6f 6f 6b 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 Data Ascii: k Products\u003C\/div>\u003C\/div>\u003Cdiv class=\"_9xo2\">\u003Ci class=\"img sp_dHO-UqKStzf sx_26c47c\">\u003C\/i>\u003Cdiv class=\"_9xo4\">Provide a safer experience by using information we receive from cookies on and off Facebook\u003C\/div>\u003C\/d
2022-04-04 01:18:56 UTC	78	IN	Data Raw: 3d 5c 22 5f 39 6f 2d 6b 5c 22 3e 4f 70 74 69 6f 6e 61 6c 20 63 6f 6f 6b 69 65 73 5c 75 30 30 33 43 5c 2f 70 3e 5c 75 30 30 33 43 70 3e 5c 75 30 30 33 43 5c 2f 70 3e 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 70 2d 5c 22 3e 43 6f 6f 6b 69 65 73 20 66 72 6f 6d 20 6f 74 68 65 72 20 63 6f 6d 70 61 6e 69 65 73 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 6f 2d 69 5c 22 3e 57 65 20 75 73 65 20 74 6f 6f 6c 73 20 66 72 6f 6d 20 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 70 6f 6c 69 63 69 65 73 5c 2f 63 6f 6f 6b 69 65 73 5c 2f 23 6f 74 68 65 72 5f 63 Data Ascii: =\"_9o-k\">Optional cookies\u003C\/p>\u003Cp>\u003C\/p>\u003Cdiv>\u003Cdiv>\u003Cdiv class=\"_9xp-\">Cookies from other companies\u003C\/div>\u003Cdiv class=\"_9o-i\">We use tools from \u003Ca href=\"https:\/\/www.facebook.com\/policies\/cookies\/#other_c
2022-04-04 01:18:56 UTC	80	IN	Data Raw: 75 30 30 33 43 70 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 70 61 6d 20 5f 39 6f 2d 6e 20 75 69 42 6f 78 47 72 61 79 5c 22 3e 5c 75 30 30 33 43 70 20 63 6c 61 73 73 3d 5c 22 5f 39 6f 2d 6f 5c 22 3e 49 66 20 79 6f 75 20 64 6f 6e 5c 75 32 30 31 39 74 20 61 6c 6c 6f 77 20 74 68 65 73 65 20 63 6f 6f 6b 69 65 73 3a 5c 75 30 30 33 43 5c 2f 70 3e 5c 75 30 30 33 43 70 20 63 6c 61 73 73 3d 5c 22 5f 39 6f 2d 70 5c 22 3e 5c 75 30 30 33 43 75 6c 20 63 6c 61 73 73 3d 5c 22 5f 39 78 70 5f 5c 22 3e 5c 75 30 30 33 43 6c 69 20 63 6c 61 73 73 3d 5c 22 5f 39 78 71 30 5c 22 3e 57 65 20 77 6f 6e 5c 75 32 30 31 39 74 20 75 73 65 20 63 6f 6f 6b 69 65 73 20 66 72 6f 6d 20 6f 74 68 65 72 20 63 6f 6d 70 61 6e 69 65 73 20 74 6f 20 68 65 6c 70 20 70 65 72 73 6f 6e 61 Data Ascii: u003Cp>\u003Cdiv class=\"pam _9o-n uiBoxGray\">\u003Cp class=\"_9o-o\">If you don\u2019t allow these cookies:\u003C\/p>\u003Cp class=\"_9o-p\">\u003Cul class=\"_9xp_\">\u003Cli class=\"_9xq0\">We won\u2019t use cookies from other companies to help persona
2022-04-04 01:18:56 UTC	81	IN	Data Raw: 68 6f 77 20 79 6f 75 20 61 64 73 20 69 6e 20 79 6f 75 72 20 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 73 65 74 74 69 6e 67 73 5c 2f 61 64 73 5c 2f 5c 22 3e 61 64 20 73 65 74 74 69 6e 67 73 5c 75 30 30 33 43 5c 2f 61 3e 2e 5c 75 30 30 33 43 5c 2f 70 3e 5c 75 30 30 33 43 70 20 63 6c 61 73 73 3d 5c 22 5f 39 6f 2d 6d 5c 22 3e 54 68 65 20 46 61 63 65 62 6f 6f 6b 20 41 75 64 69 65 6e 63 65 20 4e 65 74 77 6f 72 6b 20 69 73 20 61 20 77 61 79 20 66 6f 72 20 61 64 76 65 72 74 69 73 65 72 73 20 74 6f 20 73 68 6f 77 20 79 6f 75 20 61 64 73 20 69 6e 20 61 70 70 73 20 61 6e 64 20 77 65 62 73 69 74 65 73 20 6f 66 66 20 74 68 65 20 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 Data Ascii: how you ads in your \u003Ca href=\"https:\/\/www.facebook.com\/settings\/ads\/\">ad settings\u003C\/a>.\u003C\/p>\u003Cp class=\"_9o-m\">The Facebook Audience Network is a way for advertisers to show you ads in apps and websites off the \u003Ca href=\"htt
2022-04-04 01:18:56 UTC	83	IN	Data Raw: 77 65 20 75 73 65 20 69 74 2c 20 61 6e 64 20 68 6f 77 20 79 6f 75 20 63 61 6e 20 6d 61 6e 61 67 65 20 69 74 2e 5c 75 30 30 33 43 5c 2f 70 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 76 74 67 5c 22 20 69 64 3d 5c 22 75 5f 30 5f 6a 5f 31 66 5c 22 3e 5c 75 30 30 33 43 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 5c 22 5f 39 6e 67 64 20 5f 39 6e 67 65 5c 22 20 74 69 74 6c 65 3d 5c 22 65 78 70 61 6e 64 61 62 6c 65 20 73 65 63 74 69 6f 6e 5c 22 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 6e 67 63 5c 22 3e 5c 75 30 30 33 43 73 70 61 6e 20 63 6c 61 73 73 3d 5c Data Ascii: we use it, and how you can manage it.\u003C\/p>\u003C\/div>\u003C\/div>\u003C\/div>\u003C\/div>\u003Cdiv>\u003Cdiv class=\"_9vtg\" id=\"u_0_j_1f\">\u003Cbutton class=\"_9ngd _9nge\" title=\"expandable section\">\u003Cdiv class=\"_9ngc\">\u003Cspan class=\
2022-04-04 01:18:56 UTC	84	IN	Data Raw: 2e 70 68 70 3f 75 3d 68 74 74 70 73 5c 75 30 30 32 35 33 41 5c 75 30 30 32 35 32 46 5c 75 30 30 32 35 32 46 77 77 77 2e 79 6f 75 72 6f 6e 6c 69 6e 65 63 68 6f 69 63 65 73 2e 63 6f 6d 5c 75 30 30 32 35 32 46 26 61 6d 70 3b 68 3d 41 54 30 76 5f 42 77 78 73 31 48 32 31 36 72 59 42 37 7a 46 53 7a 48 50 38 30 7a 5a 44 59 30 62 4e 6b 5a 76 70 63 77 69 36 73 39 6c 4e 47 53 74 48 34 42 2d 4c 49 5f 6f 6e 42 64 76 46 67 52 38 62 58 71 48 64 48 75 5f 31 54 2d 31 77 48 70 69 50 45 70 75 2d 55 36 47 67 54 37 43 75 53 63 7a 44 6d 47 61 55 31 66 75 53 65 41 44 61 4c 47 48 62 51 4f 6e 48 79 4c 64 50 50 35 2d 4c 32 73 79 6e 73 33 38 44 39 6f 64 32 48 49 41 4d 6f 48 6e 4c 59 44 49 57 41 5c 22 20 74 61 72 67 65 74 3d 5c 22 5f 62 6c 61 6e 6b 5c 22 20 72 65 6c 3d 5c 22 6e 6f Data Ascii: .php?u=https\u00253A\u00252F\u00252Fwww.youronlinechoices.com\u00252F&h=AT0v_Bwxs1H216rYB7zFSzHP80zZDY0bNkZvpcwi6s9lNGStH4B-LI_onBdvFgR8bXqHdHu_1T-1wHpiPEpu-U6GgT7CuSczDmGaU1fuSeADaLGHbQOnHyLdPP5-L2syns38D9od2HIAMoHnLYDIWA\" target=\"_blank\" rel=\"no
2022-04-04 01:18:56 UTC	86	IN	Data Raw: 6d 54 52 42 4d 4d 6d 56 4b 46 6d 59 73 76 39 4a 35 6a 31 41 7a 45 78 2d 69 59 4c 67 4d 74 6b 61 39 2d 67 43 64 4b 55 43 39 74 31 36 55 45 2d 36 72 67 5c 22 20 74 61 72 67 65 74 3d 5c 22 5f 62 6c 61 6e 6b 5c 22 20 72 65 6c 3d 5c 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 66 6f 6c 6c 6f 77 5c 22 20 64 61 74 61 2d 6c 79 6e 78 2d 6d 6f 64 65 3d 5c 22 61 73 79 6e 63 6c 61 7a 79 5c 22 3e 44 69 67 69 74 61 6c 20 41 64 76 65 72 74 69 73 69 6e 67 20 41 6c 6c 69 61 6e 63 65 20 6f 66 20 43 61 6e 61 64 61 5c 75 30 30 33 43 5c 2f 61 3e 5c 75 30 30 33 43 5c 2f 6c 69 3e 5c 75 30 30 33 43 6c 69 3e 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 6c 2e 70 68 70 3f 75 3d 68 74 74 70 73 5c 75 30 30 32 35 33 Data Ascii: mTRBMMmVKFmYsv9J5j1AzEx-iYLgMtka9-gCdKUC9t16UE-6rg\" target=\"_blank\" rel=\"noopener nofollow\" data-lynx-mode=\"asynclazy\">Digital Advertising Alliance of Canada\u003C\/a>\u003C\/li>\u003Cli>\u003Ca href=\"https:\/\/l.facebook.com\/l.php?u=https\u00253
2022-04-04 01:18:56 UTC	87	IN	Data Raw: 72 74 61 69 6e 20 70 61 72 74 73 20 6f 66 20 46 61 63 65 62 6f 6f 6b 20 50 72 6f 64 75 63 74 73 20 6d 61 79 20 6e 6f 74 20 77 6f 72 6b 20 70 72 6f 70 65 72 6c 79 20 69 66 20 79 6f 75 20 68 61 76 65 20 64 69 73 61 62 6c 65 64 20 62 72 6f 77 73 65 72 20 63 6f 6f 6b 69 65 73 2e 20 50 6c 65 61 73 65 20 62 65 20 61 77 61 72 65 20 74 68 61 74 20 74 68 65 73 65 20 63 6f 6e 74 72 6f 6c 73 20 61 72 65 20 64 69 73 74 69 6e 63 74 20 66 72 6f 6d 20 74 68 65 20 63 6f 6e 74 72 6f 6c 73 20 74 68 61 74 20 46 61 63 65 62 6f 6f 6b 20 6f 66 66 65 72 73 2e 5c 75 30 30 33 43 5c 2f 70 3e 5c 75 30 30 33 43 75 6c 20 63 6c 61 73 73 3d 5c 22 5f 39 6f 2d 71 5c 22 3e 5c 75 30 30 33 43 6c 69 3e 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 6c 2e 66 61 63 Data Ascii: rtain parts of Facebook Products may not work properly if you have disabled browser cookies. Please be aware that these controls are distinct from the controls that Facebook offers.\u003C\/p>\u003Cul class=\"_9o-q\">\u003Cli>\u003Ca href=\"https:\/\/l.fac
2022-04-04 01:18:56 UTC	89	IN	Data Raw: 64 65 3d 5c 22 61 73 79 6e 63 6c 61 7a 79 5c 22 3e 46 69 72 65 66 6f 78 5c 75 30 30 33 43 5c 2f 61 3e 5c 75 30 30 33 43 5c 2f 6c 69 3e 5c 75 30 30 33 43 6c 69 3e 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 6c 2e 70 68 70 3f 75 3d 68 74 74 70 73 5c 75 30 30 32 35 33 41 5c 75 30 30 32 35 32 46 5c 75 30 30 32 35 32 46 73 75 70 70 6f 72 74 2e 61 70 70 6c 65 2e 63 6f 6d 5c 75 30 30 32 35 32 46 65 6e 2d 69 65 5c 75 30 30 32 35 32 46 67 75 69 64 65 5c 75 30 30 32 35 32 46 73 61 66 61 72 69 5c 75 30 30 32 35 32 46 73 66 72 69 31 31 34 37 31 5c 75 30 30 32 35 32 46 6d 61 63 26 61 6d 70 3b 68 3d 41 54 30 48 6d 31 34 74 4f 56 56 46 76 59 6e 54 33 44 74 50 70 66 31 46 77 54 71 4f 51 50 4c Data Ascii: de=\"asynclazy\">Firefox\u003C\/a>\u003C\/li>\u003Cli>\u003Ca href=\"https:\/\/l.facebook.com\/l.php?u=https\u00253A\u00252F\u00252Fsupport.apple.com\u00252Fen-ie\u00252Fguide\u00252Fsafari\u00252Fsfri11471\u00252Fmac&h=AT0Hm14tOVVFvYnT3DtPpf1FwTqOQPL
2022-04-04 01:18:56 UTC	90	IN	Data Raw: 6a 79 33 20 5f 34 6a 79 31 20 73 65 6c 65 63 74 65 64 20 5f 35 31 73 79 5c 22 20 64 61 74 61 2d 63 6f 6f 6b 69 65 62 61 6e 6e 65 72 3d 5c 22 61 63 63 65 70 74 5f 6f 6e 6c 79 5f 65 73 73 65 6e 74 69 61 6c 5f 62 75 74 74 6f 6e 5c 22 20 64 61 74 61 2d 74 65 73 74 69 64 3d 5c 22 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 2d 6d 61 6e 61 67 65 2d 64 69 61 6c 6f 67 2d 61 63 63 65 70 74 2d 62 75 74 74 6f 6e 5c 22 20 74 69 74 6c 65 3d 5c 22 4f 6e 6c 79 20 61 6c 6c 6f 77 20 65 73 73 65 6e 74 69 61 6c 20 63 6f 6f 6b 69 65 73 5c 22 20 74 79 70 65 3d 5c 22 73 75 62 6d 69 74 5c 22 20 69 64 3d 5c 22 75 5f 30 5f 6c 5f 79 75 5c 22 3e 4f 6e 6c 79 20 61 6c 6c 6f 77 20 65 73 73 65 6e 74 69 61 6c 20 63 6f 6f 6b 69 65 73 5c 75 30 30 33 43 5c 2f 62 75 74 74 6f 6e 3e 5c 75 30 30 33 Data Ascii: jy3 _4jy1 selected _51sy\" data-cookiebanner=\"accept_only_essential_button\" data-testid=\"cookie-policy-manage-dialog-accept-button\" title=\"Only allow essential cookies\" type=\"submit\" id=\"u_0_l_yu\">Only allow essential cookies\u003C\/button>\u003
2022-04-04 01:18:56 UTC	92	IN	Data Raw: 30 5f 6a 5f 36 31 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 52 6f 6d 5c 75 30 30 65 32 6e 5c 75 30 31 30 33 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 6b 5f 68 54 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 53 75 6f 6d 69 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 6c 5f 4e 46 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 53 76 65 6e 73 6b 61 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 6d 5f 6a 64 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 54 69 5c 75 31 65 62 66 6e 67 20 56 69 5c 75 31 65 63 37 74 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 6e 5f 54 49 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 54 5c 75 30 30 66 63 72 Data Ascii: 0_j_61",{"__html":"Rom\u00e2n\u0103"},1],["__markup_3310c079_0_k_hT",{"__html":"Suomi"},1],["__markup_3310c079_0_l_NF",{"__html":"Svenska"},1],["__markup_3310c079_0_m_jd",{"__html":"Ti\u1ebfng Vi\u1ec7t"},1],["__markup_3310c079_0_n_TI",{"__html":"T\u00fcr
2022-04-04 01:18:56 UTC	93	IN	Data Raw: 2c 22 67 6c 6f 62 61 6c 43 6f 6e 74 61 69 6e 65 72 22 2c 32 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 61 35 38 38 66 35 30 37 5f 30 5f 32 5f 43 67 22 2c 22 63 6f 6e 74 65 6e 74 22 2c 31 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 38 33 35 63 36 33 33 61 5f 30 5f 30 5f 56 71 22 2c 22 75 5f 30 5f 61 5f 5c 2f 53 22 2c 31 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 39 66 35 66 61 63 31 35 5f 30 5f 30 5f 35 59 22 2c 22 70 61 73 73 43 6f 6e 74 61 69 6e 65 72 22 2c 31 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 35 35 38 36 30 38 66 33 5f 30 5f 30 5f 73 55 22 2c 22 70 61 73 73 22 2c 31 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 61 35 38 38 66 35 30 37 5f 30 5f 33 5f 75 72 22 2c 22 75 5f 30 5f 62 5f 72 4d 22 2c 31 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 61 35 38 38 66 35 30 37 5f 30 5f 34 5f 56 63 22 2c 22 75 5f 30 5f 63 Data Ascii: ,"globalContainer",2],["__elem_a588f507_0_2_Cg","content",1],["__elem_835c633a_0_0_Vq","u_0_a_\/S",1],["__elem_9f5fac15_0_0_5Y","passContainer",1],["__elem_558608f3_0_0_sU","pass",1],["__elem_a588f507_0_3_ur","u_0_b_rM",1],["__elem_a588f507_0_4_Vc","u_0_c
2022-04-04 01:18:56 UTC	94	IN	Data Raw: 30 5f 78 43 22 2c 22 5f 5f 65 6c 65 6d 5f 35 31 62 65 36 63 62 37 5f 30 5f 30 5f 4a 72 22 2c 22 5f 5f 69 6e 73 74 5f 35 62 34 64 30 63 30 30 5f 30 5f 30 5f 77 72 22 2c 22 5f 5f 69 6e 73 74 5f 35 62 34 64 30 63 30 30 5f 30 5f 31 5f 41 6f 22 2c 22 5f 5f 69 6e 73 74 5f 65 35 61 64 32 34 33 64 5f 30 5f 30 5f 32 7a 22 2c 22 5f 5f 69 6e 73 74 5f 65 35 61 64 32 34 33 64 5f 30 5f 31 5f 41 37 22 5d 2c 5b 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 33 66 63 33 64 61 31 38 5f 30 5f 30 5f 78 43 22 7d 2c 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 35 31 62 65 36 63 62 37 5f 30 5f 30 5f 4a 72 22 7d 2c 7b 22 5f 5f 6d 22 3a 22 5f 5f 69 6e 73 74 5f 35 62 34 64 30 63 30 30 5f 30 5f 30 5f 77 72 22 7d 2c 7b 22 5f 5f 6d 22 3a 22 5f 5f 69 6e 73 74 5f 35 62 34 64 30 63 30 30 Data Ascii: 0_xC","__elem_51be6cb7_0_0_Jr","__inst_5b4d0c00_0_0_wr","__inst_5b4d0c00_0_1_Ao","__inst_e5ad243d_0_0_2z","__inst_e5ad243d_0_1_A7"],[{"__m":"__elem_3fc3da18_0_0_xC"},{"__m":"__elem_51be6cb7_0_0_Jr"},{"__m":"__inst_5b4d0c00_0_0_wr"},{"__m":"__inst_5b4d0c00
2022-04-04 01:18:56 UTC	96	IN	Data Raw: 2c 5b 22 4c 6f 67 69 6e 46 6f 72 6d 54 6f 67 67 6c 65 22 2c 22 69 6e 69 74 54 6f 67 67 6c 65 22 2c 5b 22 5f 5f 65 6c 65 6d 5f 61 35 38 38 66 35 30 37 5f 30 5f 33 5f 75 72 22 2c 22 5f 5f 65 6c 65 6d 5f 61 35 38 38 66 35 30 37 5f 30 5f 34 5f 56 63 22 2c 22 5f 5f 65 6c 65 6d 5f 35 35 38 36 30 38 66 33 5f 30 5f 30 5f 73 55 22 2c 22 5f 5f 65 6c 65 6d 5f 39 66 35 66 61 63 31 35 5f 30 5f 30 5f 35 59 22 5d 2c 5b 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 61 35 38 38 66 35 30 37 5f 30 5f 33 5f 75 72 22 7d 2c 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 61 35 38 38 66 35 30 37 5f 30 5f 34 5f 56 63 22 7d 2c 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 35 35 38 36 30 38 66 33 5f 30 5f 30 5f 73 55 22 7d 2c 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 39 66 35 66 61 Data Ascii: ,["LoginFormToggle","initToggle",["__elem_a588f507_0_3_ur","__elem_a588f507_0_4_Vc","__elem_558608f3_0_0_sU","__elem_9f5fac15_0_0_5Y"],[{"__m":"__elem_a588f507_0_3_ur"},{"__m":"__elem_a588f507_0_4_Vc"},{"__m":"__elem_558608f3_0_0_sU"},{"__m":"__elem_9f5fa
2022-04-04 01:18:56 UTC	97	IN	Data Raw: 6e 6f 77 5f 69 6e 6c 3d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 70 3d 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 3b 72 65 74 75 72 6e 20 70 26 26 70 2e 6e 6f 77 26 26 70 2e 74 69 6d 69 6e 67 26 26 70 2e 74 69 6d 69 6e 67 2e 6e 61 76 69 67 61 74 69 6f 6e 53 74 61 72 74 3f 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 70 2e 6e 6f 77 28 29 2b 70 2e 74 69 6d 69 6e 67 2e 6e 61 76 69 67 61 74 69 6f 6e 53 74 61 72 74 7d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 7d 3b 7d 29 28 29 3b 77 69 6e 64 6f 77 2e 5f 5f 62 69 67 50 69 70 65 46 52 3d 6e 6f 77 5f 69 6e 6c 28 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 Data Ascii: now_inl=(function(){var p=window.performance;return p&&p.now&&p.timing&&p.timing.navigationStart?function(){return p.now()+p.timing.navigationStart}:function(){return new Date().getTime()};})();window.__bigPipeFR=now_inl();</script><link rel="preload" hr
2022-04-04 01:18:56 UTC	99	IN	Data Raw: 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 5a 2f 72 2f 4a 68 76 69 64 39 78 6d 73 64 54 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 6e 6f 6e 63 65 3d 22 6d 4b 6d 76 35 44 65 67 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 34 2f 6c 2f 30 2c 63 72 6f 73 73 2f 74 33 64 39 58 46 65 71 34 33 53 2e 63 73 73 3f 5f 6e 63 Data Ascii: k rel="preload" href="https://static.xx.fbcdn.net/rsrc.php/v3/yZ/r/Jhvid9xmsdT.js?_nc_x=Ij3Wp8lg5Kz" as="script" crossorigin="anonymous" nonce="mKmv5Deg" /><link rel="preload" href="https://static.xx.fbcdn.net/rsrc.php/v3/y4/l/0,cross/t3d9XFeq43S.css?_nc
2022-04-04 01:18:56 UTC	100	IN	Data Raw: 22 30 30 41 77 73 36 4b 22 2c 22 66 6f 78 6f 58 72 6e 22 2c 22 69 34 75 6c 41 71 53 22 2c 22 53 6c 33 47 67 38 79 22 2c 22 6f 48 59 2f 4b 76 67 22 2c 22 72 65 64 2b 34 4b 37 22 2c 22 44 6f 71 46 31 50 77 22 2c 22 39 4d 30 57 53 4b 32 22 2c 22 50 2f 6d 72 35 56 45 22 5d 2c 69 64 3a 22 66 69 72 73 74 5f 72 65 73 70 6f 6e 73 65 22 2c 70 68 61 73 65 3a 30 2c 6c 61 73 74 5f 69 6e 5f 70 68 61 73 65 3a 74 72 75 65 2c 74 74 69 5f 70 68 61 73 65 3a 30 2c 61 6c 6c 5f 70 68 61 73 65 73 3a 5b 36 33 5d 2c 68 73 72 70 3a 7b 68 62 6c 70 3a 7b 63 6f 6e 73 69 73 74 65 6e 63 79 3a 7b 72 65 76 3a 31 30 30 35 32 39 30 32 30 33 7d 7d 7d 2c 61 6c 6c 52 65 73 6f 75 72 63 65 73 3a 5b 22 57 57 38 66 71 56 6e 22 2c 22 31 52 76 2f 2b 58 7a 22 2c 22 2f 47 72 34 43 45 52 22 2c 22 37 Data Ascii: "00Aws6K","foxoXrn","i4ulAqS","Sl3Gg8y","oHY/Kvg","red+4K7","DoqF1Pw","9M0WSK2","P/mr5VE"],id:"first_response",phase:0,last_in_phase:true,tti_phase:0,all_phases:[63],hsrp:{hblp:{consistency:{rev:1005290203}}},allResources:["WW8fqVn","1Rv/+Xz","/Gr4CER","7
2022-04-04 01:18:56 UTC	101	IN	Data Raw: 31 32 30 34 0d 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 6d 4b 6d 76 35 44 65 67 22 3e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3d 6e 6f 77 5f 69 6e 6c 28 29 3b 72 65 71 75 69 72 65 4c 61 7a 79 28 5b 22 5f 5f 62 69 67 50 69 70 65 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 62 69 67 50 69 70 65 29 7b 62 69 67 50 69 70 65 2e 62 65 66 6f 72 65 50 61 67 65 6c 65 74 41 72 72 69 76 65 28 22 6c 61 73 74 5f 72 65 73 70 6f 6e 73 65 22 2c 6e 29 3b 7d 29 7d 29 28 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 6d 4b 6d 76 35 44 65 67 22 3e 72 65 71 75 69 72 65 4c 61 7a 79 28 5b 22 5f 5f 62 69 67 50 69 70 65 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 62 69 67 50 69 70 65 29 7b 62 69 67 50 69 70 65 2e 6f 6e 50 61 67 65 6c 65 74 41 Data Ascii: 1204<script nonce="mKmv5Deg">(function(){var n=now_inl();requireLazy(["__bigPipe"],function(bigPipe){bigPipe.beforePageletArrive("last_response",n);})})();</script><script nonce="mKmv5Deg">requireLazy(["__bigPipe"],(function(bigPipe){bigPipe.onPageletA
2022-04-04 01:18:56 UTC	102	IN	Data Raw: 30 30 76 45 32 54 67 66 4b 78 53 43 61 46 6d 4a 55 6c 74 36 71 41 36 72 30 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 30 34 31 22 2c 5b 5d 2c 7b 5f 5f 72 63 3a 5b 6e 75 6c 6c 2c 22 41 61 30 45 33 37 57 75 76 5f 6a 52 59 49 70 65 57 59 77 4d 53 4c 63 39 30 50 6e 68 51 4c 61 6b 2d 51 6f 79 67 4f 71 38 6a 43 69 66 31 4d 43 34 75 59 30 30 76 45 32 54 67 66 4b 78 53 43 61 46 6d 4a 55 6c 74 36 71 41 36 72 30 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 30 34 38 22 2c 5b 5d 2c 7b 5f 5f 72 63 3a 5b 6e 75 6c 6c 2c 22 41 61 30 45 33 37 57 75 76 5f 6a 52 59 49 70 65 57 59 77 4d 53 4c 63 39 30 50 6e 68 51 4c 61 6b 2d 51 6f 79 67 4f 71 38 6a 43 69 66 31 4d 43 34 75 59 30 30 76 45 32 54 67 66 4b 78 53 43 61 46 6d 4a 55 6c 74 36 71 41 36 72 30 22 5d 7d 2c 2d 31 5d 2c 5b 22 Data Ascii: 00vE2TgfKxSCaFmJUlt6qA6r0"]},-1],["cr:1041",[],{__rc:[null,"Aa0E37Wuv_jRYIpeWYwMSLc90PnhQLak-QoygOq8jCif1MC4uY00vE2TgfKxSCaFmJUlt6qA6r0"]},-1],["cr:1048",[],{__rc:[null,"Aa0E37Wuv_jRYIpeWYwMSLc90PnhQLak-QoygOq8jCif1MC4uY00vE2TgfKxSCaFmJUlt6qA6r0"]},-1],["
2022-04-04 01:18:56 UTC	104	IN	Data Raw: 5a 6d 5a 36 55 46 69 38 41 45 5f 45 77 4a 4c 66 57 59 37 54 46 51 4d 79 2d 56 59 65 64 45 45 4e 2d 67 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 39 37 31 34 37 33 22 2c 5b 22 4c 61 79 65 72 48 69 64 65 4f 6e 54 72 61 6e 73 69 74 69 6f 6e 22 5d 2c 7b 5f 5f 72 63 3a 5b 22 4c 61 79 65 72 48 69 64 65 4f 6e 54 72 61 6e 73 69 74 69 6f 6e 22 2c 22 41 61 31 79 70 62 63 4e 5a 35 58 44 6a 49 69 55 70 45 73 68 53 68 75 47 2d 50 6a 72 73 36 68 56 46 39 6f 4b 57 48 44 66 78 6a 76 57 47 30 63 67 49 35 67 4d 79 6f 6b 78 70 4b 43 65 6d 6f 70 55 35 36 39 72 35 6f 6b 7a 51 48 4f 69 6a 39 64 4f 2d 6e 37 66 4d 4a 5f 4c 63 35 77 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 31 30 35 31 35 34 22 2c 5b 5d 2c 7b 5f 5f 72 63 3a 5b 6e 75 6c 6c 2c 22 41 61 32 69 56 50 48 39 45 73 78 67 69 Data Ascii: ZmZ6UFi8AE_EwJLfWY7TFQMy-VYedEEN-g"]},-1],["cr:971473",["LayerHideOnTransition"],{__rc:["LayerHideOnTransition","Aa1ypbcNZ5XDjIiUpEshShuG-Pjrs6hVF9oKWHDfxjvWG0cgI5gMyokxpKCemopU569r5okzQHOij9dO-n7fMJ_Lc5w"]},-1],["cr:1105154",[],{__rc:[null,"Aa2iVPH9Esxgi
2022-04-04 01:18:56 UTC	105	IN	Data Raw: 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 32 36 38 33 22 2c 5b 22 77 61 72 6e 69 6e 67 42 6c 75 65 22 5d 2c 7b 5f 5f 72 63 3a 5b 22 77 61 72 6e 69 6e 67 42 6c 75 65 22 2c 22 41 61 30 4e 38 45 4f 52 4d 30 4f 47 51 39 74 52 75 74 31 74 46 74 32 66 33 73 37 4f 76 6d 32 32 45 39 35 49 30 48 4b 30 6f 77 44 73 4b 50 77 4d 43 4f 36 4c 32 5f 76 77 30 6b 6c 6a 39 6b 0d 0a 31 36 65 39 0d 0a 31 59 4b 78 51 35 49 46 49 59 50 68 61 50 61 39 72 44 74 64 58 36 47 68 70 6b 41 41 73 6a 22 5d 7d 2c 2d 31 5d 2c 5b 22 43 6f 72 65 57 61 72 6e 69 6e 67 47 4b 22 2c 5b 5d 2c 7b 66 6f 72 63 65 57 61 72 6e 69 6e 67 3a 66 61 6c 73 65 7d 2c 37 32 35 5d 2c 5b 22 63 72 3a 31 33 34 34 34 38 36 22 2c 5b 22 52 65 61 63 74 44 4f 4d 2e 63 6c 61 73 73 69 63 2e 70 72 6f 64 22 5d 2c 7b 5f 5f 72 63 Data Ascii: ]},-1],["cr:2683",["warningBlue"],{__rc:["warningBlue","Aa0N8EORM0OGQ9tRut1tFt2f3s7Ovm22E95I0HK0owDsKPwMCO6L2_vw0klj9k16e91YKxQ5IFIYPhaPa9rDtdX6GhpkAAsj"]},-1],["CoreWarningGK",[],{forceWarning:false},725],["cr:1344486",["ReactDOM.classic.prod"],{__rc
2022-04-04 01:18:56 UTC	107	IN	Data Raw: 65 6c 6c 65 72 7c 28 5b 5e 2f 5d 2b 2f 29 3f 64 69 61 6c 6f 67 7c 6c 65 67 61 6c 7c 2e 2b 5c 5c 2e 70 64 66 24 7c 2e 2b 2f 73 65 74 74 69 6e 67 73 2f 29 22 2c 62 61 64 52 65 71 75 65 73 74 4b 65 79 73 3a 5b 22 6e 6f 6e 63 65 22 2c 22 61 63 63 65 73 73 5f 74 6f 6b 65 6e 22 2c 22 6f 61 75 74 68 5f 74 6f 6b 65 6e 22 2c 22 78 73 22 2c 22 63 68 65 63 6b 70 6f 69 6e 74 5f 64 61 74 61 22 2c 22 63 6f 64 65 22 5d 2c 6c 6f 67 52 65 66 72 65 73 68 4f 76 65 72 68 65 61 64 3a 66 61 6c 73 65 7d 2c 36 30 5d 2c 5b 22 54 72 61 63 6b 69 6e 67 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 64 6f 6d 61 69 6e 3a 22 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 22 7d 2c 33 32 35 5d 2c 5b 22 57 65 62 44 65 76 69 63 65 50 65 72 66 49 6e 66 6f 44 61 74 61 22 Data Ascii: eller\|([^/]+/)?dialog\|legal\|.+\\.pdf$\|.+/settings/)",badRequestKeys:["nonce","access_token","oauth_token","xs","checkpoint_data","code"],logRefreshOverhead:false},60],["TrackingConfig",[],{domain:"https://pixel.facebook.com"},325],["WebDevicePerfInfoData"
2022-04-04 01:18:56 UTC	108	IN	Data Raw: 30 31 5d 2c 5b 33 30 30 30 34 2c 38 33 38 38 30 31 5d 2c 5b 33 30 30 30 35 2c 38 33 38 38 30 31 5d 2c 5b 33 30 30 30 36 2c 35 37 33 35 38 35 5d 2c 5b 33 30 30 30 37 2c 38 33 38 38 30 31 5d 2c 5b 33 30 30 30 38 2c 38 33 38 38 30 31 5d 2c 5b 33 30 30 31 32 2c 38 33 38 38 30 31 5d 2c 5b 33 30 30 31 33 2c 38 33 38 38 30 31 5d 2c 5b 33 30 30 31 35 2c 38 30 36 30 33 33 5d 2c 5b 33 30 30 31 38 2c 38 30 36 30 33 33 5d 2c 5b 33 30 30 34 30 2c 38 30 36 30 33 33 5d 2c 5b 33 30 30 39 33 2c 38 30 36 30 33 33 5d 2c 5b 33 30 30 39 34 2c 38 30 36 30 33 33 5d 2c 5b 33 30 30 39 35 2c 38 30 36 30 33 33 5d 2c 5b 33 30 31 30 31 2c 35 34 31 35 39 31 5d 2c 5b 33 30 31 30 32 2c 35 34 31 35 39 31 5d 2c 5b 33 30 31 30 33 2c 35 34 31 35 39 31 5d 2c 5b 33 30 31 30 34 2c 35 34 31 35 Data Ascii: 01],[30004,838801],[30005,838801],[30006,573585],[30007,838801],[30008,838801],[30012,838801],[30013,838801],[30015,806033],[30018,806033],[30040,806033],[30093,806033],[30094,806033],[30095,806033],[30101,541591],[30102,541591],[30103,541591],[30104,5415
2022-04-04 01:18:56 UTC	110	IN	Data Raw: 61 3a 7b 22 31 36 35 32 38 34 33 22 3a 7b 72 65 73 75 6c 74 3a 66 61 6c 73 65 2c 68 61 73 68 3a 22 41 54 36 75 68 39 4e 57 52 59 34 51 45 51 6f 59 6f 78 30 22 7d 7d 7d 2c 68 62 6c 70 3a 7b 63 6f 6e 73 69 73 74 65 6e 63 79 3a 7b 72 65 76 3a 31 30 30 35 32 39 30 32 30 33 7d 2c 72 73 72 63 4d 61 70 3a 7b 43 42 51 34 7a 55 6c 3a 7b 74 79 70 65 3a 22 6a 73 22 2c 73 72 63 3a 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 58 2f 72 2f 78 4f 4a 73 33 33 78 4a 35 46 64 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 7d 2c 52 53 66 6d 38 34 43 3a 7b 74 79 70 65 3a 22 6a 73 22 2c 73 72 63 3a 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 Data Ascii: a:{"1652843":{result:false,hash:"AT6uh9NWRY4QEQoYox0"}}},hblp:{consistency:{rev:1005290203},rsrcMap:{CBQ4zUl:{type:"js",src:"https://static.xx.fbcdn.net/rsrc.php/v3/yX/r/xOJs33xJ5Fd.js?_nc_x=Ij3Wp8lg5Kz"},RSfm84C:{type:"js",src:"https://static.xx.fbcdn.ne
2022-04-04 01:18:56 UTC	111	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.2	49839	34.120.208.123	443	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-04 01:19:31 UTC	111	OUT	POST /submit/telemetry/4d4e9ed8-d41e-47c2-af5c-0d0eb3230cdd/event/Firefox/88.0.1/release/20210504152106?v=4 HTTP/1.1 Date: Mon, 04 Apr 2022 11:57:44 GMT X-PingSender-Version: 1.0 Content-Encoding: gzip User-Agent: pingsender/1.0 Host: incoming.telemetry.mozilla.org Content-Length: 2786 Cache-Control: no-cache
2022-04-04 01:19:31 UTC	112	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a d5 59 0b 6f db 46 12 fe 2b 04 81 16 2d 60 aa 7c 4a 94 80 e2 2a 9b 8a 23 d4 4a 5c c9 4e 7a 0d 02 61 c9 5d 4a 7b e6 ab cb a5 64 d5 f0 7f bf 99 5d 8a 96 fc 68 83 b4 d7 e6 02 07 26 67 87 b3 3b ef 6f d6 77 a6 dc 55 cc 1c 99 6c c3 0a 69 9e 98 9c c2 8b 4f 7d 36 64 34 b4 a8 ef 30 cb 1f 24 ae 45 d2 20 b1 6c 6a b3 d8 73 3d 3b a1 14 78 13 c1 88 e4 65 11 11 89 22 5c db 75 2d db 87 9f 2b c7 19 05 83 91 ef f4 fc 7e f8 0b 70 6e 98 a8 81 d1 1c f9 27 26 a9 aa 8c 27 ea 43 73 74 67 12 91 ac b9 64 89 6c 04 0a b9 0d fb 56 df 87 4f e2 86 67 74 4a b5 5c c7 0e 6c df 09 e0 77 1f 96 0a 92 23 eb 2b 2e 58 5a de 1e 8a 37 c3 b0 67 f7 1c 20 51 5e 57 19 d9 bd 7b ba 02 8a d2 52 00 65 56 fe c6 b3 8c 00 09 38 65 5a 8a fc 19 ee db 2a 29 f3 71 cc f5 d1 96 7d df Data Ascii: YoF+-`\|J#J\Nza]J{d]h&g;owUliO}6d40$E ljs=;xe"\u-+~pn'&'CstgdlVOgtJ\lw#+.XZ7g Q^W{ReV8eZ)q}
2022-04-04 01:19:31 UTC	114	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 04 Apr 2022 01:19:31 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 0 Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.2	49841	34.120.208.123	443	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-04 01:19:32 UTC	115	OUT	POST /submit/telemetry/c07646ef-d9d3-4d8c-811b-81063ab65053/health/Firefox/88.0.1/release/20210504152106?v=4 HTTP/1.1 Date: Mon, 04 Apr 2022 11:57:46 GMT X-PingSender-Version: 1.0 Content-Encoding: gzip User-Agent: pingsender/1.0 Host: incoming.telemetry.mozilla.org Content-Length: 335 Cache-Control: no-cache
2022-04-04 01:19:32 UTC	115	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a 6d 50 41 6e c3 20 10 fc 0b e7 60 81 0d d8 f1 ad 52 15 29 87 e6 94 b6 52 2f d5 1a 88 8c 84 c1 c2 24 4d 1a e5 ef 5d 3b 3d b4 6a 25 b4 68 87 99 61 76 af 24 5f 46 4b 5a d2 5b f0 b9 27 2b e2 0c 76 9a d5 4a 28 7b a0 66 6d 2a 2a 4c a3 69 c3 79 87 85 a9 0a 3a 25 99 ac 90 ab 93 85 ec 62 78 84 3c 7b 94 ac 2c 29 13 78 f6 9c b7 b2 6e 05 2f 44 cd de 90 79 b2 69 42 22 69 c5 8a c0 38 7a a7 17 21 69 af 04 92 ee 5d b6 3a 1f d3 6c 72 6e 14 55 02 25 dd d1 79 b3 35 77 5f ce 24 13 5c e2 ad f0 29 c0 30 53 37 2e d9 43 3c ff b4 27 4d 53 b0 82 23 64 dc 34 7a b8 bc fc 7d 39 d9 60 62 42 e4 29 7e 3a ef 01 21 64 e6 43 4c c3 3f ec f3 a8 e3 f0 d0 b9 7b b4 77 25 e8 30 9d f4 3c 7c 0f 21 58 8f 78 b2 de c2 64 c9 0d 8d e0 e2 23 98 79 ae 38 cd f5 3b ea eb 76 b7 Data Ascii: mPAn `R)R/$M];=j%hav$_FKZ['+vJ({fm**Liy:%bx<{,)xn/DyiB"i8z!i]:lrnU%y5w_$\)0S7.C<'MS#d4z}9`bB)~:!dCL?{w%0<\|!Xxd#y8;v
2022-04-04 01:19:32 UTC	116	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 04 Apr 2022 01:19:32 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 0 Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.2	49842	34.120.208.123	443	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-04 01:19:32 UTC	116	OUT	POST /submit/telemetry/02261d48-0564-4e3d-9859-ba76e838e396/main/Firefox/88.0.1/release/20210504152106?v=4 HTTP/1.1 Date: Mon, 04 Apr 2022 11:57:47 GMT X-PingSender-Version: 1.0 Content-Encoding: gzip User-Agent: pingsender/1.0 Host: incoming.telemetry.mozilla.org Content-Length: 11010 Cache-Control: no-cache
2022-04-04 01:19:32 UTC	117	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a dd 7d 8b 6e e3 38 b2 e8 af 18 1e ec c5 39 40 2b 23 51 ef 06 0e ee 71 6c 25 f1 6d bf c6 76 3a d3 b3 58 08 b2 45 27 3a b1 25 8f 24 27 9d 19 f4 bf df 2a 92 92 25 5b 7e e6 d1 7b ef a2 77 92 50 14 ab 58 55 ac 17 8b d4 df f5 f4 65 49 eb 9f eb 0b 2f 08 eb 9f ea 81 0f bf cb 84 18 8a af 59 92 ac 1b 9a a4 51 d5 97 6c 4b b7 a5 89 67 1a d4 52 2d aa da 06 f4 9d c6 d4 4b 83 28 6c 79 29 8e 40 e0 35 49 d6 e0 df 58 51 3e eb e6 67 8d 5c e8 8a fe 07 f4 7c a2 71 02 1d eb 9f b5 4f 75 6f b9 9c 07 53 f6 62 fd f3 df 75 2f 9e 3e 04 29 9d a6 ab 18 07 f9 6e 19 92 a1 c1 2b 93 55 30 f7 db 3e 1f 57 91 75 59 53 74 f8 89 70 43 6f 81 5d af 82 98 ce a2 ef c5 e1 eb 96 75 21 5f 28 d0 e4 07 c9 72 ee bd 7c dd 7e f2 44 43 3f 8a a1 a5 1b fd 15 cc e7 1e 34 41 cf 74 Data Ascii: }n89@+#Qql%mv:XE':%$'*%[~{wPXUeI/YQlKgR-K(ly)@5IXQ>g\\|qOuoSbu/>)n+U0>WuYStpCo]u!_(r\|~DC?4At
2022-04-04 01:19:32 UTC	127	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 04 Apr 2022 01:19:32 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 0 Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS Access-Control-Max-Age: 1728000 Access-Control-Allow-Headers: Accept-Encoding,Connection,Content-Encoding,Content-Length,Content-Type,DNT,Date,Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,User-Agent,X-Client-Type,X-Client-Version,X-Debug-ID,X-Forwarded-For,X-Pingsender-Version,X-Pipeline-Proxy,X-Source-Tags,X-Telemetry-Agent Via: 1.1 google Alt-Svc: clear Connection: close

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Refund Details.exePID: 2024, Parent PID: 6368

General

Target ID:	0
Start time:	03:17:21
Start date:	04/04/2022
Path:	C:\Users\user\Desktop\Refund Details.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Refund Details.exe"
Imagebase:	0xa50000
File size:	201728 bytes
MD5 hash:	4F3781678B0516506DA4919AE93A7968
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Codoso_Gh0st_1, Description: Detects Codoso APT Gh0st Malware, Source: 00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, Author: Florian Roth Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Codoso_Gh0st_1, Description: Detects Codoso APT Gh0st Malware, Source: 00000000.00000000.1533482048.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, Author: Florian Roth Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 00000000.00000000.1533482048.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000000.00000000.1533482048.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.1533482048.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: firefox.exePID: 6308, Parent PID: 3840

General

Target ID:	2
Start time:	03:17:37
Start date:	04/04/2022
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe"
Imagebase:	0x7ff793fe0000
File size:	596464 bytes
MD5 hash:	F7A3347AC587E97C57CFAC49A17BD309
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: firefox.exePID: 2492, Parent PID: 6308

General

Target ID:	4
Start time:	03:17:42
Start date:	04/04/2022
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Mozilla Firefox\firefox.exe
Imagebase:	0x7ff793fe0000
File size:	596464 bytes
MD5 hash:	F7A3347AC587E97C57CFAC49A17BD309
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: firefox.exePID: 5536, Parent PID: 2492

General

Target ID:	5
Start time:	03:17:47
Start date:	04/04/2022
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.0.488927132\823982072" -childID 1 -isForBrowser -prefsHandle 2672 -prefMapHandle 2680 -prefsLen 1 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 2560 tab
Imagebase:	0x7ff793fe0000
File size:	596464 bytes
MD5 hash:	F7A3347AC587E97C57CFAC49A17BD309
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: firefox.exePID: 1396, Parent PID: 2492

General

Target ID:	6
Start time:	03:17:48
Start date:	04/04/2022
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.6.1666811742\456711594" -childID 2 -isForBrowser -prefsHandle 3076 -prefMapHandle 3068 -prefsLen 1 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 3088 tab
Imagebase:	0x7ff7add60000
File size:	596464 bytes
MD5 hash:	F7A3347AC587E97C57CFAC49A17BD309
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: firefox.exePID: 3596, Parent PID: 2492

General

Target ID:	7
Start time:	03:17:54
Start date:	04/04/2022
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.12.1229122738\1823760468" -parentBuildID 20210504152106 -prefsHandle 3792 -prefMapHandle 3788 -prefsLen 160 -prefMapSize 235609 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 1032 rdd
Imagebase:	0x7ff793fe0000
File size:	596464 bytes
MD5 hash:	F7A3347AC587E97C57CFAC49A17BD309
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: firefox.exePID: 4244, Parent PID: 2492

General

Target ID:	8
Start time:	03:17:54
Start date:	04/04/2022
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.13.2039529717\595573382" -childID 3 -isForBrowser -prefsHandle 4132 -prefMapHandle 4128 -prefsLen 160 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 4368 tab
Imagebase:	0x7ff793fe0000
File size:	596464 bytes
MD5 hash:	F7A3347AC587E97C57CFAC49A17BD309
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: firefox.exePID: 4816, Parent PID: 2492

General

Target ID:	13
Start time:	03:18:03
Start date:	04/04/2022
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.17.2031288100\1490268157" -childID 4 -isForBrowser -prefsHandle 4504 -prefMapHandle 4500 -prefsLen 5258 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 4420 tab
Imagebase:	0x7ff793fe0000
File size:	596464 bytes
MD5 hash:	F7A3347AC587E97C57CFAC49A17BD309
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: firefox.exePID: 6688, Parent PID: 2492

General

Target ID:	16
Start time:	03:18:14
Start date:	04/04/2022
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.28.1606140724\1125369852" -childID 5 -isForBrowser -prefsHandle 4960 -prefMapHandle 5176 -prefsLen 5436 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 4664 tab
Imagebase:	0x7ff793fe0000
File size:	596464 bytes
MD5 hash:	F7A3347AC587E97C57CFAC49A17BD309
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: firefox.exePID: 5908, Parent PID: 2492

General

Target ID:	19
Start time:	03:18:39
Start date:	04/04/2022
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.34.1568289426\1261120468" -childID 6 -isForBrowser -prefsHandle 5712 -prefMapHandle 4972 -prefsLen 6561 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 5780 tab
Imagebase:	0x7ff793fe0000
File size:	596464 bytes
MD5 hash:	F7A3347AC587E97C57CFAC49A17BD309
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: firefox.exePID: 4016, Parent PID: 2492

General

Target ID:	21
Start time:	03:18:57
Start date:	04/04/2022
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.40.1897084510\906370204" -childID 7 -isForBrowser -prefsHandle 7248 -prefMapHandle 7244 -prefsLen 6742 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 7252 tab
Imagebase:	0x7ff793fe0000
File size:	596464 bytes
MD5 hash:	F7A3347AC587E97C57CFAC49A17BD309
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: pingsender.exePID: 6308, Parent PID: 2492

General

Target ID:	24
Start time:	03:19:28
Start date:	04/04/2022
Path:	C:\Program Files\Mozilla Firefox\pingsender.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\pingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/4d4e9ed8-d41e-47c2-af5c-0d0eb3230cdd/event/Firefox/88.0.1/release/20210504152106?v=4 C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\4d4e9ed8-d41e-47c2-af5c-0d0eb3230cdd https://incoming.telemetry.mozilla.org/submit/telemetry/c07646ef-d9d3-4d8c-811b-81063ab65053/health/Firefox/88.0.1/release/20210504152106?v=4 C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\c07646ef-d9d3-4d8c-811b-81063ab65053 https://incoming.telemetry.mozilla.org/submit/telemetry/02261d48-0564-4e3d-9859-ba76e838e396/main/Firefox/88.0.1/release/20210504152106?v=4 C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\02261d48-0564-4e3d-9859-ba76e838e396
Imagebase:	0x7ff6754f0000
File size:	75248 bytes
MD5 hash:	07CDCC91CA168BB8992BB86A8BC69FFB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5348, Parent PID: 6308

General

Target ID:	25
Start time:	03:19:28
Start date:	04/04/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff663be0000
File size:	885760 bytes
MD5 hash:	C5E9B1D1103EDCEA2E408E9497A5A88F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: Refund Details.exePID: 2024, Parent PID: 6368COMMON

Executed Functions

Function 00007FFA2F2104AF Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1545918190.00007FFA2F210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFA2F210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffa2f210000_Refund Details.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa8ee4f7721f1674b9e443d1955ce8d8e21d1e064b3f8ee04e7c1a5171583a4e
Instruction ID: 211f12d925f8d80c301f8112b221e429667446e6a9b1ed3154d05c1772d5ae23
Opcode Fuzzy Hash: aa8ee4f7721f1674b9e443d1955ce8d8e21d1e064b3f8ee04e7c1a5171583a4e
Instruction Fuzzy Hash: F4418030658A49DFD384EB6CC8A56AA3BB1FB96305F808065E04DD72DBDF786805C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA2F210A3B Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1545918190.00007FFA2F210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFA2F210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffa2f210000_Refund Details.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5acd5c3e0899999f652ce77bf2159957a244f85af780161a0e384fbdb4af258e
Instruction ID: ee891e0c84bec53585f7776f5838d2252f696ae3a16195fd125dac1e3645155e
Opcode Fuzzy Hash: 5acd5c3e0899999f652ce77bf2159957a244f85af780161a0e384fbdb4af258e
Instruction Fuzzy Hash: 2A316B32B4C5064FEB58F7789C922AA7291EF97759F008239E14EE22C3DE6964168385

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00A621AA Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1544150906.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1544404583.0000000000A84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_Refund Details.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6788c499b7e13f1557d2454285ac47a9e75e08a76e020fe23b11ca8ae0040f98
Instruction ID: e5ad924a87d80d9ab88101526169938b178a88f1ee74f2319729e7df0cac404e
Opcode Fuzzy Hash: 6788c499b7e13f1557d2454285ac47a9e75e08a76e020fe23b11ca8ae0040f98
Instruction Fuzzy Hash: B821B4B3F006049FE315DFB4DC92BEC3BB4AB48728F188526FF05A7645E6309A858B54

Uniqueness

Uniqueness Score: -1.00%

Function 00A64463 Relevance: .1, Instructions: 63
COMMONCrypto

Download Yara Rule

C-Code - Quality: 74%

			E00A64463(signed int __edx, void* __esp, signed int* __rax, void* __rcx, void* __rdx) {
				void* _t13;
				void* _t26;
				signed int _t33;
				signed int _t34;
				signed int _t42;
				signed int _t47;
				signed int* _t60;
				signed long long _t63;
				signed char* _t65;
				void* _t67;

				_t60 = __rax;
				_t33 = __edx;
				asm("cdq");
				_push(_t65);
				_push(_t63);
				_t42 =  *(_t67 + 8);
				_t47 =  ~(__rdx + __rax >> 2);
				if((__edx & 0x00000003) != 0) {
					do {
						asm("rol eax, 0xf");
						asm("rol eax, 0xd");
						_t42 = ( *(_t65 + _t63 * 4) * 0xcc9e2d51 * 0x1b873593 ^ _t42) * 5 - 0x19ab949c;
						_t47 = _t47 + 1;
					} while (_t47 != 0);
				}
				_t34 = 0;
				_t13 = (_t33 & 0x00000003) - 1;
				if(_t13 == 0) {
					L7:
					asm("rol eax, 0xf");
					_t42 = _t42 ^ ( *_t65 & 0x000000ff ^ _t34) * 0xcc9e2d51 * 0x1b873593;
				} else {
					_t26 = _t13 - 1;
					if(_t26 == 0) {
						L6:
						_t34 = _t34 ^ (_t65[1] & 0x000000ff) << 0x00000008;
						goto L7;
					} else {
						if(_t26 == 1) {
							_t34 = (_t65[2] & 0x000000ff) << 0x10;
							goto L6;
						}
					}
				}
				 *_t60 = (((_t42 ^ _t33) >> 0x00000010 ^ _t42 ^ _t33) * 0x85ebca6b >> 0x0000000d ^ ((_t42 ^ _t33) >> 0x00000010 ^ _t42 ^ _t33) * 0x85ebca6b) * 0xc2b2ae35 >> 0x00000010 ^ (((_t42 ^ _t33) >> 0x00000010 ^ _t42 ^ _t33) * 0x85ebca6b >> 0x0000000d ^ ((_t42 ^ _t33) >> 0x00000010 ^ _t42 ^ _t33) * 0x85ebca6b) * 0xc2b2ae35;
				return  *((intOrPtr*)(_t67 + 0xc));
			}

0x00a64463
0x00a64467
0x00a6446b
0x00a6446f
0x00a64470
0x00a64474
0x00a6447d
0x00a6447f
0x00a64481
0x00a64488
0x00a64493
0x00a64499
0x00a6449f
0x00a6449f
0x00a64481
0x00a644a6
0x00a644ab
0x00a644ae
0x00a644ca
0x00a644d5
0x00a644de
0x00a644b0
0x00a644b0
0x00a644b3
0x00a644c1
0x00a644c8
0x00000000
0x00a644b5
0x00a644b8
0x00a644be
0x00000000
0x00a644be
0x00a644b8
0x00a644b3
0x00a64509
0x00a6450c

Memory Dump Source

Source File: 00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1544150906.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1544404583.0000000000A84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_Refund Details.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9a03c5baf9720a6e7d8e5d675cdaadf48f2bf7d7bc5066cbb6e6d82dfa4c0b
Instruction ID: dbbb5c77f8ece8b2bac9199191e0c1dfc01b12f418b8f4e578a6899d461476e2
Opcode Fuzzy Hash: ee9a03c5baf9720a6e7d8e5d675cdaadf48f2bf7d7bc5066cbb6e6d82dfa4c0b
Instruction Fuzzy Hash: 391148333141100F971D893D9E5B06ABE9AD3CC65078CC63ADAABCB695E834D7468680

Uniqueness

Uniqueness Score: -1.00%

Function 00A5B240 Relevance: 14.0, Strings: 11, Instructions: 264COMMON

Download Yara Rule

Strings

pKA, xrefs: 00A5B3E8
KA, xrefs: 00A5B5F1
KA, xrefs: 00A5B598
KA, xrefs: 00A5B650
$KA, xrefs: 00A5B3A8
HKA, xrefs: 00A5B3B2
dKA, xrefs: 00A5B543
TKA, xrefs: 00A5B4EC
8KA, xrefs: 00A5B3BC
KA, xrefs: 00A5B662
KA, xrefs: 00A5B3F2

Memory Dump Source

Source File: 00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1544150906.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1544404583.0000000000A84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_Refund Details.jbxd

Yara matches

Similarity

API ID:
String ID: KA$$KA$8KA$HKA$TKA$dKA$pKA$KA$KA$KA$KA
API String ID: 0-1692419818
Opcode ID: f9df788c5c1d5ccd48a44d1dc040f83cf39532b36f7e28dc96b56ae9d8d1ed27
Instruction ID: 3687a7fd1119c202f5ca07f7b2cad819b39159b21488dcf3eb075d5bb4d51ed0
Opcode Fuzzy Hash: f9df788c5c1d5ccd48a44d1dc040f83cf39532b36f7e28dc96b56ae9d8d1ed27
Instruction Fuzzy Hash: AA810736A28110C3D72C5768A5687F86172F391783F258137DE4337EA5DB389D8C92BA

Uniqueness

Uniqueness Score: -1.00%

Function 00A6B4D1 Relevance: 11.5, Strings: 9, Instructions: 248COMMON

Download Yara Rule

Strings

2, xrefs: 00A6B546
l, xrefs: 00A6B526
.dll, xrefs: 00A6B511
1, xrefs: 00A6B540
l.dl, xrefs: 00A6B51F
userlll.dl, xrefs: 00A6B554, 00A6B557
ntdll, xrefs: 00A6B54E, 00A6B551
kern, xrefs: 00A6B50D, 00A6B510
el32, xrefs: 00A6B500

Memory Dump Source

Source File: 00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1544150906.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1544404583.0000000000A84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_Refund Details.jbxd

Yara matches

Similarity

API ID:
String ID: .dll$1$2$el32$kern$l$l.dl$ntdll$userlll.dl
API String ID: 0-3839465228
Opcode ID: d273159145775cbf99d807b09e3f9e0c2e71cc428fd30a0d8cec744a2f70898a
Instruction ID: 5c7c0ca066fcba50d6eb91b76371b4a63bdbd91a7a072f9c49be06d8caffca72
Opcode Fuzzy Hash: d273159145775cbf99d807b09e3f9e0c2e71cc428fd30a0d8cec744a2f70898a
Instruction Fuzzy Hash: 28810AB3F50600AEF310DFF0DD45FAC3BB5A704758F284015EF15AAA89EB709A498B55

Uniqueness

Uniqueness Score: -1.00%

Function 00A60C65 Relevance: 11.5, Strings: 9, Instructions: 235
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00A60C65(signed int __ecx, void* __edx, void* __esp, void* __eflags, void* __rax, void* __rdx, void* __r9, void* __r11, void* __r13, void* __r14) {
				void* _t53;
				void* _t54;
				intOrPtr _t59;
				intOrPtr _t60;
				void* _t106;
				intOrPtr _t173;
				void* _t185;
				void* _t187;
				void* _t189;
				void* _t190;
				void* _t191;
				void* _t193;
				void* _t195;

				_t200 = __r14;
				_t199 = __r13;
				_t198 = __r11;
				_t197 = __r9;
				_t188 = __rdx;
				_t184 = __rax;
				_t164 = __edx;
				 *0xe74dfc(__rax, _t191, _t193, _t185);
				_push(6);
				_pop(_t187);
				memcpy(0x54e020, _t195 - 0x28, __ecx << 2);
				_t179 = __esp - 0x28 + 0xc;
				 *0xe74e17(__rax);
				 *0xe74e17(_t193);
				_t168 =  *((intOrPtr*)(_t195 + 8));
				_t114 =  *((intOrPtr*)(_t195 + 0xc));
				 *0xfaed2b =  *((intOrPtr*)(_t195 + 8));
				 *0xfaed29 = 0x54d000;
				 *0xfaed2b =  *((intOrPtr*)(_t195 + 0xc));
				_t53 = E00A6068A(__edx, 0x54e020, __esp - 0x28 + 0xc, __eflags, __rax, _t187, __rdx);
				_t181 = _t53;
				if(_t53 == 0) {
					_t54 = E00A61D88(_t179, __rax, _t187);
					__eflags = _t54 - 6;
					if(_t54 < 6) {
						L14:
						E00A573FC(_t195 - 0x20, _t179);
						E00A57796(_t114, _t168, _t179, _t184, _t187, _t188, _t197, _t198, _t199, _t200);
						E00A573D9(_t195 - 0x20);
						 *0xe750e5(_t193, _t184, 2, 0x54e07c, 0x54e080);
						_t59 = 0;
						__eflags = 0;
					} else {
						_t60 = E00A61D39(_t179, __rax, _t187);
						__eflags = _t60;
						if(_t60 != 0) {
							goto L14;
						} else {
							__eflags = E00A62467(0, _t179, __rax) - 1;
							if(__eflags == 0) {
								_push(8);
								_pop(_t189);
								E00A55D12(_t195 + 8, __edx, _t179, __eflags, __rax, _t189);
								_push(__rax);
								E00A55CA2(0x54e07c, _t179, __rax);
								E00A58710(_t187);
								_push(8);
								_pop(_t190);
								E00A55D12(_t195 + 8, __edx, _t179, __eflags, __rax, _t190);
								E00A55CA2(0x54e080, _t179, __rax);
								E00A58710(_t187);
								_t173 = 0;
								 *0xe74ecc(0x80000002, 0x416778, _t193, _t193, _t193, 0xf013f, _t193, __rax, __rax, __rax);
								 *((intOrPtr*)(_t195 - 0xc)) = 0;
								 *0xe74ee3( *((long long*)(_t195 - 8)),  *0xfaeefe, _t193, 4, __rax, 4);
								 *0xe74ed4( *((long long*)(_t195 - 8)));
								_push(_t185);
								_push(0x54e07c);
								__eflags = E00A5FC83( *((intOrPtr*)(_t195 + 8)), _t179, __rax, __r13);
								if(__eflags != 0) {
									E00A55E50(_t195 + 8, _t179, __eflags, __rax);
									E00A63EC6( *((intOrPtr*)(_t195 + 0xc)), __edx, _t179, __rax, _t187, _t190);
									E00A58710(_t187);
									E00A55E50(_t195 + 0xc, _t179, __eflags, __rax);
									E00A63EC6( *((intOrPtr*)(_t195 + 0xc)), _t164, _t179, __rax, _t187, _t190);
									E00A58710(_t187);
									E00A547B6(0x54e038, _t179, __rax);
									 *0xe750b5(_t191, 0x40e2e7, _t191, __rax, 0x416768, _t185, __rax, 0x41675c, 0x54e07c);
									_t59 = 0;
								} else {
									_push(_t185);
									_push(0x54e07c);
									_push(9);
									E00A573FC(_t195 - 0x20, _t179);
									_push(__rax);
									E00A57796(0x54e080, _t168, _t179, __rax, _t187, _t190, __r9, __r11, __r13, __r14);
									E00A573D9(_t195 - 0x20);
									goto L12;
								}
							} else {
								_push(0x54e080);
								_push(0x54e07c);
								_push(1);
								E00A573FC(_t195 - 0x20, _t179);
								_push(__rax);
								E00A57796(_t114, _t168, _t179, __rax, _t187, __rdx, __r9, __r11, __r13, __r14);
								E00A573D9(_t195 - 0x20);
								_t173 = 0;
								goto L12;
							}
						}
					}
				} else {
					_push(0x41675c);
					E00A55E50(_t195 + 8, _t179, _t181, __rax);
					_push(__rax);
					_push(__rax);
					E00A63EF9(__edx, _t179, __rax, _t187, __rdx);
					_push(__rax);
					E00A55CA2(0x54e07c, _t179, __rax);
					E00A58710(_t187);
					 *((intOrPtr*)(_t195 + 0xc)) = 0;
					E00A58710(_t187);
					_push(0x416768);
					E00A55E50(_t195 + 8, _t179, _t181, __rax);
					_push(__rax);
					_push(__rax);
					E00A63EF9(__edx, _t179, __rax, _t187, __rdx);
					_push(__rax);
					E00A55CA2(0x54e080, _t179, __rax);
					E00A58710(_t187);
					 *((intOrPtr*)(_t195 + 0xc)) = 0;
					E00A58710(_t187);
					if(E00A55ACC(_t187) != 0) {
						L4:
						_push(_t185);
						_push(0x54e07c);
						_push(8);
						E00A573FC(_t195 - 0x20, _t179);
						_push(_t184);
						E00A57796(0x54e080, _t168, _t179, _t184, _t187, _t188, _t197, _t198, _t199, _t200);
						E00A573D9(_t195 - 0x20);
					} else {
						_t106 = E00A55ACC(_t187);
						_t183 = _t106;
						if(_t106 != 0) {
							goto L4;
						} else {
							_push(_t185);
							E00A55E50(_t195 + 8, _t179, _t183, __rax);
							_push(__rax);
							_push(_t185);
							E00A55E50(_t195 + 0xc, _t179, _t183, __rax);
							_push(__rax);
							_push(8);
							E00A573FC(_t195 - 0x20, _t179);
							_push(__rax);
							E00A57796(0x414648, _t168, _t179, __rax, _t187, __rdx, __r9, __r11, __r13, __r14);
							E00A573D9(_t195 - 0x20);
							E00A58710(_t187);
							 *((intOrPtr*)(_t195 + 0xc)) = 0;
							E00A58710(_t187);
						}
					}
					_t173 = 0;
					L12:
					 *0xe7504f(_t191);
					_t59 = _t173;
				}
				return _t59;
			}

0x00a60c65
0x00a60c65
0x00a60c65
0x00a60c65
0x00a60c65
0x00a60c65
0x00a60c65
0x00a60c72
0x00a60c78
0x00a60c7a
0x00a60c86
0x00a60c86
0x00a60c89
0x00a60c95
0x00a60c9b
0x00a60c9e
0x00a60ca1
0x00a60ca7
0x00a60cb1
0x00a60cb7
0x00a60cbc
0x00a60cbe
0x00a60dbf
0x00a60dc4
0x00a60dc7
0x00a60f3a
0x00a60f49
0x00a60f51
0x00a60f59
0x00a60f5f
0x00a60f65
0x00a60f65
0x00a60dcd
0x00a60dcd
0x00a60dd2
0x00a60dd4
0x00000000
0x00a60dda
0x00a60ddf
0x00a60de2
0x00a60e0f
0x00a60e11
0x00a60e15
0x00a60e1a
0x00a60e20
0x00a60e28
0x00a60e2d
0x00a60e2f
0x00a60e33
0x00a60e40
0x00a60e48
0x00a60e50
0x00a60e6a
0x00a60e75
0x00a60e85
0x00a60e8e
0x00a60e94
0x00a60e95
0x00a60e9f
0x00a60ea1
0x00a60ee3
0x00a60eee
0x00a60ef6
0x00a60f04
0x00a60f0c
0x00a60f14
0x00a60f29
0x00a60f2f
0x00a60f35
0x00a60ea3
0x00a60ea3
0x00a60ea4
0x00a60ea9
0x00a60eae
0x00a60eb3
0x00a60eb6
0x00a60ebe
0x00000000
0x00a60ebe
0x00a60de4
0x00a60de4
0x00a60de9
0x00a60dee
0x00a60df3
0x00a60df8
0x00a60dfb
0x00a60e03
0x00a60e08
0x00000000
0x00a60e08
0x00a60de2
0x00a60dd4
0x00a60cc4
0x00a60cc4
0x00a60ccc
0x00a60cd1
0x00a60cd7
0x00a60cd8
0x00a60cdd
0x00a60ce3
0x00a60ceb
0x00a60cf5
0x00a60cf8
0x00a60cfd
0x00a60d05
0x00a60d0a
0x00a60d10
0x00a60d11
0x00a60d1b
0x00a60d1e
0x00a60d26
0x00a60d2e
0x00a60d31
0x00a60d42
0x00a60d97
0x00a60d97
0x00a60d98
0x00a60d9d
0x00a60da2
0x00a60da7
0x00a60daa
0x00a60db2
0x00a60d44
0x00a60d46
0x00a60d4b
0x00a60d4d
0x00000000
0x00a60d4f
0x00a60d57
0x00a60d58
0x00a60d5d
0x00a60d5e
0x00a60d62
0x00a60d67
0x00a60d68
0x00a60d6d
0x00a60d72
0x00a60d75
0x00a60d7d
0x00a60d85
0x00a60d8d
0x00a60d90
0x00a60d90
0x00a60d4d
0x00a60db7
0x00a60ec3
0x00a60ec9
0x00a60ecf
0x00a60ecf
0x00a60f6b

Strings

HFA, xrefs: 00A60D4F
T, xrefs: 00A60C7E
T, xrefs: 00A60C8F
|T, xrefs: 00A60D36
|T, xrefs: 00A60CDE
8T, xrefs: 00A60F1E
|T, xrefs: 00A60E1B
T, xrefs: 00A60EC3
T, xrefs: 00A60F19

Memory Dump Source

Source File: 00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1544150906.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1544404583.0000000000A84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_Refund Details.jbxd

Yara matches

Similarity

API ID:
String ID: T$ T$ T$ T$8T$HFA$|T$|T$|T
API String ID: 0-449739334
Opcode ID: 6b4f76d34bbfbde380a7d1a0836aeab91cfa023e8c418480bdde2516ce3b6f59
Instruction ID: 8db74210580e6f603f7b45f58e7dc85910f957761d9448f48019abb0115634e9
Opcode Fuzzy Hash: 6b4f76d34bbfbde380a7d1a0836aeab91cfa023e8c418480bdde2516ce3b6f59
Instruction Fuzzy Hash: CB81C072640200AEE714FB70DD96FEE3B71FB08759F044424FE1A6A696EF74AA49C740

Uniqueness

Uniqueness Score: -1.00%

Function 00A60F6E Relevance: 11.4, Strings: 9, Instructions: 121
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00A60F6E(void* __edx, intOrPtr __edi, void* __esp, intOrPtr* __rax, void* __rcx, void* __rdx) {
				void* _t12;
				void* _t20;
				intOrPtr _t40;
				void* _t64;
				void* _t74;
				intOrPtr* _t79;
				void* _t80;
				void* _t83;
				void* _t84;
				void* _t85;
				void* _t88;
				void* _t90;

				_t84 = __rdx;
				_t79 = __rax;
				_t76 = __esp;
				_t64 = __edx;
				 *0xe75105(0x54e020, _t85, _t88, _t80, __rcx, __rcx);
				_push(5);
				_pop(_t86);
				asm("xorps xmm0, xmm0");
				 *0xfaeffd = __edi;
				 *0xfaeffd = __edi;
				_push(0x18);
				_pop(_t83);
				asm("movups [0x54e038], xmm0");
				 *0xfaefed = 0;
				asm("movups [0x54e050], xmm0");
				 *0xfaf012 = 0;
				 *0xfaf024 = 0;
				_t12 = E00A587BE(__rax, _t83);
				_t77 = _t12;
				if(_t12 == 0) {
					_t40 = 0;
				} else {
					 *__rax = __edi;
					_t1 = _t79 + 4; // 0x4
					_t40 = _t1;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
				}
				 *0xfaf03d = _t40;
				_push(0x416674);
				 *0xfaf065 = 0;
				 *0xfaf06f = 0;
				E00A55B6A(0x54e048, _t64, _t76, _t79, _t83, _t84);
				E00A55B6A(0x54e054, _t64, _t76, _t79, _t83, _t84);
				_push(0x4166ac);
				_t65 = E00A55E50(_t90 - 8, _t76, _t77, _t79);
				E00A55A3F(_t90 - 4, _t15, _t76, _t77, _t79);
				_push(_t79);
				E00A55CA2(0x54e060, _t76, _t79);
				E00A58710(_t83);
				 *((intOrPtr*)(_t90 - 4)) = 0;
				E00A58710(_t83);
				_t20 = E00A624C3(_t76, _t83);
				_t78 = _t20 - 1;
				if(_t20 != 1) {
					_t66 = 0x54e054;
					E00A55A3F(_t90 - 8, 0x54e054, _t76, __eflags, _t79);
					_t74 = 0x54e058;
					_push(_t79);
					E00A55CA2(0x54e058, _t76, _t79);
					E00A58710(_t83);
				} else {
					_push(0x4166d0);
					E00A55B6A(0x54e054, _t65, _t76, _t79, _t83, _t84);
					_t66 = 0x54e054;
					E00A55A3F(_t90 - 8, 0x54e054, _t76, _t78, _t79);
					_t74 = 0x54e058;
					_push(_t79);
					E00A55CA2(0x54e058, _t76, _t79);
					E00A58710(_t83);
					_push(_t86);
					E00A55B6A(0x54e054, 0x54e054, _t76, _t79, _t83, _t84);
				}
				_push(_t86);
				E00A55CD5(_t74, _t66, _t76, _t78, _t79, _t83, _t84);
				_push(_t86);
				E00A55CD5(0x54e054, _t66, _t76, _t78, _t79, _t83, _t84);
				_push(0x416710);
				E00A55CD5(0x54e060, _t66, _t76, _t78, _t79, _t83, _t84);
				E00A61F8A(_t83);
				_push(_t88);
				E00A55CA2(0x54e05c, _t76, _t79);
				_push(0x416728);
				E00A55CD5(0x54e05c, _t66, _t76, _t78, _t79, _t83, _t84);
				_push(_t86);
				E00A55CD5(_t74, _t66, _t76, _t78, _t79, _t83, _t84);
				_push(_t86);
				E00A55CD5(0x54e054, _t66, _t76, _t78, _t79, _t83, _t84);
				return 0x54e020;
			}

0x00a60f6e
0x00a60f6e
0x00a60f6e
0x00a60f6e
0x00a60f7b
0x00a60f81
0x00a60f83
0x00a60f84
0x00a60f87
0x00a60f8f
0x00a60f95
0x00a60f97
0x00a60f98
0x00a60f9f
0x00a60fa5
0x00a60fac
0x00a60fb2
0x00a60fb8
0x00a60fbd
0x00a60fbf
0x00a60fd1
0x00a60fc1
0x00a60fc1
0x00a60fc3
0x00a60fc3
0x00a60fca
0x00a60fcb
0x00a60fcc
0x00a60fcd
0x00a60fce
0x00a60fce
0x00a60fd3
0x00a60fde
0x00a60fe3
0x00a60fe9
0x00a60fef
0x00a61001
0x00a61006
0x00a61013
0x00a61018
0x00a6101d
0x00a61023
0x00a6102b
0x00a61033
0x00a61036
0x00a6103b
0x00a61040
0x00a61043
0x00a6107a
0x00a6107f
0x00a61084
0x00a61089
0x00a6108c
0x00a61094
0x00a61045
0x00a61045
0x00a6104c
0x00a61051
0x00a61056
0x00a6105b
0x00a61060
0x00a61063
0x00a6106b
0x00a61070
0x00a61073
0x00a61073
0x00a610a0
0x00a610a1
0x00a610a6
0x00a610a9
0x00a610ae
0x00a610b8
0x00a610bf
0x00a610c9
0x00a610cc
0x00a610d1
0x00a610d8
0x00a610e4
0x00a610e5
0x00a610ea
0x00a610ed
0x00a610fb

Strings

HT, xrefs: 00A60FD9
DgA, xrefs: 00A610DD
`T, xrefs: 00A6101E
`T, xrefs: 00A610B3
XT, xrefs: 00A6105B
T, xrefs: 00A610F4
TT, xrefs: 00A60FF9
XT, xrefs: 00A61084
\T, xrefs: 00A610C4

Memory Dump Source

Source File: 00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1544150906.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1544404583.0000000000A84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_Refund Details.jbxd

Yara matches

Similarity

API ID:
String ID: T$DgA$HT$TT$XT$XT$\T$`T$`T
API String ID: 0-4008493988
Opcode ID: 0ced6505a1c9ccb6f94d7d05fd12f2e63cf3a0189e6c3fc846c1f0e2cddffe9a
Instruction ID: 6633dfb398a5ffcad4ceca58325052bf21af1ea19df8472e709977ef8904a224
Opcode Fuzzy Hash: 0ced6505a1c9ccb6f94d7d05fd12f2e63cf3a0189e6c3fc846c1f0e2cddffe9a
Instruction Fuzzy Hash: 05412771F006109BD724BB70DE66BBC2B62BB84705F21403ABD0B576D2DE788D8E8745

Uniqueness

Uniqueness Score: -1.00%

Function 00A5C845 Relevance: 6.3, Strings: 5, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00A5C845(void* __ecx, void* __eflags, void* __rcx, void* __rdx) {
				intOrPtr _t31;
				void* _t75;
				void* _t84;
				void* _t88;

				_t85 = __rcx;
				_t31 = E00A6323D( *((intOrPtr*)(_t88 + 0x14)), 0, _t75, __eflags, _t84, __rcx, __rdx);
				 *((intOrPtr*)(_t88 + 0x10)) = _t31;
				_t77 = _t31;
				if(_t31 == 0) {
					L7:
					__eflags = 0;
					return 0;
				} else {
					_push(__rcx);
					 *((intOrPtr*)(_t88 + 0x30)) = E00A631D4(_t31, 0x415e9c, _t75, _t77, _t84, __rcx);
					 *((intOrPtr*)(_t88 + 0x34)) = E00A631D4( *((intOrPtr*)(_t88 + 0x10)), 0x415eac, _t75, _t77, _t84, _t85);
					 *((intOrPtr*)(_t88 + 0x38)) = E00A631D4( *((intOrPtr*)(_t88 + 0x10)), 0x415ebc, _t75, _t77, _t84, _t85);
					 *((intOrPtr*)(_t88 + 0x40)) = E00A631D4( *((intOrPtr*)(_t88 + 0x10)), 0x415ed0, _t75, _t77, _t84, _t85);
					 *((intOrPtr*)(_t88 + 0x44)) = E00A631D4( *((intOrPtr*)(_t88 + 0x10)), 0x415ee4, _t75, _t77, _t84, _t85);
					 *((intOrPtr*)(_t88 + 0x3c)) = E00A631D4( *((intOrPtr*)(_t88 + 0x10)), 0x415ef4, _t75, _t77, _t84, _t85);
					 *((intOrPtr*)(_t88 + 0x2c)) = E00A631D4( *((intOrPtr*)(_t88 + 0x10)), 0x415f04, _t75, _t77, _t84, _t85);
					 *((intOrPtr*)(_t88 + 0x54)) = E00A631D4( *((intOrPtr*)(_t88 + 0x10)), 0x415f14, _t75, _t77, _t84, _t85);
					 *((intOrPtr*)(_t88 + 0x58)) = E00A631D4( *((intOrPtr*)(_t88 + 0x10)), 0x415f28, _t75, _t77, _t84, _t85);
					 *((intOrPtr*)(_t88 + 0x5c)) = E00A631D4( *((intOrPtr*)(_t88 + 0x10)), 0x415f3c, _t75, _t77, _t84, _t85);
					 *((intOrPtr*)(_t88 + 0x64)) = E00A631D4( *((intOrPtr*)(_t88 + 0x10)), 0x415f54, _t75, _t77, _t84, _t85);
					 *((intOrPtr*)(_t88 + 0x60)) = E00A631D4( *((intOrPtr*)(_t88 + 0x10)), 0x415f68, _t75, _t77, _t84, _t85);
					if( *((intOrPtr*)(_t88 + 0x30)) == 0 ||  *((intOrPtr*)(_t88 + 0x34)) == 0 ||  *((intOrPtr*)(_t88 + 0x38)) == 0 ||  *((intOrPtr*)(_t88 + 0x40)) == 0 ||  *((intOrPtr*)(_t88 + 0x44)) == 0) {
						return 0;
					} else {
						goto L7;
					}
				}
			}

0x00a5c845
0x00a5c84e
0x00a5c853
0x00a5c856
0x00a5c858
0x00a5c93e
0x00a5c93e
0x00a5c942
0x00a5c85e
0x00a5c85e
0x00a5c873
0x00a5c883
0x00a5c893
0x00a5c8a3
0x00a5c8b3
0x00a5c8c3
0x00a5c8d3
0x00a5c8e3
0x00a5c8f3
0x00a5c903
0x00a5c913
0x00a5c91b
0x00a5c924
0x00a5c93d
0x00000000
0x00000000
0x00000000
0x00a5c924

Strings

^A, xrefs: 00A5C89E
<_A, xrefs: 00A5C8EE
h_A, xrefs: 00A5C90E
T_A, xrefs: 00A5C8FE
(_A, xrefs: 00A5C8DE

Memory Dump Source

Source File: 00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1544150906.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1544404583.0000000000A84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_Refund Details.jbxd

Yara matches

Similarity

API ID:
String ID: (_A$<_A$T_A$h_A$^A
API String ID: 0-531287766
Opcode ID: cc683f7ea35b702b570c489556ef3f49140987ab942287dbc5150f5a3c01e446
Instruction ID: 7ab3c26351f6b92173e1c1d91d68412735379af60bb7b1b16f55197caa1973b6
Opcode Fuzzy Hash: cc683f7ea35b702b570c489556ef3f49140987ab942287dbc5150f5a3c01e446
Instruction Fuzzy Hash: 7C21B1B2A14744CBCF38EB70A55409AB272F786300310892A9B978BB44EF3CE942CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00A5DDC4 Relevance: 5.1, Strings: 4, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00A5DDC4(void* __ecx) {
				void* __rcx;
				intOrPtr _t17;
				intOrPtr _t24;
				void* _t42;
				void* _t50;
				void* _t51;
				void* _t55;

				_t17 =  *0xe71ef2(0x415838);
				 *((intOrPtr*)(_t55 + 0xc0)) = _t17;
				_t43 = _t17;
				if(_t17 == 0) {
					L7:
					__eflags = 0;
					return 0;
				} else {
					_push(_t51);
					 *((intOrPtr*)(_t55 + 0x8c)) = E00A631D4(_t17, 0x415848, _t42, _t43, _t50, _t51);
					 *((intOrPtr*)(_t55 + 0x90)) = E00A631D4( *((intOrPtr*)(_t55 + 0xc0)), 0x415858, _t42, _t43, _t50, _t51);
					 *((intOrPtr*)(_t55 + 0x94)) = E00A631D4( *((intOrPtr*)(_t55 + 0xc0)), 0x415868, _t42, _t43, _t50, _t51);
					 *((intOrPtr*)(_t55 + 0x98)) = E00A631D4( *((intOrPtr*)(_t55 + 0xc0)), 0x41587c, _t42, _t43, _t50, _t51);
					 *((intOrPtr*)(_t55 + 0x9c)) = E00A631D4( *((intOrPtr*)(_t55 + 0xc0)), 0x41587c, _t42, _t43, _t50, _t51);
					_t24 = E00A631D4( *((intOrPtr*)(_t55 + 0xc0)), 0x41588c, _t42, _t43, _t50, _t51);
					 *((intOrPtr*)(_t55 + 0xa0)) = _t24;
					if( *((intOrPtr*)(_t55 + 0x8c)) == 0 ||  *((intOrPtr*)(_t55 + 0x94)) == 0 ||  *((intOrPtr*)(_t55 + 0x90)) == 0 ||  *((intOrPtr*)(_t55 + 0x98)) == 0 || _t24 == 0) {
						goto L7;
					} else {
						return 0;
					}
				}
			}

0x00a5ddcc
0x00a5ddd2
0x00a5ddd8
0x00a5ddda
0x00a5de8e
0x00a5de8e
0x00a5de91
0x00a5dde0
0x00a5dde1
0x00a5ddf9
0x00a5de0f
0x00a5de27
0x00a5de3a
0x00a5de50
0x00a5de56
0x00a5de5e
0x00a5de6b
0x00000000
0x00a5de89
0x00a5de8d
0x00a5de8d
0x00a5de6b

Strings

XXA, xrefs: 00A5DDF4
hXA, xrefs: 00A5DE0A
|XA, xrefs: 00A5DE20
HXA, xrefs: 00A5DDE2

Memory Dump Source

Source File: 00000000.00000002.1544171575.0000000000A52000.00000002.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1544150906.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1544404583.0000000000A84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_Refund Details.jbxd

Yara matches

Similarity

API ID:
String ID: HXA$XXA$hXA$|XA
API String ID: 0-1570881228
Opcode ID: be62e8687bf88a62caf9433af38f9bb44ee03444bac42c73a5791496473ddc0b
Instruction ID: fd860cea2b192f106451f9ee2c1844ec295df6011ec6930192ba93b0b1d4868c
Opcode Fuzzy Hash: be62e8687bf88a62caf9433af38f9bb44ee03444bac42c73a5791496473ddc0b
Instruction Fuzzy Hash: CC11FB32A15281CBDF3CAB71A902BDAB661F782701F14862A9F5697741DF38E842CB00

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: firefox.exePID: 1396, Parent PID: 2492COMMON

Executed Functions

Function 0000008B8C101E50 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2730105584.0000008B8C101000.00000020.00000800.00020000.00000000.sdmp, Offset: 0000008B8C101000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8b8c101000_firefox.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f1707e6418c0a67787080577053961c7d7d55a720c32b038b24850150b06c20
Instruction ID: c7fda78c2246200b61f7d7efa30cd05a31562c16550bef0f8854edcb246700a2
Opcode Fuzzy Hash: 2f1707e6418c0a67787080577053961c7d7d55a720c32b038b24850150b06c20
Instruction Fuzzy Hash: 0431B670608A0D8FDFC8FA1C845672A77E1FB68300F14499AD898C3691EF24DC91C793

Uniqueness

Uniqueness Score: -1.00%

Function 0000008B8C103DA0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2730105584.0000008B8C101000.00000020.00000800.00020000.00000000.sdmp, Offset: 0000008B8C101000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8b8c101000_firefox.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c67fd043fd94fc767654a02ea356fa8503694e337f3574f8fec0f9e76719ae16
Instruction ID: d352b5d3d3b3e9b99c74c684f97fe7efcb0045bbb4d0a9beeaaa108df2f728a6
Opcode Fuzzy Hash: c67fd043fd94fc767654a02ea356fa8503694e337f3574f8fec0f9e76719ae16
Instruction Fuzzy Hash: 67210370508A098BEAC8B62C5897B657BD5F768300F58864BD448C66E2DE108CC5C3E2

Uniqueness

Uniqueness Score: -1.00%

Function 0000008B8C102590 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2730105584.0000008B8C101000.00000020.00000800.00020000.00000000.sdmp, Offset: 0000008B8C101000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8b8c101000_firefox.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 234caac2f8e0fadd78b68cdb4e8699a496252572dcd8df33b89ed452877ba32a
Instruction ID: f6f19de84e3e13a782fa641074cd4c38d3f95cfbdd8763b55c42a7ae6b8ae19c
Opcode Fuzzy Hash: 234caac2f8e0fadd78b68cdb4e8699a496252572dcd8df33b89ed452877ba32a
Instruction Fuzzy Hash: 15113360615D088BEAD8B63C1C97B623AD5F758300F588557E488C66E2EE048CC9C3E3

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: firefox.exePID: 3596, Parent PID: 2492COMMON

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	100%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000001EF00F48CEC Relevance: 24.4, APIs: 1, Strings: 9, Instructions: 6945nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 000001EF00F48D54

Strings

z, xrefs: 000001EF00F4A3B4
#, xrefs: 000001EF00F4706F
>, xrefs: 000001EF00F4CF6D
#, xrefs: 000001EF00F49EB5
z, xrefs: 000001EF00F48D81
4, xrefs: 000001EF00F4CF47
#, xrefs: 000001EF00F48D78
>, xrefs: 000001EF00F49BE0
>, xrefs: 000001EF00F48DAF

Memory Dump Source

Source File: 00000007.00000002.2828226460.000001EF00F46000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EF00F46000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1ef00f46000_firefox.jbxd

Similarity

API ID: InformationQuerySystem
String ID: #$#$#$4$>$>$>$z$z
API String ID: 3562636166-664736986
Opcode ID: 8d7ed66da55717e90c7888a32c124a9ddf92c773f30d213c5e05b0d1360bed31
Instruction ID: bfab331dabcad7069bddc96fd44e335fede47be4402b92f94ec5448f36d79b12
Opcode Fuzzy Hash: 8d7ed66da55717e90c7888a32c124a9ddf92c773f30d213c5e05b0d1360bed31
Instruction Fuzzy Hash: 2EA3A331618A498BDB6DDF18DC856EA77E6FB94701F04423EEC4AC3256DE34E9068BC1

Uniqueness

Uniqueness Score: -1.00%

Function 000001EF00F29F58 Relevance: 8.4, APIs: 1, Instructions: 6882nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 000001EF00F29F78

Memory Dump Source

Source File: 00000007.00000002.2827209972.000001EF00F27000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EF00F27000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1ef00f27000_firefox.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 5cf12108560fe5924422c91feb2a372c38ee8cf31d23d1c09161473b6b3ec24f
Instruction ID: 9d582bcff92c640b27f94472d5ae839fe210e9e7b13fb8c97f74527e884a7d65
Opcode Fuzzy Hash: 5cf12108560fe5924422c91feb2a372c38ee8cf31d23d1c09161473b6b3ec24f
Instruction Fuzzy Hash: 1DA3D331614A598BDB29DF28D8856EE77E5FB99301F04463EEC4BC3252DF34E9428B81

Uniqueness

Uniqueness Score: -1.00%

Function 000001EF00F243CF Relevance: .4, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2827114661.000001EF00F22000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EF00F22000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1ef00f22000_firefox.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90b6c031f421fbf11930b0b40fdba29f0a5b67ec1f76c8700ecdf38793ac25fe
Instruction ID: c689bc952ac5a8e3097f96ca420128a782d0d95c2eed8d35dcd49cd477e01ba4
Opcode Fuzzy Hash: 90b6c031f421fbf11930b0b40fdba29f0a5b67ec1f76c8700ecdf38793ac25fe
Instruction Fuzzy Hash: 0CB16331308E1DCFCF55EF58D880FA977E2FBA9311B05456AE80AC3255DE74E9868B81

Uniqueness

Uniqueness Score: -1.00%

Function 000001EF00F243C1 Relevance: .3, Instructions: 349
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2827114661.000001EF00F22000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EF00F22000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1ef00f22000_firefox.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba8a1244ace3d74d26865e607c940e286069e746bcd13b9e2c16c0c014eb634
Instruction ID: 7a4e500b16b58bb6b3fabbad75c8edeefe6d56da35d38b07c0172c1e8b6f72ee
Opcode Fuzzy Hash: 1ba8a1244ace3d74d26865e607c940e286069e746bcd13b9e2c16c0c014eb634
Instruction Fuzzy Hash: 7FB18331308E1DCFCF55EF58D880FE977E2EBA9311B05456AE80AC3255DE74E9868B81

Uniqueness

Uniqueness Score: -1.00%

Function 000001EF00F238C3 Relevance: .1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2827114661.000001EF00F22000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EF00F22000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1ef00f22000_firefox.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ada7133d01ecbfa441c84acdb98c97747e889023a70d1a1751ab4fd26a854472
Instruction ID: e9a207b21f147e049a66a3fe8f30457c107db656666cfc7213a613617c871665
Opcode Fuzzy Hash: ada7133d01ecbfa441c84acdb98c97747e889023a70d1a1751ab4fd26a854472
Instruction Fuzzy Hash: B421937150CB8D4FD745DF28C844796BBE1FB5A310F1406AFE48AC3292D634D945C782

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: firefox.exePID: 4816, Parent PID: 2492COMMON

Executed Functions

Function 0000034197A11E50 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2803481572.0000034197A11000.00000020.00000800.00020000.00000000.sdmp, Offset: 0000034197A11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_34197a11000_firefox.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee637fb7d8b78b99acd246d334ac632e1ccce014798c1bb8c5f6228b360def9d
Instruction ID: 4c1bf5f95ee105f7aa445441b8fa3b16da44a78e8f357799405d321faa8faefa
Opcode Fuzzy Hash: ee637fb7d8b78b99acd246d334ac632e1ccce014798c1bb8c5f6228b360def9d
Instruction Fuzzy Hash: 3C31EE3560CE4C8FEB85E62C945572977E0FF99300F08489AD8ACC7291E624AD91CB83

Uniqueness

Uniqueness Score: -1.00%

Function 0000034197A14DC0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2803481572.0000034197A11000.00000020.00000800.00020000.00000000.sdmp, Offset: 0000034197A11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_34197a11000_firefox.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38751a92e94de05b53a106747ce771545d9ed8e8927202c39e820e10e860752f
Instruction ID: 44836c37578ef513d4d6fad35be59ead3cfb45a7dbb2553977b4b2448a234e53
Opcode Fuzzy Hash: 38751a92e94de05b53a106747ce771545d9ed8e8927202c39e820e10e860752f
Instruction Fuzzy Hash: 80317A36515E088BFA4AF72C7C5665077D5FB85390F4C8646D42CCB2D2EA149EC887C3

Uniqueness

Uniqueness Score: -1.00%

Function 0000034197A13DA0 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2803481572.0000034197A11000.00000020.00000800.00020000.00000000.sdmp, Offset: 0000034197A11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_34197a11000_firefox.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebb977d561ccb2b9119635e42c96f96f8b740c2d9eb830f2da632b11543a174f
Instruction ID: d0538fea067907dc0e0561bae5aae669c59edcff31a822961a3c0a06a21b8336
Opcode Fuzzy Hash: ebb977d561ccb2b9119635e42c96f96f8b740c2d9eb830f2da632b11543a174f
Instruction Fuzzy Hash: 72216A36109E088BFA5AE62C685676477D5FB85354F1C464AD41CCA2E2DA10ADC4C3C3

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: firefox.exePID: 6688, Parent PID: 2492COMMON

Executed Functions

Function 000003E0B39C3DA0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2627168928.000003E0B39C1000.00000020.00000800.00020000.00000000.sdmp, Offset: 000003E0B39C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3e0b39c1000_firefox.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8c8c89e6298d09e51e918f72520d454d88e95c895439fd72a6c50d62f43ccf2
Instruction ID: 86503940c9e1cdb89f51745584d9e636797c882c2245c1dbdfb54e73fa6a380e
Opcode Fuzzy Hash: c8c8c89e6298d09e51e918f72520d454d88e95c895439fd72a6c50d62f43ccf2
Instruction Fuzzy Hash: 3341C53550CB4A4FDB89EA2CC445B19B7E5FB58300F640A8AD858C72E2E6B8EDD4C743

Uniqueness

Uniqueness Score: -1.00%

Source: Joe Sandbox View	JA3 fingerprint: a72f351cf3c3cd1edb345f7dc071d813
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: firefox.exe, 0000000D.00000003.2126599550.000002676B11F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://www.facebook.com/plugins/comments.php", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.2126599550.000002676B11F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://www.facebook.com/plugins/comments/async/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.2126599550.000002676B11F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://www.facebook.com/plugins/feedback.php", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.2126599550.000002676B11F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://www.facebook.com/plugins/like_box.php", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000004.00000003.2123028354.000001D978A4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: !!www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000002.2745855510.000002676AC13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://webcompat-addon-testbed.herokuapp.com/shims_test.js://static.adsafeprotected.com/vans-adapter-google-ima.jsmoz-extension://122f193f-ff7e-4385-b730-f58afba1c658/log.js://media.richrelevance.com/rrserver/js/1.2/p13n.js://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js://id.rambler.ru/rambler-id-helper/auth_events.jsPlease use $(ref:tabs.query) <code>{windowId: windowId}</code>.://www.jp.square-enix.com/music/sem/page/FF7R/ost/*resource:///modules/translation/LanguageDetector.jsm equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000000D.00000002.2745855510.000002676AC13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/plugins/comments.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000002.2745855510.000002676AC13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/plugins/comments/async/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000002.2745855510.000002676AC13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/plugins/feedback.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000002.2745855510.000002676AC13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/plugins/like_box.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000006.00000003.2271880620.0000026337636000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2290882558.0000026337649000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2386171850.0000026337641000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2281865644.0000026337638000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2394942546.0000026337642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2445658560.0000026337649000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2886244740.0000026337649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 0https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000006.00000002.2846265945.0000026334EB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2471827932.0000026336F2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 2https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000006.00000002.2846265945.0000026334EB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2471827932.0000026336F2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 4https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000006.00000002.2873799083.0000026336F07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2874143703.0000026336F26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2472059050.0000026336F26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2801570285.0000026332FD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000006.00000002.2802289334.0000026332FE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2874143703.0000026336F26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2472059050.0000026336F26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000006.00000002.2904970558.000039E007700000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 9https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000D.00000002.2745855510.000002676AC13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Test shim for Mochitests (branch)Test shim for Mochitests (platform)://pubads.g.doubleclick.net/gampad/adsTest shim for Mochitests (disabled by default)://connect.facebook.net//sdk.js://connect.facebook.net//all.js://www.facebook.com/plugins/feedback.php://www.facebook.com/plugins/comments.php://www.facebook.com/plugins/comments/async/://www.google-analytics.com/analytics.jsGoogle Analytics E-Commerce Plugingoogle-analytics-ecommerce-plugin.js://libs.coremetrics.com/eluminate.js://www.google-analytics.com/plugins/ua/ec.js://www.google-analytics.com/gtm/jsTest shim for Mochitests (notHost)resource://app/localization/{locale}/Ad Safe Protected Google IMA Adapter://www.facebook.com/plugins/like_box.php**://auth.9c9media.ca/auth/main.js equals www.facebook.com (Facebook)
Source: firefox.exe, 00000006.00000002.2873799083.0000026336F07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2874143703.0000026336F26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2807491730.000002633304E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2472059050.0000026336F26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2801570285.0000026332FD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000006.00000002.2802289334.0000026332FE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2271880620.0000026337636000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2874143703.0000026336F26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2290882558.0000026337649000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2386171850.0000026337641000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2904970558.000039E007700000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2281865644.0000026337638000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2394942546.0000026337642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2445658560.0000026337649000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2886244740.0000026337649000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2472059050.0000026336F26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2904574215.000039BE3B4CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000005.00000002.2046729460.0000027A628DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2844973570.0000026334E67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2805588074.0000026333010000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000007.00000002.2815474303.000001EF00910000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000008.00000002.2016601658.000002422E3CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000002.2717851159.0000026764510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000005.00000002.2046729460.0000027A628DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2844973570.0000026334E67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2805588074.0000026333010000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000007.00000002.2815474303.000001EF00910000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000008.00000002.2016601658.000002422E3CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000002.2717851159.0000026764510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000004.00000003.2123028354.000001D978A4D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2126029691.000001D975A96000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2215969603.000001D97BBB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2890299719.0000026337836000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000003.2464023579.0000026337836000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000004.00000003.2123028354.000001D978A4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.twitter.com equals www.twitter.com (Twitter)
Source: firefox.exe, 00000004.00000003.2123028354.000001D978A4D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2215969603.000001D97BBB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000004.00000003.2128600461.000001D975622000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2129613602.000001D97B511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {"defaultHandlersVersion":{"en-US":4},"mimeTypes":{"application/pdf":{"action":3,"extensions":["pdf"]},"text/xml":{"action":3,"extensions":["xml"]},"image/svg+xml":{"action":3,"extensions":["svg"]},"image/webp":{"action":3,"extensions":["webp"]}},"schemes":{"irc":{"stubEntry":true,"handlers":[null,{"name":"Mibbit","uriTemplate":"https://www.mibbit.com/?url=%s"}]},"ircs":{"stubEntry":true,"handlers":[null,{"name":"Mibbit","uriTemplate":"https://www.mibbit.com/?url=%s"}]},"mailto":{"stubEntry":true,"handlers":[null,{"name":"Yahoo! Mail","uriTemplate":"https://compose.mail.yahoo.com/?To=%s"},{"name":"Gmail","uriTemplate":"https://mail.google.com/mail/?extsrc=mailto&url=%s"}]}}} equals www.yahoo.com (Yahoo)
Source: firefox.exe, 00000004.00000003.2129613602.000001D97B511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {"defaultHandlersVersion":{"en-US":4},"mimeTypes":{"application/pdf":{"action":3,"extensions":["pdf"]},"text/xml":{"action":3,"extensions":["xml"]},"image/svg+xml":{"action":3,"extensions":["svg"]},"image/webp":{"action":3,"extensions":["webp"]}},"schemes":{"irc":{"stubEntry":true,"handlers":[null,{"name":"Mibbit","uriTemplate":"https://www.mibbit.com/?url=%s"}]},"ircs":{"stubEntry":true,"handlers":[null,{"name":"Mibbit","uriTemplate":"https://www.mibbit.com/?url=%s"}]},"mailto":{"stubEntry":true,"handlers":[null,{"name":"Yahoo! Mail","uriTemplate":"https://compose.mail.yahoo.com/?To=%s"},{"name":"Gmail","uriTemplate":"https://mail.google.com/mail/?extsrc=mailto&url=%s"}]}}}x equals www.yahoo.com (Yahoo)

Source: Refund Details.exe	Virustotal: Detection: 66%	Perma Link
Source: Refund Details.exe	Metadefender: Detection: 37%	Perma Link
Source: Refund Details.exe	ReversingLabs: Detection: 85%

Source: 0.2.Refund Details.exe.a50000.0.unpack	Avira: Label: TR/Redcap.ghjpt
Source: 0.0.Refund Details.exe.a50000.0.unpack	Avira: Label: TR/Redcap.ghjpt

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown	Process created: C:\Users\user\Desktop\Refund Details.exe "C:\Users\user\Desktop\Refund Details.exe"
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.0.488927132\823982072" -childID 1 -isForBrowser -prefsHandle 2672 -prefMapHandle 2680 -prefsLen 1 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 2560 tab
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.6.1666811742\456711594" -childID 2 -isForBrowser -prefsHandle 3076 -prefMapHandle 3068 -prefsLen 1 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 3088 tab
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.12.1229122738\1823760468" -parentBuildID 20210504152106 -prefsHandle 3792 -prefMapHandle 3788 -prefsLen 160 -prefMapSize 235609 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 1032 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.13.2039529717\595573382" -childID 3 -isForBrowser -prefsHandle 4132 -prefMapHandle 4128 -prefsLen 160 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 4368 tab
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.17.2031288100\1490268157" -childID 4 -isForBrowser -prefsHandle 4504 -prefMapHandle 4500 -prefsLen 5258 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 4420 tab
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.28.1606140724\1125369852" -childID 5 -isForBrowser -prefsHandle 4960 -prefMapHandle 5176 -prefsLen 5436 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 4664 tab
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.34.1568289426\1261120468" -childID 6 -isForBrowser -prefsHandle 5712 -prefMapHandle 4972 -prefsLen 6561 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 5780 tab
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.40.1897084510\906370204" -childID 7 -isForBrowser -prefsHandle 7248 -prefMapHandle 7244 -prefsLen 6742 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 7252 tab
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\pingsender.exe "C:\Program Files\Mozilla Firefox\pingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/4d4e9ed8-d41e-47c2-af5c-0d0eb3230cdd/event/Firefox/88.0.1/release/20210504152106?v=4 C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\4d4e9ed8-d41e-47c2-af5c-0d0eb3230cdd https://incoming.telemetry.mozilla.org/submit/telemetry/c07646ef-d9d3-4d8c-811b-81063ab65053/health/Firefox/88.0.1/release/20210504152106?v=4 C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\c07646ef-d9d3-4d8c-811b-81063ab65053 https://incoming.telemetry.mozilla.org/submit/telemetry/02261d48-0564-4e3d-9859-ba76e838e396/main/Firefox/88.0.1/release/20210504152106?v=4 C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\02261d48-0564-4e3d-9859-ba76e838e396
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.0.488927132\823982072" -childID 1 -isForBrowser -prefsHandle 2672 -prefMapHandle 2680 -prefsLen 1 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 2560 tab	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.6.1666811742\456711594" -childID 2 -isForBrowser -prefsHandle 3076 -prefMapHandle 3068 -prefsLen 1 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 3088 tab	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.12.1229122738\1823760468" -parentBuildID 20210504152106 -prefsHandle 3792 -prefMapHandle 3788 -prefsLen 160 -prefMapSize 235609 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 1032 rdd	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.13.2039529717\595573382" -childID 3 -isForBrowser -prefsHandle 4132 -prefMapHandle 4128 -prefsLen 160 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 4368 tab	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.17.2031288100\1490268157" -childID 4 -isForBrowser -prefsHandle 4504 -prefMapHandle 4500 -prefsLen 5258 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 4420 tab	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.28.1606140724\1125369852" -childID 5 -isForBrowser -prefsHandle 4960 -prefMapHandle 5176 -prefsLen 5436 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 4664 tab	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.34.1568289426\1261120468" -childID 6 -isForBrowser -prefsHandle 5712 -prefMapHandle 4972 -prefsLen 6561 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 5780 tab	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.40.1897084510\906370204" -childID 7 -isForBrowser -prefsHandle 7248 -prefMapHandle 7244 -prefsLen 6742 -prefMapSize 235609 -parentBuildID 20210504152106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 7252 tab	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\pingsender.exe "C:\Program Files\Mozilla Firefox\pingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/4d4e9ed8-d41e-47c2-af5c-0d0eb3230cdd/event/Firefox/88.0.1/release/20210504152106?v=4 C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\4d4e9ed8-d41e-47c2-af5c-0d0eb3230cdd https://incoming.telemetry.mozilla.org/submit/telemetry/c07646ef-d9d3-4d8c-811b-81063ab65053/health/Firefox/88.0.1/release/20210504152106?v=4 C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\c07646ef-d9d3-4d8c-811b-81063ab65053 https://incoming.telemetry.mozilla.org/submit/telemetry/02261d48-0564-4e3d-9859-ba76e838e396/main/Firefox/88.0.1/release/20210504152106?v=4 C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\e9q05n55.default-release\saved-telemetry-pings\02261d48-0564-4e3d-9859-ba76e838e396	Jump to behavior

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use hidden users to mask the presence of user accounts they create. Every user account in macOS has a userID associated with it. When creating a user, you can specify the userID for that account.
Tactics:	Defense Evasion
Data Sources:	Authentication logs, File monitoring
Platforms:	macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Refund Details.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: AveMaria

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Mozilla\uninstall_ping_308046B0AF4A39CB_7924128a-3afe-49c1-80a5-51166342c3b7.json (copy)

C:\ProgramData\Mozilla\uninstall_ping_308046B0AF4A39CB_7924128a-3afe-49c1-80a5-51166342c3b7.json.tmp

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Refund Details.exe.log

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\cache2\doomed\22562 (copy)

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\cache2\doomed\29438

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\cache2\entries\0999C553432185C954530B80972C1B492AB736B1

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\cache2\entries\97AE667565B6120DDEBF42730CC21468FE5AC36E

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\cache2\entries\98E7F8D76509844398CCF67AC5DFA26D4F5053E5

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\startupCache\scriptCache-child-new.bin

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\startupCache\scriptCache-child.bin (copy)

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\startupCache\scriptCache-new.bin

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\startupCache\scriptCache.bin (copy)

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\e9q05n55.default-release\startupCache\urlCache-new.bin

Windows Analysis Report
Refund Details.com

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre