hxxps://url[.]rw/Solara/

Resubmissions

09/08/2024, 22:26 UTC

240809-2csyyssdnp 6

09/08/2024, 22:19 UTC

240809-18ynmsscjp 10

09/08/2024, 22:18 UTC

240809-17yl9asbnp 1

09/08/2024, 22:15 UTC

240809-16pyqawcme 3

Analysis

max time kernel
72s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 22:18 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://url.rw/Solara/

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	firefox.exe
Token: SeDebugPrivilege	2904	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2904	2448	firefox.exe	84
PID 2448 wrote to memory of 2904	2448	firefox.exe	84
PID 2448 wrote to memory of 2904	2448	firefox.exe	84
PID 2448 wrote to memory of 2904	2448	firefox.exe	84
PID 2448 wrote to memory of 2904	2448	firefox.exe	84
PID 2448 wrote to memory of 2904	2448	firefox.exe	84
PID 2448 wrote to memory of 2904	2448	firefox.exe	84
PID 2448 wrote to memory of 2904	2448	firefox.exe	84
PID 2448 wrote to memory of 2904	2448	firefox.exe	84
PID 2448 wrote to memory of 2904	2448	firefox.exe	84
PID 2448 wrote to memory of 2904	2448	firefox.exe	84
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 220	2904	firefox.exe	85
PID 2904 wrote to memory of 3356	2904	firefox.exe	86
PID 2904 wrote to memory of 3356	2904	firefox.exe	86
PID 2904 wrote to memory of 3356	2904	firefox.exe	86
PID 2904 wrote to memory of 3356	2904	firefox.exe	86
PID 2904 wrote to memory of 3356	2904	firefox.exe	86
PID 2904 wrote to memory of 3356	2904	firefox.exe	86
PID 2904 wrote to memory of 3356	2904	firefox.exe	86
PID 2904 wrote to memory of 3356	2904	firefox.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://url.rw/Solara/"
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://url.rw/Solara/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1508 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b29360aa-eb9d-4b99-9ea8-accb43554921} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" gpu
    3⤵
    PID:220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2436 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb7b7d6b-b3cf-497d-946c-fac27e22b64f} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" socket
    3⤵
    PID:3356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2852 -childID 1 -isForBrowser -prefsHandle 2984 -prefMapHandle 2896 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9783da9b-78aa-450e-bf4c-a2c3a697c2f3} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" tab
    3⤵
    PID:4924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2808 -childID 2 -isForBrowser -prefsHandle 3668 -prefMapHandle 3664 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c8ca069-4643-4044-b226-4d6616380dfc} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" tab
    3⤵
    PID:4068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4204 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4236 -prefMapHandle 4232 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6de111d-eb1b-418c-8336-6595bda09b44} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" utility
    3⤵
    - Checks processor information in registry
    PID:1012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5464 -childID 3 -isForBrowser -prefsHandle 5480 -prefMapHandle 5456 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {857cf905-3b56-4f43-8e1e-0729e9b2d3fe} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" tab
    3⤵
    PID:1712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5712 -childID 4 -isForBrowser -prefsHandle 5704 -prefMapHandle 5700 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27e2b08d-8cfb-4c1c-87da-e32f2d388237} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" tab
    3⤵
    PID:1888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5632 -childID 5 -isForBrowser -prefsHandle 5616 -prefMapHandle 5700 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60cd792e-e6fd-4703-9d8d-26ba112a1134} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" tab
    3⤵
    PID:2628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6204 -childID 6 -isForBrowser -prefsHandle 6188 -prefMapHandle 6196 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04880062-8b61-460e-90f4-cc3a3b8e65a8} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" tab
    3⤵
    PID:3240

Network

DNS

58.55.71.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

58.55.71.13.in-addr.arpa

IN PTR

Response
DNS

18.58.20.217.in-addr.arpa

Remote address:

8.8.8.8:53

Request

18.58.20.217.in-addr.arpa

IN PTR

Response
DNS

url.rw

firefox.exe

Remote address:

8.8.8.8:53

Request

url.rw

IN A

Response

url.rw

IN A

188.166.2.160
DNS

spocs.getpocket.com

firefox.exe

Remote address:

8.8.8.8:53

Request

spocs.getpocket.com

IN A

Response

spocs.getpocket.com

IN CNAME

prod.ads.prod.webservices.mozgcp.net

prod.ads.prod.webservices.mozgcp.net

IN A

34.117.188.166
DNS

firefox-api-proxy.cdn.mozilla.net

firefox.exe

Remote address:

8.8.8.8:53

Request

firefox-api-proxy.cdn.mozilla.net

IN A

Response

firefox-api-proxy.cdn.mozilla.net

IN CNAME

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

IN A

34.149.97.1
GET

https://url.rw/Solara/

firefox.exe

Remote address:

188.166.2.160:443

Request

GET /Solara/ HTTP/1.1
Host: url.rw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

Response

HTTP/1.1 301 Moved Permanently

Date: Fri, 09 Aug 2024 22:18:23 GMT
Server: Apache/2.4.52 (Ubuntu)
Location: https://url.rw/Solara
Content-Length: 302
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
GET

https://url.rw/Solara

firefox.exe

Remote address:

188.166.2.160:443

Request

GET /Solara HTTP/1.1
Host: url.rw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

Response

HTTP/1.1 200 OK

Date: Fri, 09 Aug 2024 22:18:23 GMT
Server: Apache/2.4.52 (Ubuntu)
Cache-Control: no-cache, private
Set-Cookie: XSRF-TOKEN=eyJpdiI6Ims3K2lJT2VpWS9LME1EWHdROHpmNkE9PSIsInZhbHVlIjoiSjN6SVd6YzJiTGxWbEpCSERja1p6L0hkRWpHb2w2M3YzelJBS1NPWXl4T24ydjljVDZEODZrMWJ5UDVtcmhmamJMYmN4dThDQUtGblZrZGNpaWJIazBURkpoaVo3d2xiZitscVQwTmd6ZzVVZmlvajVwRFhOc2VreS9ldmFNY2oiLCJtYWMiOiI2Y2EzMjI4ODczYzhmNTFiZjRkMGVlMzBlNWQ0OGM5OGUyY2I4ZGFkYjg4ZmY0ZmE2ZmRlMWM3NDEzNjk5NzhiIiwidGFnIjoiIn0%3D; expires=Sat, 10-Aug-2024 00:18:23 GMT; Max-Age=7200; path=/
Set-Cookie: urlrw_session=eyJpdiI6Ii9Jb3FHMitNZDJmbkpkYTZRRVMrVVE9PSIsInZhbHVlIjoicWRGcW1PUk1La3kxNzBJUy91MWRaMUtuaDNsaFc5a24xdlJCaFU4OWU1Q0dtbk1WcHdYc2hRa1FhUnloU0dkSFhscnB1RlN0ZmIzVWZBMzJjOWFvV2ZROTJRTTBUQkNYQzdubnBxM1NYU080OEpPY2tjQ2Nsek9PalBEeWdLS20iLCJtYWMiOiI4ZDEyMDllYTE4MzI3MDJkMjcxN2Y0NWE1MzFjYWNmZTIyNmIwZTVjZGZhY2VhZTNiNzgyYzc4ZDlmM2E4NDdiIiwidGFnIjoiIn0%3D; expires=Sat, 10-Aug-2024 00:18:23 GMT; Max-Age=7200; path=/; httponly
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
GET

https://url.rw/js/app.js

firefox.exe

Remote address:

188.166.2.160:443

Request

GET /js/app.js HTTP/1.1
Host: url.rw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://url.rw/Solara
Cookie: XSRF-TOKEN=eyJpdiI6Ims3K2lJT2VpWS9LME1EWHdROHpmNkE9PSIsInZhbHVlIjoiSjN6SVd6YzJiTGxWbEpCSERja1p6L0hkRWpHb2w2M3YzelJBS1NPWXl4T24ydjljVDZEODZrMWJ5UDVtcmhmamJMYmN4dThDQUtGblZrZGNpaWJIazBURkpoaVo3d2xiZitscVQwTmd6ZzVVZmlvajVwRFhOc2VreS9ldmFNY2oiLCJtYWMiOiI2Y2EzMjI4ODczYzhmNTFiZjRkMGVlMzBlNWQ0OGM5OGUyY2I4ZGFkYjg4ZmY0ZmE2ZmRlMWM3NDEzNjk5NzhiIiwidGFnIjoiIn0%3D; urlrw_session=eyJpdiI6Ii9Jb3FHMitNZDJmbkpkYTZRRVMrVVE9PSIsInZhbHVlIjoicWRGcW1PUk1La3kxNzBJUy91MWRaMUtuaDNsaFc5a24xdlJCaFU4OWU1Q0dtbk1WcHdYc2hRa1FhUnloU0dkSFhscnB1RlN0ZmIzVWZBMzJjOWFvV2ZROTJRTTBUQkNYQzdubnBxM1NYU080OEpPY2tjQ2Nsek9PalBEeWdLS20iLCJtYWMiOiI4ZDEyMDllYTE4MzI3MDJkMjcxN2Y0NWE1MzFjYWNmZTIyNmIwZTVjZGZhY2VhZTNiNzgyYzc4ZDlmM2E4NDdiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

Response

HTTP/1.1 200 OK

Date: Fri, 09 Aug 2024 22:18:23 GMT
Server: Apache/2.4.52 (Ubuntu)
Last-Modified: Thu, 28 Sep 2023 14:41:20 GMT
ETag: "3095c-6066c4d1bffea-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/javascript
GET

https://url.rw/images/favicon.png

firefox.exe

Remote address:

188.166.2.160:443

Request

GET /images/favicon.png HTTP/1.1
Host: url.rw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://url.rw/Solara
Cookie: XSRF-TOKEN=eyJpdiI6Ims3K2lJT2VpWS9LME1EWHdROHpmNkE9PSIsInZhbHVlIjoiSjN6SVd6YzJiTGxWbEpCSERja1p6L0hkRWpHb2w2M3YzelJBS1NPWXl4T24ydjljVDZEODZrMWJ5UDVtcmhmamJMYmN4dThDQUtGblZrZGNpaWJIazBURkpoaVo3d2xiZitscVQwTmd6ZzVVZmlvajVwRFhOc2VreS9ldmFNY2oiLCJtYWMiOiI2Y2EzMjI4ODczYzhmNTFiZjRkMGVlMzBlNWQ0OGM5OGUyY2I4ZGFkYjg4ZmY0ZmE2ZmRlMWM3NDEzNjk5NzhiIiwidGFnIjoiIn0%3D; urlrw_session=eyJpdiI6Ii9Jb3FHMitNZDJmbkpkYTZRRVMrVVE9PSIsInZhbHVlIjoicWRGcW1PUk1La3kxNzBJUy91MWRaMUtuaDNsaFc5a24xdlJCaFU4OWU1Q0dtbk1WcHdYc2hRa1FhUnloU0dkSFhscnB1RlN0ZmIzVWZBMzJjOWFvV2ZROTJRTTBUQkNYQzdubnBxM1NYU080OEpPY2tjQ2Nsek9PalBEeWdLS20iLCJtYWMiOiI4ZDEyMDllYTE4MzI3MDJkMjcxN2Y0NWE1MzFjYWNmZTIyNmIwZTVjZGZhY2VhZTNiNzgyYzc4ZDlmM2E4NDdiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

Response

HTTP/1.1 200 OK

Date: Fri, 09 Aug 2024 22:18:23 GMT
Server: Apache/2.4.52 (Ubuntu)
Last-Modified: Tue, 29 Aug 2023 10:00:10 GMT
ETag: "209-6040ce0543e80"
Accept-Ranges: bytes
Content-Length: 521
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/png
GET

https://url.rw/uploads/brand/ppp2gW4DLdNJCB1pg5Pb2D1b91DCHpKWRYOkno9Y.png

firefox.exe

Remote address:

188.166.2.160:443

Request

GET /uploads/brand/ppp2gW4DLdNJCB1pg5Pb2D1b91DCHpKWRYOkno9Y.png HTTP/1.1
Host: url.rw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://url.rw/Solara
Cookie: XSRF-TOKEN=eyJpdiI6Ims3K2lJT2VpWS9LME1EWHdROHpmNkE9PSIsInZhbHVlIjoiSjN6SVd6YzJiTGxWbEpCSERja1p6L0hkRWpHb2w2M3YzelJBS1NPWXl4T24ydjljVDZEODZrMWJ5UDVtcmhmamJMYmN4dThDQUtGblZrZGNpaWJIazBURkpoaVo3d2xiZitscVQwTmd6ZzVVZmlvajVwRFhOc2VreS9ldmFNY2oiLCJtYWMiOiI2Y2EzMjI4ODczYzhmNTFiZjRkMGVlMzBlNWQ0OGM5OGUyY2I4ZGFkYjg4ZmY0ZmE2ZmRlMWM3NDEzNjk5NzhiIiwidGFnIjoiIn0%3D; urlrw_session=eyJpdiI6Ii9Jb3FHMitNZDJmbkpkYTZRRVMrVVE9PSIsInZhbHVlIjoicWRGcW1PUk1La3kxNzBJUy91MWRaMUtuaDNsaFc5a24xdlJCaFU4OWU1Q0dtbk1WcHdYc2hRa1FhUnloU0dkSFhscnB1RlN0ZmIzVWZBMzJjOWFvV2ZROTJRTTBUQkNYQzdubnBxM1NYU080OEpPY2tjQ2Nsek9PalBEeWdLS20iLCJtYWMiOiI4ZDEyMDllYTE4MzI3MDJkMjcxN2Y0NWE1MzFjYWNmZTIyNmIwZTVjZGZhY2VhZTNiNzgyYzc4ZDlmM2E4NDdiIiwidGFnIjoiIn0%3D; _ga_JJFL3Y4WJS=GS1.1.1723241903.1.0.1723241903.0.0.0; _ga=GA1.1.1233968703.1723241903; _ga_NMF5SXKX3G=GS1.1.1723241903.1.0.1723241903.0.0.0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

Response

HTTP/1.1 200 OK

Date: Fri, 09 Aug 2024 22:18:24 GMT
Server: Apache/2.4.52 (Ubuntu)
Last-Modified: Fri, 29 Sep 2023 11:07:53 GMT
ETag: "8c79-6067d6f9f0b11"
Accept-Ranges: bytes
Content-Length: 35961
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: image/png
GET

https://url.rw/sol

firefox.exe

Remote address:

188.166.2.160:443

Request

GET /sol HTTP/1.1
Host: url.rw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://solrx.lol/
Cookie: XSRF-TOKEN=eyJpdiI6Ims3K2lJT2VpWS9LME1EWHdROHpmNkE9PSIsInZhbHVlIjoiSjN6SVd6YzJiTGxWbEpCSERja1p6L0hkRWpHb2w2M3YzelJBS1NPWXl4T24ydjljVDZEODZrMWJ5UDVtcmhmamJMYmN4dThDQUtGblZrZGNpaWJIazBURkpoaVo3d2xiZitscVQwTmd6ZzVVZmlvajVwRFhOc2VreS9ldmFNY2oiLCJtYWMiOiI2Y2EzMjI4ODczYzhmNTFiZjRkMGVlMzBlNWQ0OGM5OGUyY2I4ZGFkYjg4ZmY0ZmE2ZmRlMWM3NDEzNjk5NzhiIiwidGFnIjoiIn0%3D; urlrw_session=eyJpdiI6Ii9Jb3FHMitNZDJmbkpkYTZRRVMrVVE9PSIsInZhbHVlIjoicWRGcW1PUk1La3kxNzBJUy91MWRaMUtuaDNsaFc5a24xdlJCaFU4OWU1Q0dtbk1WcHdYc2hRa1FhUnloU0dkSFhscnB1RlN0ZmIzVWZBMzJjOWFvV2ZROTJRTTBUQkNYQzdubnBxM1NYU080OEpPY2tjQ2Nsek9PalBEeWdLS20iLCJtYWMiOiI4ZDEyMDllYTE4MzI3MDJkMjcxN2Y0NWE1MzFjYWNmZTIyNmIwZTVjZGZhY2VhZTNiNzgyYzc4ZDlmM2E4NDdiIiwidGFnIjoiIn0%3D; _ga_JJFL3Y4WJS=GS1.1.1723241903.1.0.1723241905.0.0.0; _ga=GA1.1.1233968703.1723241903; _ga_NMF5SXKX3G=GS1.1.1723241903.1.0.1723241905.0.0.0
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

Response

HTTP/1.1 301 Moved Permanently

Date: Fri, 09 Aug 2024 22:18:28 GMT
Server: Apache/2.4.52 (Ubuntu)
Location: https://www.mediafire.com/file/ir8ttdtyavz5wum/A2Z46o6wBmjG.zip/file
Cache-Control: must-revalidate, no-cache, no-store, private
Set-Cookie: XSRF-TOKEN=eyJpdiI6ImxDR0hNaDRoR0Z1cTB2WTFjenVYeGc9PSIsInZhbHVlIjoiNVVIeU1qcDIzZjlTbVUrU0lwOXUrc2xEZ24yMEZva3Q0TXNvUytpV0txdGtDUm43SnlhQjJKM3k2MGN0TmxiNlRwVGVGYU5KWEdwb3NnaXZpMURNZ0ZCTTZ4YTlqdVBzdXBkVVpwUGQ4RWg4UytBMnFiZnNxUklYd1pLc2hNbSsiLCJtYWMiOiJiN2JjZDgzMTQ3MGI2MjdiZjAwMzAwZGNhNDViNTQ1YjU0OGFlMzI3Y2U3NTM2NmM2MzE1MGFmN2I0ZDZjMzhlIiwidGFnIjoiIn0%3D; expires=Sat, 10-Aug-2024 00:18:28 GMT; Max-Age=7200; path=/
Set-Cookie: urlrw_session=eyJpdiI6IlRTK0N1UGZ2VXFycmlmeFUwN2pHbEE9PSIsInZhbHVlIjoiSTVrQnhVQ1d1TTlyNUUrb2xUb1ZoK1Z2K0RRQzNaRCs5bjZuVFkvU2Z5OWdtT2pteUdaOU9YZG5kVVJBTi92cnQzbU81Vk5qZnVESy9WdXcvQUJjd1hjTzZ6QzNyOU1ZaXY5VzNTMnBKL3Z4MXBMc0w3WE5FLzl6SE5sSW4xeGwiLCJtYWMiOiI3NDZhOWI2NzY5MzRiNjFmNjFlZGNlZjdhMzc5ZmRlZjUyMWNkZjgyYWVjZWQyMTQ2NjQyMjRmNzMxYzY0Nzk1IiwidGFnIjoiIn0%3D; expires=Sat, 10-Aug-2024 00:18:28 GMT; Max-Age=7200; path=/; httponly
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
GET

https://url.rw/css/app.css

firefox.exe

Remote address:

188.166.2.160:443

Request

GET /css/app.css HTTP/1.1
Host: url.rw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://url.rw/Solara
Cookie: XSRF-TOKEN=eyJpdiI6Ims3K2lJT2VpWS9LME1EWHdROHpmNkE9PSIsInZhbHVlIjoiSjN6SVd6YzJiTGxWbEpCSERja1p6L0hkRWpHb2w2M3YzelJBS1NPWXl4T24ydjljVDZEODZrMWJ5UDVtcmhmamJMYmN4dThDQUtGblZrZGNpaWJIazBURkpoaVo3d2xiZitscVQwTmd6ZzVVZmlvajVwRFhOc2VreS9ldmFNY2oiLCJtYWMiOiI2Y2EzMjI4ODczYzhmNTFiZjRkMGVlMzBlNWQ0OGM5OGUyY2I4ZGFkYjg4ZmY0ZmE2ZmRlMWM3NDEzNjk5NzhiIiwidGFnIjoiIn0%3D; urlrw_session=eyJpdiI6Ii9Jb3FHMitNZDJmbkpkYTZRRVMrVVE9PSIsInZhbHVlIjoicWRGcW1PUk1La3kxNzBJUy91MWRaMUtuaDNsaFc5a24xdlJCaFU4OWU1Q0dtbk1WcHdYc2hRa1FhUnloU0dkSFhscnB1RlN0ZmIzVWZBMzJjOWFvV2ZROTJRTTBUQkNYQzdubnBxM1NYU080OEpPY2tjQ2Nsek9PalBEeWdLS20iLCJtYWMiOiI4ZDEyMDllYTE4MzI3MDJkMjcxN2Y0NWE1MzFjYWNmZTIyNmIwZTVjZGZhY2VhZTNiNzgyYzc4ZDlmM2E4NDdiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

Response

HTTP/1.1 200 OK

Date: Fri, 09 Aug 2024 22:18:23 GMT
Server: Apache/2.4.52 (Ubuntu)
Last-Modified: Thu, 28 Sep 2023 14:41:20 GMT
ETag: "16802-6066c4d1bf04a-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 16892
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
DNS

url.rw

firefox.exe

Remote address:

8.8.8.8:53

Request

url.rw

IN A

Response

url.rw

IN A

188.166.2.160
DNS

shavar.prod.mozaws.net

firefox.exe

Remote address:

8.8.8.8:53

Request

shavar.prod.mozaws.net

IN A

Response

shavar.prod.mozaws.net

IN A

35.155.86.205

shavar.prod.mozaws.net

IN A

44.239.110.200

shavar.prod.mozaws.net

IN A

35.165.99.161
DNS

prod.remote-settings.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.remote-settings.prod.webservices.mozgcp.net

IN A

Response

prod.remote-settings.prod.webservices.mozgcp.net

IN A

34.149.100.209
DNS

prod.ads.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.ads.prod.webservices.mozgcp.net

IN A

Response

prod.ads.prod.webservices.mozgcp.net

IN A

34.117.188.166
DNS

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

IN A

Response

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

IN A

34.149.97.1
DNS

prod.content-signature-chains.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.content-signature-chains.prod.webservices.mozgcp.net

IN A

Response

prod.content-signature-chains.prod.webservices.mozgcp.net

IN A

34.160.144.191
DNS

url.rw

firefox.exe

Remote address:

8.8.8.8:53

Request

url.rw

IN AAAA

Response
DNS

shavar.prod.mozaws.net

firefox.exe

Remote address:

8.8.8.8:53

Request

shavar.prod.mozaws.net

IN AAAA

Response
DNS

prod.remote-settings.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.remote-settings.prod.webservices.mozgcp.net

IN AAAA

Response
DNS

prod.ads.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.ads.prod.webservices.mozgcp.net

IN AAAA

Response
DNS

prod.content-signature-chains.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.content-signature-chains.prod.webservices.mozgcp.net

IN AAAA

Response

prod.content-signature-chains.prod.webservices.mozgcp.net

IN AAAA

2600:1901:0:92a9::
DNS

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

IN AAAA

Response

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

IN AAAA

2600:1901:0:74e4::
DNS

cdn.jsdelivr.net

firefox.exe

Remote address:

8.8.8.8:53

Request

cdn.jsdelivr.net

IN A

Response

cdn.jsdelivr.net

IN CNAME

jsdelivr.map.fastly.net

jsdelivr.map.fastly.net

IN A

151.101.129.229

jsdelivr.map.fastly.net

IN A

151.101.193.229

jsdelivr.map.fastly.net

IN A

151.101.65.229

jsdelivr.map.fastly.net

IN A

151.101.1.229
DNS

cdn.ckeditor.com

firefox.exe

Remote address:

8.8.8.8:53

Request

cdn.ckeditor.com

IN A

Response

cdn.ckeditor.com

IN CNAME

d204dvb2kydvse.cloudfront.net

d204dvb2kydvse.cloudfront.net

IN A

13.224.245.37

d204dvb2kydvse.cloudfront.net

IN A

13.224.245.79

d204dvb2kydvse.cloudfront.net

IN A

13.224.245.22

d204dvb2kydvse.cloudfront.net

IN A

13.224.245.104
DNS

rsms.me

firefox.exe

Remote address:

8.8.8.8:53

Request

rsms.me

IN A

Response

rsms.me

IN A

104.21.234.235

rsms.me

IN A

104.21.234.234
GET

https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js

firefox.exe

Remote address:

151.101.129.229:443

Request

GET /npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js HTTP/2.0
host: cdn.jsdelivr.net
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
accept: */*
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
origin: https://url.rw
referer: https://url.rw/
sec-fetch-dest: script
sec-fetch-mode: cors
sec-fetch-site: cross-site
te: trailers

Response

HTTP/2.0 200

access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
x-jsd-version: 5.0.2
x-jsd-version-type: version
etag: W/"13397-kBFpUnUH/55mLPZNjjYfNZMIlw0"
content-encoding: br
accept-ranges: bytes
date: Fri, 09 Aug 2024 22:18:23 GMT
age: 1457705
x-served-by: cache-fra-eddf8230080-FRA, cache-lon420090-LON
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 23943
GET

https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css

firefox.exe

Remote address:

151.101.129.229:443

Request

GET /npm/bootstrap@5.0.2/dist/css/bootstrap.min.css HTTP/2.0
host: cdn.jsdelivr.net
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
accept: text/css,*/*;q=0.1
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
origin: https://url.rw
referer: https://url.rw/
sec-fetch-dest: style
sec-fetch-mode: cors
sec-fetch-site: cross-site
te: trailers

Response

HTTP/2.0 200

access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
x-jsd-version: 5.0.2
x-jsd-version-type: version
etag: W/"260c5-fByeBXPlzqi603M74vxjqoxo6o0"
content-encoding: br
accept-ranges: bytes
date: Fri, 09 Aug 2024 22:18:23 GMT
age: 3184102
x-served-by: cache-fra-eddf8230097-FRA, cache-lon420090-LON
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 25360
DNS

jsdelivr.map.fastly.net

firefox.exe

Remote address:

8.8.8.8:53

Request

jsdelivr.map.fastly.net

IN A

Response

jsdelivr.map.fastly.net

IN A

151.101.193.229

jsdelivr.map.fastly.net

IN A

151.101.129.229

jsdelivr.map.fastly.net

IN A

151.101.65.229

jsdelivr.map.fastly.net

IN A

151.101.1.229
GET

https://cdn.ckeditor.com/ckeditor5/39.0.1/classic/ckeditor.js

firefox.exe

Remote address:

13.224.245.37:443

Request

GET /ckeditor5/39.0.1/classic/ckeditor.js HTTP/2.0
host: cdn.ckeditor.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
accept: */*
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
referer: https://url.rw/
sec-fetch-dest: script
sec-fetch-mode: no-cors
sec-fetch-site: cross-site
te: trailers

Response

HTTP/2.0 200

content-type: text/javascript; charset=utf-8
date: Thu, 04 Jul 2024 12:53:27 GMT
cache-control: max-age=31536000
last-modified: Thu, 04 Jul 2024 12:12:42 GMT
x-amz-version-id: QRWtBcUTkzBZ3jmA0rfgOFio9mAmaoOA
etag: W/"09e0cc9548435763e40945618292c825"
server: AmazonS3
content-encoding: br
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 1b05f9178c1c0be702b00f1d1f0bcff6.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR62-C3
x-amz-cf-id: o68vwHikUhtEp7cGZorFfHFZm4lsL4dI8vdk0sb8mhfyeMpNFQi8TA==
age: 3144297
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
vary: Origin
DNS

d204dvb2kydvse.cloudfront.net

firefox.exe

Remote address:

8.8.8.8:53

Request

d204dvb2kydvse.cloudfront.net

IN A

Response

d204dvb2kydvse.cloudfront.net

IN A

13.224.245.37

d204dvb2kydvse.cloudfront.net

IN A

13.224.245.22

d204dvb2kydvse.cloudfront.net

IN A

13.224.245.104

d204dvb2kydvse.cloudfront.net

IN A

13.224.245.79
GET

https://rsms.me/inter/inter.css

firefox.exe

Remote address:

104.21.234.235:443

Request

GET /inter/inter.css HTTP/2.0
host: rsms.me
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
accept: text/css,*/*;q=0.1
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
referer: https://url.rw/
sec-fetch-dest: style
sec-fetch-mode: no-cors
sec-fetch-site: cross-site
te: trailers

Response

HTTP/2.0 200

date: Fri, 09 Aug 2024 22:18:23 GMT
content-type: text/css; charset=utf-8
content-length: 712
x-origin-cache: HIT
last-modified: Mon, 25 Mar 2024 16:53:19 GMT
access-control-allow-origin: *
etag: W/"6601abff-1b8d"
expires: Wed, 24 Jul 2024 03:53:18 GMT
cache-control: max-age=14400
content-encoding: gzip
x-proxy-cache: MISS
x-github-request-id: 807C:212527:7F7EDE:814CCD:6601ACC9
via: 1.1 varnish
age: 557
x-served-by: cache-lcy-eglc8600028-LCY
x-cache: HIT
x-cache-hits: 1
x-timer: S1711386009.298123,VS0,VE2
vary: Accept-Encoding
x-fastly-request-id: fcd6d25c3b5758ef0c6c8be0ae63ff79ff729220
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uJrEmKBaJiraTnY5l9DVqIR8Qa3e9n3neBLzNq%2Fk25Purl9NFjSrAHNXY8Trn24N0gMfUTJp55dq5Xp6y9fSEKPmSVj%2F3oFCvPF2Yv6DnBiHYQD%2F1XfnBOa3"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8b0b1f2aba53770d-LHR
alt-svc: h3=":443"; ma=86400
DNS

rsms.me

firefox.exe

Remote address:

8.8.8.8:53

Request

rsms.me

IN A

Response

rsms.me

IN A

104.21.234.235

rsms.me

IN A

104.21.234.234
DNS

jsdelivr.map.fastly.net

firefox.exe

Remote address:

8.8.8.8:53

Request

jsdelivr.map.fastly.net

IN AAAA

Response

jsdelivr.map.fastly.net

IN AAAA

2a04:4e42:400::485

jsdelivr.map.fastly.net

IN AAAA

2a04:4e42::485

jsdelivr.map.fastly.net

IN AAAA

2a04:4e42:600::485

jsdelivr.map.fastly.net

IN AAAA

2a04:4e42:200::485
DNS

rsms.me

firefox.exe

Remote address:

8.8.8.8:53

Request

rsms.me

IN AAAA

Response

rsms.me

IN AAAA

2606:4700:3038::6815:eaeb

rsms.me

IN AAAA

2606:4700:3038::6815:eaea
DNS

d204dvb2kydvse.cloudfront.net

firefox.exe

Remote address:

8.8.8.8:53

Request

d204dvb2kydvse.cloudfront.net

IN AAAA

Response

d204dvb2kydvse.cloudfront.net

IN AAAA

2600:9000:21b3:5e00:f:20fd:b80:93a1

d204dvb2kydvse.cloudfront.net

IN AAAA

2600:9000:21b3:ae00:f:20fd:b80:93a1

d204dvb2kydvse.cloudfront.net

IN AAAA

2600:9000:21b3:ac00:f:20fd:b80:93a1

d204dvb2kydvse.cloudfront.net

IN AAAA

2600:9000:21b3:9a00:f:20fd:b80:93a1

d204dvb2kydvse.cloudfront.net

IN AAAA

2600:9000:21b3:c00:f:20fd:b80:93a1

d204dvb2kydvse.cloudfront.net

IN AAAA

2600:9000:21b3:f400:f:20fd:b80:93a1

d204dvb2kydvse.cloudfront.net

IN AAAA

2600:9000:21b3:c400:f:20fd:b80:93a1

d204dvb2kydvse.cloudfront.net

IN AAAA

2600:9000:21b3:5a00:f:20fd:b80:93a1
DNS

1.97.149.34.in-addr.arpa

Remote address:

8.8.8.8:53

Request

1.97.149.34.in-addr.arpa

IN PTR

Response

1.97.149.34.in-addr.arpa

IN PTR

19714934bcgoogleusercontentcom
DNS

160.2.166.188.in-addr.arpa

Remote address:

8.8.8.8:53

Request

160.2.166.188.in-addr.arpa

IN PTR

Response

160.2.166.188.in-addr.arpa

IN PTR

prod-urlrw
DNS

200.110.239.44.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.110.239.44.in-addr.arpa

IN PTR

Response

200.110.239.44.in-addr.arpa

IN PTR

ec2-44-239-110-200 us-west-2compute amazonawscom
DNS

229.129.101.151.in-addr.arpa

Remote address:

8.8.8.8:53

Request

229.129.101.151.in-addr.arpa

IN PTR

Response
DNS

168.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

168.179.250.142.in-addr.arpa

IN PTR

Response

168.179.250.142.in-addr.arpa

IN PTR

ams15s41-in-f81e100net
DNS

37.245.224.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

37.245.224.13.in-addr.arpa

IN PTR

Response

37.245.224.13.in-addr.arpa

IN PTR

server-13-224-245-37lhr62r cloudfrontnet
DNS

235.234.21.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

235.234.21.104.in-addr.arpa

IN PTR

Response
DNS

region1.google-analytics.com

firefox.exe

Remote address:

8.8.8.8:53

Request

region1.google-analytics.com

IN A

Response

region1.google-analytics.com

IN A

216.239.34.36

region1.google-analytics.com

IN A

216.239.32.36
DNS

region1.google-analytics.com

firefox.exe

Remote address:

8.8.8.8:53

Request

region1.google-analytics.com

IN A

Response

region1.google-analytics.com

IN A

216.239.34.36

region1.google-analytics.com

IN A

216.239.32.36
DNS

region1.google-analytics.com

firefox.exe

Remote address:

8.8.8.8:53

Request

region1.google-analytics.com

IN AAAA

Response

region1.google-analytics.com

IN AAAA

2001:4860:4802:34::36

region1.google-analytics.com

IN AAAA

2001:4860:4802:32::36
POST

https://region1.google-analytics.com/g/collect?v=2&tid=G-JJFL3Y4WJS&gtm=45je4880v9137012356za200&_p=1723241902182&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=0&cid=1233968703.1723241903&ul=en-us&sr=1280x720&frm=0&pscdl=noapi&_s=1&sid=1723241903&sct=1&seg=0&dl=https%3A%2F%2Furl.rw%2FSolara&dt=Solara&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1237

firefox.exe

Remote address:

216.239.34.36:443

Request

POST /g/collect?v=2&tid=G-JJFL3Y4WJS&gtm=45je4880v9137012356za200&_p=1723241902182&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=0&cid=1233968703.1723241903&ul=en-us&sr=1280x720&frm=0&pscdl=noapi&_s=1&sid=1723241903&sct=1&seg=0&dl=https%3A%2F%2Furl.rw%2FSolara&dt=Solara&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1237 HTTP/2.0
host: region1.google-analytics.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
accept: */*
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
referer: https://url.rw/
origin: https://url.rw
sec-fetch-dest: empty
sec-fetch-mode: no-cors
sec-fetch-site: cross-site
pragma: no-cache
cache-control: no-cache
content-length: 0
te: trailers
POST

https://region1.google-analytics.com/g/collect?v=2&tid=G-NMF5SXKX3G&gtm=45je4880v9138199991za200zb9137012356&_p=1723241902182&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=0&cid=1233968703.1723241903&ul=en-us&sr=1280x720&frm=0&pscdl=noapi&_s=1&sid=1723241903&sct=1&seg=0&dl=https%3A%2F%2Furl.rw%2FSolara&dt=Solara&en=page_view&_fv=1&_ss=1&_ee=1&tfd=1463

firefox.exe

Remote address:

216.239.34.36:443

Request

POST /g/collect?v=2&tid=G-NMF5SXKX3G&gtm=45je4880v9138199991za200zb9137012356&_p=1723241902182&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=0&cid=1233968703.1723241903&ul=en-us&sr=1280x720&frm=0&pscdl=noapi&_s=1&sid=1723241903&sct=1&seg=0&dl=https%3A%2F%2Furl.rw%2FSolara&dt=Solara&en=page_view&_fv=1&_ss=1&_ee=1&tfd=1463 HTTP/2.0
host: region1.google-analytics.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
accept: */*
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
referer: https://url.rw/
origin: https://url.rw
sec-fetch-dest: empty
sec-fetch-mode: no-cors
sec-fetch-site: cross-site
pragma: no-cache
cache-control: no-cache
content-length: 0
te: trailers
DNS

36.34.239.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

36.34.239.216.in-addr.arpa

IN PTR

Response
DNS

g.bing.com

Remote address:

8.8.8.8:53

Request

g.bing.com

IN A

Response

g.bing.com

IN CNAME

g-bing-com.dual-a-0034.a-msedge.net

g-bing-com.dual-a-0034.a-msedge.net

IN CNAME

dual-a-0034.a-msedge.net

dual-a-0034.a-msedge.net

IN A

204.79.197.237

dual-a-0034.a-msedge.net

IN A

13.107.21.237
DNS

67.31.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

67.31.126.40.in-addr.arpa

IN PTR

Response
GET

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a49b76fdbad8451a9f9ea06169ae146c&localId=w:C73FBD69-E259-A995-64BC-A5A688D3CF0D&deviceId=6755468654711223&anid=

Remote address:

204.79.197.237:443

Request

GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a49b76fdbad8451a9f9ea06169ae146c&localId=w:C73FBD69-E259-A995-64BC-A5A688D3CF0D&deviceId=6755468654711223&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=3CA77F392D936FDD23E26BEF2C286E6F; domain=.bing.com; expires=Wed, 03-Sep-2025 22:18:26 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D620AE019760464BAE4D2FAE008D5461 Ref B: LON04EDGE0822 Ref C: 2024-08-09T22:18:26Z
date: Fri, 09 Aug 2024 22:18:25 GMT
GET

https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=a49b76fdbad8451a9f9ea06169ae146c&localId=w:C73FBD69-E259-A995-64BC-A5A688D3CF0D&deviceId=6755468654711223&anid=

Remote address:

204.79.197.237:443

Request

GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=a49b76fdbad8451a9f9ea06169ae146c&localId=w:C73FBD69-E259-A995-64BC-A5A688D3CF0D&deviceId=6755468654711223&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=3CA77F392D936FDD23E26BEF2C286E6F

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=wB4QZncpPU8CqsOK05EgP6_wqoIIlkg2n9F8F13T1H0; domain=.bing.com; expires=Wed, 03-Sep-2025 22:18:26 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 078BCEED3FF5401AAC672E110A41AAFF Ref B: LON04EDGE0822 Ref C: 2024-08-09T22:18:26Z
date: Fri, 09 Aug 2024 22:18:25 GMT
GET

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a49b76fdbad8451a9f9ea06169ae146c&localId=w:C73FBD69-E259-A995-64BC-A5A688D3CF0D&deviceId=6755468654711223&anid=

Remote address:

204.79.197.237:443

Request

GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a49b76fdbad8451a9f9ea06169ae146c&localId=w:C73FBD69-E259-A995-64BC-A5A688D3CF0D&deviceId=6755468654711223&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=3CA77F392D936FDD23E26BEF2C286E6F; MSPTC=wB4QZncpPU8CqsOK05EgP6_wqoIIlkg2n9F8F13T1H0

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7F1D93FF918448A1A5BEFA11BD349EDC Ref B: LON04EDGE0822 Ref C: 2024-08-09T22:18:26Z
date: Fri, 09 Aug 2024 22:18:25 GMT
DNS

solrx.lol

firefox.exe

Remote address:

8.8.8.8:53

Request

solrx.lol

IN A

Response

solrx.lol

IN A

89.187.188.226
GET

https://solrx.lol/

firefox.exe

Remote address:

89.187.188.226:443

Request

GET / HTTP/2.0
host: solrx.lol
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
upgrade-insecure-requests: 1
sec-fetch-dest: document
sec-fetch-mode: navigate
sec-fetch-site: cross-site
te: trailers

Response

HTTP/2.0 200

server: nginx
date: Fri, 09 Aug 2024 22:15:50 GMT
content-type: text/html; charset=UTF-8
strict-transport-security: max-age=31536000;
GET

https://solrx.lol/styles.css

firefox.exe

Remote address:

89.187.188.226:443

Request

GET /styles.css HTTP/2.0
host: solrx.lol
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
accept: text/css,*/*;q=0.1
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
referer: https://solrx.lol/
sec-fetch-dest: style
sec-fetch-mode: no-cors
sec-fetch-site: same-origin
te: trailers

Response

HTTP/2.0 200

server: nginx
date: Fri, 09 Aug 2024 22:15:50 GMT
content-type: text/css
content-length: 6541
last-modified: Fri, 09 Aug 2024 10:53:45 GMT
etag: "66b5f539-198d"
strict-transport-security: max-age=31536000;
accept-ranges: bytes
GET

https://solrx.lol/logo.png

firefox.exe

Remote address:

89.187.188.226:443

Request

GET /logo.png HTTP/2.0
host: solrx.lol
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
accept: image/avif,image/webp,*/*
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
referer: https://solrx.lol/
sec-fetch-dest: image
sec-fetch-mode: no-cors
sec-fetch-site: same-origin
te: trailers

Response

HTTP/2.0 200

server: nginx
date: Fri, 09 Aug 2024 22:15:50 GMT
content-type: image/png
content-length: 24185
last-modified: Fri, 09 Aug 2024 10:53:45 GMT
etag: "66b5f539-5e79"
strict-transport-security: max-age=31536000;
accept-ranges: bytes
GET

https://solrx.lol/solar.png

firefox.exe

Remote address:

89.187.188.226:443

Request

GET /solar.png HTTP/2.0
host: solrx.lol
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
accept: image/avif,image/webp,*/*
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
referer: https://solrx.lol/
sec-fetch-dest: image
sec-fetch-mode: no-cors
sec-fetch-site: same-origin
te: trailers

Response

HTTP/2.0 200

server: nginx
date: Fri, 09 Aug 2024 22:15:50 GMT
content-type: image/png
content-length: 54433
last-modified: Fri, 09 Aug 2024 10:53:45 GMT
etag: "66b5f539-d4a1"
strict-transport-security: max-age=31536000;
accept-ranges: bytes
GET

https://solrx.lol/scripts.js

firefox.exe

Remote address:

89.187.188.226:443

Request

GET /scripts.js HTTP/2.0
host: solrx.lol
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
accept: */*
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
referer: https://solrx.lol/
sec-fetch-dest: script
sec-fetch-mode: no-cors
sec-fetch-site: same-origin
te: trailers

Response

HTTP/2.0 200

server: nginx
date: Fri, 09 Aug 2024 22:15:50 GMT
content-type: application/javascript; charset=UTF-8
content-length: 1562
last-modified: Fri, 09 Aug 2024 15:15:55 GMT
etag: "66b632ab-61a"
strict-transport-security: max-age=31536000;
accept-ranges: bytes
GET

https://solrx.lol/icon.ico

firefox.exe

Remote address:

89.187.188.226:443

Request

GET /icon.ico HTTP/2.0
host: solrx.lol
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
accept: image/avif,image/webp,*/*
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
referer: https://solrx.lol/
sec-fetch-dest: image
sec-fetch-mode: no-cors
sec-fetch-site: same-origin
te: trailers

Response

HTTP/2.0 200

server: nginx
date: Fri, 09 Aug 2024 22:15:50 GMT
content-type: image/vnd.microsoft.icon
content-length: 4286
last-modified: Fri, 09 Aug 2024 10:53:45 GMT
etag: "10be-61f3df51b61fb"
accept-ranges: bytes
strict-transport-security: max-age=31536000;
DNS

solrx.lol

firefox.exe

Remote address:

8.8.8.8:53

Request

solrx.lol

IN A

Response

solrx.lol

IN A

89.187.188.226
DNS

solrx.lol

firefox.exe

Remote address:

8.8.8.8:53

Request

solrx.lol

IN A

Response

solrx.lol

IN A

89.187.188.226
DNS

solrx.lol

firefox.exe

Remote address:

8.8.8.8:53

Request

solrx.lol

IN AAAA

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

237.197.79.204.in-addr.arpa

Remote address:

8.8.8.8:53

Request

237.197.79.204.in-addr.arpa

IN PTR

Response
DNS

226.188.187.89.in-addr.arpa

Remote address:

8.8.8.8:53

Request

226.188.187.89.in-addr.arpa

IN PTR

Response
DNS

jsdelivr.map.fastly.net

firefox.exe

Remote address:

8.8.8.8:53

Request

jsdelivr.map.fastly.net

IN A

Response

jsdelivr.map.fastly.net

IN A

151.101.193.229

jsdelivr.map.fastly.net

IN A

151.101.129.229

jsdelivr.map.fastly.net

IN A

151.101.65.229

jsdelivr.map.fastly.net

IN A

151.101.1.229
DNS

www.mediafire.com

firefox.exe

Remote address:

8.8.8.8:53

Request

www.mediafire.com

IN A

Response

www.mediafire.com

IN A

104.16.113.74

www.mediafire.com

IN A

104.16.114.74
GET

https://www.mediafire.com/file/ir8ttdtyavz5wum/A2Z46o6wBmjG.zip/file

firefox.exe

Remote address:

104.16.113.74:443

Request

GET /file/ir8ttdtyavz5wum/A2Z46o6wBmjG.zip/file HTTP/2.0
host: www.mediafire.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
referer: https://solrx.lol/
upgrade-insecure-requests: 1
sec-fetch-dest: document
sec-fetch-mode: navigate
sec-fetch-site: cross-site
te: trailers

Response

HTTP/2.0 302

date: Fri, 09 Aug 2024 22:18:28 GMT
content-type: text/html; charset=UTF-8
location: https://download2284.mediafire.com/cos35lsdzqwgHi21mHRWGXZoPgm_w1Kh8FQvFbx_MAGzt4otzHL5JaY7K7wXEKLZl3xuRWeB7P47Fv6IkrOKhpSDZTUU8wLOJiy9bpW3WP_RSR9gBWeK48JRU3MT_J6k3y4JCW9qR1COX9pUT6Axt5gmsNNDJxP1iN4kdWLSc6A/ir8ttdtyavz5wum/A2Z46o6wBmjG.zip
cf-ray: 8b0b1f468f78cd1c-LHR
cf-cache-status: DYNAMIC
access-control-allow-origin: https://www.mediafire.com
set-cookie: ukey=h0fbm4yh2bpn502thzbyc19lybkggbtb; expires=Tue, 09-Aug-2044 22:18:28 GMT; Max-Age=631152000; path=/; domain=.mediafire.com; HttpOnly
strict-transport-security: max-age=0
access-control-allow-methods: OPTIONS, POST, GET
alt-svc: h3=":443"; ma=86400
x-mf-env: liveApi
x-mf-fe: mf2
set-cookie: __cf_bm=dRs22Ib6H15KP3PuJsImOdGJuRj_9iwyos5svSe22T4-1723241908-1.0.1.1-nMg1vrJohk0bcVzrlnou4SHmiiDJaEdlWBFRG7vxbs.CH4F0figcCKX7cyHxGLnZanBkZNh0J9yUGoJkGSayew; path=/; expires=Fri, 09-Aug-24 22:48:28 GMT; domain=.mediafire.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
server: cloudflare
DNS

www.mediafire.com

firefox.exe

Remote address:

8.8.8.8:53

Request

www.mediafire.com

IN A

Response

www.mediafire.com

IN A

104.16.114.74

www.mediafire.com

IN A

104.16.113.74
DNS

www.mediafire.com

firefox.exe

Remote address:

8.8.8.8:53

Request

www.mediafire.com

IN AAAA

Response
DNS

download2284.mediafire.com

firefox.exe

Remote address:

8.8.8.8:53

Request

download2284.mediafire.com

IN A

Response

download2284.mediafire.com

IN A

199.91.155.25
GET

https://download2284.mediafire.com/cos35lsdzqwgHi21mHRWGXZoPgm_w1Kh8FQvFbx_MAGzt4otzHL5JaY7K7wXEKLZl3xuRWeB7P47Fv6IkrOKhpSDZTUU8wLOJiy9bpW3WP_RSR9gBWeK48JRU3MT_J6k3y4JCW9qR1COX9pUT6Axt5gmsNNDJxP1iN4kdWLSc6A/ir8ttdtyavz5wum/A2Z46o6wBmjG.zip

firefox.exe

Remote address:

199.91.155.25:443

Request

GET /cos35lsdzqwgHi21mHRWGXZoPgm_w1Kh8FQvFbx_MAGzt4otzHL5JaY7K7wXEKLZl3xuRWeB7P47Fv6IkrOKhpSDZTUU8wLOJiy9bpW3WP_RSR9gBWeK48JRU3MT_J6k3y4JCW9qR1COX9pUT6Axt5gmsNNDJxP1iN4kdWLSc6A/ir8ttdtyavz5wum/A2Z46o6wBmjG.zip HTTP/1.1
Host: download2284.mediafire.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://solrx.lol/
Connection: keep-alive
Cookie: ukey=h0fbm4yh2bpn502thzbyc19lybkggbtb; __cf_bm=dRs22Ib6H15KP3PuJsImOdGJuRj_9iwyos5svSe22T4-1723241908-1.0.1.1-nMg1vrJohk0bcVzrlnou4SHmiiDJaEdlWBFRG7vxbs.CH4F0figcCKX7cyHxGLnZanBkZNh0J9yUGoJkGSayew
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

Response

HTTP/1.1 200 OK

server: bd-0.1.27
content-type: application/zip
accept-ranges: bytes
connection: close
cache-control: no-store
x-robots-tag: noindex, nofollow
content-disposition: attachment; filename="A2Z46o6wBmjG.zip"
content-length: 157122029
date: Fri, 09 Aug 2024 22:18:28 GMT
DNS

download2284.mediafire.com

firefox.exe

Remote address:

8.8.8.8:53

Request

download2284.mediafire.com

IN A

Response

download2284.mediafire.com

IN A

199.91.155.25
DNS

download2284.mediafire.com

firefox.exe

Remote address:

8.8.8.8:53

Request

download2284.mediafire.com

IN AAAA

Response
DNS

74.113.16.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

74.113.16.104.in-addr.arpa

IN PTR

Response
DNS

25.155.91.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

25.155.91.199.in-addr.arpa

IN PTR

Response
DNS

154.239.44.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

154.239.44.20.in-addr.arpa

IN PTR

Response
DNS

154.239.44.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

154.239.44.20.in-addr.arpa

IN PTR
DNS

157.123.68.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

157.123.68.40.in-addr.arpa

IN PTR

Response
DNS

location.services.mozilla.com

firefox.exe

Remote address:

8.8.8.8:53

Request

location.services.mozilla.com

IN A

Response

location.services.mozilla.com

IN CNAME

prod.classify-client.prod.webservices.mozgcp.net

prod.classify-client.prod.webservices.mozgcp.net

IN A

35.190.72.216
DNS

prod.classify-client.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.classify-client.prod.webservices.mozgcp.net

IN A

Response

prod.classify-client.prod.webservices.mozgcp.net

IN A

35.190.72.216
DNS

prod.balrog.prod.cloudops.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.balrog.prod.cloudops.mozgcp.net

IN AAAA

Response
DNS

prod.classify-client.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.classify-client.prod.webservices.mozgcp.net

IN AAAA

Response
DNS

prod.classify-client.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.classify-client.prod.webservices.mozgcp.net

IN AAAA
DNS

prod.classify-client.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.classify-client.prod.webservices.mozgcp.net

IN AAAA
DNS

prod.content-signature-chains.prod.webservices.mozgcp.net

firefox.exe

Remote address:

8.8.8.8:53

Request

prod.content-signature-chains.prod.webservices.mozgcp.net

IN AAAA

Response

prod.content-signature-chains.prod.webservices.mozgcp.net

IN AAAA

2600:1901:0:92a9::
DNS

redirector.gvt1.com

firefox.exe

Remote address:

8.8.8.8:53

Request

redirector.gvt1.com

IN A

Response

redirector.gvt1.com

IN A

142.250.179.174
DNS

ciscobinary.openh264.org

firefox.exe

Remote address:

8.8.8.8:53

Request

ciscobinary.openh264.org

IN A

Response

ciscobinary.openh264.org

IN CNAME

a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com

a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com

IN CNAME

a17.rackcdn.com

a17.rackcdn.com

IN CNAME

a17.rackcdn.com.mdc.edgesuite.net

a17.rackcdn.com.mdc.edgesuite.net

IN CNAME

a19.dscg10.akamai.net

a19.dscg10.akamai.net

IN A

88.221.134.155

a19.dscg10.akamai.net

IN A

88.221.134.209
GET

https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2710.0-win-x64.zip

firefox.exe

Remote address:

142.250.179.174:443

Request

GET /edgedl/widevine-cdm/4.10.2710.0-win-x64.zip HTTP/2.0
host: redirector.gvt1.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
accept: */*
accept-language: en-US,en;q=0.5
accept-encoding: gzip, deflate, br
te: trailers
DNS

redirector.gvt1.com

firefox.exe

Remote address:

8.8.8.8:53

Request

redirector.gvt1.com

IN A

Response

redirector.gvt1.com

IN A

142.250.179.174
GET

http://ciscobinary.openh264.org/openh264-win64-31c4d2e4a037526fd30d4e5c39f60885986cf865.zip

firefox.exe

Remote address:

88.221.134.155:80

Request

GET /openh264-win64-31c4d2e4a037526fd30d4e5c39f60885986cf865.zip HTTP/1.1
Host: ciscobinary.openh264.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive

Response

HTTP/1.1 200 OK

Last-Modified: Wed, 10 Apr 2024 18:35:32 GMT
ETag: 09372174e83dbbf696ee732fd2e875bb
Content-Length: 491284
Accept-Ranges: bytes
X-Timestamp: 1712774131.24210
Content-Type: application/zip
X-Trans-Id: tx35bbff3f42894cd8a58fe-0066184989dfw1
Cache-Control: public, max-age=197945
Expires: Mon, 12 Aug 2024 05:17:57 GMT
Date: Fri, 09 Aug 2024 22:18:52 GMT
Connection: keep-alive
DNS

a19.dscg10.akamai.net

firefox.exe

Remote address:

8.8.8.8:53

Request

a19.dscg10.akamai.net

IN A

Response

a19.dscg10.akamai.net

IN A

88.221.134.209

a19.dscg10.akamai.net

IN A

88.221.134.155
DNS

redirector.gvt1.com

firefox.exe

Remote address:

8.8.8.8:53

Request

redirector.gvt1.com

IN AAAA

Response

redirector.gvt1.com

IN AAAA

2a00:1450:400e:802::200e
DNS

a19.dscg10.akamai.net

firefox.exe

Remote address:

8.8.8.8:53

Request

a19.dscg10.akamai.net

IN AAAA

Response

a19.dscg10.akamai.net

IN AAAA

2a02:26f0:a1::58dd:86d1

a19.dscg10.akamai.net

IN AAAA

2a02:26f0:a1::58dd:869b
DNS

r3---sn-4g5edn6k.gvt1.com

firefox.exe

Remote address:

8.8.8.8:53

Request

r3---sn-4g5edn6k.gvt1.com

IN A

Response

r3---sn-4g5edn6k.gvt1.com

IN CNAME

r3.sn-4g5edn6k.gvt1.com

r3.sn-4g5edn6k.gvt1.com

IN A

74.125.111.136
GET

https://r3---sn-4g5edn6k.gvt1.com/edgedl/widevine-cdm/4.10.2710.0-win-x64.zip?cms_redirect=yes&mh=R8&mip=194.110.13.70&mm=28&mn=sn-4g5edn6k&ms=nvh&mt=1723241540&mv=m&mvi=3&pl=24&rmhost=r1---sn-4g5edn6k.gvt1.com&shardbypass=sd&smhost=r3---sn-4g5ednd7.gvt1.com

firefox.exe

Remote address:

74.125.111.136:443

Request

GET /edgedl/widevine-cdm/4.10.2710.0-win-x64.zip?cms_redirect=yes&mh=R8&mip=194.110.13.70&mm=28&mn=sn-4g5edn6k&ms=nvh&mt=1723241540&mv=m&mvi=3&pl=24&rmhost=r1---sn-4g5edn6k.gvt1.com&shardbypass=sd&smhost=r3---sn-4g5ednd7.gvt1.com HTTP/1.1
Host: r3---sn-4g5edn6k.gvt1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Cache-Control: public,max-age=86400
Content-Disposition: attachment
Content-Length: 14485862
Content-Security-Policy: default-src 'none'
Content-Type: application/zip
Etag: "1d3918c"
Server: downloads
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 0
Date: Fri, 09 Aug 2024 22:04:04 GMT
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Last-Modified: Thu, 05 Oct 2023 00:56:47 GMT
Connection: keep-alive
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Vary: Origin
DNS

r3.sn-4g5edn6k.gvt1.com

firefox.exe

Remote address:

8.8.8.8:53

Request

r3.sn-4g5edn6k.gvt1.com

IN A

Response

r3.sn-4g5edn6k.gvt1.com

IN A

74.125.111.136
DNS

r3.sn-4g5edn6k.gvt1.com

firefox.exe

Remote address:

8.8.8.8:53

Request

r3.sn-4g5edn6k.gvt1.com

IN AAAA

Response

r3.sn-4g5edn6k.gvt1.com

IN AAAA

2a00:1450:4001:d::8
DNS

18.31.95.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

18.31.95.13.in-addr.arpa

IN PTR

Response
DNS

216.72.190.35.in-addr.arpa

Remote address:

8.8.8.8:53

Request

216.72.190.35.in-addr.arpa

IN PTR

Response

216.72.190.35.in-addr.arpa

IN PTR

2167219035bcgoogleusercontentcom
DNS

201.181.244.35.in-addr.arpa

Remote address:

8.8.8.8:53

Request

201.181.244.35.in-addr.arpa

IN PTR

Response

201.181.244.35.in-addr.arpa

IN PTR

20118124435bcgoogleusercontentcom
DNS

147.142.123.92.in-addr.arpa

Remote address:

8.8.8.8:53

Request

147.142.123.92.in-addr.arpa

IN PTR

Response

147.142.123.92.in-addr.arpa

IN PTR

a92-123-142-147deploystaticakamaitechnologiescom
DNS

174.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

174.179.250.142.in-addr.arpa

IN PTR

Response

174.179.250.142.in-addr.arpa

IN PTR

ams15s41-in-f141e100net
DNS

136.111.125.74.in-addr.arpa

Remote address:

8.8.8.8:53

Request

136.111.125.74.in-addr.arpa

IN PTR

Response

136.111.125.74.in-addr.arpa

IN PTR

fra16s57-in-f81e100net
DNS

136.111.125.74.in-addr.arpa

Remote address:

8.8.8.8:53

Request

136.111.125.74.in-addr.arpa

IN PTR
DNS

172.214.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.214.232.199.in-addr.arpa

IN PTR

Response
DNS

43.58.199.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

43.58.199.20.in-addr.arpa

IN PTR

Response

127.0.0.1:62320

firefox.exe
188.166.2.160:443

https://url.rw/sol

tls, http

firefox.exe

7.9kB
109.3kB
30
90

HTTP Request

GET https://url.rw/Solara/

HTTP Response

301

HTTP Request

GET https://url.rw/Solara

HTTP Response

200

HTTP Request

GET https://url.rw/js/app.js

HTTP Response

200

HTTP Request

GET https://url.rw/images/favicon.png

HTTP Response

200

HTTP Request

GET https://url.rw/uploads/brand/ppp2gW4DLdNJCB1pg5Pb2D1b91DCHpKWRYOkno9Y.png

HTTP Response

200

HTTP Request

GET https://url.rw/sol

HTTP Response

301
188.166.2.160:443

https://url.rw/css/app.css

tls, http

firefox.exe

2.4kB
21.6kB
13
23

HTTP Request

GET https://url.rw/css/app.css

HTTP Response

200
151.101.129.229:443

https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css

tls, http2

firefox.exe

2.2kB
58.1kB
18
54

HTTP Request

GET https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js

HTTP Request

GET https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css

HTTP Response

200

HTTP Response

200
151.101.129.229:443

cdn.jsdelivr.net

tls, http2

firefox.exe

1.6kB
5.7kB
14
13
13.224.245.37:443

https://cdn.ckeditor.com/ckeditor5/39.0.1/classic/ckeditor.js

tls, http2

firefox.exe

3.7kB
265.9kB
54
199

HTTP Request

GET https://cdn.ckeditor.com/ckeditor5/39.0.1/classic/ckeditor.js

HTTP Response

200
104.21.234.235:443

https://rsms.me/inter/inter.css

tls, http2

firefox.exe

1.8kB
5.8kB
13
13

HTTP Request

GET https://rsms.me/inter/inter.css

HTTP Response

200
188.166.2.160:443

url.rw

tls

firefox.exe

1.3kB
599 B
9
6
216.239.34.36:443

https://region1.google-analytics.com/g/collect?v=2&tid=G-NMF5SXKX3G&gtm=45je4880v9138199991za200zb9137012356&_p=1723241902182&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=0&cid=1233968703.1723241903&ul=en-us&sr=1280x720&frm=0&pscdl=noapi&_s=1&sid=1723241903&sct=1&seg=0&dl=https%3A%2F%2Furl.rw%2FSolara&dt=Solara&en=page_view&_fv=1&_ss=1&_ee=1&tfd=1463

tls, http2

firefox.exe

2.8kB
6.5kB
19
19

HTTP Request

POST https://region1.google-analytics.com/g/collect?v=2&tid=G-JJFL3Y4WJS&gtm=45je4880v9137012356za200&_p=1723241902182&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=0&cid=1233968703.1723241903&ul=en-us&sr=1280x720&frm=0&pscdl=noapi&_s=1&sid=1723241903&sct=1&seg=0&dl=https%3A%2F%2Furl.rw%2FSolara&dt=Solara&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1237

HTTP Request

POST https://region1.google-analytics.com/g/collect?v=2&tid=G-NMF5SXKX3G&gtm=45je4880v9138199991za200zb9137012356&_p=1723241902182&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=0&cid=1233968703.1723241903&ul=en-us&sr=1280x720&frm=0&pscdl=noapi&_s=1&sid=1723241903&sct=1&seg=0&dl=https%3A%2F%2Furl.rw%2FSolara&dt=Solara&en=page_view&_fv=1&_ss=1&_ee=1&tfd=1463
204.79.197.237:443

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a49b76fdbad8451a9f9ea06169ae146c&localId=w:C73FBD69-E259-A995-64BC-A5A688D3CF0D&deviceId=6755468654711223&anid=

tls, http2

1.7kB
9.3kB
16
19

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a49b76fdbad8451a9f9ea06169ae146c&localId=w:C73FBD69-E259-A995-64BC-A5A688D3CF0D&deviceId=6755468654711223&anid=

HTTP Response

204

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=a49b76fdbad8451a9f9ea06169ae146c&localId=w:C73FBD69-E259-A995-64BC-A5A688D3CF0D&deviceId=6755468654711223&anid=

HTTP Response

204

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a49b76fdbad8451a9f9ea06169ae146c&localId=w:C73FBD69-E259-A995-64BC-A5A688D3CF0D&deviceId=6755468654711223&anid=

HTTP Response

204
89.187.188.226:443

https://solrx.lol/icon.ico

tls, http2

firefox.exe

3.0kB
102.8kB
29
86

HTTP Request

GET https://solrx.lol/

HTTP Response

200

HTTP Request

GET https://solrx.lol/styles.css

HTTP Request

GET https://solrx.lol/logo.png

HTTP Request

GET https://solrx.lol/solar.png

HTTP Request

GET https://solrx.lol/scripts.js

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://solrx.lol/icon.ico

HTTP Response

200
127.0.0.1:62328

firefox.exe
151.101.129.229:443

cdn.jsdelivr.net

tls, http2

firefox.exe

1.4kB
5.7kB
10
12
13.224.245.37:443

cdn.ckeditor.com

tls, http2

firefox.exe

1.4kB
6.8kB
10
14
104.21.234.235:443

rsms.me

tls, http2

firefox.exe

1.3kB
4.1kB
9
10
104.16.113.74:443

https://www.mediafire.com/file/ir8ttdtyavz5wum/A2Z46o6wBmjG.zip/file

tls, http2

firefox.exe

2.1kB
7.4kB
16
17

HTTP Request

GET https://www.mediafire.com/file/ir8ttdtyavz5wum/A2Z46o6wBmjG.zip/file

HTTP Response

302
199.91.155.25:443

https://download2284.mediafire.com/cos35lsdzqwgHi21mHRWGXZoPgm_w1Kh8FQvFbx_MAGzt4otzHL5JaY7K7wXEKLZl3xuRWeB7P47Fv6IkrOKhpSDZTUU8wLOJiy9bpW3WP_RSR9gBWeK48JRU3MT_J6k3y4JCW9qR1COX9pUT6Axt5gmsNNDJxP1iN4kdWLSc6A/ir8ttdtyavz5wum/A2Z46o6wBmjG.zip

tls, http

firefox.exe

387.4kB
26.8MB
7908
19208

HTTP Request

GET https://download2284.mediafire.com/cos35lsdzqwgHi21mHRWGXZoPgm_w1Kh8FQvFbx_MAGzt4otzHL5JaY7K7wXEKLZl3xuRWeB7P47Fv6IkrOKhpSDZTUU8wLOJiy9bpW3WP_RSR9gBWeK48JRU3MT_J6k3y4JCW9qR1COX9pUT6Axt5gmsNNDJxP1iN4kdWLSc6A/ir8ttdtyavz5wum/A2Z46o6wBmjG.zip

HTTP Response

200
142.250.179.174:443

https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2710.0-win-x64.zip

tls, http2

firefox.exe

1.5kB
8.8kB
16
19

HTTP Request

GET https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2710.0-win-x64.zip
88.221.134.155:80

http://ciscobinary.openh264.org/openh264-win64-31c4d2e4a037526fd30d4e5c39f60885986cf865.zip

http

firefox.exe

3.2kB
506.5kB
62
369

HTTP Request

GET http://ciscobinary.openh264.org/openh264-win64-31c4d2e4a037526fd30d4e5c39f60885986cf865.zip

HTTP Response

200
74.125.111.136:443

https://r3---sn-4g5edn6k.gvt1.com/edgedl/widevine-cdm/4.10.2710.0-win-x64.zip?cms_redirect=yes&mh=R8&mip=194.110.13.70&mm=28&mn=sn-4g5edn6k&ms=nvh&mt=1723241540&mv=m&mvi=3&pl=24&rmhost=r1---sn-4g5edn6k.gvt1.com&shardbypass=sd&smhost=r3---sn-4g5ednd7.gvt1.com

tls, http

firefox.exe

519.6kB
16.3MB
7937
11696

HTTP Request

GET https://r3---sn-4g5edn6k.gvt1.com/edgedl/widevine-cdm/4.10.2710.0-win-x64.zip?cms_redirect=yes&mh=R8&mip=194.110.13.70&mm=28&mn=sn-4g5edn6k&ms=nvh&mt=1723241540&mv=m&mvi=3&pl=24&rmhost=r1---sn-4g5edn6k.gvt1.com&shardbypass=sd&smhost=r3---sn-4g5ednd7.gvt1.com

HTTP Response

200

8.8.8.8:53

58.55.71.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

58.55.71.13.in-addr.arpa
8.8.8.8:53

18.58.20.217.in-addr.arpa

dns

71 B
131 B
1
1

DNS Request

18.58.20.217.in-addr.arpa
8.8.8.8:53

url.rw

dns

firefox.exe

52 B
68 B
1
1

DNS Request

url.rw

DNS Response

188.166.2.160
8.8.8.8:53

spocs.getpocket.com

dns

firefox.exe

65 B
131 B
1
1

DNS Request

spocs.getpocket.com

DNS Response

34.117.188.166
8.8.8.8:53

firefox-api-proxy.cdn.mozilla.net

dns

firefox.exe

79 B
160 B
1
1

DNS Request

firefox-api-proxy.cdn.mozilla.net

DNS Response

34.149.97.1
8.8.8.8:53

url.rw

dns

firefox.exe

52 B
68 B
1
1

DNS Request

url.rw

DNS Response

188.166.2.160
8.8.8.8:53

shavar.prod.mozaws.net

dns

firefox.exe

68 B
116 B
1
1

DNS Request

shavar.prod.mozaws.net

DNS Response

35.155.86.205

44.239.110.200

35.165.99.161
34.149.97.1:443

firefox-api-proxy.cdn.mozilla.net

https

firefox.exe

2.1kB
12.6kB
6
13
34.117.188.166:443

spocs.getpocket.com

https

firefox.exe

2.4kB
19.0kB
9
18
34.117.188.166:443

spocs.getpocket.com

https

firefox.exe

2.0kB
12.9kB
7
14
8.8.8.8:53

prod.remote-settings.prod.webservices.mozgcp.net

dns

firefox.exe

94 B
110 B
1
1

DNS Request

prod.remote-settings.prod.webservices.mozgcp.net

DNS Response

34.149.100.209
8.8.8.8:53

prod.ads.prod.webservices.mozgcp.net

dns

firefox.exe

82 B
98 B
1
1

DNS Request

prod.ads.prod.webservices.mozgcp.net

DNS Response

34.117.188.166
8.8.8.8:53

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

dns

firefox.exe

100 B
116 B
1
1

DNS Request

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

DNS Response

34.149.97.1
8.8.8.8:53

prod.content-signature-chains.prod.webservices.mozgcp.net

dns

firefox.exe

103 B
119 B
1
1

DNS Request

prod.content-signature-chains.prod.webservices.mozgcp.net

DNS Response

34.160.144.191
8.8.8.8:53

url.rw

dns

firefox.exe

52 B
114 B
1
1

DNS Request

url.rw
8.8.8.8:53

shavar.prod.mozaws.net

dns

firefox.exe

68 B
153 B
1
1

DNS Request

shavar.prod.mozaws.net
8.8.8.8:53

prod.remote-settings.prod.webservices.mozgcp.net

dns

firefox.exe

94 B
187 B
1
1

DNS Request

prod.remote-settings.prod.webservices.mozgcp.net
8.8.8.8:53

prod.ads.prod.webservices.mozgcp.net

dns

firefox.exe

82 B
175 B
1
1

DNS Request

prod.ads.prod.webservices.mozgcp.net
8.8.8.8:53

prod.content-signature-chains.prod.webservices.mozgcp.net

dns

firefox.exe

103 B
131 B
1
1

DNS Request

prod.content-signature-chains.prod.webservices.mozgcp.net

DNS Response

2600:1901:0:92a9::
8.8.8.8:53

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

dns

firefox.exe

100 B
128 B
1
1

DNS Request

firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net

DNS Response

2600:1901:0:74e4::
8.8.8.8:53

cdn.jsdelivr.net

dns

firefox.exe

62 B
160 B
1
1

DNS Request

cdn.jsdelivr.net

DNS Response

151.101.129.229

151.101.193.229

151.101.65.229

151.101.1.229
8.8.8.8:53

cdn.ckeditor.com

dns

firefox.exe

62 B
169 B
1
1

DNS Request

cdn.ckeditor.com

DNS Response

13.224.245.37

13.224.245.79

13.224.245.22

13.224.245.104
8.8.8.8:53

rsms.me

dns

firefox.exe

53 B
85 B
1
1

DNS Request

rsms.me

DNS Response

104.21.234.235

104.21.234.234
8.8.8.8:53

jsdelivr.map.fastly.net

dns

firefox.exe

69 B
133 B
1
1

DNS Request

jsdelivr.map.fastly.net

DNS Response

151.101.193.229

151.101.129.229

151.101.65.229

151.101.1.229
8.8.8.8:53

d204dvb2kydvse.cloudfront.net

dns

firefox.exe

75 B
139 B
1
1

DNS Request

d204dvb2kydvse.cloudfront.net

DNS Response

13.224.245.37

13.224.245.22

13.224.245.104

13.224.245.79
8.8.8.8:53

rsms.me

dns

firefox.exe

53 B
85 B
1
1

DNS Request

rsms.me

DNS Response

104.21.234.235

104.21.234.234
8.8.8.8:53

jsdelivr.map.fastly.net

dns

firefox.exe

69 B
181 B
1
1

DNS Request

jsdelivr.map.fastly.net

DNS Response

2a04:4e42:400::485

2a04:4e42::485

2a04:4e42:600::485

2a04:4e42:200::485
8.8.8.8:53

rsms.me

dns

firefox.exe

53 B
109 B
1
1

DNS Request

rsms.me

DNS Response

2606:4700:3038::6815:eaeb

2606:4700:3038::6815:eaea
8.8.8.8:53

d204dvb2kydvse.cloudfront.net

dns

firefox.exe

75 B
299 B
1
1

DNS Request

d204dvb2kydvse.cloudfront.net

DNS Response

2600:9000:21b3:5e00:f:20fd:b80:93a1

2600:9000:21b3:ae00:f:20fd:b80:93a1

2600:9000:21b3:ac00:f:20fd:b80:93a1

2600:9000:21b3:9a00:f:20fd:b80:93a1

2600:9000:21b3:c00:f:20fd:b80:93a1

2600:9000:21b3:f400:f:20fd:b80:93a1

2600:9000:21b3:c400:f:20fd:b80:93a1

2600:9000:21b3:5a00:f:20fd:b80:93a1
151.101.129.229:443

jsdelivr.map.fastly.net

https

firefox.exe

1.9kB
4.3kB
6
6
104.21.234.235:443

rsms.me

https

firefox.exe

1.8kB
6.6kB
5
10
8.8.8.8:53

1.97.149.34.in-addr.arpa

dns

70 B
120 B
1
1

DNS Request

1.97.149.34.in-addr.arpa
8.8.8.8:53

160.2.166.188.in-addr.arpa

dns

72 B
97 B
1
1

DNS Request

160.2.166.188.in-addr.arpa
8.8.8.8:53

200.110.239.44.in-addr.arpa

dns

73 B
137 B
1
1

DNS Request

200.110.239.44.in-addr.arpa
8.8.8.8:53

229.129.101.151.in-addr.arpa

dns

74 B
134 B
1
1

DNS Request

229.129.101.151.in-addr.arpa
8.8.8.8:53

168.179.250.142.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

168.179.250.142.in-addr.arpa
8.8.8.8:53

37.245.224.13.in-addr.arpa

dns

72 B
129 B
1
1

DNS Request

37.245.224.13.in-addr.arpa
8.8.8.8:53

235.234.21.104.in-addr.arpa

dns

73 B
135 B
1
1

DNS Request

235.234.21.104.in-addr.arpa
8.8.8.8:53

region1.google-analytics.com

dns

firefox.exe

74 B
106 B
1
1

DNS Request

region1.google-analytics.com

DNS Response

216.239.34.36

216.239.32.36
8.8.8.8:53

region1.google-analytics.com

dns

firefox.exe

74 B
106 B
1
1

DNS Request

region1.google-analytics.com

DNS Response

216.239.34.36

216.239.32.36
8.8.8.8:53

region1.google-analytics.com

dns

firefox.exe

74 B
130 B
1
1

DNS Request

region1.google-analytics.com

DNS Response

2001:4860:4802:34::36

2001:4860:4802:32::36
216.239.34.36:443

region1.google-analytics.com

https

firefox.exe

3.2kB
7.9kB
10
14
8.8.8.8:53

36.34.239.216.in-addr.arpa

dns

72 B
132 B
1
1

DNS Request

36.34.239.216.in-addr.arpa
8.8.8.8:53

g.bing.com

dns

56 B
151 B
1
1

DNS Request

g.bing.com

DNS Response

204.79.197.237

13.107.21.237
8.8.8.8:53

67.31.126.40.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

67.31.126.40.in-addr.arpa
8.8.8.8:53

solrx.lol

dns

firefox.exe

55 B
71 B
1
1

DNS Request

solrx.lol

DNS Response

89.187.188.226
8.8.8.8:53

solrx.lol

dns

firefox.exe

110 B
142 B
2
2

DNS Request

solrx.lol

DNS Request

solrx.lol

DNS Response

89.187.188.226

DNS Response

89.187.188.226
8.8.8.8:53

solrx.lol

dns

firefox.exe

55 B
119 B
1
1

DNS Request

solrx.lol
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

237.197.79.204.in-addr.arpa

dns

73 B
143 B
1
1

DNS Request

237.197.79.204.in-addr.arpa
8.8.8.8:53

226.188.187.89.in-addr.arpa

dns

73 B
136 B
1
1

DNS Request

226.188.187.89.in-addr.arpa
8.8.8.8:53

jsdelivr.map.fastly.net

dns

firefox.exe

69 B
133 B
1
1

DNS Request

jsdelivr.map.fastly.net

DNS Response

151.101.193.229

151.101.129.229

151.101.65.229

151.101.1.229
8.8.8.8:53

www.mediafire.com

dns

firefox.exe

63 B
95 B
1
1

DNS Request

www.mediafire.com

DNS Response

104.16.113.74

104.16.114.74
8.8.8.8:53

www.mediafire.com

dns

firefox.exe

63 B
95 B
1
1

DNS Request

www.mediafire.com

DNS Response

104.16.114.74

104.16.113.74
8.8.8.8:53

www.mediafire.com

dns

firefox.exe

63 B
121 B
1
1

DNS Request

www.mediafire.com
104.16.113.74:443

www.mediafire.com

https

firefox.exe

2.1kB
9.4kB
10
13
8.8.8.8:53

download2284.mediafire.com

dns

firefox.exe

72 B
88 B
1
1

DNS Request

download2284.mediafire.com

DNS Response

199.91.155.25
8.8.8.8:53

download2284.mediafire.com

dns

firefox.exe

72 B
88 B
1
1

DNS Request

download2284.mediafire.com

DNS Response

199.91.155.25
8.8.8.8:53

download2284.mediafire.com

dns

firefox.exe

72 B
130 B
1
1

DNS Request

download2284.mediafire.com
8.8.8.8:53

74.113.16.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

74.113.16.104.in-addr.arpa
8.8.8.8:53

25.155.91.199.in-addr.arpa

dns

72 B
72 B
1
1

DNS Request

25.155.91.199.in-addr.arpa
8.8.8.8:53

154.239.44.20.in-addr.arpa

dns

144 B
158 B
2
1

DNS Request

154.239.44.20.in-addr.arpa

DNS Request

154.239.44.20.in-addr.arpa
8.8.8.8:53

157.123.68.40.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

157.123.68.40.in-addr.arpa
8.8.8.8:53

location.services.mozilla.com

dns

firefox.exe

75 B
153 B
1
1

DNS Request

location.services.mozilla.com

DNS Response

35.190.72.216
8.8.8.8:53

tls

82 B
98 B
1
1
35.190.72.216:443

location.services.mozilla.com

https

firefox.exe

2.1kB
4.6kB
8
9
8.8.8.8:53

prod.classify-client.prod.webservices.mozgcp.net

dns

firefox.exe

94 B
110 B
1
1

DNS Request

prod.classify-client.prod.webservices.mozgcp.net

DNS Response

35.190.72.216
8.8.8.8:53

prod.balrog.prod.cloudops.mozgcp.net

dns

firefox.exe

82 B
175 B
1
1

DNS Request

prod.balrog.prod.cloudops.mozgcp.net
8.8.8.8:53

prod.classify-client.prod.webservices.mozgcp.net

dns

firefox.exe

282 B
187 B
3
1

DNS Request

prod.classify-client.prod.webservices.mozgcp.net

DNS Request

prod.classify-client.prod.webservices.mozgcp.net

DNS Request

prod.classify-client.prod.webservices.mozgcp.net
8.8.8.8:53

prod.content-signature-chains.prod.webservices.mozgcp.net

dns

firefox.exe

103 B
131 B
1
1

DNS Request

prod.content-signature-chains.prod.webservices.mozgcp.net

DNS Response

2600:1901:0:92a9::
8.8.8.8:53

redirector.gvt1.com

dns

firefox.exe

65 B
81 B
1
1

DNS Request

redirector.gvt1.com

DNS Response

142.250.179.174
8.8.8.8:53

ciscobinary.openh264.org

dns

firefox.exe

70 B
286 B
1
1

DNS Request

ciscobinary.openh264.org

DNS Response

88.221.134.155

88.221.134.209
8.8.8.8:53

redirector.gvt1.com

dns

firefox.exe

65 B
81 B
1
1

DNS Request

redirector.gvt1.com

DNS Response

142.250.179.174
8.8.8.8:53

a19.dscg10.akamai.net

dns

firefox.exe

67 B
99 B
1
1

DNS Request

a19.dscg10.akamai.net

DNS Response

88.221.134.209

88.221.134.155
8.8.8.8:53

redirector.gvt1.com

dns

firefox.exe

65 B
93 B
1
1

DNS Request

redirector.gvt1.com

DNS Response

2a00:1450:400e:802::200e
8.8.8.8:53

a19.dscg10.akamai.net

dns

firefox.exe

67 B
123 B
1
1

DNS Request

a19.dscg10.akamai.net

DNS Response

2a02:26f0:a1::58dd:86d1

2a02:26f0:a1::58dd:869b
142.250.179.174:443

redirector.gvt1.com

https

firefox.exe

1.8kB
9.3kB
6
10
8.8.8.8:53

r3---sn-4g5edn6k.gvt1.com

dns

firefox.exe

71 B
116 B
1
1

DNS Request

r3---sn-4g5edn6k.gvt1.com

DNS Response

74.125.111.136
8.8.8.8:53

r3.sn-4g5edn6k.gvt1.com

dns

firefox.exe

69 B
85 B
1
1

DNS Request

r3.sn-4g5edn6k.gvt1.com

DNS Response

74.125.111.136
8.8.8.8:53

r3.sn-4g5edn6k.gvt1.com

dns

firefox.exe

69 B
97 B
1
1

DNS Request

r3.sn-4g5edn6k.gvt1.com

DNS Response

2a00:1450:4001:d::8
8.8.8.8:53

18.31.95.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

18.31.95.13.in-addr.arpa
8.8.8.8:53

216.72.190.35.in-addr.arpa

dns

72 B
124 B
1
1

DNS Request

216.72.190.35.in-addr.arpa
8.8.8.8:53

201.181.244.35.in-addr.arpa

dns

73 B
126 B
1
1

DNS Request

201.181.244.35.in-addr.arpa
8.8.8.8:53

147.142.123.92.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

147.142.123.92.in-addr.arpa
8.8.8.8:53

174.179.250.142.in-addr.arpa

dns

74 B
113 B
1
1

DNS Request

174.179.250.142.in-addr.arpa
74.125.111.136:443

r3.sn-4g5edn6k.gvt1.com

https

firefox.exe

1.8kB
5.9kB
6
7
8.8.8.8:53

136.111.125.74.in-addr.arpa

dns

146 B
111 B
2
1

DNS Request

136.111.125.74.in-addr.arpa

DNS Request

136.111.125.74.in-addr.arpa
8.8.8.8:53

172.214.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.214.232.199.in-addr.arpa
8.8.8.8:53

43.58.199.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

43.58.199.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\activity-stream.discovery_stream.json.tmp

Filesize
29KB

MD5
35fc6ddd8da7004e22c7696dcff4d148

SHA1
810ca6752f6c303aab318c86b7d774caf945b033

SHA256
4b7c532947a4b7ec20cca8ebfcc1e13d78f761bc9eae51118d19bad26de2dd9d

SHA512
c587ae69ef20414dbef52797b42c5a9c25d2f52d7af363a2bd197401f471e2fc7ed35ec19f199527b56a2a1cb9803a1cafc3b3905301d98d5dbb9b925fe3afa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin

Filesize
10KB

MD5
d22e28dc0a1fe7991bf6016e9bc58056

SHA1
8df658e1c0387e63ddfec113148493e8f2665cc6

SHA256
75dbb302433f144b65d2ecf1684b9e4e8b1a3834b596d84ce047395d73acde91

SHA512
3e56e5b9e63ffe5a986c7683ba35709950818a3ddbd6146717695e33e6be194d0e5cb4bf0e8048097ff843e76353b1501e048356df017b763ac4c9119b72ff4f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin

Filesize
15KB

MD5
5042823c03d06439f02e30294e451114

SHA1
71a3140c4663f20623a755dcbe711b3ef0487c76

SHA256
96c0069121fac549c05f758324eeed1b21d462f98a9dcb3646762790b9e6078b

SHA512
fc54b4345f3a930ea9f064f729f5742c05d1f45c2962d358cf29762334153f8c44dd56955e7fb878e3e5977d38eaddece4fd1326a6fe1e1123f6625a64259042

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

Filesize
16KB

MD5
859a4364e87456c692c36acd47f21b0d

SHA1
4f8b8687b9679e156b56c9d944bb47ecce546001

SHA256
f1460cfab379712906b7712867d9e5f4eabf7123f0e65deb23db57716616db60

SHA512
28b651274f81c1958c4ebbe88bafc0e7ea7d333f107ba258df6836e9cb262a02c17e897c4efc6ecbb56a0b9961ead578b97f2710735974cf20cea2e2ae47276d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
ccffd50d21eae2969ac1c8a4dcadf38f

SHA1
239db690dcab581f0e3647f127c74cc64e89a1bf

SHA256
85b6bc1fd6b8626febffbee39e9387fd4ed5a4d92719790441a832eebe69b077

SHA512
ccdbebecca56d8e26990c1d898c08e2b4606a663331bbc849f5edfdf09b242c23726e8ae0eb843b8dbb5b9a833d381025f14faafb6fce38cda47b35a720a147c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
30c42cf88cf0c34f1c4844275e99f0cd

SHA1
cfaa415e0749dd2bf118577ba1f18d9acc922788

SHA256
64a05f3685ed6f961f967a8b4e0dcf8cb623e36b455506779814f68ae9d4c4a0

SHA512
c50319ee88ee41e079d439bbbd205814de1c64746abb1bdfd6f664c27b852be1ffbff80954928e8b703801444c148eedabcc755a2c17901095b9089de431eb4d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\0352b322-2188-4a6e-9c98-169cd2950bc0

Filesize
982B

MD5
7905bcbfb24f8b32f81693ab7ce83c52

SHA1
876d3e8ff18b641bb3ed5cc0e82275270b650588

SHA256
82517ff2cdab89d918bf1fe3b929090c402135231accc965d6f6fa5c4e18642f

SHA512
2a8174218f84e3676375726d17fa56a29d9a01ace3a048fcfa315bf3a619431c84dcee529df73cc0d4dac0d18c6c293b2ee598494337377a04122dc295a7cf91

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\6010b1bc-02b0-479c-aceb-34ae1853145d

Filesize
671B

MD5
7b94d36356fdd780fe4c76af77939734

SHA1
8f4449c6a702930c3ca6c42f88ed70c59b0ef26c

SHA256
f20cb2dbd89f66bef14dcfd6087925e37a3d4a34afce1fa853f5b811914d4e51

SHA512
94fbc1681705a131142b57ec619aeb35fd02b311c8b2107fafde082e1b3edd42bf07bd897883ee0954673ddcf02d6877a739929e69631f3ce371c85c0f773809

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\febd0fdc-b21e-4b37-8fa7-040593fa0a8f

Filesize
26KB

MD5
c6f15342fd489930a65754a09c4f8370

SHA1
8e2dbc36c89ab2ebdd08e1e152ae41de33adc522

SHA256
e08a1317b926782e6c5cad702d70b1cbb831ff711feacc5d3b86511f9e158e53

SHA512
a07013770ad9daf349a5668da8479c5ca6b26743d81e81055513b6aa1bf038a949a22b9fd4949a99abc32343a2adeae59ebd2fa1b14a37e7b9aad2dd1e7f6da7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs-1.js

Filesize
11KB

MD5
66f8b69d4c2a0de78e77b68d978c25e1

SHA1
7650dd557e55fdb5c9542ab5d5f7cdc18eab70ed

SHA256
e7f0ea49ebd679738d8552c0c547897f74f6343bd3e2abd9966393ad09bca328

SHA512
ed14332502eda7e45cbdd7805bab8cd73152991f810755ba89af08bfd8ea04611f074c0fa036c2392f2bde6672c6ee9a69fedb0c50d9cd487000b6074a0240e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs.js

Filesize
11KB

MD5
7fe3764e9cc054e63a695eaa93f73de1

SHA1
2864ca92dc643b7650d41236347a2e71a2e3b510

SHA256
b117085c6e42156daa47ad32570cd3c9c3e2cf6a660971efee029f0e22b4a63e

SHA512
c2bf0f7ad088310f0d12b494375b6e95c3a5bf9e8e4c04584046af37ca25c948594898d35bf4227eeba81935d8097a249740bee0c8bd6045d1fe7a3d661b6e76

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
0568bccbd49b055a473d333c866f4ed4

SHA1
fa050087d9b16dfa7612db7b39fe4994a2aed673

SHA256
8fe251c4bf3d57729ed6a9044b2d3c6ac94d8f3a14c103daf19686dec09fb7e1

SHA512
007770a7cf5004e9b48aa09402b4b61d5246b91d8a5003db43c5b801926438c9307e169f09d5f8111cae32743e2641e0fabdeb54d0c30b0b0dbc8e080819c02a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
2e3962148ca6408322e97a1f0fb1ec87

SHA1
c12819ddc5ca83a22b29a0eff1f01b6a170e0a13

SHA256
84f0b65094afcb01726cce6934d83eb1b5c42397088fb967caee07a5affdfea7

SHA512
bb440432e3e40c1cc300e811473906e6c0f9f149c5c94c9952fdf84b4f94361ad1bbd2da068ca6ff4541725496659ce1e96f83fc45baa2ecc77c0b23582b2194

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request