hxxps://adobe-after-effects[.]download-windows[.]org/adobe-after-effects-x64

Resubmissions

06/04/2024, 14:19 UTC

240406-rnb5gacb8x 1

06/04/2024, 13:32 UTC

240406-qsyzcsca74 1

06/04/2024, 12:23 UTC

240406-pkz11sab5v 8

Analysis

max time kernel
1705s
max time network
1760s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 13:32 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://adobe-after-effects.download-windows.org/adobe-after-effects-x64

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Adobe_After_Effects_CC_2017_ru.iso:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1776	firefox.exe
Token: SeDebugPrivilege	1776	firefox.exe
Token: SeDebugPrivilege	1776	firefox.exe
Token: SeDebugPrivilege	1776	firefox.exe
Token: SeDebugPrivilege	1776	firefox.exe
Token: SeDebugPrivilege	1776	firefox.exe
Token: SeManageVolumePrivilege	4972	svchost.exe
Token: SeDebugPrivilege	1776	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1776	firefox.exe
1776	firefox.exe
1776	firefox.exe
1776	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1776	firefox.exe
1776	firefox.exe
1776	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1776	firefox.exe
1776	firefox.exe
1776	firefox.exe
1776	firefox.exe
1776	firefox.exe
1776	firefox.exe
1776	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 1776	3524	firefox.exe	85
PID 3524 wrote to memory of 1776	3524	firefox.exe	85
PID 3524 wrote to memory of 1776	3524	firefox.exe	85
PID 3524 wrote to memory of 1776	3524	firefox.exe	85
PID 3524 wrote to memory of 1776	3524	firefox.exe	85
PID 3524 wrote to memory of 1776	3524	firefox.exe	85
PID 3524 wrote to memory of 1776	3524	firefox.exe	85
PID 3524 wrote to memory of 1776	3524	firefox.exe	85
PID 3524 wrote to memory of 1776	3524	firefox.exe	85
PID 3524 wrote to memory of 1776	3524	firefox.exe	85
PID 3524 wrote to memory of 1776	3524	firefox.exe	85
PID 1776 wrote to memory of 64	1776	firefox.exe	86
PID 1776 wrote to memory of 64	1776	firefox.exe	86
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5056	1776	firefox.exe	87
PID 1776 wrote to memory of 5028	1776	firefox.exe	88
PID 1776 wrote to memory of 5028	1776	firefox.exe	88
PID 1776 wrote to memory of 5028	1776	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://adobe-after-effects.download-windows.org/adobe-after-effects-x64"
1⤵
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://adobe-after-effects.download-windows.org/adobe-after-effects-x64
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1776.0.1785913323\1795031880" -parentBuildID 20221007134813 -prefsHandle 1840 -prefMapHandle 1832 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {12e9dbc7-4ac6-457d-9560-4393a54fb4bf} 1776 "\\.\pipe\gecko-crash-server-pipe.1776" 1920 1eb9bc83158 gpu
    3⤵
    PID:64
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1776.1.1912325184\1340887001" -parentBuildID 20221007134813 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {868c0b2a-1243-4165-a985-bc70864b912f} 1776 "\\.\pipe\gecko-crash-server-pipe.1776" 1992 1eb9a9f1c58 socket
    3⤵
    PID:5056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1776.2.112932126\1773658727" -childID 1 -isForBrowser -prefsHandle 3052 -prefMapHandle 3068 -prefsLen 21668 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b293b403-9314-4868-951f-2c8e5ced0e47} 1776 "\\.\pipe\gecko-crash-server-pipe.1776" 3236 1eb9ecbbf58 tab
    3⤵
    PID:5028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1776.3.1248006632\1739394202" -childID 2 -isForBrowser -prefsHandle 3628 -prefMapHandle 3624 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {19c04b4f-6f73-4d8a-9e0b-6561ab65b98e} 1776 "\\.\pipe\gecko-crash-server-pipe.1776" 3640 1eb9fb07358 tab
    3⤵
    PID:1436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1776.4.1548784981\32960726" -childID 3 -isForBrowser -prefsHandle 5100 -prefMapHandle 5004 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6cd4f47-c3cb-4a15-bd86-2bcff670c204} 1776 "\\.\pipe\gecko-crash-server-pipe.1776" 5128 1eba1418a58 tab
    3⤵
    PID:3128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1776.5.1859453678\2065608656" -childID 4 -isForBrowser -prefsHandle 5268 -prefMapHandle 5272 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b0edfed-5b26-4648-ac99-9a3a040105f8} 1776 "\\.\pipe\gecko-crash-server-pipe.1776" 5260 1eba141a858 tab
    3⤵
    PID:4444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1776.6.757992567\1482482563" -childID 5 -isForBrowser -prefsHandle 5476 -prefMapHandle 5480 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1164 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbafd995-e7d8-48c9-b899-0687df22d28f} 1776 "\\.\pipe\gecko-crash-server-pipe.1776" 5468 1eba1419958 tab
    3⤵
    PID:4236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1776.7.2007160977\2017249727" -parentBuildID 20221007134813 -prefsHandle 5304 -prefMapHandle 5308 -prefsLen 26206 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ff69ddc-0549-4f91-a722-e0ab7fd19ab9} 1776 "\\.\pipe\gecko-crash-server-pipe.1776" 5988 1eba1d99658 rdd
    3⤵
    PID:3240

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4556

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4972

Network

DNS

adobe-after-effects.download-windows.org

firefox.exe

Remote address:

8.8.8.8:53

Request

adobe-after-effects.download-windows.org

IN A

Response

adobe-after-effects.download-windows.org

IN A

193.42.111.249
DNS

contile.services.mozilla.com

firefox.exe

Remote address:

8.8.8.8:53

Request

contile.services.mozilla.com

IN A

Response

contile.services.mozilla.com

IN A

34.117.237.239
DNS

adobe-after-effects.download-windows.org

firefox.exe

Remote address:

8.8.8.8:53

Request

adobe-after-effects.download-windows.org

IN A

Response

adobe-after-effects.download-windows.org

IN A

193.42.111.249
DNS

content-signature-2.cdn.mozilla.net

firefox.exe

Remote address:

8.8.8.8:53

Request

content-signature-2.cdn.mozilla.net

IN A

Response

content-signature-2.cdn.mozilla.net

IN CNAME

content-signature-chains.prod.autograph.services.mozaws.net

content-signature-chains.prod.autograph.services.mozaws.net

IN CNAME

prod.content-signature-chains.prod.webservices.mozgcp.net

prod.content-signature-chains.prod.webservices.mozgcp.net

IN A

34.160.144.191
DNS

shavar.services.mozilla.com

firefox.exe

Remote address:

8.8.8.8:53

Request

shavar.services.mozilla.com

IN A

Response

shavar.services.mozilla.com

IN CNAME

shavar.prod.mozaws.net

shavar.prod.mozaws.net

IN A

54.245.32.185

shavar.prod.mozaws.net

IN A

44.239.14.124

shavar.prod.mozaws.net

IN A

44.239.148.246
DNS

push.services.mozilla.com

firefox.exe

Remote address:

8.8.8.8:53

Request

push.services.mozilla.com

IN A

Response

push.services.mozilla.com

IN CNAME

autopush.prod.mozaws.net

autopush.prod.mozaws.net

IN A

34.107.243.93
DNS

firefox.settings.services.mozilla.com

firefox.exe

Remote address:

8.8.8.8:53

Request

firefox.settings.services.mozilla.com

IN A

Response

firefox.settings.services.mozilla.com

IN CNAME

prod.remote-settings.prod.webservices.mozgcp.net

prod.remote-settings.prod.webservices.mozgcp.net

IN A

34.149.100.209
GET

https://contile.services.mozilla.com/v1/tiles

firefox.exe

Remote address:

34.117.237.239:443

Request

GET /v1/tiles HTTP/2.0
host: contile.services.mozilla.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
accept: */*
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: cross-site
te: trailers
DNS

contile.services.mozilla.com

firefox.exe

Remote address:

8.8.8.8:53

Request

contile.services.mozilla.com

IN A

Response

contile.services.mozilla.com

IN A

34.117.237.239
DNS

prod.content-signature-chains.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.content-signature-chains.prod.webservices.mozgcp.net

IN A

Response

prod.content-signature-chains.prod.webservices.mozgcp.net

IN A

34.160.144.191
DNS

adobe-after-effects.download-windows.org

firefox.exe

Remote address:

8.8.8.8:53

Request

adobe-after-effects.download-windows.org

IN AAAA

Response
GET

https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

firefox.exe

Remote address:

34.149.100.209:443

Request

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/2.0
host: firefox.settings.services.mozilla.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
accept: application/json
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
content-type: application/json
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: cross-site
if-modified-since: Fri, 25 Mar 2022 17:45:46 GMT
if-none-match: "1648230346554"
te: trailers

Response

HTTP/2.0 200

server: nginx
content-length: 232
access-control-allow-origin: *
access-control-expose-headers: Backoff, Retry-After, Content-Length, Alert, Content-Type
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
via: 1.1 google
date: Sat, 06 Apr 2024 13:21:38 GMT
age: 655
last-modified: Sat, 06 Apr 2024 09:57:12 GMT
content-type: application/json
last-modified: Sat, 06 Apr 2024 09:57:12 GMT
content-type: application/json
GET

https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?collection=partitioning-exempt-urls&bucket=main&_expected=0

firefox.exe

Remote address:

34.149.100.209:443

Request

GET /v1/buckets/monitor/collections/changes/changeset?collection=partitioning-exempt-urls&bucket=main&_expected=0 HTTP/2.0
host: firefox.settings.services.mozilla.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
accept: */*
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
sec-fetch-dest: empty
sec-fetch-mode: no-cors
sec-fetch-site: cross-site
te: trailers

Response

HTTP/2.0 200

server: nginx
content-length: 232
access-control-allow-origin: *
access-control-expose-headers: Backoff, Retry-After, Content-Length, Alert, Content-Type
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
via: 1.1 google
date: Sat, 06 Apr 2024 13:21:38 GMT
age: 655
last-modified: Sat, 06 Apr 2024 09:57:12 GMT
content-type: application/json
last-modified: Sat, 06 Apr 2024 09:57:12 GMT
content-type: application/json
GET

https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/partitioning-exempt-urls/changeset?_expected=1702403047185

firefox.exe

Remote address:

34.149.100.209:443

Request

GET /v1/buckets/main/collections/partitioning-exempt-urls/changeset?_expected=1702403047185 HTTP/2.0
host: firefox.settings.services.mozilla.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
accept: application/json
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
content-type: application/json
sec-fetch-dest: empty
sec-fetch-mode: no-cors
sec-fetch-site: cross-site
te: trailers

Response

HTTP/2.0 200

server: nginx
content-length: 232
access-control-allow-origin: *
access-control-expose-headers: Backoff, Retry-After, Content-Length, Alert, Content-Type
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
via: 1.1 google
date: Sat, 06 Apr 2024 13:21:38 GMT
age: 655
last-modified: Sat, 06 Apr 2024 09:57:12 GMT
content-type: application/json
last-modified: Sat, 06 Apr 2024 09:57:12 GMT
content-type: application/json
GET

https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?_expected=%221712397432218%22

firefox.exe

Remote address:

34.149.100.209:443

Response

HTTP/2.0 200

server: nginx
content-length: 232
access-control-allow-origin: *
access-control-expose-headers: Backoff, Retry-After, Content-Length, Alert, Content-Type
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
via: 1.1 google
date: Sat, 06 Apr 2024 13:21:38 GMT
age: 655
last-modified: Sat, 06 Apr 2024 09:57:12 GMT
content-type: application/json
last-modified: Sat, 06 Apr 2024 09:57:12 GMT
content-type: application/json

Request

GET /v1/buckets/monitor/collections/changes/changeset?_expected=%221712397432218%22 HTTP/2.0
host: firefox.settings.services.mozilla.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
accept: */*
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
sec-fetch-dest: empty
sec-fetch-mode: no-cors
sec-fetch-site: cross-site
te: trailers
DNS

firefox.exe

Remote address:

34.149.100.209:443

Response

HTTP/2.0 200

server: nginx
content-length: 232
access-control-allow-origin: *
access-control-expose-headers: Backoff, Retry-After, Content-Length, Alert, Content-Type
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
via: 1.1 google
date: Sat, 06 Apr 2024 13:21:38 GMT
age: 655
last-modified: Sat, 06 Apr 2024 09:57:12 GMT
content-type: application/json
last-modified: Sat, 06 Apr 2024 09:57:12 GMT
content-type: application/json
DNS

firefox.exe

Remote address:

34.149.100.209:443

Response

HTTP/2.0 200

server: nginx
content-length: 232
access-control-allow-origin: *
access-control-expose-headers: Backoff, Retry-After, Content-Length, Alert, Content-Type
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
via: 1.1 google
date: Sat, 06 Apr 2024 13:21:38 GMT
age: 655
last-modified: Sat, 06 Apr 2024 09:57:12 GMT
content-type: application/json
last-modified: Sat, 06 Apr 2024 09:57:12 GMT
content-type: application/json
DNS

firefox.exe

Remote address:

34.149.100.209:443

Response

HTTP/2.0 200

server: nginx
content-length: 2377
access-control-allow-origin: *
access-control-expose-headers: Alert, Content-Length, Backoff, Content-Type, Retry-After
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
via: 1.1 google
date: Sat, 06 Apr 2024 12:39:44 GMT
age: 3169
last-modified: Sat, 06 Apr 2024 00:00:06 GMT
content-type: application/json
last-modified: Sat, 06 Apr 2024 09:57:12 GMT
content-type: application/json
GET

https://push.services.mozilla.com/

firefox.exe

Remote address:

34.107.243.93:443

Request

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: Gl4KbRqQKVVffdpCZ8JWBA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

Response

HTTP/1.1 101 Switching Protocols

sec-websocket-accept: ekmOY1socshrKsRqR817vENAMlQ=
date: Sat, 06 Apr 2024 13:32:33 GMT
Via: 1.1 google
Upgrade: websocket
Connection: Upgrade
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
DNS

contile.services.mozilla.com

firefox.exe

Remote address:

8.8.8.8:53

Request

contile.services.mozilla.com

IN AAAA

Response
DNS

prod.content-signature-chains.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.content-signature-chains.prod.webservices.mozgcp.net

IN AAAA

Response

prod.content-signature-chains.prod.webservices.mozgcp.net

IN AAAA

2600:1901:0:92a9::
DNS

prod.remote-settings.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.remote-settings.prod.webservices.mozgcp.net

IN A

Response

prod.remote-settings.prod.webservices.mozgcp.net

IN A

34.149.100.209
DNS

shavar.prod.mozaws.net

firefox.exe

Remote address:

8.8.8.8:53

Request

shavar.prod.mozaws.net

IN A

Response

shavar.prod.mozaws.net

IN A

54.245.32.185

shavar.prod.mozaws.net

IN A

44.239.14.124

shavar.prod.mozaws.net

IN A

44.239.148.246
DNS

autopush.prod.mozaws.net

firefox.exe

Remote address:

8.8.8.8:53

Request

autopush.prod.mozaws.net

IN A

Response

autopush.prod.mozaws.net

IN A

34.107.243.93
DNS

prod.remote-settings.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.remote-settings.prod.webservices.mozgcp.net

IN AAAA

Response
DNS

autopush.prod.mozaws.net

firefox.exe

Remote address:

8.8.8.8:53

Request

autopush.prod.mozaws.net

IN AAAA

Response
DNS

location.services.mozilla.com

firefox.exe

Remote address:

8.8.8.8:53

Request

location.services.mozilla.com

IN A

Response

location.services.mozilla.com

IN CNAME

locprod2-elb-us-west-2.prod.mozaws.net

locprod2-elb-us-west-2.prod.mozaws.net

IN A

52.41.233.141

locprod2-elb-us-west-2.prod.mozaws.net

IN A

52.24.13.216

locprod2-elb-us-west-2.prod.mozaws.net

IN A

44.240.83.117
DNS

shavar.prod.mozaws.net

firefox.exe

Remote address:

8.8.8.8:53

Request

shavar.prod.mozaws.net

IN AAAA

Response
DNS

office-2016.download-windows.org

firefox.exe

Remote address:

8.8.8.8:53

Request

office-2016.download-windows.org

IN A

Response

office-2016.download-windows.org

IN A

193.42.111.249
DNS

download-windows.org

firefox.exe

Remote address:

8.8.8.8:53

Request

download-windows.org

IN A

Response

download-windows.org

IN A

193.42.111.249
DNS

97.17.167.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

97.17.167.52.in-addr.arpa

IN PTR

Response
DNS

240.197.17.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.197.17.2.in-addr.arpa

IN PTR

Response

240.197.17.2.in-addr.arpa

IN PTR

a2-17-197-240deploystaticakamaitechnologiescom
DNS

249.111.42.193.in-addr.arpa

Remote address:

8.8.8.8:53

Request

249.111.42.193.in-addr.arpa

IN PTR

Response

249.111.42.193.in-addr.arpa

IN PTR

vps12326 ua-hostingcompany
DNS

185.32.245.54.in-addr.arpa

Remote address:

8.8.8.8:53

Request

185.32.245.54.in-addr.arpa

IN PTR

Response

185.32.245.54.in-addr.arpa

IN PTR

ec2-54-245-32-185 us-west-2compute amazonawscom
DNS

download-windows.org

firefox.exe

Remote address:

8.8.8.8:53

Request

download-windows.org

IN A

Response

download-windows.org

IN A

193.42.111.249
DNS

office-2016.download-windows.org

firefox.exe

Remote address:

8.8.8.8:53

Request

office-2016.download-windows.org

IN A

Response

office-2016.download-windows.org

IN A

193.42.111.249
DNS

office-2016.download-windows.org

firefox.exe

Remote address:

8.8.8.8:53

Request

office-2016.download-windows.org

IN AAAA

Response
DNS

download-windows.org

firefox.exe

Remote address:

8.8.8.8:53

Request

download-windows.org

IN AAAA

Response
DNS

cdn.jsdelivr.net

firefox.exe

Remote address:

8.8.8.8:53

Request

cdn.jsdelivr.net

IN A

Response

cdn.jsdelivr.net

IN CNAME

jsdelivr.map.fastly.net

jsdelivr.map.fastly.net

IN A

151.101.1.229

jsdelivr.map.fastly.net

IN A

151.101.65.229

jsdelivr.map.fastly.net

IN A

151.101.129.229

jsdelivr.map.fastly.net

IN A

151.101.193.229
DNS

jsdelivr.map.fastly.net

firefox.exe

Remote address:

8.8.8.8:53

Request

jsdelivr.map.fastly.net

IN A

Response

jsdelivr.map.fastly.net

IN A

151.101.1.229

jsdelivr.map.fastly.net

IN A

151.101.65.229

jsdelivr.map.fastly.net

IN A

151.101.129.229

jsdelivr.map.fastly.net

IN A

151.101.193.229
GET

https://cdn.jsdelivr.net/npm/yandex-share2/share.js

firefox.exe

Remote address:

151.101.1.229:443

Request

GET /npm/yandex-share2/share.js HTTP/2.0
host: cdn.jsdelivr.net
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
accept: */*
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
referer: https://adobe-after-effects.download-windows.org/
sec-fetch-dest: script
sec-fetch-mode: no-cors
sec-fetch-site: cross-site
te: trailers

Response

HTTP/2.0 200

access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=604800, s-maxage=43200
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
x-jsd-version: 3.1.0
x-jsd-version-type: version
etag: W/"18fb1-E6EcOXtf49Exy3+AxB6z5Bkvomc"
content-encoding: br
accept-ranges: bytes
date: Sat, 06 Apr 2024 13:32:33 GMT
age: 2641
x-served-by: cache-fra-eddf8230136-FRA, cache-lcy-eglc8600027-LCY
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 28932
DNS

jsdelivr.map.fastly.net

firefox.exe

Remote address:

8.8.8.8:53

Request

jsdelivr.map.fastly.net

IN AAAA

Response

jsdelivr.map.fastly.net

IN AAAA

2a04:4e42::485

jsdelivr.map.fastly.net

IN AAAA

2a04:4e42:200::485

jsdelivr.map.fastly.net

IN AAAA

2a04:4e42:400::485

jsdelivr.map.fastly.net

IN AAAA

2a04:4e42:600::485
DNS

202.16.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

202.16.217.172.in-addr.arpa

IN PTR

Response

202.16.217.172.in-addr.arpa

IN PTR

fra16s08-in-f2021e100net

202.16.217.172.in-addr.arpa

IN PTR

fra16s08-in-f10�J

202.16.217.172.in-addr.arpa

IN PTR

fra16s65-in-f10�J
DNS

229.1.101.151.in-addr.arpa

Remote address:

8.8.8.8:53

Request

229.1.101.151.in-addr.arpa

IN PTR

Response
DNS

227.185.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

227.185.250.142.in-addr.arpa

IN PTR

Response

227.185.250.142.in-addr.arpa

IN PTR

fra16s53-in-f31e100net
DNS

mc.yandex.ru

firefox.exe

Remote address:

8.8.8.8:53

Request

mc.yandex.ru

IN A

Response

mc.yandex.ru

IN A

93.158.134.119

mc.yandex.ru

IN A

87.250.251.119

mc.yandex.ru

IN A

77.88.21.119

mc.yandex.ru

IN A

87.250.250.119
DNS

mc.yandex.ru

firefox.exe

Remote address:

8.8.8.8:53

Request

mc.yandex.ru

IN A

Response

mc.yandex.ru

IN A

77.88.21.119

mc.yandex.ru

IN A

93.158.134.119

mc.yandex.ru

IN A

87.250.251.119

mc.yandex.ru

IN A

87.250.250.119
DNS

mc.yandex.ru

firefox.exe

Remote address:

8.8.8.8:53

Request

mc.yandex.ru

IN AAAA

Response

mc.yandex.ru

IN AAAA

2a02:6b8::1:119
GET

https://mc.yandex.ru/metrika/tag.js

firefox.exe

Remote address:

93.158.134.119:443

Request

GET /metrika/tag.js HTTP/2.0
host: mc.yandex.ru
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
accept: */*
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
referer: https://adobe-after-effects.download-windows.org/
sec-fetch-dest: script
sec-fetch-mode: no-cors
sec-fetch-site: cross-site
te: trailers
GET

https://mc.yandex.ru/watch/44743444?wmode=7&page-url=https%3A%2F%2Fadobe-after-effects.download-windows.org%2Fadobe-after-effects-x64&charset=utf-8&uah=che%0A0&browser-info=pv%3A1%3Avf%3A6q5vo8idyottrxskya84otwin%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1290%3Acn%3A2%3Adp%3A0%3Als%3A538220264466%3Ahid%3A248011055%3Az%3A0%3Ai%3A20240406133234%3Aet%3A1712410354%3Ac%3A1%3Arn%3A252534274%3Arqn%3A1%3Au%3A171241035411220936%3Aw%3A1263x595%3As%3A1280x720x24%3Ask%3A1%3Afp%3A1028%3Awv%3A2%3Ads%3A56%2C167%2C173%2C3%2C-228%2C0%2C%2C738%2C19%2C%2C%2C%2C1108%3Aco%3A0%3Acpf%3A1%3Ans%3A1712410352278%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-0ed8ce9e1e39cec802dafc59181dfc61-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-9ad520ece76e579dc982eec1cd6a0b42-a3fa00e127f881df2924f73305812722-61b9878bbce18de73aafc8582a198c0c-c5b517516608a78b2e1fb16c10e14b31-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-d2ad8cb9e64f13dabdfa85f419d7079d%3Arqnl%3A1%3Ast%3A1712410354%3At%3AAdobe%20After%20Effects%20x64%20%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE%20%D0%B4%D0%BB%D1%8F%20windows&t=gdpr(14)clc(0-0-0)rqnt(1)eco(21037572)aw(1)rcm(1)cdl(na)fip(1)ti(1)

firefox.exe

Remote address:

93.158.134.119:443

Request

GET /watch/44743444?wmode=7&page-url=https%3A%2F%2Fadobe-after-effects.download-windows.org%2Fadobe-after-effects-x64&charset=utf-8&uah=che%0A0&browser-info=pv%3A1%3Avf%3A6q5vo8idyottrxskya84otwin%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1290%3Acn%3A2%3Adp%3A0%3Als%3A538220264466%3Ahid%3A248011055%3Az%3A0%3Ai%3A20240406133234%3Aet%3A1712410354%3Ac%3A1%3Arn%3A252534274%3Arqn%3A1%3Au%3A171241035411220936%3Aw%3A1263x595%3As%3A1280x720x24%3Ask%3A1%3Afp%3A1028%3Awv%3A2%3Ads%3A56%2C167%2C173%2C3%2C-228%2C0%2C%2C738%2C19%2C%2C%2C%2C1108%3Aco%3A0%3Acpf%3A1%3Ans%3A1712410352278%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-0ed8ce9e1e39cec802dafc59181dfc61-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-9ad520ece76e579dc982eec1cd6a0b42-a3fa00e127f881df2924f73305812722-61b9878bbce18de73aafc8582a198c0c-c5b517516608a78b2e1fb16c10e14b31-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-d2ad8cb9e64f13dabdfa85f419d7079d%3Arqnl%3A1%3Ast%3A1712410354%3At%3AAdobe%20After%20Effects%20x64%20%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE%20%D0%B4%D0%BB%D1%8F%20windows&t=gdpr(14)clc(0-0-0)rqnt(1)eco(21037572)aw(1)rcm(1)cdl(na)fip(1)ti(1) HTTP/2.0
host: mc.yandex.ru
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
accept: */*
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
referer: https://adobe-after-effects.download-windows.org/
origin: https://adobe-after-effects.download-windows.org
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: cross-site
te: trailers
GET

https://mc.yandex.ru/watch/26812653?wmode=7&page-url=https%3A%2F%2Fadobe-after-effects.download-windows.org%2Fadobe-after-effects-x64&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22redesign%22%3A1%7D&uah=che%0A0&browser-info=pv%3A1%3Avf%3A6q5vo8idyottrxskya84otwin%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1290%3Acn%3A1%3Adp%3A0%3Als%3A144087860803%3Ahid%3A248011055%3Az%3A0%3Ai%3A20240406133234%3Aet%3A1712410354%3Ac%3A1%3Arn%3A373369596%3Arqn%3A1%3Au%3A171241035411220936%3Aw%3A1263x595%3As%3A1280x720x24%3Ask%3A1%3Afp%3A1028%3Awv%3A2%3Ads%3A56%2C167%2C173%2C3%2C-228%2C0%2C%2C738%2C19%2C%2C%2C%2C1108%3Aco%3A0%3Acpf%3A1%3Ans%3A1712410352278%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-0ed8ce9e1e39cec802dafc59181dfc61-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-9ad520ece76e579dc982eec1cd6a0b42-a3fa00e127f881df2924f73305812722-61b9878bbce18de73aafc8582a198c0c-c5b517516608a78b2e1fb16c10e14b31-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-d2ad8cb9e64f13dabdfa85f419d7079d%3Arqnl%3A1%3Ast%3A1712410354%3At%3AAdobe%20After%20Effects%20x64%20%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE%20%D0%B4%D0%BB%D1%8F%20windows&t=gdpr(14)clc(0-0-0)rqnt(1)eco(16851712)aw(1)rcm(1)cdl(na)fip(1)ti(1)

firefox.exe

Remote address:

93.158.134.119:443

Request

GET /watch/26812653?wmode=7&page-url=https%3A%2F%2Fadobe-after-effects.download-windows.org%2Fadobe-after-effects-x64&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22redesign%22%3A1%7D&uah=che%0A0&browser-info=pv%3A1%3Avf%3A6q5vo8idyottrxskya84otwin%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1290%3Acn%3A1%3Adp%3A0%3Als%3A144087860803%3Ahid%3A248011055%3Az%3A0%3Ai%3A20240406133234%3Aet%3A1712410354%3Ac%3A1%3Arn%3A373369596%3Arqn%3A1%3Au%3A171241035411220936%3Aw%3A1263x595%3As%3A1280x720x24%3Ask%3A1%3Afp%3A1028%3Awv%3A2%3Ads%3A56%2C167%2C173%2C3%2C-228%2C0%2C%2C738%2C19%2C%2C%2C%2C1108%3Aco%3A0%3Acpf%3A1%3Ans%3A1712410352278%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-0ed8ce9e1e39cec802dafc59181dfc61-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-9ad520ece76e579dc982eec1cd6a0b42-a3fa00e127f881df2924f73305812722-61b9878bbce18de73aafc8582a198c0c-c5b517516608a78b2e1fb16c10e14b31-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-d2ad8cb9e64f13dabdfa85f419d7079d%3Arqnl%3A1%3Ast%3A1712410354%3At%3AAdobe%20After%20Effects%20x64%20%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE%20%D0%B4%D0%BB%D1%8F%20windows&t=gdpr(14)clc(0-0-0)rqnt(1)eco(16851712)aw(1)rcm(1)cdl(na)fip(1)ti(1) HTTP/2.0
host: mc.yandex.ru
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
accept: */*
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
referer: https://adobe-after-effects.download-windows.org/
origin: https://adobe-after-effects.download-windows.org
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: cross-site
te: trailers
DNS

22.160.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

22.160.190.20.in-addr.arpa

IN PTR

Response
DNS

238.181.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

238.181.250.142.in-addr.arpa

IN PTR

Response

238.181.250.142.in-addr.arpa

IN PTR

fra16s56-in-f141e100net
DNS

119.134.158.93.in-addr.arpa

Remote address:

8.8.8.8:53

Request

119.134.158.93.in-addr.arpa

IN PTR

Response

119.134.158.93.in-addr.arpa

IN PTR

mcyandexru
DNS

119.134.158.93.in-addr.arpa

Remote address:

8.8.8.8:53

Request

119.134.158.93.in-addr.arpa

IN PTR

Response

119.134.158.93.in-addr.arpa

IN PTR

mcyandexru
DNS

232.184.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

232.184.250.142.in-addr.arpa

IN PTR

Response

232.184.250.142.in-addr.arpa

IN PTR

fra24s12-in-f81e100net
DNS

dw-files-63.top

firefox.exe

Remote address:

8.8.8.8:53

Request

dw-files-63.top

IN A

Response

dw-files-63.top

IN A

89.41.180.195
DNS

dw-files-63.top

firefox.exe

Remote address:

8.8.8.8:53

Request

dw-files-63.top

IN A

Response

dw-files-63.top

IN A

89.41.180.195
DNS

dw-files-63.top

firefox.exe

Remote address:

8.8.8.8:53

Request

dw-files-63.top

IN A

Response

dw-files-63.top

IN A

89.41.180.195
DNS

dw-files-63.top

firefox.exe

Remote address:

8.8.8.8:53

Request

dw-files-63.top

IN AAAA

Response
DNS

dw-files-63.top

firefox.exe

Remote address:

8.8.8.8:53

Request

dw-files-63.top

IN AAAA

Response
DNS

195.180.41.89.in-addr.arpa

Remote address:

8.8.8.8:53

Request

195.180.41.89.in-addr.arpa

IN PTR

Response

195.180.41.89.in-addr.arpa

IN PTR

8941180195 zetserverscom
DNS

195.180.41.89.in-addr.arpa

Remote address:

8.8.8.8:53

Request

195.180.41.89.in-addr.arpa

IN PTR

Response

195.180.41.89.in-addr.arpa

IN PTR

8941180195 zetserverscom
DNS

149.220.183.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

149.220.183.52.in-addr.arpa

IN PTR

Response
DNS

86.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

86.23.85.13.in-addr.arpa

IN PTR

Response
DNS

56.126.166.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

56.126.166.20.in-addr.arpa

IN PTR

Response
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

aus5.mozilla.org

firefox.exe

Remote address:

8.8.8.8:53

Request

aus5.mozilla.org

IN A

Response

aus5.mozilla.org

IN CNAME

balrog-aus5.r53-2.services.mozilla.com

balrog-aus5.r53-2.services.mozilla.com

IN CNAME

prod.balrog.prod.cloudops.mozgcp.net

prod.balrog.prod.cloudops.mozgcp.net

IN A

35.244.181.201
DNS

prod.balrog.prod.cloudops.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.balrog.prod.cloudops.mozgcp.net

IN A

Response

prod.balrog.prod.cloudops.mozgcp.net

IN A

35.244.181.201
DNS

prod.balrog.prod.cloudops.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.balrog.prod.cloudops.mozgcp.net

IN AAAA

Response
DNS

ciscobinary.openh264.org

firefox.exe

Remote address:

8.8.8.8:53

Request

ciscobinary.openh264.org

IN A

Response

ciscobinary.openh264.org

IN CNAME

a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com

a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com

IN CNAME

a17.rackcdn.com

a17.rackcdn.com

IN CNAME

a17.rackcdn.com.mdc.edgesuite.net

a17.rackcdn.com.mdc.edgesuite.net

IN CNAME

a19.dscg10.akamai.net

a19.dscg10.akamai.net

IN A

2.18.121.73

a19.dscg10.akamai.net

IN A

2.18.121.79
GET

http://ciscobinary.openh264.org/openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip

firefox.exe

Remote address:

2.18.121.73:80

Request

GET /openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip HTTP/1.1
Host: ciscobinary.openh264.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive

Response

HTTP/1.1 200 OK

Last-Modified: Thu, 08 Feb 2024 02:25:35 GMT
ETag: 85430baed3398695717b0263807cf97c
Content-Length: 453023
Accept-Ranges: bytes
X-Timestamp: 1707359134.18771
Content-Type: application/zip
X-Trans-Id: tx2f531fd561724b9d9f2be-0065c7a454dfw1
Cache-Control: public, max-age=76883
Expires: Sun, 07 Apr 2024 10:54:39 GMT
Date: Sat, 06 Apr 2024 13:33:16 GMT
Connection: keep-alive
DNS

a19.dscg10.akamai.net

firefox.exe

Remote address:

8.8.8.8:53

Request

a19.dscg10.akamai.net

IN A

Response

a19.dscg10.akamai.net

IN A

2.18.121.79

a19.dscg10.akamai.net

IN A

2.18.121.73
DNS

a19.dscg10.akamai.net

firefox.exe

Remote address:

8.8.8.8:53

Request

a19.dscg10.akamai.net

IN AAAA

Response

a19.dscg10.akamai.net

IN AAAA

2a02:26f0:a1::58dd:86d1

a19.dscg10.akamai.net

IN AAAA

2a02:26f0:a1::58dd:869b
DNS

redirector.gvt1.com

firefox.exe

Remote address:

8.8.8.8:53

Request

redirector.gvt1.com

IN A

Response

redirector.gvt1.com

IN A

142.250.186.142
DNS

redirector.gvt1.com

firefox.exe

Remote address:

8.8.8.8:53

Request

redirector.gvt1.com

IN A

Response

redirector.gvt1.com

IN A

142.250.186.142
DNS

redirector.gvt1.com

firefox.exe

Remote address:

8.8.8.8:53

Request

redirector.gvt1.com

IN A

Response

redirector.gvt1.com

IN A

142.250.186.142
DNS

redirector.gvt1.com

firefox.exe

Remote address:

8.8.8.8:53

Request

redirector.gvt1.com

IN AAAA

Response

redirector.gvt1.com

IN AAAA

2a00:1450:4001:82a::200e
DNS

201.181.244.35.in-addr.arpa

Remote address:

8.8.8.8:53

Request

201.181.244.35.in-addr.arpa

IN PTR

Response

201.181.244.35.in-addr.arpa

IN PTR

20118124435bcgoogleusercontentcom
DNS

73.121.18.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

73.121.18.2.in-addr.arpa

IN PTR

Response

73.121.18.2.in-addr.arpa

IN PTR

a2-18-121-73deploystaticakamaitechnologiescom
DNS

142.186.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

142.186.250.142.in-addr.arpa

IN PTR

Response

142.186.250.142.in-addr.arpa

IN PTR

fra24s07-in-f141e100net
DNS

r1---sn-aigl6ney.gvt1.com

firefox.exe

Remote address:

8.8.8.8:53

Request

r1---sn-aigl6ney.gvt1.com

IN A

Response

r1---sn-aigl6ney.gvt1.com

IN CNAME

r1.sn-aigl6ney.gvt1.com

r1.sn-aigl6ney.gvt1.com

IN A

173.194.183.166
DNS

r1.sn-aigl6ney.gvt1.com

firefox.exe

Remote address:

8.8.8.8:53

Request

r1.sn-aigl6ney.gvt1.com

IN A

Response

r1.sn-aigl6ney.gvt1.com

IN A

173.194.183.166
DNS

r1.sn-aigl6ney.gvt1.com

firefox.exe

Remote address:

8.8.8.8:53

Request

r1.sn-aigl6ney.gvt1.com

IN AAAA

Response

r1.sn-aigl6ney.gvt1.com

IN AAAA

2a00:1450:4009:11::6
DNS

166.183.194.173.in-addr.arpa

Remote address:

8.8.8.8:53

Request

166.183.194.173.in-addr.arpa

IN PTR

Response

166.183.194.173.in-addr.arpa

IN PTR

lhr25s19-in-f61e100net
DNS

0.205.248.87.in-addr.arpa

Remote address:

8.8.8.8:53

Request

0.205.248.87.in-addr.arpa

IN PTR

Response

0.205.248.87.in-addr.arpa

IN PTR

https-87-248-205-0lgwllnwnet
DNS

48.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

48.229.111.52.in-addr.arpa

IN PTR

Response
DNS

249.197.17.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

249.197.17.2.in-addr.arpa

IN PTR

Response

249.197.17.2.in-addr.arpa

IN PTR

a2-17-197-249deploystaticakamaitechnologiescom
DNS

contile.services.mozilla.com

firefox.exe

Remote address:

8.8.8.8:53

Request

contile.services.mozilla.com

IN A

Response

contile.services.mozilla.com

IN A

34.117.237.239
GET

https://contile.services.mozilla.com/v1/tiles

firefox.exe

Remote address:

34.117.237.239:443

Request

GET /v1/tiles HTTP/2.0
host: contile.services.mozilla.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
accept: */*
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: cross-site
te: trailers
DNS

contile.services.mozilla.com

firefox.exe

Remote address:

8.8.8.8:53

Request

contile.services.mozilla.com

IN AAAA

Response
DNS

aus5.mozilla.org

firefox.exe

Remote address:

8.8.8.8:53

Request

aus5.mozilla.org

IN A

Response

aus5.mozilla.org

IN CNAME

balrog-aus5.r53-2.services.mozilla.com

balrog-aus5.r53-2.services.mozilla.com

IN CNAME

prod.balrog.prod.cloudops.mozgcp.net

prod.balrog.prod.cloudops.mozgcp.net

IN A

35.244.181.201
DNS

prod.balrog.prod.cloudops.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.balrog.prod.cloudops.mozgcp.net

IN A

Response

prod.balrog.prod.cloudops.mozgcp.net

IN A

35.244.181.201
DNS

prod.balrog.prod.cloudops.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.balrog.prod.cloudops.mozgcp.net

IN AAAA

Response
DNS

locprod2-elb-us-west-2.prod.mozaws.net

firefox.exe

Remote address:

8.8.8.8:53

Request

locprod2-elb-us-west-2.prod.mozaws.net

IN A

Response

locprod2-elb-us-west-2.prod.mozaws.net

IN A

52.41.233.141

locprod2-elb-us-west-2.prod.mozaws.net

IN A

52.24.13.216

locprod2-elb-us-west-2.prod.mozaws.net

IN A

44.240.83.117
DNS

locprod2-elb-us-west-2.prod.mozaws.net

firefox.exe

Remote address:

8.8.8.8:53

Request

locprod2-elb-us-west-2.prod.mozaws.net

IN A
DNS

locprod2-elb-us-west-2.prod.mozaws.net

firefox.exe

Remote address:

8.8.8.8:53

Request

locprod2-elb-us-west-2.prod.mozaws.net

IN A
DNS

locprod2-elb-us-west-2.prod.mozaws.net

firefox.exe

Remote address:

8.8.8.8:53

Request

locprod2-elb-us-west-2.prod.mozaws.net

IN AAAA

Response
DNS

141.233.41.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

141.233.41.52.in-addr.arpa

IN PTR

Response

141.233.41.52.in-addr.arpa

IN PTR

ec2-52-41-233-141 us-west-2compute amazonawscom
DNS

contile.services.mozilla.com

firefox.exe

Remote address:

8.8.8.8:53

Request

contile.services.mozilla.com

IN A

Response

contile.services.mozilla.com

IN A

34.117.237.239
GET

https://contile.services.mozilla.com/v1/tiles

firefox.exe

Remote address:

34.117.237.239:443

Request

GET /v1/tiles HTTP/2.0
host: contile.services.mozilla.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
accept: */*
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: cross-site
te: trailers
DNS

contile.services.mozilla.com

firefox.exe

Remote address:

8.8.8.8:53

Request

contile.services.mozilla.com

IN AAAA

Response
DNS

67.31.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

67.31.126.40.in-addr.arpa

IN PTR

Response
DNS

157.123.68.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

157.123.68.40.in-addr.arpa

IN PTR

Response
DNS

9.228.82.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

9.228.82.20.in-addr.arpa

IN PTR

Response
DNS

21.114.53.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

21.114.53.23.in-addr.arpa

IN PTR

Response

21.114.53.23.in-addr.arpa

IN PTR

a23-53-114-21deploystaticakamaitechnologiescom
DNS

206.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.23.85.13.in-addr.arpa

IN PTR

Response
DNS

154.173.246.72.in-addr.arpa

Remote address:

8.8.8.8:53

Request

154.173.246.72.in-addr.arpa

IN PTR

Response

154.173.246.72.in-addr.arpa

IN PTR

a72-246-173-154deploystaticakamaitechnologiescom
DNS

119.110.54.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

119.110.54.20.in-addr.arpa

IN PTR

Response
DNS

28.143.109.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

28.143.109.104.in-addr.arpa

IN PTR

Response

28.143.109.104.in-addr.arpa

IN PTR

a104-109-143-28deploystaticakamaitechnologiescom
DNS

200.197.17.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.197.17.2.in-addr.arpa

IN PTR

Response

200.197.17.2.in-addr.arpa

IN PTR

a2-17-197-200deploystaticakamaitechnologiescom
DNS

0.204.248.87.in-addr.arpa

Remote address:

8.8.8.8:53

Request

0.204.248.87.in-addr.arpa

IN PTR

Response

0.204.248.87.in-addr.arpa

IN PTR

https-87-248-204-0lhrllnwnet
DNS

208.14.97.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

208.14.97.104.in-addr.arpa

IN PTR

Response

208.14.97.104.in-addr.arpa

IN PTR

a104-97-14-208deploystaticakamaitechnologiescom
DNS

17.143.109.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

17.143.109.104.in-addr.arpa

IN PTR

Response

17.143.109.104.in-addr.arpa

IN PTR

a104-109-143-17deploystaticakamaitechnologiescom
DNS

159.113.53.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

159.113.53.23.in-addr.arpa

IN PTR

Response

159.113.53.23.in-addr.arpa

IN PTR

a23-53-113-159deploystaticakamaitechnologiescom
DNS

159.113.53.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

159.113.53.23.in-addr.arpa

IN PTR

Response

159.113.53.23.in-addr.arpa

IN PTR

a23-53-113-159deploystaticakamaitechnologiescom

127.0.0.1:50932

firefox.exe
193.42.111.249:443

adobe-after-effects.download-windows.org

tls

firefox.exe

13.5kB
171.0kB
64
149
34.117.237.239:443

https://contile.services.mozilla.com/v1/tiles

tls, http2

firefox.exe

2.1kB
6.5kB
20
20

HTTP Request

GET https://contile.services.mozilla.com/v1/tiles
34.160.144.191:443

content-signature-2.cdn.mozilla.net

tls

firefox.exe

2.6kB
16.6kB
27
33
34.149.100.209:443

https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?_expected=%221712397432218%22

tls, http2

firefox.exe

3.4kB
35.8kB
37
49

HTTP Request

GET https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

HTTP Request

GET https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?collection=partitioning-exempt-urls&bucket=main&_expected=0

HTTP Request

GET https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/partitioning-exempt-urls/changeset?_expected=1702403047185

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?_expected=%221712397432218%22
54.245.32.185:443

shavar.services.mozilla.com

tls

firefox.exe

2.2kB
3.7kB
10
9
34.107.243.93:443

https://push.services.mozilla.com/

tls, http

firefox.exe

2.2kB
5.1kB
15
21

HTTP Request

GET https://push.services.mozilla.com/

HTTP Response

101
193.42.111.249:443

adobe-after-effects.download-windows.org

tls

firefox.exe

10.4kB
52.1kB
41
56
193.42.111.249:443

adobe-after-effects.download-windows.org

tls

firefox.exe

9.1kB
32.6kB
36
42
193.42.111.249:443

adobe-after-effects.download-windows.org

tls

firefox.exe

10.6kB
88.8kB
45
83
193.42.111.249:443

adobe-after-effects.download-windows.org

tls

firefox.exe

9.5kB
148.4kB
47
130
193.42.111.249:443

adobe-after-effects.download-windows.org

tls

firefox.exe

9.7kB
35.2kB
38
45
193.42.111.249:443

office-2016.download-windows.org

tls

firefox.exe

1.9kB
10.6kB
16
20
34.149.100.209:443

firefox.settings.services.mozilla.com

tls

firefox.exe

1.0kB
3.9kB
11
9
151.101.1.229:443

https://cdn.jsdelivr.net/npm/yandex-share2/share.js

tls, http2

firefox.exe

2.0kB
36.6kB
19
39

HTTP Request

GET https://cdn.jsdelivr.net/npm/yandex-share2/share.js

HTTP Response

200
193.42.111.249:443

download-windows.org

tls

firefox.exe

1.9kB
12.9kB
16
21
93.158.134.119:443

https://mc.yandex.ru/watch/26812653?wmode=7&page-url=https%3A%2F%2Fadobe-after-effects.download-windows.org%2Fadobe-after-effects-x64&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22redesign%22%3A1%7D&uah=che%0A0&browser-info=pv%3A1%3Avf%3A6q5vo8idyottrxskya84otwin%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1290%3Acn%3A1%3Adp%3A0%3Als%3A144087860803%3Ahid%3A248011055%3Az%3A0%3Ai%3A20240406133234%3Aet%3A1712410354%3Ac%3A1%3Arn%3A373369596%3Arqn%3A1%3Au%3A171241035411220936%3Aw%3A1263x595%3As%3A1280x720x24%3Ask%3A1%3Afp%3A1028%3Awv%3A2%3Ads%3A56%2C167%2C173%2C3%2C-228%2C0%2C%2C738%2C19%2C%2C%2C%2C1108%3Aco%3A0%3Acpf%3A1%3Ans%3A1712410352278%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-0ed8ce9e1e39cec802dafc59181dfc61-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-9ad520ece76e579dc982eec1cd6a0b42-a3fa00e127f881df2924f73305812722-61b9878bbce18de73aafc8582a198c0c-c5b517516608a78b2e1fb16c10e14b31-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-d2ad8cb9e64f13dabdfa85f419d7079d%3Arqnl%3A1%3Ast%3A1712410354%3At%3AAdobe%20After%20Effects%20x64%20%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE%20%D0%B4%D0%BB%D1%8F%20windows&t=gdpr(14)clc(0-0-0)rqnt(1)eco(16851712)aw(1)rcm(1)cdl(na)fip(1)ti(1)

tls, http2

firefox.exe

172.3kB
95.0kB
198
186

HTTP Request

GET https://mc.yandex.ru/metrika/tag.js

HTTP Request

GET https://mc.yandex.ru/watch/44743444?wmode=7&page-url=https%3A%2F%2Fadobe-after-effects.download-windows.org%2Fadobe-after-effects-x64&charset=utf-8&uah=che%0A0&browser-info=pv%3A1%3Avf%3A6q5vo8idyottrxskya84otwin%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1290%3Acn%3A2%3Adp%3A0%3Als%3A538220264466%3Ahid%3A248011055%3Az%3A0%3Ai%3A20240406133234%3Aet%3A1712410354%3Ac%3A1%3Arn%3A252534274%3Arqn%3A1%3Au%3A171241035411220936%3Aw%3A1263x595%3As%3A1280x720x24%3Ask%3A1%3Afp%3A1028%3Awv%3A2%3Ads%3A56%2C167%2C173%2C3%2C-228%2C0%2C%2C738%2C19%2C%2C%2C%2C1108%3Aco%3A0%3Acpf%3A1%3Ans%3A1712410352278%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-0ed8ce9e1e39cec802dafc59181dfc61-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-9ad520ece76e579dc982eec1cd6a0b42-a3fa00e127f881df2924f73305812722-61b9878bbce18de73aafc8582a198c0c-c5b517516608a78b2e1fb16c10e14b31-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-d2ad8cb9e64f13dabdfa85f419d7079d%3Arqnl%3A1%3Ast%3A1712410354%3At%3AAdobe%20After%20Effects%20x64%20%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE%20%D0%B4%D0%BB%D1%8F%20windows&t=gdpr(14)clc(0-0-0)rqnt(1)eco(21037572)aw(1)rcm(1)cdl(na)fip(1)ti(1)

HTTP Request

GET https://mc.yandex.ru/watch/26812653?wmode=7&page-url=https%3A%2F%2Fadobe-after-effects.download-windows.org%2Fadobe-after-effects-x64&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22redesign%22%3A1%7D&uah=che%0A0&browser-info=pv%3A1%3Avf%3A6q5vo8idyottrxskya84otwin%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1290%3Acn%3A1%3Adp%3A0%3Als%3A144087860803%3Ahid%3A248011055%3Az%3A0%3Ai%3A20240406133234%3Aet%3A1712410354%3Ac%3A1%3Arn%3A373369596%3Arqn%3A1%3Au%3A171241035411220936%3Aw%3A1263x595%3As%3A1280x720x24%3Ask%3A1%3Afp%3A1028%3Awv%3A2%3Ads%3A56%2C167%2C173%2C3%2C-228%2C0%2C%2C738%2C19%2C%2C%2C%2C1108%3Aco%3A0%3Acpf%3A1%3Ans%3A1712410352278%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-0ed8ce9e1e39cec802dafc59181dfc61-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-9ad520ece76e579dc982eec1cd6a0b42-a3fa00e127f881df2924f73305812722-61b9878bbce18de73aafc8582a198c0c-c5b517516608a78b2e1fb16c10e14b31-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-d2ad8cb9e64f13dabdfa85f419d7079d%3Arqnl%3A1%3Ast%3A1712410354%3At%3AAdobe%20After%20Effects%20x64%20%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE%20%D0%B4%D0%BB%D1%8F%20windows&t=gdpr(14)clc(0-0-0)rqnt(1)eco(16851712)aw(1)rcm(1)cdl(na)fip(1)ti(1)
127.0.0.1:50941

firefox.exe
89.41.180.195:443

dw-files-63.top

tls

firefox.exe

25.7MB
1.8GB
547224
1314841
35.244.181.201:443

aus5.mozilla.org

tls

firefox.exe

1.9kB
5.7kB
20
19
2.18.121.73:80

http://ciscobinary.openh264.org/openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip

http

firefox.exe

8.7kB
467.5kB
182
349

HTTP Request

GET http://ciscobinary.openh264.org/openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip

HTTP Response

200
142.250.186.142:443

redirector.gvt1.com

tls

firefox.exe

1.6kB
9.0kB
17
21
173.194.183.166:443

r1---sn-aigl6ney.gvt1.com

tls

firefox.exe

203.4kB
8.7MB
3262
6256
34.117.237.239:443

https://contile.services.mozilla.com/v1/tiles

tls, http2

firefox.exe

2.2kB
3.6kB
19
16

HTTP Request

GET https://contile.services.mozilla.com/v1/tiles
34.149.100.209:443

firefox.settings.services.mozilla.com

tls

firefox.exe

2.8kB
28.7kB
33
34
35.244.181.201:443

aus5.mozilla.org

tls

firefox.exe

2.1kB
1.5kB
18
18
52.41.233.141:443

location.services.mozilla.com

tls

firefox.exe

1.2kB
3.5kB
11
8
52.41.233.141:443

location.services.mozilla.com

tls

firefox.exe

1.8kB
4.3kB
15
15
34.117.237.239:443

https://contile.services.mozilla.com/v1/tiles

tls, http2

firefox.exe

2.1kB
3.5kB
18
17

HTTP Request

GET https://contile.services.mozilla.com/v1/tiles

8.8.8.8:53

adobe-after-effects.download-windows.org

dns

firefox.exe

86 B
102 B
1
1

DNS Request

adobe-after-effects.download-windows.org

DNS Response

193.42.111.249
8.8.8.8:53

contile.services.mozilla.com

dns

firefox.exe

74 B
90 B
1
1

DNS Request

contile.services.mozilla.com

DNS Response

34.117.237.239
8.8.8.8:53

adobe-after-effects.download-windows.org

dns

firefox.exe

86 B
102 B
1
1

DNS Request

adobe-after-effects.download-windows.org

DNS Response

193.42.111.249
8.8.8.8:53

content-signature-2.cdn.mozilla.net

dns

firefox.exe

81 B
235 B
1
1

DNS Request

content-signature-2.cdn.mozilla.net

DNS Response

34.160.144.191
8.8.8.8:53

shavar.services.mozilla.com

dns

firefox.exe

73 B
157 B
1
1

DNS Request

shavar.services.mozilla.com

DNS Response

54.245.32.185

44.239.14.124

44.239.148.246
8.8.8.8:53

push.services.mozilla.com

dns

firefox.exe

71 B
125 B
1
1

DNS Request

push.services.mozilla.com

DNS Response

34.107.243.93
8.8.8.8:53

firefox.settings.services.mozilla.com

dns

firefox.exe

83 B
161 B
1
1

DNS Request

firefox.settings.services.mozilla.com

DNS Response

34.149.100.209
8.8.8.8:53

contile.services.mozilla.com

dns

firefox.exe

74 B
90 B
1
1

DNS Request

contile.services.mozilla.com

DNS Response

34.117.237.239
8.8.8.8:53

prod.content-signature-chains.prod.webservices.mozgcp.net

dns

firefox.exe

103 B
119 B
1
1

DNS Request

prod.content-signature-chains.prod.webservices.mozgcp.net

DNS Response

34.160.144.191
8.8.8.8:53

adobe-after-effects.download-windows.org

dns

firefox.exe

86 B
153 B
1
1

DNS Request

adobe-after-effects.download-windows.org
8.8.8.8:53

contile.services.mozilla.com

dns

firefox.exe

74 B
155 B
1
1

DNS Request

contile.services.mozilla.com
8.8.8.8:53

prod.content-signature-chains.prod.webservices.mozgcp.net

dns

firefox.exe

103 B
131 B
1
1

DNS Request

prod.content-signature-chains.prod.webservices.mozgcp.net

DNS Response

2600:1901:0:92a9::
8.8.8.8:53

prod.remote-settings.prod.webservices.mozgcp.net

dns

firefox.exe

94 B
110 B
1
1

DNS Request

prod.remote-settings.prod.webservices.mozgcp.net

DNS Response

34.149.100.209
8.8.8.8:53

shavar.prod.mozaws.net

dns

firefox.exe

68 B
116 B
1
1

DNS Request

shavar.prod.mozaws.net

DNS Response

54.245.32.185

44.239.14.124

44.239.148.246
8.8.8.8:53

autopush.prod.mozaws.net

dns

firefox.exe

70 B
86 B
1
1

DNS Request

autopush.prod.mozaws.net

DNS Response

34.107.243.93
8.8.8.8:53

prod.remote-settings.prod.webservices.mozgcp.net

dns

firefox.exe

94 B
187 B
1
1

DNS Request

prod.remote-settings.prod.webservices.mozgcp.net
8.8.8.8:53

autopush.prod.mozaws.net

dns

firefox.exe

145 B
330 B
2
2

DNS Request

autopush.prod.mozaws.net

DNS Request

location.services.mozilla.com

DNS Response

52.41.233.141

52.24.13.216

44.240.83.117
8.8.8.8:53

shavar.prod.mozaws.net

dns

firefox.exe

68 B
153 B
1
1

DNS Request

shavar.prod.mozaws.net
8.8.8.8:53

office-2016.download-windows.org

dns

firefox.exe

78 B
94 B
1
1

DNS Request

office-2016.download-windows.org

DNS Response

193.42.111.249
8.8.8.8:53

download-windows.org

dns

firefox.exe

66 B
82 B
1
1

DNS Request

download-windows.org

DNS Response

193.42.111.249
8.8.8.8:53

97.17.167.52.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

97.17.167.52.in-addr.arpa
8.8.8.8:53

240.197.17.2.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

240.197.17.2.in-addr.arpa
8.8.8.8:53

249.111.42.193.in-addr.arpa

dns

73 B
114 B
1
1

DNS Request

249.111.42.193.in-addr.arpa
8.8.8.8:53

185.32.245.54.in-addr.arpa

dns

72 B
135 B
1
1

DNS Request

185.32.245.54.in-addr.arpa
8.8.8.8:53

download-windows.org

dns

firefox.exe

66 B
82 B
1
1

DNS Request

download-windows.org

DNS Response

193.42.111.249
8.8.8.8:53

office-2016.download-windows.org

dns

firefox.exe

78 B
94 B
1
1

DNS Request

office-2016.download-windows.org

DNS Response

193.42.111.249
8.8.8.8:53

office-2016.download-windows.org

dns

firefox.exe

78 B
145 B
1
1

DNS Request

office-2016.download-windows.org
8.8.8.8:53

download-windows.org

dns

firefox.exe

66 B
133 B
1
1

DNS Request

download-windows.org
8.8.8.8:53

cdn.jsdelivr.net

dns

firefox.exe

62 B
160 B
1
1

DNS Request

cdn.jsdelivr.net

DNS Response

151.101.1.229

151.101.65.229

151.101.129.229

151.101.193.229
8.8.8.8:53

jsdelivr.map.fastly.net

dns

firefox.exe

69 B
133 B
1
1

DNS Request

jsdelivr.map.fastly.net

DNS Response

151.101.1.229

151.101.65.229

151.101.129.229

151.101.193.229
8.8.8.8:53

jsdelivr.map.fastly.net

dns

firefox.exe

69 B
181 B
1
1

DNS Request

jsdelivr.map.fastly.net

DNS Response

2a04:4e42::485

2a04:4e42:200::485

2a04:4e42:400::485

2a04:4e42:600::485
151.101.1.229:443

jsdelivr.map.fastly.net

https

firefox.exe

2.7kB
102.8kB
13
78
8.8.8.8:53

202.16.217.172.in-addr.arpa

dns

73 B
173 B
1
1

DNS Request

202.16.217.172.in-addr.arpa
8.8.8.8:53

229.1.101.151.in-addr.arpa

dns

72 B
132 B
1
1

DNS Request

229.1.101.151.in-addr.arpa
8.8.8.8:53

227.185.250.142.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

227.185.250.142.in-addr.arpa
8.8.8.8:53

mc.yandex.ru

dns

firefox.exe

58 B
122 B
1
1

DNS Request

mc.yandex.ru

DNS Response

93.158.134.119

87.250.251.119

77.88.21.119

87.250.250.119
8.8.8.8:53

mc.yandex.ru

dns

firefox.exe

58 B
122 B
1
1

DNS Request

mc.yandex.ru

DNS Response

77.88.21.119

93.158.134.119

87.250.251.119

87.250.250.119
8.8.8.8:53

mc.yandex.ru

dns

firefox.exe

58 B
86 B
1
1

DNS Request

mc.yandex.ru

DNS Response

2a02:6b8::1:119
8.8.8.8:53

22.160.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

22.160.190.20.in-addr.arpa
8.8.8.8:53

238.181.250.142.in-addr.arpa

dns

74 B
113 B
1
1

DNS Request

238.181.250.142.in-addr.arpa
8.8.8.8:53

119.134.158.93.in-addr.arpa

dns

146 B
198 B
2
2

DNS Request

119.134.158.93.in-addr.arpa

DNS Request

119.134.158.93.in-addr.arpa
8.8.8.8:53

232.184.250.142.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

232.184.250.142.in-addr.arpa
8.8.8.8:53

dw-files-63.top

dns

firefox.exe

122 B
154 B
2
2

DNS Request

dw-files-63.top

DNS Request

dw-files-63.top

DNS Response

89.41.180.195

DNS Response

89.41.180.195
8.8.8.8:53

dw-files-63.top

dns

firefox.exe

61 B
77 B
1
1

DNS Request

dw-files-63.top

DNS Response

89.41.180.195
8.8.8.8:53

dw-files-63.top

dns

firefox.exe

122 B
244 B
2
2

DNS Request

dw-files-63.top

DNS Request

dw-files-63.top
8.8.8.8:53

195.180.41.89.in-addr.arpa

dns

144 B
228 B
2
2

DNS Request

195.180.41.89.in-addr.arpa

DNS Request

195.180.41.89.in-addr.arpa
8.8.8.8:53

149.220.183.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

149.220.183.52.in-addr.arpa
8.8.8.8:53

86.23.85.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

86.23.85.13.in-addr.arpa
8.8.8.8:53

56.126.166.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

56.126.166.20.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

aus5.mozilla.org

dns

firefox.exe

62 B
180 B
1
1

DNS Request

aus5.mozilla.org

DNS Response

35.244.181.201
8.8.8.8:53

prod.balrog.prod.cloudops.mozgcp.net

dns

firefox.exe

82 B
98 B
1
1

DNS Request

prod.balrog.prod.cloudops.mozgcp.net

DNS Response

35.244.181.201
8.8.8.8:53

prod.balrog.prod.cloudops.mozgcp.net

dns

firefox.exe

82 B
175 B
1
1

DNS Request

prod.balrog.prod.cloudops.mozgcp.net
8.8.8.8:53

ciscobinary.openh264.org

dns

firefox.exe

70 B
286 B
1
1

DNS Request

ciscobinary.openh264.org

DNS Response

2.18.121.73

2.18.121.79
8.8.8.8:53

a19.dscg10.akamai.net

dns

firefox.exe

67 B
99 B
1
1

DNS Request

a19.dscg10.akamai.net

DNS Response

2.18.121.79

2.18.121.73
8.8.8.8:53

a19.dscg10.akamai.net

dns

firefox.exe

67 B
123 B
1
1

DNS Request

a19.dscg10.akamai.net

DNS Response

2a02:26f0:a1::58dd:86d1

2a02:26f0:a1::58dd:869b
8.8.8.8:53

redirector.gvt1.com

dns

firefox.exe

130 B
162 B
2
2

DNS Request

redirector.gvt1.com

DNS Request

redirector.gvt1.com

DNS Response

142.250.186.142

DNS Response

142.250.186.142
8.8.8.8:53

redirector.gvt1.com

dns

firefox.exe

65 B
81 B
1
1

DNS Request

redirector.gvt1.com

DNS Response

142.250.186.142
8.8.8.8:53

redirector.gvt1.com

dns

firefox.exe

65 B
93 B
1
1

DNS Request

redirector.gvt1.com

DNS Response

2a00:1450:4001:82a::200e
8.8.8.8:53

201.181.244.35.in-addr.arpa

dns

73 B
126 B
1
1

DNS Request

201.181.244.35.in-addr.arpa
8.8.8.8:53

73.121.18.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

73.121.18.2.in-addr.arpa
8.8.8.8:53

142.186.250.142.in-addr.arpa

dns

74 B
113 B
1
1

DNS Request

142.186.250.142.in-addr.arpa
142.250.186.142:443

redirector.gvt1.com

https

firefox.exe

3.3kB
9.5kB
9
10
8.8.8.8:53

r1---sn-aigl6ney.gvt1.com

dns

firefox.exe

71 B
116 B
1
1

DNS Request

r1---sn-aigl6ney.gvt1.com

DNS Response

173.194.183.166
8.8.8.8:53

r1.sn-aigl6ney.gvt1.com

dns

firefox.exe

69 B
85 B
1
1

DNS Request

r1.sn-aigl6ney.gvt1.com

DNS Response

173.194.183.166
8.8.8.8:53

r1.sn-aigl6ney.gvt1.com

dns

firefox.exe

69 B
97 B
1
1

DNS Request

r1.sn-aigl6ney.gvt1.com

DNS Response

2a00:1450:4009:11::6
173.194.183.166:443

r1.sn-aigl6ney.gvt1.com

https

firefox.exe

1.8kB
6.5kB
5
8
8.8.8.8:53

166.183.194.173.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

166.183.194.173.in-addr.arpa
8.8.8.8:53

0.205.248.87.in-addr.arpa

dns

71 B
116 B
1
1

DNS Request

0.205.248.87.in-addr.arpa
8.8.8.8:53

48.229.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

48.229.111.52.in-addr.arpa
8.8.8.8:53

249.197.17.2.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

249.197.17.2.in-addr.arpa
8.8.8.8:53

contile.services.mozilla.com

dns

firefox.exe

74 B
90 B
1
1

DNS Request

contile.services.mozilla.com

DNS Response

34.117.237.239
8.8.8.8:53

contile.services.mozilla.com

dns

firefox.exe

74 B
155 B
1
1

DNS Request

contile.services.mozilla.com
8.8.8.8:53

aus5.mozilla.org

dns

firefox.exe

62 B
180 B
1
1

DNS Request

aus5.mozilla.org

DNS Response

35.244.181.201
8.8.8.8:53

prod.balrog.prod.cloudops.mozgcp.net

dns

firefox.exe

82 B
98 B
1
1

DNS Request

prod.balrog.prod.cloudops.mozgcp.net

DNS Response

35.244.181.201
8.8.8.8:53

prod.balrog.prod.cloudops.mozgcp.net

dns

firefox.exe

82 B
175 B
1
1

DNS Request

prod.balrog.prod.cloudops.mozgcp.net
8.8.8.8:53

locprod2-elb-us-west-2.prod.mozaws.net

dns

firefox.exe

252 B
132 B
3
1

DNS Request

locprod2-elb-us-west-2.prod.mozaws.net

DNS Request

locprod2-elb-us-west-2.prod.mozaws.net

DNS Request

locprod2-elb-us-west-2.prod.mozaws.net

DNS Response

52.41.233.141

52.24.13.216

44.240.83.117
8.8.8.8:53

locprod2-elb-us-west-2.prod.mozaws.net

dns

firefox.exe

84 B
169 B
1
1

DNS Request

locprod2-elb-us-west-2.prod.mozaws.net
8.8.8.8:53

141.233.41.52.in-addr.arpa

dns

72 B
135 B
1
1

DNS Request

141.233.41.52.in-addr.arpa
8.8.8.8:53

contile.services.mozilla.com

dns

firefox.exe

74 B
90 B
1
1

DNS Request

contile.services.mozilla.com

DNS Response

34.117.237.239
8.8.8.8:53

contile.services.mozilla.com

dns

firefox.exe

74 B
155 B
1
1

DNS Request

contile.services.mozilla.com
8.8.8.8:53

67.31.126.40.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

67.31.126.40.in-addr.arpa
8.8.8.8:53

157.123.68.40.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

157.123.68.40.in-addr.arpa
8.8.8.8:53

9.228.82.20.in-addr.arpa

dns

70 B
156 B
1
1

DNS Request

9.228.82.20.in-addr.arpa
8.8.8.8:53

21.114.53.23.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

21.114.53.23.in-addr.arpa
8.8.8.8:53

206.23.85.13.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

206.23.85.13.in-addr.arpa
8.8.8.8:53

154.173.246.72.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

154.173.246.72.in-addr.arpa
8.8.8.8:53

119.110.54.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

119.110.54.20.in-addr.arpa
8.8.8.8:53

28.143.109.104.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

28.143.109.104.in-addr.arpa
8.8.8.8:53

200.197.17.2.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

200.197.17.2.in-addr.arpa
8.8.8.8:53

0.204.248.87.in-addr.arpa

dns

71 B
116 B
1
1

DNS Request

0.204.248.87.in-addr.arpa
8.8.8.8:53

208.14.97.104.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

208.14.97.104.in-addr.arpa
8.8.8.8:53

17.143.109.104.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

17.143.109.104.in-addr.arpa
8.8.8.8:53

159.113.53.23.in-addr.arpa

dns

144 B
274 B
2
2

DNS Request

159.113.53.23.in-addr.arpa

DNS Request

159.113.53.23.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0etkwu5l.default-release\cache2\doomed\16021

Filesize
9KB

MD5
5f8254fff1e49010ec2b66b279c3d8c3

SHA1
4a2618535aa3b0dd7b36a47215ab81a773dd927e

SHA256
fb9c28bc1601a47ca21f8e6d2d3ea16792005a7d29dae19846b5570ad43ba2af

SHA512
e0e8e639ea2492b3e29068123bb3b340397078f92d54c5fff9c8f2f53b5cfd690d0841aea5105ec1ee141a523bf84a151cb1d8ced059cea1fdf5f9bd5eadd685

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0etkwu5l.default-release\cache2\doomed\22817

Filesize
10KB

MD5
4cd50df37894a02da43470a7ab9c9696

SHA1
e0a7239bf7e38b89cd06ab2a1c384bd66a904430

SHA256
0c00bd9ab85ed9e88971049af097d8b5a0f9da32dcfe111bb61bb80f02742cb0

SHA512
7432ca1824ddefcb6b36f5e13732133e936b6647eed738a98a4b3fddd62b9eaa3382c64ca8164b6fab410f8952d33adf527c05391024cdfe50fb1513c9974d4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
9KB

MD5
bc7da528ee02af8bf1571748900a1b5c

SHA1
d3727b26344f10f5f5bc4b4cd564c668f506a124

SHA256
4f357b79b385e7351af6c6a695b8bf61ffda1004007ce49eeea5ba71f18d2d8b

SHA512
0eed56b632e2b1818c8c95c90cddddbd836e6943299f1379b89961c88e912f060b49ddbb1c7a94fab9ea5a2e85f78aa9c9166fc4c2c405f4b6405a0a8b19c12d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\bookmarkbackups\bookmarks-2024-04-06_11_UV+VfokoahLxAwotieqjbg==.jsonlz4

Filesize
947B

MD5
7954d2d919bbce9bb2c4b6eccdaab27c

SHA1
1d40084343efc8360f47aa41eac14c17ef337ac4

SHA256
7c0bbb04b37d1742547bd6e53a6c12065986d2aaecd09d2e2717eab71b21ffdf

SHA512
53a78ff46cdd89129a3e0c92d02d1b6292d9e28864a0b3ff935045185bede8520b5b1264171a2f1e3e2d0663c35012f7e0733dca09909dc18ea733adad112ecc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\broadcast-listeners.json

Filesize
204B

MD5
72c95709e1a3b27919e13d28bbe8e8a2

SHA1
00892decbee63d627057730bfc0c6a4f13099ee4

SHA256
9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

SHA512
613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
8e39d1e2036b678322a3f7f62c178485

SHA1
641b9c19b2fd19ee85b90cb8a3fd88f773d12bd8

SHA256
021341981ca0ebea775fd539f4bf65957c05f3f3e0d0f4b4148b19f65108da75

SHA512
8c0a2fca22bcaf3e1b44e20843a53252bd102a2d3ae33098c8d941dffd5f9f9cbe525c060dd92932b41f6078dc07f8f247a01a96629b9b00f2f408b11e62553d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\datareporting\glean\pending_pings\0e78655f-e6a5-43e7-922c-2ee74d7cd7d2

Filesize
746B

MD5
db81653694fdd2555ffe37c20950aaf1

SHA1
682250edb1c3ec2ce9dfdced2f2b6b3cbdeb33b7

SHA256
b03d6057ec5de7bdd58c7f5dd6d27b6488a2d320eeff4e353d119828e85268b3

SHA512
863c932ab4cf9da2bba019a3df4eb38caaf1107ce91aa7682b81a512ea179ac583b1e416c9e987dd4972e4dbcdc0a0d17446bf6e3210b312fc8ab91f708fad28

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\datareporting\glean\pending_pings\533380b7-7fa9-461b-bdae-bee846665c02

Filesize
10KB

MD5
c346c0385e879023ec295d21b51c6a24

SHA1
9de91fa89416575e933a46a137e9f361f6698cc0

SHA256
52bb50ddaae7680882bde72f369541acadbb37c9df4559b3097a2c3b4a0c2809

SHA512
ada128dadbfe2cfd8dbdfcc04f33bc3b42fdc6666ed89367a35dfdae3e2e35b2a2a022d0d8ee15246a8d4ef89c49f47345334198be22d006b6ca82502afd3eb7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\downloads.json

Filesize
862B

MD5
2843b416c81fca4e60e0c53d49ecfaa3

SHA1
13111ba79e059c07a1798a4d84cd5ecba2068940

SHA256
1e8ad95f0903c6825e8ad7d1966b173a23fe6306413c424d85f155823013df7d

SHA512
58f79a620f82759cc914efbb02e3a20ea9ff52ef5fa84175a819733f83e48b8685008fc00f0f247b595aa732d73791401e67cfcf5e924d925da37b35257cda16

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\prefs-1.js

Filesize
7KB

MD5
f4792f659f8940b594d045a93b22c66b

SHA1
f7579cfc9a19f9ddda38b83e1088de9d2829ec16

SHA256
f3d5f839d0ecf931f5671d91b8f0fad629c1f8e418dfb57acffeaa16679ac3f8

SHA512
d6f9b83ed218fd3947ed7110c5dbd4dea7ef33073c88dddfe88bbc3655625941f5081a3d08223497339773c4424cf86131429c5134431f09d7822709cc3cedc6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\prefs-1.js

Filesize
7KB

MD5
eb8cf04cfc139d69556dcda604beb6a1

SHA1
353e4b4b2059b165a22095a93b0f1592fbf8cd09

SHA256
2f413528eff986ba166af90be5d5c5e3c82ae4d6bfdd4e41c56e9c646ed77985

SHA512
db7e19a9f93f0f452dcce4564b34037b82432a13b174df671fdb33c0f56d7a8556f58a89dea835bc3f867cee240999f3f4f335428f7a7340dc4abb2e47dfc283

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\prefs-1.js

Filesize
6KB

MD5
875a8257734edef42f6449c1aee90d87

SHA1
7ca2f5636f4db83da2d788d878b5ea8c42ebecb9

SHA256
78d0717141e2a69ce5b3b24a0562fdc07c3078716802cd65127b73ad14a42614

SHA512
4e1cfe4f27d74cb2f3f890f39a05dda1f9e5b57e9e0d01bfcfefe8813947a7dbbe11ad77f741e744440708a77ea81d02a2b4bd78158dfe6f8e31c03848f9977f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\prefs.js

Filesize
7KB

MD5
cbe0320ce87a7ab85db85316d251841b

SHA1
33473c15a1c34035072fb9de470f350a5d3ee3c6

SHA256
5ad0bab2192ae9578378a0fc0e05540f3e654035df332515e08c903b8f550bf0

SHA512
5d63abcfca9b271e61a56d1db0a79ce5d63fb61a0676a4ba7bc35b959d749860fcb7232b14c95f54c628d266dc10ad830877b894bbd5e8f33c4156e741230749

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\prefs.js

Filesize
6KB

MD5
155b3c32a3cd2db07040aa3d38d369c2

SHA1
84f6dc2fcac8568cbc03cf7c91174fef80ffaaa7

SHA256
1425ecaf55efb567e7cfe68a5819177e64b2473f47e996e81e5f30d2584b7ec3

SHA512
67cf30f1b293c86b997fb0f706244794eff1f88e2423c8290ab6e683707b5cbf6adf5120c8fb50734b14fd1eea9e0d90a8b634e773798ff9764c26583f1e5b2f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\prefs.js

Filesize
6KB

MD5
56c208203bf2fb51e6b47bf26158756a

SHA1
43dbe742c97bee1d21697cacbb57977d7f5a2cb0

SHA256
9a31dc4e07ad8d0e82e41bbb0249639f43921e118df12b1e7b116d30a0ac95ef

SHA512
3ec02bd2b484220af41e6cd5e4972ff03c9581d32b35e04be99706cef8de97c9cc66bdfe731fb741102314c8b59760a0e0a1c9d74346471cd49735e59c14fd63

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
f728c7e92f4eeb993d0280f04758c142

SHA1
e86b39803e7ee82957e93a0b000c442a5637b72c

SHA256
b2b194109e8d11692e5c4884d9436a6a59d1964061bb1dd9905a9dbf487763a8

SHA512
71045b063304009e5f331c4105204c27c1d27f89b02a142a92a35f2da849fb2d93add1cd01e30f17efc8cfef7bb6734d084bec70072d36124a920073298e2f19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\targeting.snapshot.json

Filesize
3KB

MD5
7357039c4f8f162cb44aa7f2002632bf

SHA1
72a72b8c225e2d37ebc9a913f48d02f0484fee76

SHA256
0e6a0adad03a0d8942ee43284fdd361227a8e9e41142f4211029a7b7b0860a90

SHA512
12c5bb35bf09eb6912f0a346718032041520e51845c9ddf5c7fe987f589327f2dd5945cba44f0f311e8f7b0a3285e39869f411e49ac5fb7dc9b349d48fb9ae1c

Download Submit
C:\Users\Admin\Downloads\Adobe_After_Effects_CC_2017_ru.57ksInBu.iso.part

Filesize
31KB

MD5
a6bcbb3a160bf3aae8f13c7043be2ea5

SHA1
eab38553c976acb562aae37c5e345009b86463c0

SHA256
e5cce11415a8e0e9c567864170722790ebe3ba5fd53ae300a5cb02cb84b3f8a7

SHA512
b90ece8d73a806b71df87c33974dbd52e85209a5719bd20f15b7b86cd41cc298b35e322207005f13ec7c0352a36e51a5eab6085d5648a7182532147b1892c09a

Download Submit
memory/4972-458-0x00000222A06A0000-0x00000222A06B0000-memory.dmp

Filesize
64KB

Download
memory/4972-474-0x00000222A07A0000-0x00000222A07B0000-memory.dmp

Filesize
64KB

Download
memory/4972-490-0x00000222A8B10000-0x00000222A8B11000-memory.dmp

Filesize
4KB

Download
memory/4972-492-0x00000222A8B40000-0x00000222A8B41000-memory.dmp

Filesize
4KB

Download
memory/4972-493-0x00000222A8B40000-0x00000222A8B41000-memory.dmp

Filesize
4KB

Download
memory/4972-494-0x00000222A8C50000-0x00000222A8C51000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Response