Strange things with a script started when you logon on ebay
https://signin.ebay.co.uk
debug show
04/12/2017 14:00:43 Added firefox.exe TCP 127.0.0.1:50082 127.0.0.1:5900
04/12/2017 14:00:46 Added firefox.exe TCP 127.0.0.1:50085 127.0.0.1:5901
04/12/2017 14:00:47 Added firefox.exe TCP 127.0.0.1:50086 127.0.0.1:5902
04/12/2017 14:00:49 Added firefox.exe TCP 127.0.0.1:50088 127.0.0.1:5902
04/12/2017 14:00:52 Added firefox.exe TCP 127.0.0.1:50091 127.0.0.1:5903
04/12/2017 14:00:53 Added firefox.exe TCP 127.0.0.1:50092 127.0.0.1:3389
It seems to load
https://src.ebay-us.com/fp/check.js
and that launch a connection on the following ports
['REF:63333','VNC:5900','VNC:5901','VNC:5902','VNC:5903','RDP:3389','APC:5279','TV:5939'];
What's going on... is ebay logging how to possible access your system
In the vnc logging we see that a connection to the server is made .... from the browser.
A security check ?