Windows Analysis Report
file.exe

AV Detection

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: file.exe

Joe Sandbox ML: detected

Compliance

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.91:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49859 version: TLS 1.2

Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.13.dr
Source:	Binary string: xWindows.Security.Integrity.pdb source: firefox.exe, 0000000D.00000003.1978629354.000002988F926000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1987578137.000002988F926000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: NapiNSP.pdbUGP source: firefox.exe, 0000000D.00000003.1996968204.00000298855B9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: NapiNSP.pdb source: firefox.exe, 0000000D.00000003.1996968204.00000298855B9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: xWindows.StateRepositoryPS.pdb source: firefox.exe, 0000000D.00000003.1978629354.000002988F926000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1987578137.000002988F926000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: netprofm.pdb source: firefox.exe, 0000000D.00000003.1993881961.00000298855B3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.13.dr
Source:	Binary string: netprofm.pdbUGP source: firefox.exe, 0000000D.00000003.1993881961.00000298855B3000.00000004.00000020.00020000.00000000.sdmp

Spreading

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FADBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,		0_2_00FADBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB68EE FindFirstFileW,FindClose,		0_2_00FB68EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,		0_2_00FB698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FAD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,		0_2_00FAD076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FAD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,		0_2_00FAD3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,		0_2_00FB9642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,		0_2_00FB979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,		0_2_00FB9B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB5C97 FindFirstFileW,FindNextFileW,FindClose,		0_2_00FB5C97

Software Vulnerabilities

Source: firefox.exe

Memory has grown: Private usage: 38MB later: 223MB

Networking

Source: unknown

Network traffic detected: DNS query count 31

Source: Joe Sandbox View	IP Address: 34.149.100.209 34.149.100.209
Source: Joe Sandbox View	IP Address: 151.101.65.91 151.101.65.91
Source: Joe Sandbox View	IP Address: 34.117.188.166 34.117.188.166
Source: Joe Sandbox View	IP Address: 34.160.144.191 34.160.144.191

Source: Joe Sandbox View

JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FBCE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

0_2_00FBCE44

Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 0000000D.00000003.1985458304.00000298FFA6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1985458304.00000298FFA6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000D.00000003.1984811129.00000298873B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: *://www.facebook.com/* equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Wikipedia&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Reddit&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Twitter&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000000D.00000003.1979365336.000002988E258000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1962595375.000002988F974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8*://www.facebook.com/* equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1979365336.000002988E287000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1963508678.000002988F5C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854585762.000002988E287000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1979365336.000002988E287000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854585762.000002988E287000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000D.00000003.1963508678.000002988F5C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1960119629.0000029891A17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1963508678.000002988F5B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000D.00000003.1979365336.000002988E258000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1962595375.000002988F974000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1971597638.00000298878D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1987843430.000002988F4E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964264894.000002988F4E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854363427.000002988F4F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1987843430.000002988F4E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964264894.000002988F4E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854363427.000002988F4F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{&quot;engine&quot;: &quot;Google&quot;}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;YouTube&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{&quot;engine&quot;: &quot;Google&quot;}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;YouTube&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000000D.00000003.1979365336.000002988E287000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1963508678.000002988F5C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854585762.000002988E287000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1979365336.000002988E287000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1963508678.000002988F5C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854585762.000002988E287000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000014.00000002.3014895067.000001F7FF40C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000014.00000002.3014895067.000001F7FF40C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000014.00000002.3014895067.000001F7FF40C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3015225093.0000020C1180A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3014895067.000001F7FF40C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000002.3015225093.0000020C1180A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3014895067.000001F7FF40C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000010.00000002.3015225093.0000020C1180A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3014895067.000001F7FF40C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000D.00000003.1979365336.000002988E258000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1962595375.000002988F974000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1971597638.00000298878D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1971597638.00000298878B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x*://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com

Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: firefox.exe, 0000000D.00000003.1963172855.000002988F5F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 0000000D.00000003.1963172855.000002988F5F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 0000000D.00000003.1963172855.000002988F5F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 0000000D.00000003.1963172855.000002988F5F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: gmpopenh264.dll.tmp.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: firefox.exe, 0000000D.00000003.1992251934.000002988557E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1985565174.0000029885589000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1989052693.0000029885589000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1989801273.0000029885589000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1984967237.0000029885589000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1990530385.0000029885589000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: gmpopenh264.dll.tmp.13.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: gmpopenh264.dll.tmp.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: firefox.exe, 0000000D.00000003.1992251934.000002988557E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1985565174.0000029885589000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1989052693.0000029885589000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1989801273.0000029885589000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1984967237.0000029885589000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1990530385.0000029885589000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.13.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: gmpopenh264.dll.tmp.13.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: firefox.exe, 0000000D.00000003.1992251934.000002988557E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1985565174.0000029885589000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1989052693.0000029885589000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1989801273.0000029885589000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1984967237.0000029885589000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1990530385.0000029885589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: gmpopenh264.dll.tmp.13.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: firefox.exe, 0000000D.00000003.1977679237.000002988FE66000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1962151432.000002988FE37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000000D.00000003.1962151432.000002988FE37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000000D.00000003.1962595375.000002988F974000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1987843430.000002988F4E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1970482803.0000029887F19000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964264894.000002988F4E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000000D.00000003.1961865467.000002988FED5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1968617068.000002988847F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1982060265.000002988847F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000000D.00000003.1962595375.000002988F9A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 0000000D.00000003.1962595375.000002988F9A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 0000000D.00000003.1928917074.000002988F366000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 0000000D.00000003.1932342739.00000298875A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1865663672.00000298875F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854692379.000002988E1FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1966963832.000002988902C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964561554.000002988DFC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1980144212.000002988E1FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1890734312.00000298877C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1957256306.0000029885AC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1875673309.00000298877C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1865663672.00000298875A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1982060265.000002988849B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1918641063.00000298875AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1981259590.000002988DFC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1876317916.00000298877D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1883850105.00000298877D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1820759215.00000298857A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1967239317.00000298885F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1984936519.0000029887709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1817894612.0000029885968000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1884728901.000002988758A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1870971198.0000029887645000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: gmpopenh264.dll.tmp.13.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: firefox.exe, 0000000D.00000003.1992251934.000002988557E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1985565174.0000029885589000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1989052693.0000029885589000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1989801273.0000029885589000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1984967237.0000029885589000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1990530385.0000029885589000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.13.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: gmpopenh264.dll.tmp.13.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: firefox.exe, 0000000D.00000003.1961405065.000002989184A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964124007.000002988F588000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: firefox.exe, 0000000D.00000003.1965137487.000002988D9EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 0000000D.00000003.1961405065.000002989184A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1965137487.000002988D9EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964124007.000002988F588000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: gmpopenh264.dll.tmp.13.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: gmpopenh264.dll.tmp.13.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: gmpopenh264.dll.tmp.13.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: firefox.exe, 0000000D.00000003.1992251934.000002988557E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1985565174.0000029885589000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1989052693.0000029885589000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1989801273.0000029885589000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1984967237.0000029885589000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1990530385.0000029885589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: gmpopenh264.dll.tmp.13.dr	String found in binary or memory: http://www.mozilla.com0
Source: firefox.exe, 0000000D.00000003.1963172855.000002988F5F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 0000000D.00000003.1856953213.00000298867F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1965420879.000002988D99C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1970482803.0000029887FB1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1988680420.0000029887FB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1970482803.0000029887F67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000000D.00000003.1970482803.0000029887FB1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1988680420.0000029887FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 00000010.00000002.3021622390.0000020C125FD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1848693076.0000020C125FD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1849685684.0000020C125FD000.00000004.00000020.00020000.00000000.sdmp, mozilla-temp-41.13.dr	String found in binary or memory: http://www.videolan.org/x264.html
Source: firefox.exe, 0000000D.00000003.1961405065.000002989184A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1965137487.000002988D9EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: firefox.exe, 0000000D.00000003.1961405065.000002989184A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1965137487.000002988D9EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000000D.00000003.1963172855.000002988F5EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: firefox.exe, 0000000D.00000003.1964124007.000002988F57A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1816942616.0000029885977000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1816809632.000002988595A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1816348887.0000029885700000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1816637497.000002988593C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1816485008.000002988591F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 0000000D.00000003.1966044441.0000029889061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 0000000D.00000003.1980526103.000002988E154000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1986911192.0000029891A1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1976585446.0000029891A1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1960119629.0000029891A1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000000D.00000003.1980526103.000002988E17B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 0000000D.00000003.1953178911.0000029886C6A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1928774772.00000298879CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1887018999.0000029886C47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1970482803.0000029887FE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1952263119.0000029886C83000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1986911192.0000029891A1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1952395425.0000029886C5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1952701176.0000029886C9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1887018999.0000029886C9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1976585446.0000029891A1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1960119629.0000029891A1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000000D.00000003.1985458304.00000298FFA9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000000D.00000003.1968617068.0000029888448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000000D.00000003.1978993310.000002988F460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000000D.00000003.1963172855.000002988F5F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1981259590.000002988DFB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000000D.00000003.1976585446.0000029891A32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000000D.00000003.1977679237.000002988FE79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1960119629.0000029891A9D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1976388461.0000029891A9D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1987321603.000002988FE79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1962151432.000002988FE79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: firefox.exe, 0000000D.00000003.1985458304.00000298FFA6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.3016075236.0000024ABB5CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3015225093.0000020C118E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3019338953.000001F7FF704000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.13.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: firefox.exe, 0000000D.00000003.1985458304.00000298FFA6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.3016075236.0000024ABB5CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3015225093.0000020C118E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3019338953.000001F7FF704000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.13.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 0000000D.00000003.1985458304.00000298FFA28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000000D.00000003.1911212138.00000298879F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1879871313.0000029886FA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1909406210.00000298879F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1189266
Source: firefox.exe, 0000000D.00000003.1880946360.0000029886FAE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1911212138.00000298879F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1879871313.0000029886FA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1909406210.00000298879F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1193802
Source: firefox.exe, 0000000D.00000003.1909406210.00000298879DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1908448683.0000029887AF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1879871313.0000029886FA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1879871313.0000029886F82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1909406210.00000298879F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1207993
Source: firefox.exe, 0000000D.00000003.1879871313.0000029886F96000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1909406210.00000298879DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1266220
Source: firefox.exe, 0000000D.00000003.1911212138.00000298879F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1879871313.0000029886FA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1909406210.00000298879F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1283601
Source: firefox.exe, 0000000D.00000003.1988161888.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964561554.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000000D.00000003.1988161888.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964561554.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000000D.00000003.1988161888.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964561554.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000000D.00000003.1988161888.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964561554.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: firefox.exe, 0000000D.00000003.1908448683.0000029887AF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1880946360.0000029886FAE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1911212138.00000298879F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1879871313.0000029886FA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1909406210.00000298879F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1678448
Source: firefox.exe, 0000000D.00000003.1876317916.00000298877D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1883850105.00000298877D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1872025667.00000298877D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1934565326.00000298877D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1694699#c21
Source: firefox.exe, 0000000D.00000003.1879871313.0000029886FA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1909406210.00000298879F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=792480
Source: firefox.exe, 0000000D.00000003.1879871313.0000029886F76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1879871313.0000029886F96000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1909406210.00000298879DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1908448683.0000029887AF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1879871313.0000029886FA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1909406210.00000298879F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=809550
Source: firefox.exe, 0000000D.00000003.1879871313.0000029886F96000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1909406210.00000298879DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1908448683.0000029887AF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1879871313.0000029886FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=840161
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000000D.00000003.1816942616.0000029885977000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1816809632.000002988595A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1816348887.0000029885700000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1816637497.000002988593C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1816485008.000002988591F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000000D.00000003.1977679237.000002988FE66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 0000000D.00000003.1961911167.000002988FE94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/
Source: firefox.exe, 0000000D.00000003.1962151432.000002988FE10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1980257539.000002988E1E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: firefox.exe, 0000000D.00000003.1985458304.00000298FFA6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.3016075236.0000024ABB5CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3015225093.0000020C118E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3019338953.000001F7FF704000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.13.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: firefox.exe, 0000000D.00000003.1985458304.00000298FFA6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.3016075236.0000024ABB5CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3015225093.0000020C118E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3019338953.000001F7FF704000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.13.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000000D.00000003.1980526103.000002988E154000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854585762.000002988E287000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 0000000D.00000003.1854585762.000002988E287000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 0000000D.00000003.1854585762.000002988E287000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1979365336.000002988E2F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854585762.000002988E2F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000000D.00000003.1941855133.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1920212591.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1847899623.000002988E0BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1924490587.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1849161193.000002988E0BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000000D.00000003.1983028764.00000298872D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1986911192.0000029891A1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1976585446.0000029891A1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1960119629.0000029891A1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://datastudio.google.com/embed/reporting/
Source: firefox.exe, 0000000D.00000003.1962595375.000002988F9A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc
Source: firefox.exe, 0000000D.00000003.1962595375.000002988F9A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 0000000D.00000003.1962595375.000002988F9A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureElementReleaseCaptureWarning
Source: firefox.exe, 0000000D.00000003.1962595375.000002988F9A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#EncryptionPreventDefaultFromP
Source: firefox.exe, 0000000D.00000003.1918641063.00000298875AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 0000000D.00000003.1941855133.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1920212591.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1924490587.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1849161193.000002988E0BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000000D.00000003.1941855133.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1920212591.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1924490587.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1849161193.000002988E0BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000000D.00000003.1941855133.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1920212591.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1847899623.000002988E0BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1924490587.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1849161193.000002988E0BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000000D.00000003.1963508678.000002988F5B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 0000000D.00000003.1978993310.000002988F460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: firefox.exe, 0000000D.00000003.1818173241.0000029883233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1819680648.0000029883230000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1819566427.0000029883217000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000000D.00000003.1818173241.0000029883233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1819680648.0000029883230000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1819566427.0000029883217000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000000D.00000003.1962595375.000002988F9A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 0000000D.00000003.1988161888.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964561554.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3015225093.0000020C11812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3014895067.000001F7FF413000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000000D.00000003.1857588643.000002988F3F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1858375875.000002988F3F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000000D.00000003.1961405065.00000298918AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com
Source: firefox.exe, 0000000D.00000003.1977294376.00000298918F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/
Source: firefox.exe, 0000000D.00000003.1985458304.00000298FFA55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000000D.00000003.1968617068.0000029888448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000000D.00000003.1988161888.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964561554.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3015225093.0000020C11812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3014895067.000001F7FF413000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000000D.00000003.1854585762.000002988E287000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964561554.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1970255571.00000298880ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3015225093.0000020C118C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3014895067.000001F7FF4C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000000D.00000003.1988161888.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1855933176.00000298880ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964561554.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1970255571.00000298880ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3015225093.0000020C118C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3014895067.000001F7FF4C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000000D.00000003.1964561554.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3015225093.0000020C1182F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3014895067.000001F7FF430000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000000D.00000003.1979365336.000002988E287000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854585762.000002988E287000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 0000000D.00000003.1979365336.000002988E287000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854585762.000002988E287000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 0000000D.00000003.1979365336.000002988E287000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854585762.000002988E287000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 0000000D.00000003.1979365336.000002988E287000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854585762.000002988E287000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 0000000D.00000003.1979365336.000002988E287000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854585762.000002988E287000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 0000000D.00000003.1979365336.000002988E287000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854585762.000002988E287000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 0000000D.00000003.1979365336.000002988E287000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854585762.000002988E287000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 0000000D.00000003.1855933176.00000298880ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1970255571.00000298880ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3015225093.0000020C118C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3014895067.000001F7FF4C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000000D.00000003.1988161888.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964561554.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 0000000D.00000003.1979365336.000002988E287000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854585762.000002988E287000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 0000000D.00000003.1980354246.000002988E1A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000000D.00000003.1979365336.000002988E287000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854585762.000002988E287000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 0000000D.00000003.1855933176.00000298880ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1970255571.00000298880ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3015225093.0000020C118C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3014895067.000001F7FF4C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000000D.00000003.1988161888.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964561554.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 0000000D.00000003.1988161888.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964561554.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 0000000D.00000003.1988161888.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964561554.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000000D.00000003.1941855133.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1920212591.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1847899623.000002988E0BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1924490587.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1849161193.000002988E0BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000000D.00000003.1941855133.000002988E09C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1924490587.000002988E08E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1920212591.000002988E08E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1972744320.000002988E09F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000000D.00000003.1941855133.000002988E09C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1924490587.000002988E08E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1920212591.000002988E08E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1972744320.000002988E09F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000000D.00000003.1941855133.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1920212591.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1924490587.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1849161193.000002988E0BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000000D.00000003.1941855133.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1920212591.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1924490587.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1849161193.000002988E0BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000000D.00000003.1816942616.0000029885977000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1816809632.000002988595A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1816348887.0000029885700000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1816637497.000002988593C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1816485008.000002988591F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000000D.00000003.1960119629.0000029891A9D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1976388461.0000029891A9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: firefox.exe, 0000000D.00000003.1988161888.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964561554.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000000D.00000003.1988161888.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964561554.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000000D.00000003.1988161888.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964561554.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 0000000D.00000003.1979365336.000002988E2F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: firefox.exe, 0000000D.00000003.1988161888.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964561554.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000000D.00000003.1968617068.0000029888448000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1887018999.0000029886C47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1983028764.00000298872D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1973415095.0000029886F3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ib.absa.co.za/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000000D.00000003.1961405065.0000029891897000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/oldsyncS
Source: firefox.exe, 0000000D.00000003.1961405065.0000029891897000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/H
Source: firefox.exe, 0000000D.00000003.1961405065.0000029891897000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/HCX
Source: firefox.exe, 0000000D.00000003.1961405065.0000029891897000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryU
Source: firefox.exe, 0000000D.00000003.1961405065.0000029891897000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryUFj
Source: firefox.exe, 0000000D.00000003.1979365336.000002988E287000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854585762.000002988E287000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: prefs-1.js.13.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000000D.00000003.1961911167.000002988FEB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000014.00000002.3014895067.000001F7FF4F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000000D.00000003.1975809023.00000298920DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/messaging-system/undesired-events/1/cebfa510-3f9c-4eae
Source: firefox.exe, 0000000D.00000003.1988161888.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964561554.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 0000000D.00000003.1941855133.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1920212591.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1924490587.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1849161193.000002988E0BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000000D.00000003.1854501094.000002988F4B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964264894.000002988F4BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000000D.00000003.1941855133.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1920212591.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1924490587.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1849161193.000002988E0BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000000D.00000003.1941855133.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1920212591.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1924490587.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1849161193.000002988E0BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000000D.00000003.1941855133.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1920212591.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1924490587.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1849161193.000002988E0BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000000D.00000003.1856152981.00000298870D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000000D.00000003.1966044441.0000029889061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000000D.00000003.1970482803.0000029887F10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1966044441.0000029889061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000000D.00000003.1983028764.00000298872D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1986911192.0000029891A1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1976585446.0000029891A1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1960119629.0000029891A1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lookerstudio.google.com/embed/reporting/
Source: firefox.exe, 0000000D.00000003.1818173241.0000029883233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1819680648.0000029883230000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1819566427.0000029883217000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000000D.00000003.1818173241.0000029883233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1819680648.0000029883230000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1819566427.0000029883217000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000000D.00000003.1818173241.0000029883233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1819680648.0000029883230000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1819566427.0000029883217000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000010.00000002.3015225093.0000020C11886000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3014895067.000001F7FF48F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000000D.00000003.1876317916.00000298877FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mochitest.youtube.com/
Source: firefox.exe, 0000000D.00000003.1968617068.0000029888448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000000D.00000003.1985565174.0000029885589000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1984967237.0000029885589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org0/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000000D.00000003.1818173241.0000029883233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1819680648.0000029883230000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1819566427.0000029883217000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000000D.00000003.1876317916.00000298877FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/page/
Source: firefox.exe, 0000000D.00000003.1876317916.00000298877FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/player/
Source: firefox.exe, 0000000D.00000003.1818173241.0000029883233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1819680648.0000029883230000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1819566427.0000029883217000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000000D.00000003.1977294376.00000298918F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com
Source: firefox.exe, 0000000D.00000003.1961911167.000002988FE94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com/
Source: firefox.exe, 0000000D.00000003.1964561554.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000000D.00000003.1977679237.000002988FE79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1987321603.000002988FE79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1962151432.000002988FE79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000000D.00000003.1980257539.000002988E1E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000000D.00000003.1816485008.000002988591F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000000D.00000003.1918641063.00000298875AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000000D.00000003.1968617068.000002988847F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1982060265.000002988847F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000000D.00000003.1964124007.000002988F588000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000000D.00000003.1980354246.000002988E1A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 0000000D.00000003.1981109992.000002988E110000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3015225093.0000020C11812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3014895067.000001F7FF413000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000000D.00000003.1981109992.000002988E110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000000D.00000003.1979365336.000002988E287000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854585762.000002988E287000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 0000000D.00000003.1979365336.000002988E287000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854585762.000002988E287000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 0000000D.00000003.1988161888.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964561554.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3020519911.0000020C12406000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3014895067.000001F7FF4F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000014.00000002.3014895067.000001F7FF4F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user=
Source: firefox.exe, 0000000D.00000003.1968617068.0000029888448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000000D.00000003.1988352830.0000029888140000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854929849.0000029888143000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000000D.00000003.1964561554.000002988DFC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1981259590.000002988DFC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 0000000D.00000003.1961005106.00000298918D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000000D.00000003.1962595375.000002988F9A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaPlatformDecoderNotFoundT
Source: firefox.exe, 0000000D.00000003.1962595375.000002988F9A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaWMFNeededTo
Source: firefox.exe, 0000000D.00000003.1995195982.0000029888FE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1993040967.0000029888FE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1922775352.0000029888FD3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1957103164.0000029888FCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000000D.00000003.1966044441.000002988906C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 0000000D.00000003.1961005106.00000298918D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: firefox.exe, 0000000D.00000003.1941855133.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1920212591.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1924490587.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1849161193.000002988E0BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000000D.00000003.1962595375.000002988F9A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000000D.00000003.1962595375.000002988F9A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000000D.00000003.1962595375.000002988F9A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000000D.00000003.1962595375.000002988F9A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000000D.00000003.1985458304.00000298FFA9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000000D.00000003.1968617068.0000029888448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com/
Source: firefox.exe, 0000000D.00000003.1963508678.000002988F5B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000000D.00000003.1988161888.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964561554.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000000D.00000003.1980354246.000002988E1A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1978993310.000002988F460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000000D.00000003.1941855133.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1920212591.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1847899623.000002988E0BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1924490587.000002988E0AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1849161193.000002988E0BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000000D.00000003.1978993310.000002988F460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000000D.00000003.1978993310.000002988F460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 0000000D.00000003.1978993310.000002988F460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 0000000D.00000003.1963508678.000002988F5B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: firefox.exe, 0000000D.00000003.1985458304.00000298FFA6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.3016075236.0000024ABB5CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3015225093.0000020C118E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3019338953.000001F7FF704000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.13.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 0000000D.00000003.1816942616.0000029885977000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1816809632.000002988595A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1816348887.0000029885700000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1816637497.000002988593C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1934843386.0000029887708000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1816485008.000002988591F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000000D.00000003.1962151432.000002988FE10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 0000000D.00000003.1985458304.00000298FFA28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1978993310.000002988F460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 0000000D.00000003.1987843430.000002988F4E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1978993310.000002988F460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964264894.000002988F4E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854363427.000002988F4F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 0000000D.00000003.1978993310.000002988F460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000000D.00000003.1987843430.000002988F4E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964264894.000002988F4E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854363427.000002988F4F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000000D.00000003.1978993310.000002988F460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: firefox.exe, 0000000D.00000003.1987843430.000002988F4E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964264894.000002988F4E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854363427.000002988F4F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: gmpopenh264.dll.tmp.13.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: firefox.exe, 0000000D.00000003.1987843430.000002988F4E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964264894.000002988F4E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854363427.000002988F4F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 0000000D.00000003.1978993310.000002988F460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: firefox.exe, 0000000D.00000003.1985458304.00000298FFA6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1985458304.00000298FFA77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.3016075236.0000024ABB5CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3015225093.0000020C118E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3019338953.000001F7FF704000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.13.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 0000000D.00000003.1963508678.000002988F5CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1987992702.000002988E211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000000D.00000003.1988161888.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964561554.000002988DF4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 0000000D.00000003.1980526103.000002988E17B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1848630165.000002988E321000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1850511387.000002988E387000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000000D.00000003.1816942616.0000029885977000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1816809632.000002988595A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1816348887.0000029885700000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1816637497.000002988593C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1816485008.000002988591F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: firefox.exe, 0000000D.00000003.1981109992.000002988E110000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1816485008.000002988591F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000000D.00000003.1961005106.00000298918DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000000D.00000003.1876317916.00000298877FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hulu.com/watch/
Source: firefox.exe, 0000000D.00000003.1978993310.000002988F460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000000D.00000003.1876317916.00000298877FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.instagram.com/
Source: firefox.exe, 0000000D.00000003.1978993310.000002988F460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000000D.00000003.1978993310.000002988F460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 0000000D.00000003.1980526103.000002988E177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1985458304.00000298FFA28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964264894.000002988F4B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1980526103.000002988E179000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000000D.00000003.1968617068.0000029888448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: firefox.exe, 0000000D.00000003.1961005106.00000298918D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: firefox.exe, 0000000D.00000003.1857588643.000002988F3F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1858375875.000002988F3F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 0000000D.00000003.1961005106.00000298918D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: targeting.snapshot.json.tmp.13.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: firefox.exe, 0000000D.00000003.1961005106.00000298918D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964124007.000002988F598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: firefox.exe, 0000000D.00000003.1961005106.00000298918D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 00000010.00000002.3015225093.0000020C118C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3014895067.000001F7FF4F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000000D.00000003.1979365336.000002988E287000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854585762.000002988E287000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 0000000F.00000002.3016075236.0000024ABB5CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/&
Source: firefox.exe, 0000000F.00000002.3015589403.0000024ABB340000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3018906453.0000020C11D60000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.3014387735.000001F7FF2C0000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000014.00000002.3014895067.000001F7FF4F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/Trp
Source: firefox.exe, 0000000D.00000003.1979365336.000002988E287000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1854585762.000002988E287000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: firefox.exe, 0000000D.00000003.1961005106.00000298918D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 0000000D.00000003.1966044441.0000029889061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000000D.00000003.1980354246.000002988E1A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1978993310.000002988F460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000000D.00000003.1963508678.000002988F5B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000000D.00000003.1962595375.000002988F974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/
Source: firefox.exe, 0000000D.00000003.1978993310.000002988F460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 00000014.00000002.3014895067.000001F7FF40C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000000D.00000003.1980354246.000002988E1A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000000D.00000003.1962595375.000002988F9A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 0000000D.00000003.1970482803.0000029887FC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000000D.00000003.1966044441.0000029889061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: recovery.jsonlz4.tmp.13.dr	String found in binary or memory: https://youtube.com/account?=
Source: firefox.exe, 00000014.00000002.3018595456.000001F7FF500000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/sig
Source: firefox.exe, 0000000D.00000003.1977679237.000002988FE66000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1949189288.0000029887AD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1970989257.0000029887EA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1887018999.0000029886CA6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1911839096.0000029887AD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1949950246.000002988772F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.3013998055.0000024ABB19A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.3013998055.0000024ABB190000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.3019799132.0000024ABB6A4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3012538823.0000020C1153A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3013777088.0000020C116C4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3012538823.0000020C11530000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3018595456.000001F7FF504000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3013147809.000001F7FF200000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3013147809.000001F7FF20A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000000B.00000002.1793142994.0000015B60A70000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.1799892019.0000027077179000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000010.00000002.3012538823.0000020C1153A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd6
Source: firefox.exe, 0000000F.00000002.3013998055.0000024ABB190000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.3019799132.0000024ABB6A4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3013777088.0000020C116C4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3012538823.0000020C11530000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3018595456.000001F7FF504000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3013147809.000001F7FF200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: file.exe, 00000000.00000002.1822324045.0000000001890000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdf_6.0.1
Source: firefox.exe, 0000000D.00000003.1970482803.0000029887FE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1988568730.0000029887FE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comP-

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.91:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49859 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FBEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00FBEAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FBED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00FBED6A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FBEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00FBEAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FAAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00FAAA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FD9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00FD9576

System Summary

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000002.1821829043.0000000001002000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_847e7815-0
Source: file.exe, 00000000.00000002.1821829043.0000000001002000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_49e1785b-3
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_1fdabc35-4
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_7da8c58b-b

Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 16_2_0000020C11DD58B7 NtQuerySystemInformation,		16_2_0000020C11DD58B7
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 16_2_0000020C11DF98F2 NtQuerySystemInformation,		16_2_0000020C11DF98F2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FAD5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00FAD5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FA1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00FA1201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FAE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00FAE8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F48060		0_2_00F48060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB2046		0_2_00FB2046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA8298		0_2_00FA8298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F7E4FF		0_2_00F7E4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F7676B		0_2_00F7676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD4873		0_2_00FD4873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F4CAF0		0_2_00F4CAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6CAA0		0_2_00F6CAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F5CC39		0_2_00F5CC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F76DD9		0_2_00F76DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F491C0		0_2_00F491C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F5B119		0_2_00F5B119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F61394		0_2_00F61394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F61706		0_2_00F61706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6781B		0_2_00F6781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F619B0		0_2_00F619B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F5997D		0_2_00F5997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F47920		0_2_00F47920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F67A4A		0_2_00F67A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F67CA7		0_2_00F67CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F61C77		0_2_00F61C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F79EEE		0_2_00F79EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCBE44		0_2_00FCBE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F61F32		0_2_00F61F32
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 16_2_0000020C11DD58B7		16_2_0000020C11DD58B7
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 16_2_0000020C11DF98F2		16_2_0000020C11DF98F2
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 16_2_0000020C11DFA01C		16_2_0000020C11DFA01C
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 16_2_0000020C11DF9932		16_2_0000020C11DF9932

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00F5F9F2 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00F60A30 appears 46 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal64.troj.evad.winEXE@34/36@69/12

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FB37B5 GetLastError,FormatMessageW,

0_2_00FB37B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA10BF AdjustTokenPrivileges,CloseHandle,		0_2_00FA10BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00FA16C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FB51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00FB51CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FAD4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00FAD4DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FB648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00FB648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F442A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00F442A2

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File created: C:\Users\user\AppData\Local\Mozilla\Firefox\SkeletonUILock-c388d246

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7336:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7628:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7508:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7564:120:WilError_03

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File created: C:\Users\user\AppData\Local\Temp\firefox

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: firefox.exe, 0000000D.00000003.1961911167.000002988FE98000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1961405065.0000029891871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE timestamp BETWEEN date(:dateFrom) AND date(:dateTo);
Source: firefox.exe, 0000000D.00000003.1961405065.0000029891871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE events (id INTEGER PRIMARY KEY, type INTEGER NOT NULL, count INTEGER NOT NULL, timestamp DATE );
Source: firefox.exe, 0000000D.00000003.1961405065.0000029891871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INSERT INTO events (type, count, timestamp) VALUES (:type, 1, date(:date));
Source: firefox.exe, 0000000D.00000003.1961405065.0000029891871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;
Source: firefox.exe, 0000000D.00000003.1960119629.0000029891A32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1976585446.0000029891A32000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;
Source: firefox.exe, 0000000D.00000003.1961405065.0000029891871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;Fy6
Source: firefox.exe, 0000000D.00000003.1961405065.0000029891871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE events SET count = count + 1 WHERE id = :id;-
Source: firefox.exe, 0000000D.00000003.1961405065.0000029891871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9'
Source: firefox.exe, 0000000D.00000003.1961405065.0000029891871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9
Source: firefox.exe, 0000000D.00000003.1961405065.0000029891871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE type = :type AND timestamp = date(:date);

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2292 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2212 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7c5687c-def4-45c9-ae4a-1b0aa07de766} 7736 "\\.\pipe\gecko-crash-server-pipe.7736" 298f5c6ed10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4232 -parentBuildID 20230927232528 -prefsHandle 4340 -prefMapHandle 4220 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {55fd1972-1430-4133-9bd8-75ac33fba38e} 7736 "\\.\pipe\gecko-crash-server-pipe.7736" 29887e24510 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4908 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 3536 -prefMapHandle 3456 -prefsLen 33185 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {76630401-2e09-4eaa-8952-b3400db86ea9} 7736 "\\.\pipe\gecko-crash-server-pipe.7736" 29891abbf10 utility
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking			Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking			Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2292 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2212 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7c5687c-def4-45c9-ae4a-1b0aa07de766} 7736 "\\.\pipe\gecko-crash-server-pipe.7736" 298f5c6ed10 socket			Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4232 -parentBuildID 20230927232528 -prefsHandle 4340 -prefMapHandle 4220 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {55fd1972-1430-4133-9bd8-75ac33fba38e} 7736 "\\.\pipe\gecko-crash-server-pipe.7736" 29887e24510 rdd			Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4908 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 3536 -prefMapHandle 3456 -prefsLen 33185 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {76630401-2e09-4eaa-8952-b3400db86ea9} 7736 "\\.\pipe\gecko-crash-server-pipe.7736" 29891abbf10 utility			Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.13.dr
Source:	Binary string: xWindows.Security.Integrity.pdb source: firefox.exe, 0000000D.00000003.1978629354.000002988F926000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1987578137.000002988F926000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: NapiNSP.pdbUGP source: firefox.exe, 0000000D.00000003.1996968204.00000298855B9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: NapiNSP.pdb source: firefox.exe, 0000000D.00000003.1996968204.00000298855B9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: xWindows.StateRepositoryPS.pdb source: firefox.exe, 0000000D.00000003.1978629354.000002988F926000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1987578137.000002988F926000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: netprofm.pdb source: firefox.exe, 0000000D.00000003.1993881961.00000298855B3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.13.dr
Source:	Binary string: netprofm.pdbUGP source: firefox.exe, 0000000D.00000003.1993881961.00000298855B3000.00000004.00000020.00020000.00000000.sdmp

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00F442DE

Source: gmpopenh264.dll.tmp.13.dr

Static PE information: section name: .rodata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F60A76 push ecx; ret

0_2_00F60A89

Persistence and Installation Behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp			Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F5F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00F5F98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00FD1C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

Source: C:\Program Files\Mozilla Firefox\firefox.exe

Code function: 16_2_0000020C11DD58B7 rdtsc

16_2_0000020C11DD58B7

Source: C:\Users\user\Desktop\file.exe

API coverage: 3.6 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FADBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,		0_2_00FADBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB68EE FindFirstFileW,FindClose,		0_2_00FB68EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,		0_2_00FB698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FAD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,		0_2_00FAD076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FAD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,		0_2_00FAD3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,		0_2_00FB9642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,		0_2_00FB979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,		0_2_00FB9B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB5C97 FindFirstFileW,FindNextFileW,FindClose,		0_2_00FB5C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00F442DE

Source: firefox.exe, 00000010.00000002.3012538823.0000020C1153A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPh
Source: firefox.exe, 0000000F.00000002.3013998055.0000024ABB19A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll,=
Source: firefox.exe, 00000010.00000002.3020077726.0000020C11E72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllR
Source: firefox.exe, 0000000F.00000002.3013998055.0000024ABB19A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3020077726.0000020C11E60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 0000000F.00000002.3020257579.0000024ABB720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: firefox.exe, 0000000F.00000002.3020956350.0000024ABBB40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll,
Source: firefox.exe, 00000014.00000002.3019052622.000001F7FF510000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWwz
Source: firefox.exe, 00000014.00000002.3013147809.000001F7FF20A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@%Q
Source: firefox.exe, 0000000F.00000002.3020956350.0000024ABBB40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Source: C:\Program Files\Mozilla Firefox\firefox.exe

Code function: 16_2_0000020C11DD58B7 rdtsc

16_2_0000020C11DD58B7

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FBEAA2 BlockInput,

0_2_00FBEAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F72622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00F72622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00F442DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F64CE8 mov eax, dword ptr fs:[00000030h]

0_2_00F64CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FA0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00FA0B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F72622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00F72622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00F6083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F609D5 SetUnhandledExceptionFilter,		0_2_00F609D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F60C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00F60C21

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FA1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00FA1201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F82BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00F82BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FAB226 SendInput,keybd_event,

0_2_00FAB226

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_00FC22DA

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FA0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00FA0B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FA1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00FA1663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F60698 cpuid

0_2_00F60698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FB8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00FB8195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F9D27A GetUserNameW,

0_2_00F9D27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F7BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00F7BB6F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00F442DE

Stealing of Sensitive Information

Source: Yara match

File source: Process Memory Space: file.exe PID: 7312, type: MEMORYSTR

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Remote Access Functionality

Source: Yara match

File source: Process Memory Space: file.exe PID: 7312, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00FC1204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00FC1806