Edit tour

Linux Analysis Report
http://selfservicegeneraligroup.com

Overview

General Information

Sample URL:	http://selfservicegeneraligroup.com
Analysis ID:	1427195
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false

Signatures

Creates hidden files and/or directories

Creates hidden files without content (potentially used as a mutex)

Queries the installed Ubuntu/CentOS release

Reads the 'hosts' file potentially containing internal network hosts

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427195
Start date and time:	2024-04-17 08:34:03 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://selfservicegeneraligroup.com
Analysis system description:	Ubuntu Linux 16.04 x64 (Kernel 4.4.0-116, Firefox 88.0, Document Viewer 3.18.2, LibreOffice 5.1.6.2, OpenJDK 1.8.0_171)
Analysis Mode:	default
Detection:	CLEAN
Classification:	clean2.lin@0/75@24/0

Warnings

Excluded IPs from analysis (whitelisted): 142.250.217.162, 142.250.217.163, 142.250.189.131, 34.107.243.93, 23.47.204.64, 23.47.204.51
Excluded domains from analysis (whitelisted): partner46.googleadservices.com, a19.dscg10.akamai.net, ciscobinary.openh264.org, autopush.prod.mozaws.net, fonts.gstatic.com, partner.googleadservices.com, a17.rackcdn.com.mdc.edgesuite.net, aus5.mozilla.org, snippets.cdn.mozilla.net, www.gstatic.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Process Tree

system is lnxubuntu1

exo-open (PID: 4785, Parent: 4725, MD5: 39c5fa78f1cb3d950b9944f784018d3a) Arguments: exo-open http://selfservicegeneraligroup.com

exo-open New Fork (PID: 4792, Parent: 4785)

exo-open New Fork (PID: 4793, Parent: 4792)

exo-helper-1 (PID: 4793, Parent: 1656, MD5: c27a648e34ba5ce625d064af015be147) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 --launch WebBrowser http://selfservicegeneraligroup.com

exo-helper-1 New Fork (PID: 4800, Parent: 4793)

sensible-browser (PID: 4800, Parent: 4793, MD5: unknown) Arguments: /bin/sh /usr/bin/sensible-browser http://selfservicegeneraligroup.com

x-www-browser (PID: 4800, Parent: 4793, MD5: unknown) Arguments: /bin/sh /usr/bin/x-www-browser http://selfservicegeneraligroup.com

x-www-browser New Fork (PID: 4801, Parent: 4800)

which (PID: 4801, Parent: 4800, MD5: unknown) Arguments: /bin/sh /usr/bin/which /usr/bin/x-www-browser

firefox (PID: 4800, Parent: 4793, MD5: 9a5584c0c2c9ac6b1ba6296513075910) Arguments: /usr/lib/firefox/firefox http://selfservicegeneraligroup.com

firefox New Fork (PID: 4802, Parent: 4800)

firefox New Fork (PID: 4828, Parent: 4800)

firefox New Fork (PID: 4842, Parent: 4800)

lsb_release (PID: 4842, Parent: 4800, MD5: 18cba7de7bfedd0d9f027bd1c54cc2b2) Arguments: /usr/bin/python3 -Es /usr/bin/lsb_release -idrc

firefox New Fork (PID: 4862, Parent: 4800)

dbus-launch (PID: 4862, Parent: 4800, MD5: e4a469f27d130d783c21ce9c1c4456c3) Arguments: dbus-launch --autolaunch=11ced2f07072c6ae389b731c5cc84014 --binary-syntax --close-stderr

firefox New Fork (PID: 4929, Parent: 4800)

firefox New Fork (PID: 4930, Parent: 4929)

firefox (PID: 4929, Parent: 4800, MD5: 9a5584c0c2c9ac6b1ba6296513075910) Arguments: /usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 1 -prefMapSize 172334 -parentBuildID 20190410113011 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 4800 true tab

firefox New Fork (PID: 4977, Parent: 4800)

firefox New Fork (PID: 4978, Parent: 4977)

firefox (PID: 4977, Parent: 4800, MD5: 9a5584c0c2c9ac6b1ba6296513075910) Arguments: /usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 6115 -prefMapSize 172334 -parentBuildID 20190410113011 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 4800 true tab

firefox New Fork (PID: 5019, Parent: 4800)

firefox New Fork (PID: 5021, Parent: 5019)

firefox (PID: 5019, Parent: 4800, MD5: 9a5584c0c2c9ac6b1ba6296513075910) Arguments: /usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 6934 -prefMapSize 172334 -parentBuildID 20190410113011 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 4800 true tab

cleanup

Yara Signatures

⊘No yara matches

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown

HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.20:58570 version: TLS 1.2

Source: /usr/lib/firefox/firefox (PID: 4800)

Reads hosts file: /etc/hosts

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /6/Firefox/66.0.3/20190410113011/Linux_x86_64-gcc3/en-US/release-cck-ubuntu/Linux%204.4.0-116-generic%20(GTK%203.18.9%2Clibpulse%208.0.0)/canonical/1.0/ HTTP/1.1Host: snippets.cdn.mozilla.netUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /us-west/bundles-pregen/Firefox/en-us/default.json HTTP/1.1Host: snippets.cdn.mozilla.netUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /afs/ads?adtest=off&psid=1167268112&pcsa=false&channel=000002%2C000003%2C002843%2Cbucket003&client=dp-teaminternet04_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fselfservicegeneraligroup.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMDN8fHx8fHw2NjFmNmQ4NDliZTQ3fHx8MTcxMzMzNTY4NC43MjYxfGQzNmE5ZjgxODMwYTBiNmNhNDkwMWY4MjU0MzQzODUzNTIyYjUxN2J8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fFpIQXRkR1ZoYldsdWRHVnlibVYwTURSZk0zQm98ZDgyZjM2MWZiZjFhMmNkYjk1Y2Y3NmRjNjczMTAzZDYzZWVlNTdiZHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fDEwMDIxZjAxZTdjYWU3ZTgxMmFhMzg3N2NhOGZhYzEyZmFjMGYxZDh8MHxkcC10ZWFtaW50ZXJuZXQwNF8zcGh8MHwwfHw%253D&terms=Self%20Service%20Software%2C%E2%80%AASAP%20Netweaver%2COnline%20Registration%20Software%2CHelp%20Desk%20Ticket%20System%2COnboarding%20Software&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2105895058331848&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002%2C17301437%2C17301439%2C17301442%2C17301447%2C17301481&client_gdprApplies=0&format=r3%7Cs&nocache=6991713335685068&num=0&output=afd_ads&domain_name=selfservicegeneraligroup.com&v=3&bsl=8&pac=2&u_his=1&u_tz=120&dt=1713335685071&u_w=1024&u_h=768&biw=1009&bih=616&psw=1009&psh=760&frm=0&uio=--&cont=tc&drt=0&jsid=caf&jsv=623135625&rurl=http%3A%2F%2Fselfservicegeneraligroup.com%2F HTTP/1.1Host: www.adsensecustomsearchads.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brReferer: http://selfservicegeneraligroup.com/Connection: keep-aliveUpgrade-Insecure-Requests: 1
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fadtest%3Doff%26psid%3D1167268112%26pcsa%3Dfalse%26channel%3D000002%252C000003%252C002843%252Cbucket003%26client%3Ddp-teaminternet04_3ph%26r%3Dm%26hl%3Den%26rpbu%3Dhttp%253A%252F%252Fselfservicegeneraligroup.com%252F%253Fts%253DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMDN8fHx8fHw2NjFmNmQ4NDliZTQ3fHx8MTcxMzMzNTY4NC43MjYxfGQzNmE5ZjgxODMwYTBiNmNhNDkwMWY4MjU0MzQzODUzNTIyYjUxN2J8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fFpIQXRkR1ZoYldsdWRHVnlibVYwTURSZk0zQm98ZDgyZjM2MWZiZjFhMmNkYjk1Y2Y3NmRjNjczMTAzZDYzZWVlNTdiZHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fDEwMDIxZjAxZTdjYWU3ZTgxMmFhMzg3N2NhOGZhYzEyZmFjMGYxZDh8MHxkcC10ZWFtaW50ZXJuZXQwNF8zcGh8MHwwfHw%25253D%26terms%3DSelf%2520Service%2520Software%252C%25E2%2580%25AASAP%2520Netweaver%252COnline%2520Registration%2520Software%252CHelp%2520Desk%2520Ticket%2520System%252COnboarding%2520Software%26max_radlink_len%3D40%26type%3D3%26uiopt%3Dtrue%26swp%3Das-drid-2105895058331848%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301437%252C17301439%252C17301442%252C17301447%252C17301481%26client_gdprApplies%3D0%26format%3Dr3%257Cs%26nocache%3D6991713335685068%26num%3D0%26output%3Dafd_ads%26domain_name%3Dselfservicegeneraligroup.com%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D120%26dt%3D1713335685071%26u_w%3D1024%26u_h%3D768%26biw%3D1009%26bih%3D616%26psw%3D1009%26psh%3D760%26frm%3D0%26uio%3D--%26cont%3Dtc%26drt%3D0%26jsid%3Dcaf%26jsv%3D623135625%26rurl%3Dhttp%253A%252F%252Fselfservicegeneraligroup.com%252F&hl=en&q=EgRRtTk0GIbb_bAGIjACT3pJr805dBCkFxpsUUbhs3ktDDg8TsCyOJ_pdYRyWxV3VGpU2xuczbiWeH2bz_IyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brReferer: http://selfservicegeneraligroup.com/Connection: keep-aliveUpgrade-Insecure-Requests: 1
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brReferer: https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fadtest%3Doff%26psid%3D1167268112%26pcsa%3Dfalse%26channel%3D000002%252C000003%252C002843%252Cbucket003%26client%3Ddp-teaminternet04_3ph%26r%3Dm%26hl%3Den%26rpbu%3Dhttp%253A%252F%252Fselfservicegeneraligroup.com%252F%253Fts%253DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMDN8fHx8fHw2NjFmNmQ4NDliZTQ3fHx8MTcxMzMzNTY4NC43MjYxfGQzNmE5ZjgxODMwYTBiNmNhNDkwMWY4MjU0MzQzODUzNTIyYjUxN2J8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fFpIQXRkR1ZoYldsdWRHVnlibVYwTURSZk0zQm98ZDgyZjM2MWZiZjFhMmNkYjk1Y2Y3NmRjNjczMTAzZDYzZWVlNTdiZHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fDEwMDIxZjAxZTdjYWU3ZTgxMmFhMzg3N2NhOGZhYzEyZmFjMGYxZDh8MHxkcC10ZWFtaW50ZXJuZXQwNF8zcGh8MHwwfHw%25253D%26terms%3DSelf%2520Service%2520Software%252C%25E2%2580%25AASAP%2520Netweaver%252COnline%2520Registration%2520Software%252CHelp%2520Desk%2520Ticket%2520System%252COnboarding%2520Software%26max_radlink_len%3D40%26type%3D3%26uiopt%3Dtrue%26swp%3Das-drid-2105895058331848%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301437%252C17301439%252C17301442%252C17301447%252C17301481%26client_gdprApplies%3D0%26format%3Dr3%257Cs%26nocache%3D6991713335685068%26num%3D0%26output%3Dafd_ads%26domain_name%3Dselfservicegeneraligroup.com%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D120%26dt%3D1713335685071%26u_w%3D1024%26u_h%3D768%26biw%3D1009%26bih%3D616%26psw%3D1009%26psh%3D760%26frm%3D0%26uio%3D--%26cont%3Dtc%26drt%3D0%26jsid%3Dcaf%26jsv%3D623135625%26rurl%3Dhttp%253A%252F%252Fselfservicegeneraligroup.com%252F&hl=en&q=EgRRtTk0GIbb_bAGIjACT3pJr805dBCkFxpsUUbhs3ktDDg8TsCyOJ_pdYRyWxV3VGpU2xuczbiWeH2bz_IyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=jkYMcceTXa5O0Ql5TftRgDmCgYkPz5gGnrn2IIvbdOT5roe8FKflJH_PAW-QVZa5Jwb9eM13c_0L5Xi4NoFS5624IVNSJIkoPhiOXF6CApz132Cvk-SDE7By3vUrqTv1kZs2ozuzya1IxyTNJn5SQzaL5kDm2Pev9GvHZppY7Sm0XFSYrqIwuN1tSab_ilre7pcGth-Hes5VC3LxDbe7XIbvTKm1-36FKWTciH9JkpVGWXvckVfM5KxkkqBi4PrNUa4aVXYgvR7o70yzur7iGGautLlBMog&cb=yc2zn4iualcv HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brReferer: https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fadtest%3Doff%26psid%3D1167268112%26pcsa%3Dfalse%26channel%3D000002%252C000003%252C002843%252Cbucket003%26client%3Ddp-teaminternet04_3ph%26r%3Dm%26hl%3Den%26rpbu%3Dhttp%253A%252F%252Fselfservicegeneraligroup.com%252F%253Fts%253DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMDN8fHx8fHw2NjFmNmQ4NDliZTQ3fHx8MTcxMzMzNTY4NC43MjYxfGQzNmE5ZjgxODMwYTBiNmNhNDkwMWY4MjU0MzQzODUzNTIyYjUxN2J8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fFpIQXRkR1ZoYldsdWRHVnlibVYwTURSZk0zQm98ZDgyZjM2MWZiZjFhMmNkYjk1Y2Y3NmRjNjczMTAzZDYzZWVlNTdiZHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fDEwMDIxZjAxZTdjYWU3ZTgxMmFhMzg3N2NhOGZhYzEyZmFjMGYxZDh8MHxkcC10ZWFtaW50ZXJuZXQwNF8zcGh8MHwwfHw%25253D%26terms%3DSelf%2520Service%2520Software%252C%25E2%2580%25AASAP%2520Netweaver%252COnline%2520Registration%2520Software%252CHelp%2520Desk%2520Ticket%2520System%252COnboarding%2520Software%26max_radlink_len%3D40%26type%3D3%26uiopt%3Dtrue%26swp%3Das-drid-2105895058331848%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301437%252C17301439%252C17301442%252C17301447%252C17301481%26client_gdprApplies%3D0%26format%3Dr3%257Cs%26nocache%3D6991713335685068%26num%3D0%26output%3Dafd_ads%26domain_name%3Dselfservicegeneraligroup.com%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D120%26dt%3D1713335685071%26u_w%3D1024%26u_h%3D768%26biw%3D1009%26bih%3D616%26psw%3D1009%26psh%3D760%26frm%3D0%26uio%3D--%26cont%3Dtc%26drt%3D0%26jsid%3Dcaf%26jsv%3D623135625%26rurl%3Dhttp%253A%252F%252Fselfservicegeneraligroup.com%252F&hl=en&q=EgRRtTk0GIbb_bAGIjACT3pJr805dBCkFxpsUUbhs3ktDDg8TsCyOJ_pdYRyWxV3VGpU2xuczbiWeH2bz_IyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMConnection: keep-aliveUpgrade-Insecure-Requests: 1
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm- HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=jkYMcceTXa5O0Ql5TftRgDmCgYkPz5gGnrn2IIvbdOT5roe8FKflJH_PAW-QVZa5Jwb9eM13c_0L5Xi4NoFS5624IVNSJIkoPhiOXF6CApz132Cvk-SDE7By3vUrqTv1kZs2ozuzya1IxyTNJn5SQzaL5kDm2Pev9GvHZppY7Sm0XFSYrqIwuN1tSab_ilre7pcGth-Hes5VC3LxDbe7XIbvTKm1-36FKWTciH9JkpVGWXvckVfM5KxkkqBi4PrNUa4aVXYgvR7o70yzur7iGGautLlBMog&cb=yc2zn4iualcvConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /js/bg/KTA1qoE7ZDz05UuzGBms7CVmuC34sZ4nnXwNjg065Po.js HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=jkYMcceTXa5O0Ql5TftRgDmCgYkPz5gGnrn2IIvbdOT5roe8FKflJH_PAW-QVZa5Jwb9eM13c_0L5Xi4NoFS5624IVNSJIkoPhiOXF6CApz132Cvk-SDE7By3vUrqTv1kZs2ozuzya1IxyTNJn5SQzaL5kDm2Pev9GvHZppY7Sm0XFSYrqIwuN1tSab_ilre7pcGth-Hes5VC3LxDbe7XIbvTKm1-36FKWTciH9JkpVGWXvckVfM5KxkkqBi4PrNUa4aVXYgvR7o70yzur7iGGautLlBMog&cb=yc2zn4iualcvConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brReferer: https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fadtest%3Doff%26psid%3D1167268112%26pcsa%3Dfalse%26channel%3D000002%252C000003%252C002843%252Cbucket003%26client%3Ddp-teaminternet04_3ph%26r%3Dm%26hl%3Den%26rpbu%3Dhttp%253A%252F%252Fselfservicegeneraligroup.com%252F%253Fts%253DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMDN8fHx8fHw2NjFmNmQ4NDliZTQ3fHx8MTcxMzMzNTY4NC43MjYxfGQzNmE5ZjgxODMwYTBiNmNhNDkwMWY4MjU0MzQzODUzNTIyYjUxN2J8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fFpIQXRkR1ZoYldsdWRHVnlibVYwTURSZk0zQm98ZDgyZjM2MWZiZjFhMmNkYjk1Y2Y3NmRjNjczMTAzZDYzZWVlNTdiZHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fDEwMDIxZjAxZTdjYWU3ZTgxMmFhMzg3N2NhOGZhYzEyZmFjMGYxZDh8MHxkcC10ZWFtaW50ZXJuZXQwNF8zcGh8MHwwfHw%25253D%26terms%3DSelf%2520Service%2520Software%252C%25E2%2580%25AASAP%2520Netweaver%252COnline%2520Registration%2520Software%252CHelp%2520Desk%2520Ticket%2520System%252COnboarding%2520Software%26max_radlink_len%3D40%26type%3D3%26uiopt%3Dtrue%26swp%3Das-drid-2105895058331848%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301437%252C17301439%252C17301442%252C17301447%252C17301481%26client_gdprApplies%3D0%26format%3Dr3%257Cs%26nocache%3D6991713335685068%26num%3D0%26output%3Dafd_ads%26domain_name%3Dselfservicegeneraligroup.com%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D120%26dt%3D1713335685071%26u_w%3D1024%26u_h%3D768%26biw%3D1009%26bih%3D616%26psw%3D1009%26psh%3D760%26frm%3D0%26uio%3D--%26cont%3Dtc%26drt%3D0%26jsid%3Dcaf%26jsv%3D623135625%26rurl%3Dhttp%253A%252F%252Fselfservicegeneraligroup.com%252F&hl=en&q=EgRRtTk0GIbb_bAGIjACT3pJr805dBCkFxpsUUbhs3ktDDg8TsCyOJ_pdYRyWxV3VGpU2xuczbiWeH2bz_IyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMConnection: keep-aliveUpgrade-Insecure-Requests: 1
Source: global traffic	HTTP traffic detected: GET /update/3/GMP/66.0.3/20190410113011/Linux_x86_64-gcc3/null/release-cck-ubuntu/Linux%204.4.0-116-generic%20(GTK%203.18.9%2Clibpulse%208.0.0)/canonical/1.0/update.xml HTTP/1.1Host: aus5.mozilla.orgUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: selfservicegeneraligroup.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-aliveUpgrade-Insecure-Requests: 1
Source: global traffic	HTTP traffic detected: GET /track.php?domain=selfservicegeneraligroup.com&toggle=browserjs&uid=MTcxMzMzNTY4NC42Mzg2OjVmMjExNDhkOTQ3ODAyM2UyODBlYzE0YWFmNmIyNDhlOTQ5YWEzMTNiYmM4MzYzM2IxMjg1OThkYzlmNTBmOTg6NjYxZjZkODQ5YmU5Yg%3D%3D HTTP/1.1Host: selfservicegeneraligroup.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateReferer: http://selfservicegeneraligroup.com/Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /themes/cleanPeppermintBlack_657d9013/img/arrows.png HTTP/1.1Host: d38psrni17bvxu.cloudfront.netUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: image/webp,/Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateReferer: http://selfservicegeneraligroup.com/Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /ls.php?t=661f6d84&token=10021f01e7cae7e812aa3877ca8fac12fac0f1d8 HTTP/1.1Host: selfservicegeneraligroup.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateReferer: http://selfservicegeneraligroup.com/Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /adsense/domains/caf.js?abp=1 HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateReferer: http://selfservicegeneraligroup.com/Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: selfservicegeneraligroup.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: image/webp,/Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alive

Source: unknown

DNS traffic detected: queries for: selfservicegeneraligroup.com

Source: cert9.db-journal.34.dr, cert9.db.34.dr	String found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0?
Source: cert9.db-journal.34.dr, cert9.db.34.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: cert9.db-journal.34.dr, cert9.db.34.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 8C0900F504EEA56B743B4031F3F815083E14491B.34.dr	String found in binary or memory: http://d38psrni17bvxu.cloudfront.net/
Source: 1DBCF2C5F4A9AAB308F13D41AB219EA85A810612.34.dr, 27384B62E4E2FBED7D3E85C6EAB6BF998474793D.34.dr	String found in binary or memory: http://d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/img/arrows.png
Source: 27384B62E4E2FBED7D3E85C6EAB6BF998474793D.34.dr	String found in binary or memory: http://d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/img/arrows.png1
Source: 1DBCF2C5F4A9AAB308F13D41AB219EA85A810612.34.dr	String found in binary or memory: http://d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/img/arrows.pngnecko:classi
Source: cert9.db-journal.34.dr, cert9.db.34.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: cert9.db-journal.34.dr, cert9.db.34.dr	String found in binary or memory: http://ocsp.pki.goog/gsr202
Source: places.sqlite-wal.34.dr	String found in binary or memory: http://selfservicegeneraligroup.com
Source: recovery.jsonlz4.tmp.34.dr, 27384B62E4E2FBED7D3E85C6EAB6BF998474793D.34.dr	String found in binary or memory: http://selfservicegeneraligroup.com/
Source: 8E6243BCB240F8914D10249076C524BAE347081E.34.dr	String found in binary or memory: http://selfservicegeneraligroup.com/favicon.ico
Source: 8E6243BCB240F8914D10249076C524BAE347081E.34.dr	String found in binary or memory: http://selfservicegeneraligroup.com/favicon.icostrongly-framed1request-methodGETresponse-headHTTP/1.
Source: 2F4087E4267A59C0FFA634FA9D0E00268729B4DC.34.dr	String found in binary or memory: http://selfservicegeneraligroup.com/ls.php?t=661f6d84&token=10021f01e7cae7e812aa3877ca8fac12fac0f1d8
Source: places.sqlite-wal.34.dr	String found in binary or memory: http://selfservicegeneraligroup.com/moc.puorgilarenegecivresfles.d
Source: 27384B62E4E2FBED7D3E85C6EAB6BF998474793D.34.dr	String found in binary or memory: http://selfservicegeneraligroup.com/necko:classified1strongly-framed1request-methodGETrequest-Accept
Source: 8C0900F504EEA56B743B4031F3F815083E14491B.34.dr	String found in binary or memory: http://selfservicegeneraligroup.com/predictor::seen1predictor::resource-count3predictor::http://d38p
Source: places.sqlite-wal.34.dr	String found in binary or memory: http://selfservicegeneraligroup.com/selfservicegeneraligroup.commoc.puorgilarenegecivresfles.d
Source: 37D23FAB5FB546A476E38CD3870F42D926504EC7.34.dr	String found in binary or memory: http://selfservicegeneraligroup.com/track.php?domain=selfservicegeneraligroup.com&toggle=browserjs&u
Source: places.sqlite-wal.34.dr	String found in binary or memory: http://selfservicegeneraligroup.comd
Source: places.sqlite-wal.34.dr	String found in binary or memory: http://wiki.ubuntu.com
Source: places.sqlite-wal.34.dr	String found in binary or memory: http://wiki.ubuntu.com/moc.utnubu.ikiw.
Source: places.sqlite-wal.34.dr	String found in binary or memory: http://www.debian.org
Source: places.sqlite-wal.34.dr	String found in binary or memory: http://www.debian.org/gro.naibed.www.
Source: 8C0900F504EEA56B743B4031F3F815083E14491B.34.dr	String found in binary or memory: http://www.google.com/
Source: 8C0900F504EEA56B743B4031F3F815083E14491B.34.dr	String found in binary or memory: http://www.google.com/1
Source: D2A64B5E2F392B99B4EBC1553A17EA010F0E8891.34.dr, 27384B62E4E2FBED7D3E85C6EAB6BF998474793D.34.dr	String found in binary or memory: http://www.google.com/adsense/domains/caf.js?abp=1
Source: 27384B62E4E2FBED7D3E85C6EAB6BF998474793D.34.dr	String found in binary or memory: http://www.google.com/adsense/domains/caf.js?abp=11
Source: D2A64B5E2F392B99B4EBC1553A17EA010F0E8891.34.dr	String found in binary or memory: http://www.google.com/adsense/domains/caf.js?abp=1necko:classified1strongly-framed1request-methodGET
Source: places.sqlite-wal.34.dr	String found in binary or memory: http://www.ubuntu.com
Source: places.sqlite-wal.34.dr	String found in binary or memory: http://www.ubuntu.com/moc.utnubu.www.
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://answers.launchpad.net
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://answers.launchpad.net/ubuntu/
Source: D2A64B5E2F392B99B4EBC1553A17EA010F0E8891.34.dr	String found in binary or memory: https://csp.withgoogle.com/csp/ads-afs-ui
Source: C296EE2E7F76140275BFE32DF9712B635E6BB55B.34.dr	String found in binary or memory: https://csp.withgoogle.com/csp/gws/other
Source: D2A64B5E2F392B99B4EBC1553A17EA010F0E8891.34.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/ads-afs-ui
Source: C296EE2E7F76140275BFE32DF9712B635E6BB55B.34.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/other
Source: webext.sc.lz4.tmp.34.dr	String found in binary or memory: https://github.com/
Source: 8C0900F504EEA56B743B4031F3F815083E14491B.34.dr	String found in binary or memory: https://partner.googleadservices.com/
Source: 8C0900F504EEA56B743B4031F3F815083E14491B.34.dr	String found in binary or memory: https://partner.googleadservices.com/1
Source: 27384B62E4E2FBED7D3E85C6EAB6BF998474793D.34.dr	String found in binary or memory: https://partner.googleadservices.com/gampad/cookie.js?domain=selfservicegeneraligroup.com&client=dp-
Source: cert9.db-journal.34.dr, cert9.db.34.dr	String found in binary or memory: https://pki.goog/repository/0
Source: 4098689E1EA45FF0094F1C8088E49251FFFF7585.34.dr	String found in binary or memory: https://snippets.cdn.mozilla.net/6/Firefox/66.0.3/20190410113011/Linux_x86_64-gcc3/en-US/release-cck
Source: C389DE279BF5275924497D5B33D1F1900116E591.34.dr, 4098689E1EA45FF0094F1C8088E49251FFFF7585.34.dr	String found in binary or memory: https://snippets.cdn.mozilla.net/us-west/bundles-pregen/Firefox/en-us/default.json
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://support.mozilla.org
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://support.mozilla.org/en-US/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=fire
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://support.mozilla.org/en-US/products/firefoxgro.allizom.troppus.
Source: D2A64B5E2F392B99B4EBC1553A17EA010F0E8891.34.dr	String found in binary or memory: https://www.adsensecustomsearchads.com
Source: A63C11DE5F2C5CEF985CF75DF4EFB9ECC9BF06B8.34.dr	String found in binary or memory: https://www.adsensecustomsearchads.com/
Source: C296EE2E7F76140275BFE32DF9712B635E6BB55B.34.dr	String found in binary or memory: https://www.adsensecustomsearchads.com/afs/ads?adtest=off&psid=1167268112&pcsa=false&channel=000002%
Source: A63C11DE5F2C5CEF985CF75DF4EFB9ECC9BF06B8.34.dr	String found in binary or memory: https://www.adsensecustomsearchads.com/predictor::seen1
Source: cert9.db-journal.34.dr, cert9.db.34.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: B13A714441C11853FE6BA40EFF6C7097378009F7.34.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js
Source: B13A714441C11853FE6BA40EFF6C7097378009F7.34.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: C296EE2E7F76140275BFE32DF9712B635E6BB55B.34.dr	String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fadtest%
Source: E6D3854E385D14EBC6F74CDE30437FFAD732EA8E.34.dr	String found in binary or memory: https://www.googleadservices.com/pagead/p3p.xml
Source: B13A714441C11853FE6BA40EFF6C7097378009F7.34.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__en.js
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://www.mozilla.org
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://www.mozilla.org/en-US/about/gro.allizom.www.
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://www.mozilla.org/en-US/contribute/gro.allizom.www.
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://www.mozilla.org/en-US/firefox/central/gro.allizom.www.
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 58570 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45366
Source: unknown	Network traffic detected: HTTP traffic on port 57386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57378
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35066
Source: unknown	Network traffic detected: HTTP traffic on port 35054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45366 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57386
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35078
Source: unknown	Network traffic detected: HTTP traffic on port 35078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58570
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57384
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35074
Source: unknown	Network traffic detected: HTTP traffic on port 57378 -> 443

Source: unknown

HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.20:58570 version: TLS 1.2

Source: classification engine

Classification label: clean2.lin@0/75@24/0

Source: /usr/bin/exo-open (PID: 4785)	Directory: /home/james/.Xauthority	Jump to behavior
Source: /usr/bin/exo-open (PID: 4785)	Directory: /home/james/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 (PID: 4793)	Directory: /home/james/.Xauthority	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 (PID: 4793)	Directory: /home/james/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 (PID: 4793)	Directory: /home/james/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 (PID: 4793)	Directory: /home/james/.config	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4800)	Directory: /home/james/.Xauthority	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4800)	File: /tmp/firefox_james/.parentlock	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4800)	Directory: /home/james/.Xauthority	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4800)	File: /home/james/.mozilla/firefox/5zxot757.default/.parentlock	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4800)	File: /home/james/.cache/mozilla/firefox/5zxot757.default/.startup-incomplete	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4800)	Directory: /home/james/.Xdefaults-ubuntu	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4800)	Directory: /home/james/.mime.types	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4800)	Directory: /home/james/.mozilla/firefox/5zxot757.default/storage/permanent/chrome/.metadata-v2	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4800)	Directory: /home/james/.mailcap	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4800)	Directory: /home/james/.cache	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4828)	Directory: /home/james/.Xauthority	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4828)	Directory: /home/james/.drirc	Jump to behavior
Source: /usr/bin/dbus-launch (PID: 4862)	Directory: /home/james/.Xauthority	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4929)	Directory: /home/james/.Xauthority	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4977)	Directory: /home/james/.Xauthority	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 5019)	Directory: /home/james/.Xauthority	Jump to behavior

Source: /usr/lib/firefox/firefox (PID: 4800)	Empty hidden file: /tmp/firefox_james/.parentlock	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4800)	Empty hidden file: /home/james/.cache/mozilla/firefox/5zxot757.default/.startup-incomplete	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4800)	Empty hidden file: /home/james/.mozilla/firefox/5zxot757.default/.parentlock	Jump to behavior

Source: /usr/bin/exo-open (PID: 4785)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 (PID: 4793)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4800)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4828)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/dbus-launch (PID: 4862)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4929)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4977)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 5019)	Queries kernel information via 'uname':	Jump to behavior

Source: /usr/lib/firefox/firefox (PID: 4842)

Arguments: /usr/bin/lsb_release -> /usr/bin/python3 -Es /usr/bin/lsb_release -idrc

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Hide Artifacts	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Hidden Files and Directories	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://selfservicegeneraligroup.com	1%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://pki.goog/repository/0	0%	URL Reputation	safe
http://crl.pki.goog/gsr2/gsr2.crl0?	0%	URL Reputation	safe
https://csp.withgoogle.com/csp/report-to/gws/other	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	unknown
www3.l.google.com	142.250.217.174	true	false	high
selfservicegeneraligroup.com	104.247.82.170	true	false	unknown
www.google.com	142.250.217.164	true	false	high
d228z91au11ukj.cloudfront.net	3.163.115.26	true	false	high
d38psrni17bvxu.cloudfront.net	18.160.64.187	true	false	high
push.services.mozilla.com	unknown	unknown	false	high
www.adsensecustomsearchads.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://www.google.com/adsense/domains/caf.js?abp=1	false	high
http://d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/img/arrows.png	false	high
https://www.google.com/recaptcha/api.js	false	high
https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false	high
http://selfservicegeneraligroup.com/ls.php?t=661f6d84&token=10021f01e7cae7e812aa3877ca8fac12fac0f1d8	false	unknown
http://selfservicegeneraligroup.com/favicon.ico	false	unknown
https://www.google.com/js/bg/KTA1qoE7ZDz05UuzGBms7CVmuC34sZ4nnXwNjg065Po.js	false	high
http://selfservicegeneraligroup.com/track.php?domain=selfservicegeneraligroup.com&toggle=browserjs&uid=MTcxMzMzNTY4NC42Mzg2OjVmMjExNDhkOTQ3ODAyM2UyODBlYzE0YWFmNmIyNDhlOTQ5YWEzMTNiYmM4MzYzM2IxMjg1OThkYzlmNTBmOTg6NjYxZjZkODQ5YmU5Yg%3D%3D	false	unknown
http://selfservicegeneraligroup.com/	false	unknown
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=jkYMcceTXa5O0Ql5TftRgDmCgYkPz5gGnrn2IIvbdOT5roe8FKflJH_PAW-QVZa5Jwb9eM13c_0L5Xi4NoFS5624IVNSJIkoPhiOXF6CApz132Cvk-SDE7By3vUrqTv1kZs2ozuzya1IxyTNJn5SQzaL5kDm2Pev9GvHZppY7Sm0XFSYrqIwuN1tSab_ilre7pcGth-Hes5VC3LxDbe7XIbvTKm1-36FKWTciH9JkpVGWXvckVfM5KxkkqBi4PrNUa4aVXYgvR7o70yzur7iGGautLlBMog&cb=yc2zn4iualcv	false	high
https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.debian.org/gro.naibed.www.	places.sqlite-wal.34.dr	false		high
http://www.ubuntu.com	places.sqlite-wal.34.dr	false		high
https://csp.withgoogle.com/csp/report-to/gws/other	C296EE2E7F76140275BFE32DF9712B635E6BB55B.34.dr	false	0%, Virustotal, Browse	unknown
https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fadtest%	C296EE2E7F76140275BFE32DF9712B635E6BB55B.34.dr	false		high
https://csp.withgoogle.com/csp/ads-afs-ui	D2A64B5E2F392B99B4EBC1553A17EA010F0E8891.34.dr	false		unknown
http://www.ubuntu.com/moc.utnubu.www.	places.sqlite-wal.34.dr	false		high
http://selfservicegeneraligroup.com	places.sqlite-wal.34.dr	false		unknown
https://support.mozilla.org/en-US/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=fire	places.sqlite-wal.34.dr	false		high
https://csp.withgoogle.com/csp/report-to/ads-afs-ui	D2A64B5E2F392B99B4EBC1553A17EA010F0E8891.34.dr	false		unknown
https://github.com/	webext.sc.lz4.tmp.34.dr	false		high
http://selfservicegeneraligroup.com/track.php?domain=selfservicegeneraligroup.com&toggle=browserjs&u	37D23FAB5FB546A476E38CD3870F42D926504EC7.34.dr	false		unknown
http://selfservicegeneraligroup.comd	places.sqlite-wal.34.dr	false		unknown
https://www.google.com/recaptcha/api2/	B13A714441C11853FE6BA40EFF6C7097378009F7.34.dr	false		high
http://d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/img/arrows.png1	27384B62E4E2FBED7D3E85C6EAB6BF998474793D.34.dr	false		high
http://www.google.com/adsense/domains/caf.js?abp=1necko:classified1strongly-framed1request-methodGET	D2A64B5E2F392B99B4EBC1553A17EA010F0E8891.34.dr	false		high
http://selfservicegeneraligroup.com/selfservicegeneraligroup.commoc.puorgilarenegecivresfles.d	places.sqlite-wal.34.dr	false		unknown
http://www.debian.org	places.sqlite-wal.34.dr	false		high
http://selfservicegeneraligroup.com/favicon.icostrongly-framed1request-methodGETresponse-headHTTP/1.	8E6243BCB240F8914D10249076C524BAE347081E.34.dr	false		unknown
https://support.mozilla.org/en-US/products/firefoxgro.allizom.troppus.	places.sqlite-wal.34.dr	false		high
https://www.adsensecustomsearchads.com/predictor::seen1	A63C11DE5F2C5CEF985CF75DF4EFB9ECC9BF06B8.34.dr	false		high
http://d38psrni17bvxu.cloudfront.net/	8C0900F504EEA56B743B4031F3F815083E14491B.34.dr	false		high
https://www.adsensecustomsearchads.com	D2A64B5E2F392B99B4EBC1553A17EA010F0E8891.34.dr	false		high
http://wiki.ubuntu.com/moc.utnubu.ikiw.	places.sqlite-wal.34.dr	false		high
https://pki.goog/repository/0	cert9.db-journal.34.dr, cert9.db.34.dr	false	URL Reputation: safe	unknown
https://answers.launchpad.net/ubuntu/	places.sqlite-wal.34.dr	false		high
http://selfservicegeneraligroup.com/necko:classified1strongly-framed1request-methodGETrequest-Accept	27384B62E4E2FBED7D3E85C6EAB6BF998474793D.34.dr	false		unknown
https://csp.withgoogle.com/csp/gws/other	C296EE2E7F76140275BFE32DF9712B635E6BB55B.34.dr	false		unknown
https://www.adsensecustomsearchads.com/afs/ads?adtest=off&psid=1167268112&pcsa=false&channel=000002%	C296EE2E7F76140275BFE32DF9712B635E6BB55B.34.dr	false		high
http://www.google.com/adsense/domains/caf.js?abp=11	27384B62E4E2FBED7D3E85C6EAB6BF998474793D.34.dr	false		high
https://answers.launchpad.net	places.sqlite-wal.34.dr	false		high
http://d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/img/arrows.pngnecko:classi	1DBCF2C5F4A9AAB308F13D41AB219EA85A810612.34.dr	false		high
http://www.google.com/1	8C0900F504EEA56B743B4031F3F815083E14491B.34.dr	false		high
https://www.adsensecustomsearchads.com/	A63C11DE5F2C5CEF985CF75DF4EFB9ECC9BF06B8.34.dr	false		high
http://wiki.ubuntu.com	places.sqlite-wal.34.dr	false		high
http://selfservicegeneraligroup.com/moc.puorgilarenegecivresfles.d	places.sqlite-wal.34.dr	false		unknown
http://selfservicegeneraligroup.com/predictor::seen1predictor::resource-count3predictor::http://d38p	8C0900F504EEA56B743B4031F3F815083E14491B.34.dr	false		unknown
https://support.mozilla.org	places.sqlite-wal.34.dr	false		high
http://crl.pki.goog/gsr2/gsr2.crl0?	cert9.db-journal.34.dr, cert9.db.34.dr	false	URL Reputation: safe	unknown
http://www.google.com/	8C0900F504EEA56B743B4031F3F815083E14491B.34.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.217.164	www.google.com	United States	15169	GOOGLEUS	false
142.250.217.174	www3.l.google.com	United States	15169	GOOGLEUS	false
3.163.115.26	d228z91au11ukj.cloudfront.net	United States	16509	AMAZON-02US	false
104.247.82.170	selfservicegeneraligroup.com	Canada	206834	TEAMINTERNET-CA-ASCA	false
18.160.64.187	d38psrni17bvxu.cloudfront.net	United States	3	MIT-GATEWAYSUS	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/james/.cache/dconf/user

Download File

Process:	/usr/lib/firefox/firefox
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Reputation:	low
Preview:	.

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/1DBCF2C5F4A9AAB308F13D41AB219EA85A810612

Download File

Process:	/usr/lib/firefox/firefox
File Type:	PNG image data, 1500 x 600, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	12503
Entropy (8bit):	7.670047483590351
Encrypted:	false
SSDEEP:	192:Wg3JLNIdFb540f7mqTiLHrBjcCTN1MbaJD/RBse6ogkORdLv2HamMdinUeZMdinX:vD4N54IsHVjdN1tD7lODLPmjcmjL
MD5:	9288E44D2C208B83C143D391BC9270B1
SHA1:	ED3305073B0CDAEF0A8A77DC5321BC170332D4D9
SHA-256:	EF8FD0E1F5E07926C57519FD6A5634176093A7EDCDBA2244666681817DDFEC9B
SHA-512:	22974FE0FA1709B1340F84B8CEC7AA0A85E21048534D7CDEC715C6204ABBFC53E12EC18D9B42CE0C4A5AADF3623953B782D1BDFA3B3AE51155A34477CEF98A49
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......X.....Om......tEXtSoftware.Adobe ImageReadyq.e<....PLTE......cdtIK^IK]IK\03IHK_acsceubdtcet..0=@SHK]IL]HK\MPbNQbORc.....0"&;(,@+/B04I.2F/3G-1D04H.2E04G15H26I59L8<P6:M9=Q7;N:>R:>Q;?R<@SIL\beuadtbetcftbes..-..0. 5.!6."7.#8."6.$9 %:!&;"'<"';$)>#(<%?$)=&+@%>',A&+?(-B).C(-A).B/C+0D,1E05I15G<@R=ASIM_HL]KO`HL\MQbaeu.....-../.....0../.....0../..1..1..2..3..4. 5.!6.#8.$9.%: &;"':$)<&+>',?(-@).A/B+0C,1D/A-2E.3F/4G05H16I/4F05G38K6;N49K;@S;@R<ASGL^bfuaetbft.....0.!5."6.#7.$8.%9 &:!';"(<!':#)=#)<$=&,@&,?+1E)/B06IGL]GL\HM]bfs..-.....0..1. 4.!5."6.#7.$8 '< ';*0B.4F06H06G..-..0.!5 (< (;...................................................................................................................................................................................................................................................t....tRNS..............................................................................................................................................

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/27384B62E4E2FBED7D3E85C6EAB6BF998474793D

Download File

Process:	/usr/lib/firefox/firefox
File Type:	gzip compressed data, max speed, from Unix, original size modulo 2^32 1075314688
Category:	dropped
Size (bytes):	9959
Entropy (8bit):	7.631016232006453
Encrypted:	false
SSDEEP:	192:agIIKuoJDXZdZU0QPTJL7ir04c0ZLNwk6SK2tdPlicNcdPBi29tdPlicNcdPBi25:UmoJDZd+0Mi9BZLNCSpNinZiONinZizA
MD5:	FFC467242281A89FF4E9FD8DABF731D6
SHA1:	0D21E3CD883C613242FC38CE804F707006DB4B4C
SHA-256:	0037160FDF6AFC070215852C76EB357DC48D1067C9FA22682360BF96501166FB
SHA-512:	87990F411700A5FA6534821B48D90B05426F9159BFE95423FEA8A6C6B676870B42BEDB5EC046F7AAA31ECE89551E2C2E22ADC6F2059E391665F2A96F353BC1EE
Malicious:	false
Reputation:	low
Preview:	...........[.v...}..Y....b........w.^..uj..)...Z.f..s.y..I......N.?...).....X..w..i.s}..i\|.9./.)..Q..a..1_.....v......j.rsV..Tjw...rU.\|.mZ;?k?.Z.#.........um..&.E.y\|.kG......Q..R......US..~.^}>h..U.b_>....Vfg..M..mPkH....'.6..i.=/.j.~e.......m-.?..................:.....f!?..=_U.....6+..ln..[N.=or...f....AN>::....f(...V.8........=...&...T..'Nm..i/&<.T..........S...r.<....D...RL^N<.\|6../6}.k...g]...f..{.bd\U1xYN3w...8....-;....?....!..nqG1.cO'Y.6Or...Q..083..+.:\,;.. ...)..~..[OQ......1R.\N+.N\.....\|.U.{.... kq/...........@.'w.eg.>..T..;....E.3.0..m.....k^.j.;1..1x`....1-......"".I.._D.._O..{......E.tk.q.m.m vC.....z]......g..i[z..3w..+..?s.M...j;.b[...C&....1..m.`..8..:... G,/Ed.k....;.%....0Pb.g...e...[...H....E6_.2..l..._..>..0......}.9.D..L.z6.23...^.g; !.(.>u...(c...=...@..........Pw.RH.D{..E0 .._dIV..%1......S7...b.....k&.b?..`+Cu.v1...Xv...(YZ.?4 ......\|.$B}...uM.:$..Y.m@J~9,..1.\|L..\.A.?i%.>..@._ul.J..3;..nf.8c

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/2F4087E4267A59C0FFA634FA9D0E00268729B4DC

Download File

Process:	/usr/lib/firefox/firefox
File Type:	JSON data
Category:	dropped
Size (bytes):	1771
Entropy (8bit):	5.7405498869873215
Encrypted:	false
SSDEEP:	48:YTYSlZdP0amwwSRjlki7GxiIdP0owSRzjlki7Gxihgm:KvZdPiNSRCi9IdPgSRzCi9Z
MD5:	E5111F89F00A5076A8CCD46CE5D91F8A
SHA1:	363DB8E71B4C99B516B105384CFEDE9263BD28A9
SHA-256:	5F56B53967D68CA4045C86CE18ECCFE0E8D36400B6FE45BB3D76D07BF105F1CC
SHA-512:	3D4F84170F645A3C4A2CA162A07393260A364398925D3A7D752D24496EDD1047256E9BD04A2FBC6398E597AF7EFCC41BD49F54C119557EC5CF4825A683DEC090
Malicious:	false
Reputation:	low
Preview:	{"success":true}9~:.x.........f.m.f.m.F.>F.......e....:http://selfservicegeneraligroup.com/ls.php?t=661f6d84&token=10021f01e7cae7e812aa3877ca8fac12fac0f1d8.necko:classified.1.strongly-framed.1.request-method.GET.response-head.HTTP/1.1 201 Created..Server: nginx..Date: Wed, 17 Apr 2024 06:34:45 GMT..Content-Type: text/javascript;charset=UTF-8..Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile..Accept-CH-Lifetime: 30..Charset: utf-8..Access-Control-Allow-Methods: POST, OPTIONS..Access-Control-Max-Age: 86400..X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_VCdnHgmpAzay/uwnXrphv8iHFwoWyD4KmzHqXFTgkiFyZ2UUr3YvOgRiFjjsZdMclLzkqpPl2Yo9LmNcDrAs/w==...original-response-headers.Server: nginx..Date: Wed, 17 Apr 2024 06:34:45 GMT..Content-Type: text/javascript;charset=UTF-8..Transfer-Encoding: chunked..C

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/37D23FAB5FB546A476E38CD3870F42D926504EC7

Download File

Process:	/usr/lib/firefox/firefox
File Type:	gzip compressed data, max speed, from Unix, original size modulo 2^32 335544320
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	5.506998706591659
Encrypted:	false
SSDEEP:	24:XHXonw8U5hF98A9lXHWszvrdP0qaez4io6rHQwW8pqDdP0qzmCzD7GoQwW8pqpXw:XYnwjXrbBvrdP0qGmwwVsdP0qYwViw
MD5:	BF9FA412F483DB4A5EE298B6A8789D6B
SHA1:	B7465245F6DE987E37C076E217E8E5BD4B98BD6F
SHA-256:	EAFB71197624BA49EEC7BCFC32CB255B94E57E6EB1DB94D44FB0D282AE985F9B
SHA-512:	2CE99CFC4DDC64B340D818810A6BD8901959E23F77335F909B43BE5038D269F3771E5E65CA81F3E205E51226622D772100B1EFF06C1452B2282542B4E7D7831E
Malicious:	false
Reputation:	low
Preview:	.........................0........f.m.f.m.F.>F............:http://selfservicegeneraligroup.com/track.php?domain=selfservicegeneraligroup.com&toggle=browserjs&uid=MTcxMzMzNTY4NC42Mzg2OjVmMjExNDhkOTQ3ODAyM2UyODBlYzE0YWFmNmIyNDhlOTQ5YWEzMTNiYmM4MzYzM2IxMjg1OThkYzlmNTBmOTg6NjYxZjZkODQ5YmU5Yg%3D%3D.necko:classified.1.strongly-framed.1.request-method.GET.request-Accept-Encoding.gzip, deflate.response-head.HTTP/1.1 200 OK..Server: nginx..Date: Wed, 17 Apr 2024 06:34:45 GMT..Content-Type: text/html; charset=UTF-8..Vary: Accept-Encoding..X-Custom-Track: browserjs..Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile..Accept-CH-Lifetime: 30..Access-Control-Allow-Origin: *..Content-Encoding: gzip...original-response-headers.Server: nginx..Date: Wed, 17 Apr 2024 06:34:45 GMT..Content-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..X-Custom-Tra

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/4098689E1EA45FF0094F1C8088E49251FFFF7585

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	7638
Entropy (8bit):	6.070486656600163
Encrypted:	false
SSDEEP:	192:qMS+jauOCS+jauOtfbaI8j3qQX44DX44h:qMS+e5CS+e5tTaIdCp/
MD5:	060E07557593B14A8827AFCD01F85CA7
SHA1:	53FAB7D9B0BAFA441D396ECA53C62E92F1C2F49E
SHA-256:	52E482F489046EDDC5F03DC52FE9A6E045D4024A45136F3FF795372A78DD7692
SHA-512:	F59503DCB89FCEBF1CBF04FF288687B0C0A2F3C76E0432650EF64725AA64C3C593D8159C71B7CAD292A1F4BE855E52833768020BB4B6FC42B8CE416540B4F19C
Malicious:	false
Reputation:	low
Preview:	.6G.........f.m.f.m.F.>F............:https://snippets.cdn.mozilla.net/6/Firefox/66.0.3/20190410113011/Linux_x86_64-gcc3/en-US/release-cck-ubuntu/Linux%204.4.0-116-generic%20(GTK%203.18.9%2Clibpulse%208.0.0)/canonical/1.0/.necko:classified.1.strongly-framed.0.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAWVMIIFkTCCA3mgAwIBAgISBAP4J712FToXxiMWSNzefsNeMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEqMCgGA1UECgwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMSowKAYDVQQDDCFUaGUgVW5pdmVyc2UgU2VjdXJpdHkgQ29tcGFueSBMdGQwHhcNMjQwNDE2MDYzNDQ1WhcNMjUwNDE2MDYzNDQ1WjAcMRowGAYDVQQDDBEqLmNkbi5tb3ppbGxhLm5ldDCCASAwDQYJKoZIhvcNAQEBBQADggENADCCAQgCggEBAOLCONVf5MMYa+5mqzTC6Dgbicl4/QBDrAnlvucgq5vT0rXQeUL1bAs4riVts1NSnIf/+8nm+sZVoUsDZ6q3U4QthP1QEo+V/B4lFGStK4QePrsGDzeGOmb8DG9XcHPxmpmQqO/O0yV8c4evn6lx9E9eA8uEC+v87mrcnJWtam2KnwR4ak4oYx8jHm3xGmp

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/8C0900F504EEA56B743B4031F3F815083E14491B

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.015913513234311
Encrypted:	false
SSDEEP:	6:oZzj8aelXDFSZAFLcsH3X8sXWzusDma1CrXa9CVGsDmc4IIXa9CVGsDnrC8AmrXV:o1oZ6ocmX8QuuuJP9vu5X9vunrV+9Cl
MD5:	1D1833CA919C57CD96A69111724FEE4E
SHA1:	89741647991F30B4FD3DA25B1D2117A31445EC26
SHA-256:	D32CED22C42AD20F91BEEA76B40D794E90ECB387A025EFA30CC4700093CB91B7
SHA-512:	0CB768EB9C39F8A6AE5222FD90F0D78C5AD3A3B1B936979BFAAA0B142E9C0D396F5DADE63F8A35B3F1D3B03ABD597229045AFE0F9B442898E28E8BE77F671792
Malicious:	false
Reputation:	low
Preview:	9\|2K........f.m.f.m.F.>F.......7....~predictor-origin,:http://selfservicegeneraligroup.com/.predictor::seen.1.predictor::resource-count.3.predictor::http://d38psrni17bvxu.cloudfront.net/.1,1,1713335683,4096.predictor::http://www.google.com/.1,1,1713335683,4096.predictor::https://partner.googleadservices.com/.1,1,1713335683,4096.....

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/8E6243BCB240F8914D10249076C524BAE347081E

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	642
Entropy (8bit):	5.37960228009967
Encrypted:	false
SSDEEP:	12:woFHA9lX51mHdP0qisQDIcpuYSI5dP0qisQDIcpuYaAp9nip7MX:woFHA9lXOdP0+ib5dP0+iOMX
MD5:	7BBBB4EF0053CB906DC59DA0D9ECD497
SHA1:	EC0BE24B0738357C182305C7FF21FFF0FFA683F8
SHA-256:	2D645A91E89954307D43A566B6A161F974E10EA11CADCD64AFC6919DBF1737BD
SHA-512:	D234E72F53D74338076FF8C3B83B45FE91B39988F58197EC191BD4E97DCC37B558C43389758E2EA6C3D5DDB07B333B292E9DAF07F4728F6757895869C3BB2F51
Malicious:	false
Reputation:	low
Preview:	..[@........f.m.f.m.F.>Gf(.....0....:http://selfservicegeneraligroup.com/favicon.ico.strongly-framed.1.request-method.GET.response-head.HTTP/1.1 200 OK..Server: nginx..Date: Wed, 17 Apr 2024 06:34:45 GMT..Content-Type: image/x-icon..Content-Length: 0..Last-Modified: Thu, 30 Nov 2023 13:41:22 GMT..ETag: "65689102-0"..Accept-Ranges: bytes...original-response-headers.Server: nginx..Date: Wed, 17 Apr 2024 06:34:45 GMT..Content-Type: image/x-icon..Content-Length: 0..Last-Modified: Thu, 30 Nov 2023 13:41:22 GMT..Connection: keep-alive..ETag: "65689102-0"..Accept-Ranges: bytes...net-response-time-onstart.158.net-response-time-onstop.160.....

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/A63C11DE5F2C5CEF985CF75DF4EFB9ECC9BF06B8

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.704003136511222
Encrypted:	false
SSDEEP:	3:WOlj6Mwiaaaa/lNtbVXvX3XDkySLLZcrEGT+VX8sX3u+llln:WOlGJ2XLXDOLFcrEGbsHHl/n
MD5:	921762960DA17570DAD1F0ECF86EB7A1
SHA1:	37E4C7E6C977FEF07FA90F09D6CE310EA693CF20
SHA-256:	A849DCB185115B0B4EA8056BB8EE4E52EF410158E9626A3D6E8CC1B56E6156B6
SHA-512:	BEF87A85DB7E350D19A69F3BA3FA464EAF25986FE29F6469EDE38F1A091CC82E54B720E44A16BCCDA703A96203CBDF1F51B09CBD13FBDEE502EC8532CE777651
Malicious:	false
Reputation:	low
Preview:	..Q;........f.m.f.m.F.>G.......:....~predictor-origin,:https://www.adsensecustomsearchads.com/.predictor::seen.1.....

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/B13A714441C11853FE6BA40EFF6C7097378009F7

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	15706
Entropy (8bit):	6.129107001407878
Encrypted:	false
SSDEEP:	192:fl2YuWdE8owuXPRhZK7Z5gCTou8jjt8+RZFPPZiUdE8owuXPRhZK7Z5gCTou8jjB:fJuWJoPpWToZtLjJoPpWToZtLn
MD5:	1FA0D7EF81C7C88CF705A8F5E75058D9
SHA1:	D8ACD0D8D06628697D1297D93FB6BDF0774C5639
SHA-256:	5947AD793044E10464DF0CB3F6487707B36C7EC0F8593E16F9EDCDDC1088B6D6
SHA-512:	360CD61CE802CBB908D7199E04D48658AC4CDFD9CA7CE33A8147EC143E1DEE37E838C8641ADD47B58C270F96E454D28E390B42BD7C3D9E6E5031A71C1C4E3DA6
Malicious:	false
Reputation:	low
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('onload');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;po.src='https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-eZG8e4nRp0gEpRB75JBNzhS0vVseDRBVprGQYHJNXJCYwHihzdLYpvGhxa6VAhNb';var e=d.querySelector('script[nonce]'),n=e&&(e['nonce']\|\|e.getAttribute('nonce'));if(n){po.setAttribute('nonce',n);}var s=d.getElementsByTagName('script')[0];s.parentNode.insertBefore(po, s);})();Z.2Z..........f.m.f.m.F.>Hf.n....(....:https://www.google.com/recaptcha/api.js.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXyk

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/C296EE2E7F76140275BFE32DF9712B635E6BB55B

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	30792
Entropy (8bit):	5.888055338383054
Encrypted:	false
SSDEEP:	768:JLG/m/lsbWT0R0rf0FcufAvr9DbJa74rvApEi:tG/m/lsbW42QG2Avr9Dbk4bu
MD5:	EA96C7DA47AFA22E1914647DCA57B513
SHA1:	A2A457373AAC88F3CD5798C398FE35319F659745
SHA-256:	801701596A3F59381A5BDD2ECA7E997DD0374C3AF7D2190A42F5FEA38499EDB2
SHA-512:	2F21893932D0787C81A162FC086F1D1FBED85327B788400B27978774FE3FBFF5CDB22CA9BA688B4020E5712894B583A2A9584BDC972B089FFC1B6BDE063E7D44
Malicious:	false
Reputation:	low
Preview:	6...........f.m.f.m.F.>G............:https://www.adsensecustomsearchads.com/afs/ads?adtest=off&psid=1167268112&pcsa=false&channel=000002%2C000003%2C002843%2Cbucket003&client=dp-teaminternet04_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fselfservicegeneraligroup.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMDN8fHx8fHw2NjFmNmQ4NDliZTQ3fHx8MTcxMzMzNTY4NC43MjYxfGQzNmE5ZjgxODMwYTBiNmNhNDkwMWY4MjU0MzQzODUzNTIyYjUxN2J8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fFpIQXRkR1ZoYldsdWRHVnlibVYwTURSZk0zQm98ZDgyZjM2MWZiZjFhMmNkYjk1Y2Y3NmRjNjczMTAzZDYzZWVlNTdiZHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fDEwMDIxZjAxZTdjYWU3ZTgxMmFhMzg3N2NhOGZhYzEyZmFjMGYxZDh8MHxkcC10ZWFtaW50ZXJuZXQwNF8zcGh8MHwwfHw%253D&terms=Self%20Service%20Software%2C%E2%80%AASAP%20Netweaver%2COnline%20Registration%20Software%2CHelp%20Desk%20Ticket%20System%2COnboarding%20Software&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2105895058331848&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002%2C17301437%2C17301439%2C17301442%2C17301447%2C17301481&c

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/C389DE279BF5275924497D5B33D1F1900116E591

Download File

Process:	/usr/lib/firefox/firefox
File Type:	JSON data
Category:	dropped
Size (bytes):	14963
Entropy (8bit):	6.058398795700871
Encrypted:	false
SSDEEP:	384:CgS+e5CS+e5tTaIdtU+gS+e5CS+e5tTaIdtU7:CgS+eUS+era8fgS+eUS+era8S
MD5:	7B83281C0F909F8511AAC71B3FAC3769
SHA1:	1D489290EEFCB5933AE11EF172EE5C39898EE01F
SHA-256:	9CDF352097CDD000CD55554B6A0339CA07D33DBF9C1AEB2B9E84BE30FB083D2C
SHA-512:	197C0477A0F9B157C495513F4FC17E5860EDE925F257804ECA048BCEA1779A4A1DDAF7CD5D25EC127DFBB107BF146AD980CB26E5E4745E0C7D44C26B1CC13B1E
Malicious:	false
Reputation:	low
Preview:	{}..Yxj?6........f.m.f.m.F.>Gf.o....S....:https://snippets.cdn.mozilla.net/us-west/bundles-pregen/Firefox/en-us/default.json.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAWVMIIFkTCCA3mgAwIBAgISBAP4J712FToXxiMWSNzefsNeMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEqMCgGA1UECgwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMSowKAYDVQQDDCFUaGUgVW5pdmVyc2UgU2VjdXJpdHkgQ29tcGFueSBMdGQwHhcNMjQwNDE2MDYzNDQ1WhcNMjUwNDE2MDYzNDQ1WjAcMRowGAYDVQQDDBEqLmNkbi5tb3ppbGxhLm5ldDCCASAwDQYJKoZIhvcNAQEBBQADggENADCCAQgCggEBAOLCONVf5MMYa+5mqzTC6Dgbicl4/QBDrAnlvucgq5vT0rXQeUL1bAs4riVts1NSnIf/+8nm+sZVoUsDZ6q3U4QthP1QEo+V/B4lFGStK4QePrsGDzeGOmb8DG9XcHPxmpmQqO/O0yV8c4evn6lx9E9eA8uEC+v87mrcnJWtam2KnwR4ak4oYx8jHm3xGmpqpHJRHYT7xq7pHnjXZ0rqf1DKiQJM1i2M0Y3yndqeNA+eVar5fkwG72A9056fOskHyb8ZKNvhMJArQlzpx6FshOdIsdAR9jGk

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/D2A64B5E2F392B99B4EBC1553A17EA010F0E8891

Download File

Process:	/usr/lib/firefox/firefox
File Type:	gzip compressed data, max compression, original size modulo 2^32 3508601088
Category:	dropped
Size (bytes):	76043
Entropy (8bit):	7.992659159313871
Encrypted:	true
SSDEEP:	1536:Jrzk+6ED19IFf5X1wAJfF0ywzIpRpUC9yZXENiwmB/Mqg8wnA:FTb9IFf5JQIpR9yZXEn2kqgpA
MD5:	7AB5542094FF5C5214EE7292D160514F
SHA1:	7234295B02D28E1B817FF14C84CDFC5401615EA8
SHA-256:	C78ABADE4106CABCB2D855EBC7E2941F81F0498358C5DBF40B118826C796B2B4
SHA-512:	855F23735EF126EFAB567E9CED35B54338B20A3CD5D540B7A4FEEF41EB0503A2CB3C011D0782F5524857C9E543D65C06F88949008E6F0222C2EA9F315DD38855
Malicious:	false
Reputation:	low
Preview:	...........;kw.8...+.v..5q.....i.f.&.\..z.9..Lm..8.M.... ....OOO.B..}F#9....8....(M.);\|sz.hd....]......Xq...f.H."N..j.]1..8HI.2o. Y+.C...w..."...8....TS.~:3.1.....z....oO_l..\|..~...a.?!...#Hg$Nr...b.....r..........Y...[=..ic..t.jl..S.....L'c....^.b.<..l....N.........AO.........ot...l.:7.y.../.c.}...m.....4.YR...04.6.P.%8.....j....d..%.i^}@.....,.Uo~.....e.W?M.r..@...._5t......>e.E..`..%...D..T.....D..z7M'1S...{.$>.NI...'.q.&~s.a..i.O....u(.=..N.7.Z..s..___.[./.]......._[..t.........f........c6.../.3....y........L.._../.f...]_.i,.......0.....`.\.M?...b.....5.....@.....B2...@o....>s.e..b...;..s3V,..U...;.;eIT..7A.0g.o_..9dH;.Q...^Y.....P`..+..,.[G...n..8a .9...U..N.....[7qh..{.e.;.."E....'.W..D.......WE.)...!g..F...F....8...m...H.[.m..=g...w...j.......Qs..t....!I...o...GR.=..*....g.ek/....K.$-Z..@..(..D.c.... ...;.s.Z.........i\.F..(d.@6....A.#.e.n..]7Y+..,.f.L@6.......z......\.Q3.\....v..N.=.n3b. ..?M.8Zdh..u.e...-...VY.}7....M..]..u

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/E6D3854E385D14EBC6F74CDE30437FFAD732EA8E

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	8144
Entropy (8bit):	6.115607139640882
Encrypted:	false
SSDEEP:	96:WlFh02hvBBe9MuGYIr30/RG9MuGYIr30/rGQQMnfbaIVcwsGs3NM+60ZvU0ZvX:WlFlxq+jwI+jwTfbaI8j3ql0Z80Zv
MD5:	913229C92AD721814E9944D04AB9A1D1
SHA1:	6D6199119FBD855E45B053F99DBC3F546DAF8F3D
SHA-256:	297C38CB1606169F6EA848B246D2F300EE8AF468E7FC9699D87F7E442A98BCCA
SHA-512:	12FFEBB70F621472BD20ADB2D92772653954ADC5A2F4CFA615863B9C31B05005F7C4BDAB001DAD9E74AFDB39B197052A2FBA890A29F5B2306DB2B79A89F4E20D
Malicious:	false
Reputation:	low
Preview:	__sasCookie({"_cookies_":[{"_value_":"ID=3fe8c2132d89f165:T=1713335686:RT=1713335686:S=ALNI_MaoK0gGcEJrPsRGqll6sgRafQF3YQ","_expires_":1747031686,"_path_":"/","_domain_":"selfservicegeneraligroup.com","_version_":1},{"_value_":"UID=00000a1f28309d98:T=1713335686:RT=1713335686:S=ALNI_MbGCHDTdoNs9EaC2GtltupZOpuZZQ","_expires_":1747031686,"_path_":"/","_domain_":"selfservicegeneraligroup.com","_version_":2}]});I.n.W{........f.m.f.m.F.>G............:https://partner.googleadservices.com/gampad/cookie.js?domain=selfservicegeneraligroup.com&client=dp-teaminternet04_3ph&product=SAS&callback=__sasCookie.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAWYMIIFlDCCA3ygAwIBAgIQWfp9GRQqHxYQgeVu4BxG0DANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/allow-flashallow-digest256.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	0.3372900666170139
Encrypted:	false
SSDEEP:	3:kl:s
MD5:	076933FF9904D1110D896E2C525E39E5
SHA1:	4188442577FA77F25820D9B2D01CC446E30684AC
SHA-256:	4CBBD8CA5215B8D161AEC181A74B694F4E24B001D5B081DC0030ED797A8973E0
SHA-512:	6FCEE9A7B7A7B821D241C03C82377928BC6882E7A08C78A4221199BFA220CDC55212273018EE613317C8293BB8D1CE08D1E017508E94E06AB85A734C99C7CC34
Malicious:	false
Reputation:	low
Preview:	................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/allow-flashallow-digest256.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.59524688231097
Encrypted:	false
SSDEEP:	3:VUystlMl3YLLLLLLLLLLLZ69kHrRbXq6Eeqy8A5ljGR9:ek3klm7eQA5Nq
MD5:	D886A47C89D9C49C795DA345BC236990
SHA1:	59E863E0D2B4E428D8C738D48FA0F6F7BAC36849
SHA-256:	A03C5E2656D2F292BF5794C8EEB8D223CD6BA4F4BFB2ED1F325460E879D0BCF7
SHA-512:	8B5A117BC33463F181458F0A99C14657B365CE2A7695DB346D2D086109176AD019DBD5A5F34F09DC3438E6C89CA93D83875DAA6D463EB06D995A2523FE51A5ED
Malicious:	false
Reputation:	low
Preview:	;.1..............................C.X....x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.......5...8........G...r.E...&Y...Z.;O.C.X....Y9.H...]..

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/base-track-digest256.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	0.3372900666170139
Encrypted:	false
SSDEEP:	3:kl:s
MD5:	076933FF9904D1110D896E2C525E39E5
SHA1:	4188442577FA77F25820D9B2D01CC446E30684AC
SHA-256:	4CBBD8CA5215B8D161AEC181A74B694F4E24B001D5B081DC0030ED797A8973E0
SHA-512:	6FCEE9A7B7A7B821D241C03C82377928BC6882E7A08C78A4221199BFA220CDC55212273018EE613317C8293BB8D1CE08D1E017508E94E06AB85A734C99C7CC34
Malicious:	false
Reputation:	low
Preview:	................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/base-track-digest256.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	71044
Entropy (8bit):	7.773438541966354
Encrypted:	false
SSDEEP:	1536:y2skugLebjn9aAt7UGSrqAv4IqISIPP9xubG:ycLAj9aAtY4AwIaIdxF
MD5:	60985C9439E7E254CA4EAD41AD1EFF32
SHA1:	184C8B3263D678D854F7B05FC41FDD3267A46FD6
SHA-256:	5DA0A3FFC814575410D0F58D9647944AF4EB0809BE9E3475CD96B94DC2B14B56
SHA-512:	6894ABAAD1B68CC8844D088832EEC9B5048E68190D8B330A8564D04330022F19A0ACFCFE7B15A0E4F90B8C84538DBF2FF4DA00DA80B5046F6F739A3C0A35B73D
Malicious:	false
Reputation:	low
Preview:	;.1..............................-.\....x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.........0...6....#....O......Rg.m../.-.\...z+...m....S..5..6..H.e..B...-.\.7n....~<.g94...f....\.~..s[.s..-.\.Yo..V..}B1.1k.........oS...y%..-.\.q#..QD.:..",=(.....l.......7.O..-.\....q.......A-@..R.,.m.....4.-.\......AS..F...b.. .V....o.Rs.3.-.\...ua...`...-.#,..{....D..RI....-.\..'.Y.....<~..H.(.).}...7...#w..-.\.+...g..K.A6...a....$.'....45.-.\.N...P......o.}4.<......'.@py....-.\.U.......V.yb...n......E.>.....-.\.Y..(.xZ..}...aFfuj.x.......@..-.\.h}...W@hC..6.B\|xoU/VY.p.....4..-.\...#...g.T..<BwH.t...4..#.jN:...-.\..Z7.15.J@h...Q..x....k.?.{..B.-.\...KJ..M....\._..mx'.........-.\..p..i...W.H..JQ.y\\|3vD.~.).f..-.\..w...MEL.{..I.>Bm..O.....E._A..-.\...U....X..3.}..,.>..c."9o.<.-.\...C.....8u..H.....a..j..Xb..n..-.\..mR......D..qD#...w....f.O.?...-.\.Sx..W......v.>7v...>..g.{..

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/block-flash-digest256.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	0.3372900666170139
Encrypted:	false
SSDEEP:	3:kl:s
MD5:	076933FF9904D1110D896E2C525E39E5
SHA1:	4188442577FA77F25820D9B2D01CC446E30684AC
SHA-256:	4CBBD8CA5215B8D161AEC181A74B694F4E24B001D5B081DC0030ED797A8973E0
SHA-512:	6FCEE9A7B7A7B821D241C03C82377928BC6882E7A08C78A4221199BFA220CDC55212273018EE613317C8293BB8D1CE08D1E017508E94E06AB85A734C99C7CC34
Malicious:	false
Reputation:	low
Preview:	................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/block-flash-digest256.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	7648
Entropy (8bit):	7.734433994790214
Encrypted:	false
SSDEEP:	192:9R3/tArlx3czyJ7ALpZ8X7WIisGQchKjmD9ls6ZqOgC:Lvarn3czxLDuliuyD9lLZ7F
MD5:	0E8FE60CCD7E9B4C32589A5743A95302
SHA1:	190F3BC536C9489C707AE31DA32BF86947EA5D78
SHA-256:	2B124D4026850A3CFFD28DBACB58AEC28F7DCD4D40BC14E52BBE96D60CE4E749
SHA-512:	0AF17BD91464F26072F42BACFBB6BA72E68FA07B9D5801A92B14624CC51EBD00AB127272CECD8DF6FE650FE07BF170FD6422D70C2E8CD8F9AD94BC11548446BD
Malicious:	false
Reputation:	low
Preview:	;.1.............................f/Y....x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x........T..]..h...........t.V..@..'.f/Y.hy..../..s:....@R$.Q...w..V...f/Y..Y..1...c./!>O.3!..2...f L.x.6f/Y..&F.}......ez.N.R..j....3.;.if/Y....t.J....b.n...5aL...../...f/Y.dm....5.S.k...y+.....T.....Q>f/Y..-..nj.p..z....g...^T......f/Y...`.t9..(...@..'..u.8v%.d..^.f/Y...Z>Z_.b.[).B!/..U.W.y!.G.u..f/Y..@..WG...PAG.I=tsO.......`.N.f/Y.f?..G....;.c.`X....z....j...K\|f/Y.j....A-'v...].]-.....Q..L.4.Jf/Y.{a...!.-#...7.b..\h.4.~..=.ff/Y..{B.7...Bx.K..@.v...76."..hf/Y..;..Q.......!.<...Bd9I.....Mf/Y.B..mFYTJ..5..yj".T.........f/Y. ..'.',1...D......".L/......e.Yf/Y.!W..C..W$........8h.A..Nr;}mf/Y.[..6n.ZkJ.....2........xn..f/Y..,..8n..-E.....s.\|.N..2..Z..f/Y....C.EI....21w.l...Q.p ....f..f/Y.K....J..+.C:...v1...jo.7......f/Y.C."..c.].,@.....u.}.....~

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/block-flashsubdoc-digest256.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	0.3372900666170139
Encrypted:	false
SSDEEP:	3:kl:s
MD5:	076933FF9904D1110D896E2C525E39E5
SHA1:	4188442577FA77F25820D9B2D01CC446E30684AC
SHA-256:	4CBBD8CA5215B8D161AEC181A74B694F4E24B001D5B081DC0030ED797A8973E0
SHA-512:	6FCEE9A7B7A7B821D241C03C82377928BC6882E7A08C78A4221199BFA220CDC55212273018EE613317C8293BB8D1CE08D1E017508E94E06AB85A734C99C7CC34
Malicious:	false
Reputation:	low
Preview:	................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/block-flashsubdoc-digest256.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	82744
Entropy (8bit):	7.772258239877141
Encrypted:	false
SSDEEP:	1536:RXoNNS+GqTr4HlEGVibr7rF5HlwU67HJxPU659kHvfrk++:RYfSAr4FRibr7rhojLPb5sU
MD5:	04824A1F92353F43EBB9E7F74B7476FD
SHA1:	C2636E8FFA8A5256D7D1F21E147101356E783114
SHA-256:	B48E58EBAB82E4C376F16150A3FFF850C1111FF1F5985D68819CFD6F0DB159D2
SHA-512:	92914B56FB2BDCDDCC1BEE2BF4DC98420CF0B923D380BB889C8A6EBC333D74EA4DDCA915218BEA0E729782C4904983424F1DE15BE7087C5A5338AED7319A03E5
Malicious:	false
Reputation:	low
Preview:	;.1.............................a.!Z....x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.........0...6....#....O......Rg.m../a.!Z....Nt.HO5..... ..UM..7<....a.!Z...R..Cl.&/ZM....L...n..9.k.7<.a.!Z...z+...m....S..5..6..H.e..B..a.!Z.Yo..V..}B1.1k.........oS...y%.a.!Z.a{.{..>...M.3....[.THR..>...a.!Z.b.K#.... ..!D.n...}...#k..N..a.!Z.q#..QD.:..",=(.....l.......7.O.a.!Z....q.......A-@..R.,.m.....4a.!Z...Z....]..v..M.&.t...C.D.PA.h..a.!Z......AS..F...b.. .V....o.Rs.3a.!Z...ua...`...-.#,..{....D..RI...a.!Z..'.Y.....<~..H.(.).}...7...#w.a.!Z.N...P......o.}4.<......'.@py...a.!Z.U.......V.yb...n......E.>....a.!Z.V..<.>>....r..In+....v. :L.~..a.!Z.Y..(.xZ..}...aFfuj.x.......@.a.!Z.h}...W@hC..6.B\|xoU/VY.p.....4.a.!Z...#...g.T..<BwH.t...4..#.jN:..a.!Z..Z7.15.J@h...Q..x....k.?.{..Ba.!Z..p..i...W.H..JQ.y\\|3vD.~.).f..a.!Z..)Z.ns.@......O..F...c.9[x.pa.!Z...U....X..3.}..,.>..c."

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flash-digest256.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	0.3372900666170139
Encrypted:	false
SSDEEP:	3:kl:s
MD5:	076933FF9904D1110D896E2C525E39E5
SHA1:	4188442577FA77F25820D9B2D01CC446E30684AC
SHA-256:	4CBBD8CA5215B8D161AEC181A74B694F4E24B001D5B081DC0030ED797A8973E0
SHA-512:	6FCEE9A7B7A7B821D241C03C82377928BC6882E7A08C78A4221199BFA220CDC55212273018EE613317C8293BB8D1CE08D1E017508E94E06AB85A734C99C7CC34
Malicious:	false
Reputation:	low
Preview:	................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flash-digest256.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	268
Entropy (8bit):	4.291717925117119
Encrypted:	false
SSDEEP:	3:VUystlnlftwLLLLLLLLLLLg2qaXlY0WsLhxrbxq4Y0g42Vv:eziqaXlYfaNbg42Vv
MD5:	C921D8E98FA01B4F303481E112202E92
SHA1:	9D23B452AD0D06C355477CF70E3AA5D0ADFE6278
SHA-256:	4EF1038730EC8BC7206713C29A936768831B922C5E6C83355FD62D7401D8C1DC
SHA-512:	D06422752562AFD1F8B94FF09FC9460BE58E07A84FC537FB6B56B1551C37DB7E56CB7932CC2D27D2FFE2CBAB6EC85BDDA6778F2E812E69E5193FCD6BC77066F2
Malicious:	false
Reputation:	low
Preview:	;.1.............................Q..Y....x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.......C..8.r..M.'j....-...~.B........Q..Y_.P..........X+.s.........cWn..Q..Y........g.,.}t.!

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flashallow-digest256.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	0.3372900666170139
Encrypted:	false
SSDEEP:	3:kl:s
MD5:	076933FF9904D1110D896E2C525E39E5
SHA1:	4188442577FA77F25820D9B2D01CC446E30684AC
SHA-256:	4CBBD8CA5215B8D161AEC181A74B694F4E24B001D5B081DC0030ED797A8973E0
SHA-512:	6FCEE9A7B7A7B821D241C03C82377928BC6882E7A08C78A4221199BFA220CDC55212273018EE613317C8293BB8D1CE08D1E017508E94E06AB85A734C99C7CC34
Malicious:	false
Reputation:	low
Preview:	................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flashallow-digest256.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.6124882616213143
Encrypted:	false
SSDEEP:	3:VUystlMl3YLLLLLLLLLLLpRy5Ae28XzWvhSSz17Sn:ekeU5AezzWvhSSZ7S
MD5:	6F85BC4B2ECB49E26B0BD83A821065D0
SHA1:	4DF430B4D63605E41855DBCB3837A189D4CC7604
SHA-256:	C0B3BC9B3DC507AB654CAF72D13C3AEFA58C9B13B1E4D14DD8816712D80A7E54
SHA-512:	AE7688D501A1F59D4C247ED57BA0547F6376748AF57F554BA1B6DE0EF358ED5868721886BAF94813979B3A9968EC330CE11C41767E4AF42DB413EFC9556C2E22
Malicious:	false
Reputation:	low
Preview:	;.1..............................C.X....x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.......U...f.....aJ.-.....b..rE..{....C.X...U.K..yP.SQS.

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flashsubdoc-digest256.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	0.3372900666170139
Encrypted:	false
SSDEEP:	3:kl:s
MD5:	076933FF9904D1110D896E2C525E39E5
SHA1:	4188442577FA77F25820D9B2D01CC446E30684AC
SHA-256:	4CBBD8CA5215B8D161AEC181A74B694F4E24B001D5B081DC0030ED797A8973E0
SHA-512:	6FCEE9A7B7A7B821D241C03C82377928BC6882E7A08C78A4221199BFA220CDC55212273018EE613317C8293BB8D1CE08D1E017508E94E06AB85A734C99C7CC34
Malicious:	false
Reputation:	low
Preview:	................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flashsubdoc-digest256.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	304
Entropy (8bit):	4.70325744277424
Encrypted:	false
SSDEEP:	3:VUystlCwLLLLLLLLLLLPaueiydb1Vf/cMLkBR53B2mZ6C6duKZ/PfuSv+/rI4:e9MHk5xaCQuWGjI4
MD5:	BA0009932844173BC8F9AF264229DF24
SHA1:	C8F6956FA86F4E9CF71599B735E28860245AE4B5
SHA-256:	66D1C00C04D86E313E9A02775CDF906B1BE8D4CD6BEF423A1B9E21CC4E9F50C1
SHA-512:	582D7F28F41E6A7A5F882D15EC1F48D0BE57DC63E1A0D6E6A8BBD442A3AC27E38E0C3FDB3E1C30F416C41649391AFDE61F8079844B61A4995E0AB34D6CC8E745
Malicious:	false
Reputation:	low
Preview:	;.1...............................yZ....x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.......#...).=..HZE.E.........9N..u3.....yZ..?\.I.u...Mk..<.......Ly......yZ.J...t...{.6w..y.m......Xj..yZ.w....m .U-.mCL.

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/mozplugin-block-digest256.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	0.3372900666170139
Encrypted:	false
SSDEEP:	3:kl:s
MD5:	076933FF9904D1110D896E2C525E39E5
SHA1:	4188442577FA77F25820D9B2D01CC446E30684AC
SHA-256:	4CBBD8CA5215B8D161AEC181A74B694F4E24B001D5B081DC0030ED797A8973E0
SHA-512:	6FCEE9A7B7A7B821D241C03C82377928BC6882E7A08C78A4221199BFA220CDC55212273018EE613317C8293BB8D1CE08D1E017508E94E06AB85A734C99C7CC34
Malicious:	false
Reputation:	low
Preview:	................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/mozplugin-block-digest256.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	3580
Entropy (8bit):	7.671891447828382
Encrypted:	false
SSDEEP:	96:kvmXn/rUKZuGD5fR3TNQCTBl0VyCt9wrEZRg5n:kunoKpD553BQ3t9OEzun
MD5:	D6ACF2573E12AFDD7939568804D3FCC1
SHA1:	5C54AD3FF47C6B925E7AC17D361FE0FA60B9181E
SHA-256:	5525CBF8F8DC41D19AC632ED324E55293A510AE0EEBA16D0E3F33C707AA58A0C
SHA-512:	1F72C01AA332A6E3FC5F966ED2B12534653BCACF2DC242850877961CC4C16AC3BD1846939D56EA6E230A71F336F4B37F67E0070DDDB66D57BB51526DE52819CA
Malicious:	false
Reputation:	low
Preview:	;.1.....................^..........W....x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.............p.....a.....J.B..gZ.........W....+.O..!l$...K...aP....C.5......W..;..t7p.'..qR..,....x..lP..Z...W.1.[.8..^...x.T)..}.Uj2.t..._.B...W.......1.f\|....;.m..i...........W.Q....";...'N..o>....UD..........W.Um..Uz"K...H`."e..\|...'...L...v...W.B...`..r{@...J.^....@r...B....W.}..A.......@..A.G.q...@.5.....W Iod}..zVD../xY..p..h.Z.`i&......W$HWYI.;.~..m.~..5....`.$.J.....W)w.\...t.'[!....#...G~]..CS>.@{...W$.u..%.H4....p\\|..v..)...........W4.8....g.iQE...t.....z.X....N.....W5Feb).<@3Z._..f...e.y.....u.....W6;.')..K.0.b9G.2.n........eP.d.....W6]Y1_A]xZM.L./ozM1S^.a.s....P.H...W77......Oc......g.R....d9F.9.sY...W8.....[.-..............@.?.......W9.R,.j<.G..{.<.,.8..hW.V"../....W<...#5../......@ij...8%0.gX..6...W?.......V..Z\.)..P...w.f...-...W@....c.m.I...G.q.H.R.E.. .

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/mozstd-trackwhite-digest256.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	0.3372900666170139
Encrypted:	false
SSDEEP:	3:kl:s
MD5:	076933FF9904D1110D896E2C525E39E5
SHA1:	4188442577FA77F25820D9B2D01CC446E30684AC
SHA-256:	4CBBD8CA5215B8D161AEC181A74B694F4E24B001D5B081DC0030ED797A8973E0
SHA-512:	6FCEE9A7B7A7B821D241C03C82377928BC6882E7A08C78A4221199BFA220CDC55212273018EE613317C8293BB8D1CE08D1E017508E94E06AB85A734C99C7CC34
Malicious:	false
Reputation:	low
Preview:	................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/mozstd-trackwhite-digest256.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	333988
Entropy (8bit):	7.7734168827853685
Encrypted:	false
SSDEEP:	6144:Cl/mBoixkKBn/Hd+os1p8vuG3SI7AT6/GIUegPF+8wkyyXDvo7TYwTS:4/FiHBn/9+o9GG3SID+IUey+ryXDOTYr
MD5:	845BEDB718B8941F643BB988F640E141
SHA1:	DB9BC33A9C9FF6E6D3651710DC1AC8D387759D24
SHA-256:	5083D014CC7E8CFB15D4803429A9AB5FA397E1010CE66D0C8B8215C7FC3C6FDE
SHA-512:	96B64D39DC9B4E137D5BB93FD7EF18ABAB3D956C2819C1E569B5E9971AEC465B4EA084058F7F7C1B9012F52AC61189C6D3CF07AD47D2015D372754096FA03349
Malicious:	false
Reputation:	low
Preview:	;.1.....................8$.......-.\....x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.............TV8.1..h@)..N.5.J..._.:BcT.-.\..a...'&.k.$..#.Y... -..W..(.-.\.".`....T..../[..A3..FI.rN<%N.".-.\.#<.k.+^5Q..k..jMY>.tj+.e....J.-.\.,.3b.E9ZC.j..N..l&3.XS.~b...B.-.\.-.s.vf^..9)#x<{.Y...<....z....-.\.?Yj...br4...........J.Z!......-.\.M...+.UJ.)..r..{.t.....f..B.-.\.R2."..'..k..9/z..`7d..#BmeN.j.-.\.T.........}i.<............y.-.\.U.6..."P'/.....J.....>j.E....O.-.\.b.&.-1.....7..[.UOS.W....=..R.-.\.m.#..,..D.&._^.jy.i...p.....hO.-.\.p...RrKJR.U..c"bG7.y.5..YU......-.\.t.L3..e...\.^.;2.......E...fB..-.\....a.):.;rk...U..P.....^..?.KV..-.\....'..>.$.B...3}...T.....E+.....-.\..H.K(.!.A.....(.....H...D..-.\...&q......Y.m4.D.'..S~..w.......-.\..(......7......h.5..P........4.-.\..=#.u@.9.-21.*.x....Gs....^.Ep.-.\..L..m.'..%.;..[.......z.DVn:.-.\.....8?.....h....q....!.j.

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-block-simple-1.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.367009024331335
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLVtFKAuB079M3Xs/phm:eksMFKy9M3XIQ
MD5:	E2CF527CA7550B7E7BDF7311E483A2C3
SHA1:	C354190BB2B8A00A6051EF2FB86E189AB053FE93
SHA-256:	F1E07B1D717433F47073DC54A7D98E3E87B3D0FA88E53466F93EA544AF885D11
SHA-512:	7A585735ABFB1292B9FC4709B797F09C6BE4DC90A133FBEDB14428AAE79C6DE5FAAE0B151758A75BF90566C98E5BD2A8201E738F321688180BC5B5814A97BB69
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.........`E.eK.zQ.....H..`T1l..............`.j..G1I...r..

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-block-simple.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	0.37123232664087563
Encrypted:	false
SSDEEP:	3:klMl:sk
MD5:	E2CECF06A89B4A6D968486F17F30DA5D
SHA1:	46757A7F71DCFBEB5511665F123810148727324E
SHA-256:	E6B10FF8681FB7461557E6227D036617C7ECFC6E31A35412F8A5F72C217F318B
SHA-512:	5CFFECE9AF2B403AE150E8D2E755E7E3A71BDDED474293D846CD1A6231C1403261F4B5E6069A0A933738D5CC33F7EA8CC043C721594679E17FC5E8225F3F33C6
Malicious:	false
Reputation:	low
Preview:	............................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-block-simple.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.367009024331335
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLVtFKAuB079M3Xs/phm:eksMFKy9M3XIQ
MD5:	E2CF527CA7550B7E7BDF7311E483A2C3
SHA1:	C354190BB2B8A00A6051EF2FB86E189AB053FE93
SHA-256:	F1E07B1D717433F47073DC54A7D98E3E87B3D0FA88E53466F93EA544AF885D11
SHA-512:	7A585735ABFB1292B9FC4709B797F09C6BE4DC90A133FBEDB14428AAE79C6DE5FAAE0B151758A75BF90566C98E5BD2A8201E738F321688180BC5B5814A97BB69
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.........`E.eK.zQ.....H..`T1l..............`.j..G1I...r..

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-harmful-simple-1.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.3293711760593867
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLaJPKcZrl3LcC5rY+HVl7sAVZwn:eksbQa3Lz5JPgAVen
MD5:	051FB32DECE757BA112AC36DC72E3A91
SHA1:	A30D26CEE0F69FA67BF9E60BA692F4831373CC07
SHA-256:	0806D98FB3DE55F75D7C0B17E26146567E08C483031526659A4A35D09B97EF19
SHA-512:	ADD2D3C503616070F056EA4E3A64FB54A2D8E75AF8FD5D9F1F8EE6B72A1D548FD4AB7D4A3256E4A6F4E1422631439DB62B251EE3F9D07B38A612AFF5E58936D5
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........1.....}/9<...?.nyg....N}........<<.@....{..]{:p

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-harmful-simple.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	0.37123232664087563
Encrypted:	false
SSDEEP:	3:klMl:sk
MD5:	E2CECF06A89B4A6D968486F17F30DA5D
SHA1:	46757A7F71DCFBEB5511665F123810148727324E
SHA-256:	E6B10FF8681FB7461557E6227D036617C7ECFC6E31A35412F8A5F72C217F318B
SHA-512:	5CFFECE9AF2B403AE150E8D2E755E7E3A71BDDED474293D846CD1A6231C1403261F4B5E6069A0A933738D5CC33F7EA8CC043C721594679E17FC5E8225F3F33C6
Malicious:	false
Reputation:	low
Preview:	............................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-harmful-simple.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.3293711760593867
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLaJPKcZrl3LcC5rY+HVl7sAVZwn:eksbQa3Lz5JPgAVen
MD5:	051FB32DECE757BA112AC36DC72E3A91
SHA1:	A30D26CEE0F69FA67BF9E60BA692F4831373CC07
SHA-256:	0806D98FB3DE55F75D7C0B17E26146567E08C483031526659A4A35D09B97EF19
SHA-512:	ADD2D3C503616070F056EA4E3A64FB54A2D8E75AF8FD5D9F1F8EE6B72A1D548FD4AB7D4A3256E4A6F4E1422631439DB62B251EE3F9D07B38A612AFF5E58936D5
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........1.....}/9<...?.nyg....N}........<<.@....{..]{:p

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-malware-simple-1.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.3683561037768297
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLJnawdSW+vmhnki/0Bn:eksSajWQji0
MD5:	3675254E341DF799D4307C1F59109185
SHA1:	8711844A41A4ACE77BA0A01A4D3AF2B2E59E6A75
SHA-256:	23D108134BED6099793F7DD6B8B6E62081EC3B945EFDBC7C5E0E779FD9B82F98
SHA-512:	9344CA1456E1E74A4DAC833E0AF55DB9730F8AB2954A855B4A775A938B2055C86EFF367F25BAE80F2FFEA45ACEBADE10A8347ADD18222E715620DD864F2D8E4F
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x........B.WG..a..E.+`D8.....a. ...D...q......w...X.Z.Z...~.

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-malware-simple.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	0.37123232664087563
Encrypted:	false
SSDEEP:	3:klMl:sk
MD5:	E2CECF06A89B4A6D968486F17F30DA5D
SHA1:	46757A7F71DCFBEB5511665F123810148727324E
SHA-256:	E6B10FF8681FB7461557E6227D036617C7ECFC6E31A35412F8A5F72C217F318B
SHA-512:	5CFFECE9AF2B403AE150E8D2E755E7E3A71BDDED474293D846CD1A6231C1403261F4B5E6069A0A933738D5CC33F7EA8CC043C721594679E17FC5E8225F3F33C6
Malicious:	false
Reputation:	low
Preview:	............................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-malware-simple.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.3683561037768297
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLJnawdSW+vmhnki/0Bn:eksSajWQji0
MD5:	3675254E341DF799D4307C1F59109185
SHA1:	8711844A41A4ACE77BA0A01A4D3AF2B2E59E6A75
SHA-256:	23D108134BED6099793F7DD6B8B6E62081EC3B945EFDBC7C5E0E779FD9B82F98
SHA-512:	9344CA1456E1E74A4DAC833E0AF55DB9730F8AB2954A855B4A775A938B2055C86EFF367F25BAE80F2FFEA45ACEBADE10A8347ADD18222E715620DD864F2D8E4F
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x........B.WG..a..E.+`D8.....a. ...D...q......w...X.Z.Z...~.

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-phish-simple-1.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.302539208701039
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLOW4xUO0f0iI8hE1R73sBKD:eks3pf+8RABy
MD5:	3D1CE5E50208F0CB3B979186043A548F
SHA1:	10C66032C5ACAC22D70670B9302437141E6371EF
SHA-256:	1E13D05D482C3D533DC6035AF2B2D6E84749412A5748D1435B70CEC8B312340B
SHA-512:	AE2F35C0549C26251053689C90CE831F0C5742D6F7C1DC13482560B02FB4A6029F107E472FCB26BF41B4E89E47559490F5DA049D5B51864A3C4C2C2AE3F588C2
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x........Y.......j..}`A=F......c..5.......T...8\|..d.\|..{

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-phish-simple.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	0.37123232664087563
Encrypted:	false
SSDEEP:	3:klMl:sk
MD5:	E2CECF06A89B4A6D968486F17F30DA5D
SHA1:	46757A7F71DCFBEB5511665F123810148727324E
SHA-256:	E6B10FF8681FB7461557E6227D036617C7ECFC6E31A35412F8A5F72C217F318B
SHA-512:	5CFFECE9AF2B403AE150E8D2E755E7E3A71BDDED474293D846CD1A6231C1403261F4B5E6069A0A933738D5CC33F7EA8CC043C721594679E17FC5E8225F3F33C6
Malicious:	false
Reputation:	low
Preview:	............................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-phish-simple.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.302539208701039
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLOW4xUO0f0iI8hE1R73sBKD:eks3pf+8RABy
MD5:	3D1CE5E50208F0CB3B979186043A548F
SHA1:	10C66032C5ACAC22D70670B9302437141E6371EF
SHA-256:	1E13D05D482C3D533DC6035AF2B2D6E84749412A5748D1435B70CEC8B312340B
SHA-512:	AE2F35C0549C26251053689C90CE831F0C5742D6F7C1DC13482560B02FB4A6029F107E472FCB26BF41B4E89E47559490F5DA049D5B51864A3C4C2C2AE3F588C2
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x........Y.......j..}`A=F......c..5.......T...8\|..d.\|..{

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-track-simple-1.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	272
Entropy (8bit):	3.9834161156862735
Encrypted:	false
SSDEEP:	3:VUylllvl2lll1lCLLLLLLLLLLLQ0ZIn39lAN6r3Zzk9uYs/wPMuiC:rUiU3gNAigr/wMC
MD5:	95F28EDE25C301301F25FBBD9A3C56EC
SHA1:	80F7D95AFC0DE8C608F672A6837C664EF847BCD5
SHA-256:	87763DF78772F7D750B0FA5A31EEC23E931FD3BD1CBB33BEDDFC61889DA36478
SHA-512:	C6E09C76840DDEA559E243E5C13881CFBCDCC7B0C2163461FDCCE1F3F5110E2B0BB553DE447A4E1E0D5EDF516EEEE2FAD5EFC15C398E101EF3C81501E55320AF
Malicious:	false
Reputation:	low
Preview:	;.1.........................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.......Ik...Xf2.h.J.^..P>.A.:..I%8]........=(K_..W..{...L.w...:7.&.PH..26....U.]..)..{6....(.

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-track-simple.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	0.37123232664087563
Encrypted:	false
SSDEEP:	3:klMl:sk
MD5:	E2CECF06A89B4A6D968486F17F30DA5D
SHA1:	46757A7F71DCFBEB5511665F123810148727324E
SHA-256:	E6B10FF8681FB7461557E6227D036617C7ECFC6E31A35412F8A5F72C217F318B
SHA-512:	5CFFECE9AF2B403AE150E8D2E755E7E3A71BDDED474293D846CD1A6231C1403261F4B5E6069A0A933738D5CC33F7EA8CC043C721594679E17FC5E8225F3F33C6
Malicious:	false
Reputation:	low
Preview:	............................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-track-simple.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	272
Entropy (8bit):	3.9834161156862735
Encrypted:	false
SSDEEP:	3:VUylllvl2lll1lCLLLLLLLLLLLQ0ZIn39lAN6r3Zzk9uYs/wPMuiC:rUiU3gNAigr/wMC
MD5:	95F28EDE25C301301F25FBBD9A3C56EC
SHA1:	80F7D95AFC0DE8C608F672A6837C664EF847BCD5
SHA-256:	87763DF78772F7D750B0FA5A31EEC23E931FD3BD1CBB33BEDDFC61889DA36478
SHA-512:	C6E09C76840DDEA559E243E5C13881CFBCDCC7B0C2163461FDCCE1F3F5110E2B0BB553DE447A4E1E0D5EDF516EEEE2FAD5EFC15C398E101EF3C81501E55320AF
Malicious:	false
Reputation:	low
Preview:	;.1.........................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.......Ik...Xf2.h.J.^..P>.A.:..I%8]........=(K_..W..{...L.w...:7.&.PH..26....U.]..)..{6....(.

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-trackwhite-simple-1.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.4079994338327437
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLYdIVDdSxcEtY4NL/n:eksdWdSxc3wn
MD5:	65E942614EEE70680464AC4BE75019FC
SHA1:	7CA1B5994684A7FE37A61BC350A1FA8A89BF91DA
SHA-256:	34395085DA32C8B4EFE9959E3B0D756B43FFED17694D66F39B966CD331BD9A94
SHA-512:	55B09573C235876D0CB4E6C20070CD1954CF1EB94F513A94985896237A350E48FCD47C88D5EC9632AB9D0AED4A59C250E69F59A59ED88F2A0AEB6734302744A9
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x........=Q.IU`.G...>...u..X...7...k6.b....k:u.z*N._)8.EhnZ

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-trackwhite-simple.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	0.37123232664087563
Encrypted:	false
SSDEEP:	3:klMl:sk
MD5:	E2CECF06A89B4A6D968486F17F30DA5D
SHA1:	46757A7F71DCFBEB5511665F123810148727324E
SHA-256:	E6B10FF8681FB7461557E6227D036617C7ECFC6E31A35412F8A5F72C217F318B
SHA-512:	5CFFECE9AF2B403AE150E8D2E755E7E3A71BDDED474293D846CD1A6231C1403261F4B5E6069A0A933738D5CC33F7EA8CC043C721594679E17FC5E8225F3F33C6
Malicious:	false
Reputation:	low
Preview:	............................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-trackwhite-simple.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.4079994338327437
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLYdIVDdSxcEtY4NL/n:eksdWdSxc3wn
MD5:	65E942614EEE70680464AC4BE75019FC
SHA1:	7CA1B5994684A7FE37A61BC350A1FA8A89BF91DA
SHA-256:	34395085DA32C8B4EFE9959E3B0D756B43FFED17694D66F39B966CD331BD9A94
SHA-512:	55B09573C235876D0CB4E6C20070CD1954CF1EB94F513A94985896237A350E48FCD47C88D5EC9632AB9D0AED4A59C250E69F59A59ED88F2A0AEB6734302744A9
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x........=Q.IU`.G...>...u..X...7...k6.b....k:u.z*N._)8.EhnZ

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-unwanted-simple-1.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.367107760120435
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLge3nZsRusljWFgm:eks5EsRRQB
MD5:	A5695CC64D77967232B0C1344C6E72B3
SHA1:	B0F151A5292D4B796668B242BF896FDBB5A24B67
SHA-256:	042A22B8681D754671D2018BA109B31A53EE3728D48C6379043F8E3394E7FBAD
SHA-512:	C09F56E91B41D01375C458A6CCC3FC0CEDC18696AEC5D7A2520C51905F4D9BC660F3AD28E69D64B3814AEB3279AFC686794C986F0FA6212463F3AAC850D40019
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.......^......R..U:N......LgY.u.l..H.Z....N?^c.d...].1. b

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-unwanted-simple.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	0.37123232664087563
Encrypted:	false
SSDEEP:	3:klMl:sk
MD5:	E2CECF06A89B4A6D968486F17F30DA5D
SHA1:	46757A7F71DCFBEB5511665F123810148727324E
SHA-256:	E6B10FF8681FB7461557E6227D036617C7ECFC6E31A35412F8A5F72C217F318B
SHA-512:	5CFFECE9AF2B403AE150E8D2E755E7E3A71BDDED474293D846CD1A6231C1403261F4B5E6069A0A933738D5CC33F7EA8CC043C721594679E17FC5E8225F3F33C6
Malicious:	false
Reputation:	low
Preview:	............................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-unwanted-simple.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.367107760120435
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLge3nZsRusljWFgm:eks5EsRRQB
MD5:	A5695CC64D77967232B0C1344C6E72B3
SHA1:	B0F151A5292D4B796668B242BF896FDBB5A24B67
SHA-256:	042A22B8681D754671D2018BA109B31A53EE3728D48C6379043F8E3394E7FBAD
SHA-512:	C09F56E91B41D01375C458A6CCC3FC0CEDC18696AEC5D7A2520C51905F4D9BC660F3AD28E69D64B3814AEB3279AFC686794C986F0FA6212463F3AAC850D40019
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.......^......R..U:N......LgY.u.l..H.Z....N?^c.d...].1. b

/home/james/.cache/mozilla/firefox/5zxot757.default/startupCache/webext.sc.lz4.tmp

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	87497
Entropy (8bit):	6.215715620793629
Encrypted:	false
SSDEEP:	1536:X5vK21wGeN4Z/tCww3+6R2/HuFbt4/xGJEIQiXdk992f6mwSO+lx:XZK2GGeN41w0QxyiC906mpOY
MD5:	E5A0B8F8FB6F2467FC9F268C3D87DDD0
SHA1:	573E9A4E23EEDD9010F093AF6BDFB3F8638B65F1
SHA-256:	5E8E8603749CB19F14790E36E4FF8465EFB23BC87040F0007E02B6AB865E1C74
SHA-512:	42B17A673CE2D0CA1D644B655B4CC7532A1DFB078DEF7416B699F9BDF99B752F49C516D9DA72BF16E680378C0E62F7B4D7FCC5AF04710500E2DC2C5C1B894B24
Malicious:	false
Reputation:	low
Preview:	mozJSSCLz40v001...............................manifests ....S..... ...formautofill@mozilla.orgH...(.21.0=..`.....Qen-US..s.........qapiNamew.1.....S..... ..dependenci$..(...(."id.......x........p..application... ....Rgecko...............strict_max_versionU....,..(./in(....P..update_urlA.....P..X...0.cauthor'.C........browser_specific_setting.....3...0..descript...P.{homepag..3...@..........S..... ..name.......cForm A..C......dshort_.....3... ..e...... ..backgrounH..... ..persistent......`....ss.............B...`..3.o.z.-.e.x.t.e.n.s.i.o.n.:././.5.0.d.7.6.b.8.e.-.8.d.3.b.-.4.7.5.7....5.1.6.-.c.d.6.6.5.8....c.7.4.5./.b.a.c.k.g.r.o.u.n.d...j.......S........content_....... ..ecurity_policy'..H..develope[.....x.Shidde....X.'icq..P..incognitt.....spanning....minimum_chromeN..}..P...(.\opera'.C....(..o...al_permiss....... ..0.As_uiq.....(..G...(...h...web_accessible_resourc............_overrid)....3........(ac.....scommand..$..p..devtools_pag........qomnibox.....;agem..`....nsideba........?ur

/home/james/.mozilla/firefox/5zxot757.default/addonStartup.json.lz4.tmp

Download File

Process:	/usr/lib/firefox/firefox
File Type:	Mozilla lz4 compressed data, originally 1426 bytes
Category:	dropped
Size (bytes):	638
Entropy (8bit):	6.058376992808135
Encrypted:	false
SSDEEP:	12:vkIb3bQPnkKNuN7Xnwutjp/Ai8AXyIF9nfvER9lyNinNii1ABHM6+ztbuEv2Ge:v5r4mNrnwunjR9filyNIii2sdVL7e
MD5:	C03070F8A39B68E1DF90C197530147B8
SHA1:	CA5D078F9FE04FA46AF10505F930F1F67DEA4314
SHA-256:	FB1ABAC28102E4FD1F7CD97C8B4135681C9BD4BA0EF1517895B278DB52BF5256
SHA-512:	26F8A7162835574D22C0AF33AD8F1EE1F1C24F473FD54C835D8DD512C0F26B4F30EBC9F0AE2DE6C8CA3EA92D0402867271B3CA29197B6ED141527EC4FA8200B6
Malicious:	false
Reputation:	low
Preview:	mozLz40.......{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1554899853000,"loader":null,"path":s.....xpi","runInSafeModej..telemetryKeyC.7%40....:1.0","version":"...},"screenshots..T.r.......B....K35.0......startupData...p..astentL..!er..Arunt....{"onMessage":[[]]}}}},"webcompat-reporter7..Ofals..&.z...?...I..F. 1....-..............)....p....!...Y3.0.2......'...webRequest..BeforeSendHe......[{"tabId..0typ0....0url$.U"://...-....-testcases.schub.io/"],"windowQ..},["blocking........?]],......directvnow.comn.!....P.0tag..%{}..../usr/lib/firefox/browser/features"}}

/home/james/.mozilla/firefox/5zxot757.default/cert9.db

Download File

Process:	/usr/lib/firefox/firefox
File Type:	SQLite 3.x database, last written using SQLite version 3026000, page size 32768, file counter 4, database pages 7, cookie 0x5, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	458752
Entropy (8bit):	0.42746960160571557
Encrypted:	false
SSDEEP:	384:9ozkVmvQhyn+Zoo0wJtKZYcMM0ctozkVmvQhyn+ZoovwJtKZYcMM01yw:9WwJtgYcMQFwJtgYcM1
MD5:	0E48E3B97F702324F7D42A2096323DF4
SHA1:	4878CD169663191A59F1D9E239620F5B7235EA29
SHA-256:	ED0D5D7C474071E173CC5232E17390AEF95B1059FE28E1AC06682CB0FA8AB89D
SHA-512:	A01FC37B51D01076872AA89C79C614E3B1D1F32B74A1FA3B74110AE07A34D1C7C99797AEDE0B14400E8BB14A3A64C90841A1359E3379F53E95D26FDF9BD8AF8B
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................,P.....z..\|...{.{.{@z.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/home/james/.mozilla/firefox/5zxot757.default/cert9.db-journal

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	459912
Entropy (8bit):	0.3533178454003558
Encrypted:	false
SSDEEP:	384:aZYcMM0TSozkVmvQhyn+ZooZVwJtKZYcMM04CozkVmvQhyn+Zoor:wYcMyFwJtgYcMDB
MD5:	CCEDAAF4C75F7B37F71B69F6ED5B9F03
SHA1:	42D317514430446A623A06FAB594FDA473CD4661
SHA-256:	EA2EB316D310A9B9A4D018F2BBA0A078EEDE3248E97C983D866498157BF608AF
SHA-512:	D29C43A5D7EDD50D9904B3560409FE228A061379869F914C0E9640D7EBB9C39FF1B11A45CFED8B19419AF09D84A474D2B8293E088BC3C46A85240316B872F1D2
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/home/james/.mozilla/firefox/5zxot757.default/cookies.sqlite-wal

Download File

Process:	/usr/lib/firefox/firefox
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	491912
Entropy (8bit):	0.09369638597274149
Encrypted:	false
SSDEEP:	96:UmzKyCzuXPcCLKytArRXP9fHZRnl8eJICX7:UmAqfcC/AFf9vZVlXnL
MD5:	28369489437D1EC934FF60499D887D13
SHA1:	20A9AEC0776F2A7B1F45CEA90E73DAC510F2DDA5
SHA-256:	60658F4C89407C38B586894E86963039DC527369EE93FC06AD20CF5976872DDE
SHA-512:	9CF4526931EE21D395DAC24F29DC9E4FD4234465624ECE0489444DDF2A6AD78AFB6D551B67D6B37BE4DD765B96E39E1AE8D81325DAF4EB5326CABF1C0EF5D894
Malicious:	false
Reputation:	low
Preview:	7....-......................n......................H.:`J.....~.....I~.~.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/home/james/.mozilla/firefox/5zxot757.default/key4.db

Download File

Process:	/usr/lib/firefox/firefox
File Type:	SQLite 3.x database, last written using SQLite version 3026000, page size 32768, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.39253245155101063
Encrypted:	false
SSDEEP:	192:mJLvKXzkVmvQhyn+ZoQfqlQbGhMHPaVAL23v8miXvlF:mJLozkVmvQhyn+ZooPX9F
MD5:	E4518FDC3DC74C8F8484075A4215BE93
SHA1:	FD852F909DD9098D4E128CAFC26563C4EC3DE498
SHA-256:	B89EF8725B7FBADD126D795D36DE94D08D58E68AAFC4C22DC88A3EE8A884B922
SHA-512:	AE9195A91D584437881A0C87E2E3937610FA5EA5DE8F9A38683128453A5681B70F1447F3342581C98FC18709E7E853948DDC860D486570C4F7AC0A930018FC02
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................,P.....zR.\|...{.{w{5z.zRz.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/home/james/.mozilla/firefox/5zxot757.default/key4.db-journal

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	98852
Entropy (8bit):	0.2140849137064902
Encrypted:	false
SSDEEP:	192:zN5JLvKXzkVmvQhyn+ZoQfqlQbGhMHPaVAL23v8l:p5JLozkVmvQhyn+Zool
MD5:	C4BD1E34566C48949C43EFCB61A93906
SHA1:	2749E60B1334E8CFF60F69BF8BC8234861376F16
SHA-256:	9F4580FF22CFB00A3142E61118002C3B1C3937DD3AB05C99E66D6171FE9F0CED
SHA-512:	56B4233D968EF2C21506F378AAF2663B64E66FCF2E8AD68974B0A7DE56B5217FC36609B1DE9F39F1C1F57844CA4E1A7F9CE3CE831C63012D8A08879D18EC8A8C
Malicious:	false
Reputation:	low
Preview:	............p.C.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/home/james/.mozilla/firefox/5zxot757.default/permissions.sqlite

Download File

Process:	/usr/lib/firefox/firefox
File Type:	SQLite 3.x database, user version 9, last written using SQLite version 3026000, page size 32768, file counter 5, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.09611120034147747
Encrypted:	false
SSDEEP:	12:DBl/Wlb9gPxRymgObsCVR49wcYR4fmnsCVR4aR:DLwZah76wd4+X
MD5:	3EC564DFFB31A761D90CC78B79A12619
SHA1:	179B48158BB8B9FAB1422D40C9B0618307AC0C5B
SHA-256:	18A9301EDE2C87FC24D9CE4EB1DC710DE2CD13C9DC57C46B0D88F08F8EC0CB91
SHA-512:	5081DA75330182C57DE2D4CDE5FFB484E0049ECE32810889127A4900D3A3D0BB289A59EEBE1D43022F19AC7307C7146D94D7AF4B97288BBA38500A32957980DC
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................,P.....~e..F~e........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/home/james/.mozilla/firefox/5zxot757.default/permissions.sqlite-journal

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	66076
Entropy (8bit):	0.11233894345347818
Encrypted:	false
SSDEEP:	12:M0P8bPGjH6Bl/AYlk9gPxRymgObsCVR49wcYR4fmnsCVR4Ot9:M0kjGjH6L9lMah76wd4+L9
MD5:	E7F56060214553C6F40E9F320AF7024B
SHA1:	750EC621ECC78FED73CE815FE0EF2C482247B66B
SHA-256:	52A03A3417A25DB9F2DB9043A383870E3C757E8E4FD2D5D495CC67C501CCE1E7
SHA-512:	2172D061C678A1F9496F7A2D16644E08F8E54E8878681F452593848FB7C0D489647E4642BC0AB469073F3394198058332C9990FDE4E9D3E3BDD4912F687CEE6C
Malicious:	false
Reputation:	low
Preview:	............Y(..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/home/james/.mozilla/firefox/5zxot757.default/places.sqlite-wal

Download File

Process:	/usr/lib/firefox/firefox
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	557496
Entropy (8bit):	0.16301794083521348
Encrypted:	false
SSDEEP:	96:8OaV71PqnQOxOW4ErN1Zv2TFDHFYgITLWHLqxO10A3nQOx5A3ntHgW1oOxZ:8Dcn9kL27OTFJYgIIqcTn9EntAWDv
MD5:	89D785477AD23DCA2C28DACCE4D38C8B
SHA1:	C53273C1AD28BB3BE7F637D4C60C4BA935F1A2BA
SHA-256:	0D73AB3E74EA37C2618E5331A1A0BE52EE02A2E2CF5D27AE81C5B784BCEF5A73
SHA-512:	B1B8E68E485963631C9BFEE665EECAED2EB3CB0B55EC8553290EB95FF6A34D8162E959ED8B54B54B4D0264A1BCE3529802F2C62E704709DDD01700B527A02374
Malicious:	false
Reputation:	low
Preview:	7....-.............>.........!Xw...........>....,..K....(..~...X.8.....\|..~...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/home/james/.mozilla/firefox/5zxot757.default/prefs-1.js

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with very long lines (663)
Category:	dropped
Size (bytes):	33355
Entropy (8bit):	5.174414239665305
Encrypted:	false
SSDEEP:	384:BDG51pz2DzqNDGw1pz2DzqNDGw1pz2JzqNDGw1pz2wzqNDGi1pz2wzq1:MltllLleNe1
MD5:	10CE42949C1659E50DE240E4A15AD92D
SHA1:	A647CB82B53EBA46212F0EA750744203D3B3B196
SHA-256:	E12A31682080B441723028A6DE5770285E3C2B26A0392FF902D7F1AA08AD7466
SHA-512:	1003995898F5FB2D9916156D5BEC72419AFBD97BA42916C2ADC0C30B4389996F6A5F44BEE5353A01EB3C57A6EE6908547CF366A5C71DE7BBD2EB52009CCD79FC
Malicious:	false
Reputation:	low
Preview:	// Mozilla User Preferences..// DO NOT EDIT THIS FILE..//.// If you make changes to this file while the application is running,.// the changes will be overwritten when the application exits..//.// To change a preference value, you can either:.// - modify it via the UI (e.g. via about:config in the browser); or.// - set it within a user.js file in your profile...user_pref("app.normandy.first_run", false);.user_pref("app.normandy.startupExperimentPrefs.dom.push.alwaysConnect", false);.user_pref("app.normandy.startupRolloutPrefs.media.autoplay.default", 1);.user_pref("app.normandy.user_id", "deb21830-19ac-4c3a-a05f-f7f80e818647");.user_pref("app.update.lastUpdateTime.addon-background-update-timer", 0);.user_pref("app.update.lastUpdateTime.blocklist-background-update-timer", 0);.user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1556631169);.user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 0);.user_pref("app.update.lastUpdateTime.search-engine-update-timer", 0)

/home/james/.mozilla/firefox/5zxot757.default/sessionCheckpoints.json.tmp

Download File

Process:	/usr/lib/firefox/firefox
File Type:	JSON data
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.223691028533093
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+ABaQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+kOy6Lb1BA+m2L69Yr
MD5:	C0E4C22C50DD21142F57714EF49B8713
SHA1:	06B77307DCA5C889EA279243E74730CBC10801BE
SHA-256:	6FE46B65B76B3DF32D8392853740B35ED75B6E23F4FBD6F45F3EFA1D496E6717
SHA-512:	A4516B4F15EDB429F7B8CE3EA709D3777BFCC590838B1E113147E6BFB4DF0F34F0F2B24F6185D4E4277A77F75711BB470461B86AA507921AF037A6D22DF9278E
Malicious:	false
Reputation:	low
Preview:	{"profile-after-change":true,"final-ui-startup":true}{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

/home/james/.mozilla/firefox/5zxot757.default/sessionstore-backups/recovery.jsonlz4.tmp

Download File

Process:	/usr/lib/firefox/firefox
File Type:	Mozilla lz4 compressed data, originally 26969 bytes
Category:	dropped
Size (bytes):	3694
Entropy (8bit):	6.723556964984797
Encrypted:	false
SSDEEP:	96:kx9j+HCQ3y9YiCPl18dE0Kyyl/Fn0XBQoXRk:wCvCGPlCdE0m70/k
MD5:	64CFCD032A4BCBE5F31DA7F0D249A3D6
SHA1:	353EF75C228C7151ED62D9F3CA261883CA1096DD
SHA-256:	BD4B4D1790B548E310DB99A34C0B276632CB101D0291F3A275073E595906C3AE
SHA-512:	84099ADF32185E20D81D2CAF3AF7C218E6AFC54246783AEACADE1014B606D3045F445DED036FD006F4B5E1F0EC8CF4FD8F9C20C4382AEAEA1D44B584629FA322
Malicious:	false
Reputation:	low
Preview:	mozLz40.Yi....{"version":["ses....restore",1],"windows":[{"tab..bentrie...&url":"http://selfservicegeneraligroup.com/","title":"(....","cacheKey":0,"ID...docshellUU...&"{6eaadc9b-f3b3-4b26-accd-ef6c4bfe5c45}","originalURI....resultPrincip<.tnull,"p....ToInherit_base64":"vQZuXxRvRHKDMXv9BbHtkA...w.. EY...=4bW96LW51bGxwcmluY2lwYWw6ezViMDY1YzA1LTI1M2UtNDE1MS1iNDY3LTQ3OGE4MTg0YWY2N30P..Aa..riggering.......SmIS26zLEdO3ZQBgsLbOy.....!="r..Identifier...Kpersist":true}],"lastAccessed":1713335686660,"hidden":false,"attributes":{},"userContextId_...index":1,"images..g.aselectc..,"_closedT..u],"busyf...width":921,"height":668,"screenX":4...Y..`izemod...maximized","zI......W..................@.1":{..jUpdate...1,"startTim..@1595v..centCrash]..0},"global1.Pcooki...[z..S..!Stg....9..s://www.mozilla.org/en-US/privacy/firefox...F.." P#.. Notice . MH.......9338d488-264a-4aaf-995b-482822c46064...................@.......loadReplace......2...2.S..gyOTFlNmZkLTU2MG2...VlNi04OGUwLWY3ZmIyZDBiY2VkOH0...2.o.55

/proc/4929/gid_map

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	1.4353713907745331
Encrypted:	false
SSDEEP:	3:MVUGn:MCG
MD5:	54258652109C33FE06188083A3EC23F4
SHA1:	013EC30A95D66C56642C193613A829B746982601
SHA-256:	C459EBB6CF3917EFB05A2E72EF25E223BE9B78780B1CE0CAACCE49C773DF199E
SHA-512:	AAE8A67B91BDEC9C21ACD88711C262EA3ACD3EE086AEB27645531C47DD618708C7FF284759A68000414579B77C0D8A3449F95480D039A9901F7352121B7D78F0
Malicious:	false
Reputation:	low
Preview:	1000 1000 1

/proc/4929/setgroups

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:9n:9n
MD5:	05AFB6CE69B9CEF1BD6ECE7E4745F96C
SHA1:	1D16DC2DCC6851208C1B981E2EC377250A4A0CC5
SHA-256:	3026A0CA485E5831657BA0120FA8DD66B3425427BFB0A2BE0DB743E2305CC7C5
SHA-512:	A37A7790CCB2FA5A3C3F2740480CF4035F2870502060F398A1882A44B675DE736E33D8ECD9B834BB3D19D807B46875E30AA835EDD847C5FE8F1F2942A870BAD5
Malicious:	false
Reputation:	low
Preview:	deny

/proc/4929/uid_map

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	1.4353713907745331
Encrypted:	false
SSDEEP:	3:MVUGn:MCG
MD5:	54258652109C33FE06188083A3EC23F4
SHA1:	013EC30A95D66C56642C193613A829B746982601
SHA-256:	C459EBB6CF3917EFB05A2E72EF25E223BE9B78780B1CE0CAACCE49C773DF199E
SHA-512:	AAE8A67B91BDEC9C21ACD88711C262EA3ACD3EE086AEB27645531C47DD618708C7FF284759A68000414579B77C0D8A3449F95480D039A9901F7352121B7D78F0
Malicious:	false
Reputation:	low
Preview:	1000 1000 1

/proc/4977/gid_map

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	1.4353713907745331
Encrypted:	false
SSDEEP:	3:MVUGn:MCG
MD5:	54258652109C33FE06188083A3EC23F4
SHA1:	013EC30A95D66C56642C193613A829B746982601
SHA-256:	C459EBB6CF3917EFB05A2E72EF25E223BE9B78780B1CE0CAACCE49C773DF199E
SHA-512:	AAE8A67B91BDEC9C21ACD88711C262EA3ACD3EE086AEB27645531C47DD618708C7FF284759A68000414579B77C0D8A3449F95480D039A9901F7352121B7D78F0
Malicious:	false
Reputation:	low
Preview:	1000 1000 1

/proc/4977/setgroups

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:9n:9n
MD5:	05AFB6CE69B9CEF1BD6ECE7E4745F96C
SHA1:	1D16DC2DCC6851208C1B981E2EC377250A4A0CC5
SHA-256:	3026A0CA485E5831657BA0120FA8DD66B3425427BFB0A2BE0DB743E2305CC7C5
SHA-512:	A37A7790CCB2FA5A3C3F2740480CF4035F2870502060F398A1882A44B675DE736E33D8ECD9B834BB3D19D807B46875E30AA835EDD847C5FE8F1F2942A870BAD5
Malicious:	false
Reputation:	low
Preview:	deny

/proc/4977/uid_map

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	1.4353713907745331
Encrypted:	false
SSDEEP:	3:MVUGn:MCG
MD5:	54258652109C33FE06188083A3EC23F4
SHA1:	013EC30A95D66C56642C193613A829B746982601
SHA-256:	C459EBB6CF3917EFB05A2E72EF25E223BE9B78780B1CE0CAACCE49C773DF199E
SHA-512:	AAE8A67B91BDEC9C21ACD88711C262EA3ACD3EE086AEB27645531C47DD618708C7FF284759A68000414579B77C0D8A3449F95480D039A9901F7352121B7D78F0
Malicious:	false
Reputation:	low
Preview:	1000 1000 1

/proc/5019/gid_map

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	1.4353713907745331
Encrypted:	false
SSDEEP:	3:MVUGn:MCG
MD5:	54258652109C33FE06188083A3EC23F4
SHA1:	013EC30A95D66C56642C193613A829B746982601
SHA-256:	C459EBB6CF3917EFB05A2E72EF25E223BE9B78780B1CE0CAACCE49C773DF199E
SHA-512:	AAE8A67B91BDEC9C21ACD88711C262EA3ACD3EE086AEB27645531C47DD618708C7FF284759A68000414579B77C0D8A3449F95480D039A9901F7352121B7D78F0
Malicious:	false
Reputation:	low
Preview:	1000 1000 1

/proc/5019/setgroups

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:9n:9n
MD5:	05AFB6CE69B9CEF1BD6ECE7E4745F96C
SHA1:	1D16DC2DCC6851208C1B981E2EC377250A4A0CC5
SHA-256:	3026A0CA485E5831657BA0120FA8DD66B3425427BFB0A2BE0DB743E2305CC7C5
SHA-512:	A37A7790CCB2FA5A3C3F2740480CF4035F2870502060F398A1882A44B675DE736E33D8ECD9B834BB3D19D807B46875E30AA835EDD847C5FE8F1F2942A870BAD5
Malicious:	false
Reputation:	low
Preview:	deny

/proc/5019/uid_map

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	1.4353713907745331
Encrypted:	false
SSDEEP:	3:MVUGn:MCG
MD5:	54258652109C33FE06188083A3EC23F4
SHA1:	013EC30A95D66C56642C193613A829B746982601
SHA-256:	C459EBB6CF3917EFB05A2E72EF25E223BE9B78780B1CE0CAACCE49C773DF199E
SHA-512:	AAE8A67B91BDEC9C21ACD88711C262EA3ACD3EE086AEB27645531C47DD618708C7FF284759A68000414579B77C0D8A3449F95480D039A9901F7352121B7D78F0
Malicious:	false
Reputation:	low
Preview:	1000 1000 1

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 17, 2024 08:34:43.824120045 CEST	56228	80	192.168.2.20	104.247.82.170
Apr 17, 2024 08:34:43.979829073 CEST	80	56228	104.247.82.170	192.168.2.20
Apr 17, 2024 08:34:43.980058908 CEST	56228	80	192.168.2.20	104.247.82.170
Apr 17, 2024 08:34:44.136313915 CEST	80	56228	104.247.82.170	192.168.2.20
Apr 17, 2024 08:34:44.551054955 CEST	56228	80	192.168.2.20	104.247.82.170
Apr 17, 2024 08:34:44.707077026 CEST	80	56228	104.247.82.170	192.168.2.20
Apr 17, 2024 08:34:44.811718941 CEST	80	56228	104.247.82.170	192.168.2.20
Apr 17, 2024 08:34:44.811739922 CEST	80	56228	104.247.82.170	192.168.2.20
Apr 17, 2024 08:34:44.811753035 CEST	80	56228	104.247.82.170	192.168.2.20
Apr 17, 2024 08:34:44.811765909 CEST	80	56228	104.247.82.170	192.168.2.20
Apr 17, 2024 08:34:44.811779022 CEST	80	56228	104.247.82.170	192.168.2.20
Apr 17, 2024 08:34:44.811790943 CEST	80	56228	104.247.82.170	192.168.2.20
Apr 17, 2024 08:34:44.811804056 CEST	80	56228	104.247.82.170	192.168.2.20
Apr 17, 2024 08:34:44.811949015 CEST	56228	80	192.168.2.20	104.247.82.170
Apr 17, 2024 08:34:44.811949015 CEST	56228	80	192.168.2.20	104.247.82.170
Apr 17, 2024 08:34:44.811985016 CEST	56228	80	192.168.2.20	104.247.82.170
Apr 17, 2024 08:34:44.811985016 CEST	56228	80	192.168.2.20	104.247.82.170
Apr 17, 2024 08:34:44.811985016 CEST	56228	80	192.168.2.20	104.247.82.170
Apr 17, 2024 08:34:44.811985016 CEST	56228	80	192.168.2.20	104.247.82.170
Apr 17, 2024 08:34:44.811985016 CEST	56228	80	192.168.2.20	104.247.82.170
Apr 17, 2024 08:34:45.304807901 CEST	56228	80	192.168.2.20	104.247.82.170
Apr 17, 2024 08:34:45.380356073 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:34:45.460654020 CEST	80	56228	104.247.82.170	192.168.2.20
Apr 17, 2024 08:34:45.468542099 CEST	80	56228	104.247.82.170	192.168.2.20
Apr 17, 2024 08:34:45.468671083 CEST	56228	80	192.168.2.20	104.247.82.170
Apr 17, 2024 08:34:45.484183073 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:34:45.484278917 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:34:45.484407902 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:34:45.521452904 CEST	57378	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:45.521481037 CEST	443	57378	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:45.521527052 CEST	57378	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:45.522360086 CEST	57378	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:45.522371054 CEST	443	57378	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:45.549747944 CEST	56228	80	192.168.2.20	104.247.82.170
Apr 17, 2024 08:34:45.588191032 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:34:45.588619947 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:34:45.588793993 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:34:45.588835955 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:34:45.588857889 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:34:45.588875055 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:34:45.588891029 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:34:45.588908911 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:34:45.588924885 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:34:45.588942051 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:34:45.588959932 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:34:45.588978052 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:34:45.589068890 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:34:45.589070082 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:34:45.589070082 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:34:45.589111090 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:34:45.589112043 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:34:45.589112043 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:34:45.589112043 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:34:45.589112043 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:34:45.589112043 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:34:45.652513027 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:45.712116003 CEST	80	56228	104.247.82.170	192.168.2.20
Apr 17, 2024 08:34:45.712193012 CEST	56228	80	192.168.2.20	104.247.82.170
Apr 17, 2024 08:34:45.746057034 CEST	443	57378	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:45.746169090 CEST	57378	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:45.774619102 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:45.774816990 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:45.781919003 CEST	57378	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:45.781994104 CEST	443	57378	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:45.782056093 CEST	57378	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:45.782072067 CEST	443	57378	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:45.782150030 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:45.782181025 CEST	443	57378	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:45.820660114 CEST	57378	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:45.820723057 CEST	443	57378	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:45.820806026 CEST	57378	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:45.903893948 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:45.910315037 CEST	56228	80	192.168.2.20	104.247.82.170
Apr 17, 2024 08:34:45.919459105 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:45.919487000 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:45.919506073 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:45.919523001 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:45.919536114 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:45.919536114 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:45.919536114 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:45.919540882 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:45.919554949 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:45.919559002 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:45.919593096 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:45.919593096 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:45.920181036 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:45.920201063 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:45.920217037 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:45.920228958 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:45.920228958 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:45.920236111 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:45.920245886 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:45.920275927 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.041328907 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.041363001 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.041625023 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.041625023 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.045533895 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.045559883 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.045759916 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.045759916 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.054107904 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.054135084 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.054363012 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.054363012 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.062647104 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.062670946 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.062865973 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.062865973 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.065947056 CEST	80	56228	104.247.82.170	192.168.2.20
Apr 17, 2024 08:34:46.066035032 CEST	56228	80	192.168.2.20	104.247.82.170
Apr 17, 2024 08:34:46.071201086 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.071224928 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.071346998 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.071346998 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.079724073 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.079786062 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.083973885 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.083997965 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.084033012 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.084045887 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.092536926 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.092560053 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.092580080 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.092595100 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.101111889 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.101150036 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.101188898 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.101188898 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.109903097 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.109925985 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.109957933 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.109958887 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.118208885 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.118272066 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.163520098 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.163557053 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.163706064 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.163706064 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.167737961 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.167762995 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.167831898 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.167831898 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.175510883 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.175534010 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.175724030 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.175724030 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.183240891 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.183265924 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.183339119 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.183339119 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.190654039 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.190677881 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.190735102 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.190735102 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.197989941 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.198016882 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.198249102 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.198249102 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.205204964 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.205390930 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.208893061 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.208915949 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.208959103 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.208959103 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.216150045 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.216172934 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.216202974 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.216218948 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.223433971 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.223459005 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.223496914 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.223496914 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.230664015 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.230689049 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.230844975 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.230844975 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.237986088 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.238015890 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.238218069 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.238218069 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.245158911 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.245325089 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.248790979 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.248817921 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.248934031 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.248934031 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.256072044 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.256098032 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.256145000 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.256158113 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.263029099 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.263055086 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:46.263180971 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.263180971 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:46.415045023 CEST	443	57378	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:46.415175915 CEST	443	57378	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:46.415319920 CEST	57378	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:46.415688992 CEST	57378	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:46.415728092 CEST	443	57378	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:46.415750980 CEST	57378	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:46.415761948 CEST	443	57378	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:46.420355082 CEST	57384	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:46.420397043 CEST	443	57384	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:46.420449972 CEST	57384	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:46.421216965 CEST	57384	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:46.421243906 CEST	443	57384	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:46.421578884 CEST	57384	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:46.423382998 CEST	57386	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:46.423392057 CEST	443	57386	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:46.423430920 CEST	57386	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:46.424072981 CEST	57386	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:46.424082041 CEST	443	57386	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:46.432342052 CEST	45366	443	192.168.2.20	142.250.217.174
Apr 17, 2024 08:34:46.432351112 CEST	443	45366	142.250.217.174	192.168.2.20
Apr 17, 2024 08:34:46.432387114 CEST	45366	443	192.168.2.20	142.250.217.174
Apr 17, 2024 08:34:46.433183908 CEST	45366	443	192.168.2.20	142.250.217.174
Apr 17, 2024 08:34:46.433195114 CEST	443	45366	142.250.217.174	192.168.2.20
Apr 17, 2024 08:34:46.468111992 CEST	443	57384	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:46.635840893 CEST	443	57384	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:46.636017084 CEST	57384	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:46.636024952 CEST	443	57384	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:46.636064053 CEST	57384	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:46.641484022 CEST	443	57386	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:46.641558886 CEST	57386	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:46.643192053 CEST	57386	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:46.643203974 CEST	443	57386	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:46.643379927 CEST	443	57386	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:46.643461943 CEST	57386	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:46.643470049 CEST	443	57386	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:46.680603027 CEST	57386	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:46.703377962 CEST	443	45366	142.250.217.174	192.168.2.20
Apr 17, 2024 08:34:46.703401089 CEST	443	45366	142.250.217.174	192.168.2.20
Apr 17, 2024 08:34:46.703440905 CEST	45366	443	192.168.2.20	142.250.217.174
Apr 17, 2024 08:34:46.703440905 CEST	45366	443	192.168.2.20	142.250.217.174
Apr 17, 2024 08:34:46.703449965 CEST	443	45366	142.250.217.174	192.168.2.20
Apr 17, 2024 08:34:46.703597069 CEST	45366	443	192.168.2.20	142.250.217.174
Apr 17, 2024 08:34:46.704468012 CEST	443	45366	142.250.217.174	192.168.2.20
Apr 17, 2024 08:34:46.704509974 CEST	45366	443	192.168.2.20	142.250.217.174
Apr 17, 2024 08:34:46.705337048 CEST	45366	443	192.168.2.20	142.250.217.174
Apr 17, 2024 08:34:46.705341101 CEST	443	45366	142.250.217.174	192.168.2.20
Apr 17, 2024 08:34:46.705430984 CEST	443	45366	142.250.217.174	192.168.2.20
Apr 17, 2024 08:34:46.705693007 CEST	45366	443	192.168.2.20	142.250.217.174
Apr 17, 2024 08:34:46.705704927 CEST	443	45366	142.250.217.174	192.168.2.20
Apr 17, 2024 08:34:46.744564056 CEST	45366	443	192.168.2.20	142.250.217.174
Apr 17, 2024 08:34:47.400816917 CEST	443	45366	142.250.217.174	192.168.2.20
Apr 17, 2024 08:34:47.400957108 CEST	443	45366	142.250.217.174	192.168.2.20
Apr 17, 2024 08:34:47.401019096 CEST	45366	443	192.168.2.20	142.250.217.174
Apr 17, 2024 08:34:47.401040077 CEST	443	45366	142.250.217.174	192.168.2.20
Apr 17, 2024 08:34:47.401185036 CEST	45366	443	192.168.2.20	142.250.217.174
Apr 17, 2024 08:34:47.401185036 CEST	45366	443	192.168.2.20	142.250.217.174
Apr 17, 2024 08:34:47.401338100 CEST	45366	443	192.168.2.20	142.250.217.174
Apr 17, 2024 08:34:47.401355028 CEST	45366	443	192.168.2.20	142.250.217.174
Apr 17, 2024 08:34:47.401716948 CEST	443	45366	142.250.217.174	192.168.2.20
Apr 17, 2024 08:34:47.401768923 CEST	45366	443	192.168.2.20	142.250.217.174
Apr 17, 2024 08:34:47.413867950 CEST	35052	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:47.413963079 CEST	443	35052	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:47.414035082 CEST	35052	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:47.414799929 CEST	35052	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:47.414834023 CEST	443	35052	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:47.438239098 CEST	443	57386	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:47.438292980 CEST	57386	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:47.438299894 CEST	443	57386	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:47.438391924 CEST	443	57386	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:47.438494921 CEST	57386	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:47.438617945 CEST	57386	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:47.438636065 CEST	443	57386	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:47.438647032 CEST	57386	443	192.168.2.20	3.163.115.26
Apr 17, 2024 08:34:47.438652992 CEST	443	57386	3.163.115.26	192.168.2.20
Apr 17, 2024 08:34:47.676568031 CEST	443	35052	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:47.676778078 CEST	35052	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:47.678360939 CEST	35052	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:47.678385973 CEST	443	35052	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:47.678471088 CEST	443	35052	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:47.679357052 CEST	35052	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:47.679389000 CEST	443	35052	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:47.716459036 CEST	35052	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:47.931382895 CEST	443	35052	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:47.931435108 CEST	443	35052	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:47.931441069 CEST	35052	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:47.931456089 CEST	443	35052	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:47.931469917 CEST	35052	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:47.931479931 CEST	443	35052	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:47.931499958 CEST	443	35052	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:47.931508064 CEST	35052	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:47.931508064 CEST	35052	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:47.931514025 CEST	443	35052	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:47.931531906 CEST	35052	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:47.931545973 CEST	35052	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:47.931550026 CEST	443	35052	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:47.931583881 CEST	35052	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:47.939560890 CEST	443	35052	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:47.939613104 CEST	35052	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:47.939923048 CEST	35052	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:47.940069914 CEST	443	35052	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:47.940105915 CEST	443	35052	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:47.952733994 CEST	35054	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:47.952773094 CEST	443	35054	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:47.952821016 CEST	35054	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:47.954183102 CEST	35054	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:47.954196930 CEST	443	35054	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:47.956116915 CEST	443	35052	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:47.956163883 CEST	35052	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:47.964796066 CEST	35052	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:48.218467951 CEST	443	35054	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:48.218725920 CEST	35054	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:48.220052958 CEST	35054	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:48.220063925 CEST	443	35054	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:48.220186949 CEST	443	35054	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:48.223598003 CEST	35054	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:48.223634005 CEST	443	35054	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:48.483479977 CEST	443	35054	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:48.483941078 CEST	443	35054	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:48.484613895 CEST	35054	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:48.484915972 CEST	35054	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:48.484936953 CEST	443	35054	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:48.484966040 CEST	35054	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:48.484972000 CEST	443	35054	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:49.938466072 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:49.938519001 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:49.938678980 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:49.940073967 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:49.940088987 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.207622051 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.207730055 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.211069107 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.211076975 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.211162090 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.215277910 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.215301037 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.484721899 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.484752893 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.484777927 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.484811068 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.484827995 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.484831095 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.484841108 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.484857082 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.484875917 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.492980003 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.501513958 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.501538038 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.501806021 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.501821041 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.501863956 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.507694960 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.516247034 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.516303062 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.516310930 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.552452087 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.606617928 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.606699944 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.606710911 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.606805086 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.610915899 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.611030102 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.611036062 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.611093998 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.619513988 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.619585991 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.619590998 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.619679928 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.627952099 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.628053904 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.628058910 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.628117085 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.636795044 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.636852026 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.637309074 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.637315989 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.637370110 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.637382984 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.645054102 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.645252943 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.645262003 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.645296097 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.653605938 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.653676987 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.653686047 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.653778076 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.661427975 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.661494970 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.661500931 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.661539078 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.669245005 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.669306040 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.669315100 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.669358015 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.677063942 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.677136898 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.677143097 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.677225113 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.684932947 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.685224056 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.685235023 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.685276031 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.692780018 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.692850113 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.692884922 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.692965984 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.692971945 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.693010092 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.700552940 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.700943947 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.704405069 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.704490900 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.704494953 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.704545021 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.704549074 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.704557896 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.704588890 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.704988003 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.705008984 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:50.705048084 CEST	35058	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:50.705054998 CEST	443	35058	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:51.788805008 CEST	35066	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:51.788841963 CEST	443	35066	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:51.789007902 CEST	35066	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:51.790086031 CEST	35066	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:51.790107012 CEST	443	35066	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:51.847644091 CEST	35068	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:51.847687960 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:51.847785950 CEST	35068	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:51.849683046 CEST	35068	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:51.849714041 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.055206060 CEST	443	35066	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.055322886 CEST	35066	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:52.056643963 CEST	35066	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:52.056657076 CEST	443	35066	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.056845903 CEST	443	35066	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.058229923 CEST	35066	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:52.100126982 CEST	443	35066	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.106811047 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.106906891 CEST	35068	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:52.110178947 CEST	35068	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:52.110188961 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.110265017 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.112938881 CEST	35068	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:52.156116009 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.317764044 CEST	443	35066	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.318128109 CEST	443	35066	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.318212032 CEST	35066	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:52.318690062 CEST	35066	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:52.318718910 CEST	443	35066	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.318732977 CEST	35066	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:52.318741083 CEST	443	35066	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.353183985 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.353236914 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.353270054 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.353290081 CEST	35068	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:52.353324890 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.353360891 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.353363991 CEST	35068	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:52.353375912 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.353406906 CEST	35068	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:52.361421108 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.369893074 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.369918108 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.369965076 CEST	35068	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:52.369978905 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.370026112 CEST	35068	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:52.378391981 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.386759043 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.386821032 CEST	35068	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:52.386833906 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.424444914 CEST	35068	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:52.473714113 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.473781109 CEST	35068	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:52.473793983 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.473835945 CEST	35068	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:52.477823019 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.477875948 CEST	35068	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:52.477883101 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.477912903 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.477931976 CEST	35068	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:52.478069067 CEST	35068	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:52.478092909 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:52.478107929 CEST	35068	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:52.478116989 CEST	443	35068	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:53.313539982 CEST	35074	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:53.313596964 CEST	443	35074	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:53.313678026 CEST	35074	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:53.316021919 CEST	35074	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:53.316051960 CEST	443	35074	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:53.319686890 CEST	35078	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:53.319736004 CEST	443	35078	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:53.319789886 CEST	35078	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:53.321314096 CEST	35078	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:53.321338892 CEST	443	35078	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:53.577403069 CEST	443	35074	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:53.577616930 CEST	35074	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:53.578998089 CEST	35074	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:53.579005957 CEST	443	35074	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:53.579113007 CEST	443	35074	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:53.583272934 CEST	443	35078	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:53.583336115 CEST	35078	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:53.584670067 CEST	35078	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:53.584687948 CEST	443	35078	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:53.584781885 CEST	443	35078	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:53.585834980 CEST	35078	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:53.585867882 CEST	443	35078	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:53.616449118 CEST	35074	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:53.849525928 CEST	443	35078	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:53.849591970 CEST	443	35078	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:53.849627018 CEST	443	35078	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:53.849704027 CEST	443	35078	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:53.849724054 CEST	35078	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:53.849735022 CEST	443	35078	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:53.849747896 CEST	35078	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:53.849750042 CEST	443	35078	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:53.849802971 CEST	35078	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:53.857806921 CEST	443	35078	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:53.860757113 CEST	443	35078	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:53.860892057 CEST	35078	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:53.860955000 CEST	35078	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:53.860970974 CEST	443	35078	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:53.860985994 CEST	35078	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:53.860992908 CEST	443	35078	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:55.588475943 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:34:55.692358971 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:34:56.068500996 CEST	56228	80	192.168.2.20	104.247.82.170
Apr 17, 2024 08:34:56.224288940 CEST	80	56228	104.247.82.170	192.168.2.20
Apr 17, 2024 08:34:56.260406017 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:56.382261992 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:58.507205009 CEST	35074	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:58.507229090 CEST	35074	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:58.507491112 CEST	443	35074	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:58.507544994 CEST	443	35074	142.250.217.164	192.168.2.20
Apr 17, 2024 08:34:58.507587910 CEST	35074	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:34:58.507611036 CEST	35074	443	192.168.2.20	142.250.217.164
Apr 17, 2024 08:35:01.065540075 CEST	80	56228	104.247.82.170	192.168.2.20
Apr 17, 2024 08:35:01.066287994 CEST	56228	80	192.168.2.20	104.247.82.170
Apr 17, 2024 08:35:01.222063065 CEST	80	56228	104.247.82.170	192.168.2.20
Apr 17, 2024 08:35:04.124145031 CEST	58570	443	192.168.2.20	35.244.181.201
Apr 17, 2024 08:35:04.124234915 CEST	443	58570	35.244.181.201	192.168.2.20
Apr 17, 2024 08:35:04.124320030 CEST	58570	443	192.168.2.20	35.244.181.201
Apr 17, 2024 08:35:04.124464035 CEST	58570	443	192.168.2.20	35.244.181.201
Apr 17, 2024 08:35:04.124488115 CEST	443	58570	35.244.181.201	192.168.2.20
Apr 17, 2024 08:35:04.345110893 CEST	443	58570	35.244.181.201	192.168.2.20
Apr 17, 2024 08:35:04.345299959 CEST	58570	443	192.168.2.20	35.244.181.201
Apr 17, 2024 08:35:04.351311922 CEST	58570	443	192.168.2.20	35.244.181.201
Apr 17, 2024 08:35:04.351336002 CEST	443	58570	35.244.181.201	192.168.2.20
Apr 17, 2024 08:35:04.351545095 CEST	58570	443	192.168.2.20	35.244.181.201
Apr 17, 2024 08:35:04.351561069 CEST	443	58570	35.244.181.201	192.168.2.20
Apr 17, 2024 08:35:04.351793051 CEST	443	58570	35.244.181.201	192.168.2.20
Apr 17, 2024 08:35:04.388339996 CEST	58570	443	192.168.2.20	35.244.181.201
Apr 17, 2024 08:35:04.809693098 CEST	443	58570	35.244.181.201	192.168.2.20
Apr 17, 2024 08:35:04.809786081 CEST	58570	443	192.168.2.20	35.244.181.201
Apr 17, 2024 08:35:04.809825897 CEST	443	58570	35.244.181.201	192.168.2.20
Apr 17, 2024 08:35:04.809878111 CEST	58570	443	192.168.2.20	35.244.181.201
Apr 17, 2024 08:35:04.809886932 CEST	443	58570	35.244.181.201	192.168.2.20
Apr 17, 2024 08:35:04.809921980 CEST	443	58570	35.244.181.201	192.168.2.20
Apr 17, 2024 08:35:04.809931040 CEST	58570	443	192.168.2.20	35.244.181.201
Apr 17, 2024 08:35:04.810157061 CEST	58570	443	192.168.2.20	35.244.181.201
Apr 17, 2024 08:35:04.810198069 CEST	443	58570	35.244.181.201	192.168.2.20
Apr 17, 2024 08:35:04.810229063 CEST	58570	443	192.168.2.20	35.244.181.201
Apr 17, 2024 08:35:04.810245037 CEST	443	58570	35.244.181.201	192.168.2.20
Apr 17, 2024 08:35:05.724384069 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:35:05.828747988 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:35:06.396337986 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:35:06.518295050 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:35:15.836293936 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:35:15.940252066 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:35:16.540275097 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:35:16.662410975 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:35:25.948273897 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:35:26.052268028 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:35:26.684283972 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:35:26.806334019 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:35:36.060198069 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:35:36.166649103 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:35:36.828182936 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:35:36.950208902 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:35:46.172193050 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:35:46.275898933 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:35:46.972084999 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:35:47.094021082 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:35:56.283968925 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:35:56.387717009 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:35:57.116003036 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:35:57.237695932 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:36:06.396063089 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:36:06.501442909 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:36:07.259887934 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:36:07.383241892 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:36:16.508125067 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:36:16.612134933 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:36:17.404148102 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:36:17.526190996 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:36:26.619807005 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:36:26.723597050 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:36:27.547785997 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:36:27.669780016 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:36:36.731858969 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:36:36.835758924 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:36:37.691777945 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:36:37.813720942 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:36:41.124919891 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:36:41.228888988 CEST	80	40096	18.160.64.187	192.168.2.20
Apr 17, 2024 08:36:41.229013920 CEST	40096	80	192.168.2.20	18.160.64.187
Apr 17, 2024 08:36:42.125274897 CEST	38238	80	192.168.2.20	142.250.217.164
Apr 17, 2024 08:36:42.247329950 CEST	80	38238	142.250.217.164	192.168.2.20
Apr 17, 2024 08:36:42.247566938 CEST	38238	80	192.168.2.20	142.250.217.164

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 17, 2024 08:34:43.685619116 CEST	60046	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:34:43.685619116 CEST	60046	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:34:43.813740969 CEST	53	60046	8.8.8.8	192.168.2.20
Apr 17, 2024 08:34:43.822966099 CEST	53	60046	8.8.8.8	192.168.2.20
Apr 17, 2024 08:34:45.266573906 CEST	34902	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:34:45.266573906 CEST	34902	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:34:45.374310970 CEST	53	34902	8.8.8.8	192.168.2.20
Apr 17, 2024 08:34:45.374342918 CEST	53	34902	8.8.8.8	192.168.2.20
Apr 17, 2024 08:34:45.547255993 CEST	34273	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:34:45.547255993 CEST	34273	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:34:45.651757956 CEST	53	34273	8.8.8.8	192.168.2.20
Apr 17, 2024 08:34:45.651885986 CEST	53	34273	8.8.8.8	192.168.2.20
Apr 17, 2024 08:34:46.325314999 CEST	48821	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:34:46.325315952 CEST	48821	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:34:46.431735992 CEST	53	48821	8.8.8.8	192.168.2.20
Apr 17, 2024 08:34:46.431752920 CEST	53	48821	8.8.8.8	192.168.2.20
Apr 17, 2024 08:35:04.021411896 CEST	47428	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:35:04.021411896 CEST	47428	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:35:04.125802040 CEST	53	47428	8.8.8.8	192.168.2.20
Apr 17, 2024 08:35:04.150892973 CEST	38680	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:35:04.150892973 CEST	38680	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:35:04.255369902 CEST	53	38680	8.8.8.8	192.168.2.20
Apr 17, 2024 08:35:09.759329081 CEST	41565	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:35:09.759330034 CEST	41565	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:35:09.760514021 CEST	44844	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:35:09.864120007 CEST	53	41565	8.8.8.8	192.168.2.20
Apr 17, 2024 08:35:20.375519991 CEST	50019	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:35:20.375520945 CEST	50019	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:35:20.377213001 CEST	51115	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:35:20.482378006 CEST	53	50019	8.8.8.8	192.168.2.20
Apr 17, 2024 08:35:40.982120991 CEST	47058	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:35:40.982120991 CEST	47058	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:35:40.984823942 CEST	45176	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:35:41.086678982 CEST	53	47058	8.8.8.8	192.168.2.20
Apr 17, 2024 08:36:21.594192982 CEST	49510	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:36:21.594192982 CEST	49510	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:36:21.594893932 CEST	49936	53	192.168.2.20	8.8.8.8
Apr 17, 2024 08:36:21.699465990 CEST	53	49510	8.8.8.8	192.168.2.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 17, 2024 08:34:43.685619116 CEST	192.168.2.20	8.8.8.8	0x564d	Standard query (0)	selfservicegeneraligroup.com	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:34:43.685619116 CEST	192.168.2.20	8.8.8.8	0x2091	Standard query (0)	selfservicegeneraligroup.com	28	IN (0x0001)	false
Apr 17, 2024 08:34:45.266573906 CEST	192.168.2.20	8.8.8.8	0x51e3	Standard query (0)	d38psrni17bvxu.cloudfront.net	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:34:45.266573906 CEST	192.168.2.20	8.8.8.8	0xde47	Standard query (0)	d38psrni17bvxu.cloudfront.net	28	IN (0x0001)	false
Apr 17, 2024 08:34:45.547255993 CEST	192.168.2.20	8.8.8.8	0xd92b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:34:45.547255993 CEST	192.168.2.20	8.8.8.8	0xac50	Standard query (0)	www.google.com	28	IN (0x0001)	false
Apr 17, 2024 08:34:46.325314999 CEST	192.168.2.20	8.8.8.8	0x6daa	Standard query (0)	www.adsensecustomsearchads.com	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:34:46.325315952 CEST	192.168.2.20	8.8.8.8	0x6e11	Standard query (0)	www.adsensecustomsearchads.com	28	IN (0x0001)	false
Apr 17, 2024 08:35:04.021411896 CEST	192.168.2.20	8.8.8.8	0xe21a	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:35:04.021411896 CEST	192.168.2.20	8.8.8.8	0xfe4f	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Apr 17, 2024 08:35:04.150892973 CEST	192.168.2.20	8.8.8.8	0xa5ed	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:35:04.150892973 CEST	192.168.2.20	8.8.8.8	0xec0d	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Apr 17, 2024 08:35:09.759329081 CEST	192.168.2.20	8.8.8.8	0x5097	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:35:09.759330034 CEST	192.168.2.20	8.8.8.8	0xd63d	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Apr 17, 2024 08:35:09.760514021 CEST	192.168.2.20	8.8.8.8	0xfdaa	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:35:20.375519991 CEST	192.168.2.20	8.8.8.8	0xb749	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:35:20.375520945 CEST	192.168.2.20	8.8.8.8	0x9076	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Apr 17, 2024 08:35:20.377213001 CEST	192.168.2.20	8.8.8.8	0x77d0	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:35:40.982120991 CEST	192.168.2.20	8.8.8.8	0xb3d	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:35:40.982120991 CEST	192.168.2.20	8.8.8.8	0xbfc8	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Apr 17, 2024 08:35:40.984823942 CEST	192.168.2.20	8.8.8.8	0x4b55	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:36:21.594192982 CEST	192.168.2.20	8.8.8.8	0xfbc2	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:36:21.594192982 CEST	192.168.2.20	8.8.8.8	0x3be2	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Apr 17, 2024 08:36:21.594893932 CEST	192.168.2.20	8.8.8.8	0xfe15	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 17, 2024 08:34:43.822966099 CEST	8.8.8.8	192.168.2.20	0x564d	No error (0)	selfservicegeneraligroup.com		104.247.82.170	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:34:45.374310970 CEST	8.8.8.8	192.168.2.20	0x51e3	No error (0)	d38psrni17bvxu.cloudfront.net		18.160.64.187	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:34:45.374310970 CEST	8.8.8.8	192.168.2.20	0x51e3	No error (0)	d38psrni17bvxu.cloudfront.net		18.160.64.182	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:34:45.374310970 CEST	8.8.8.8	192.168.2.20	0x51e3	No error (0)	d38psrni17bvxu.cloudfront.net		18.160.64.71	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:34:45.374310970 CEST	8.8.8.8	192.168.2.20	0x51e3	No error (0)	d38psrni17bvxu.cloudfront.net		18.160.64.11	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:34:45.374342918 CEST	8.8.8.8	192.168.2.20	0xde47	No error (0)	d38psrni17bvxu.cloudfront.net			28	IN (0x0001)	false
Apr 17, 2024 08:34:45.374342918 CEST	8.8.8.8	192.168.2.20	0xde47	No error (0)	d38psrni17bvxu.cloudfront.net			28	IN (0x0001)	false
Apr 17, 2024 08:34:45.374342918 CEST	8.8.8.8	192.168.2.20	0xde47	No error (0)	d38psrni17bvxu.cloudfront.net			28	IN (0x0001)	false
Apr 17, 2024 08:34:45.374342918 CEST	8.8.8.8	192.168.2.20	0xde47	No error (0)	d38psrni17bvxu.cloudfront.net			28	IN (0x0001)	false
Apr 17, 2024 08:34:45.374342918 CEST	8.8.8.8	192.168.2.20	0xde47	No error (0)	d38psrni17bvxu.cloudfront.net			28	IN (0x0001)	false
Apr 17, 2024 08:34:45.374342918 CEST	8.8.8.8	192.168.2.20	0xde47	No error (0)	d38psrni17bvxu.cloudfront.net			28	IN (0x0001)	false
Apr 17, 2024 08:34:45.374342918 CEST	8.8.8.8	192.168.2.20	0xde47	No error (0)	d38psrni17bvxu.cloudfront.net			28	IN (0x0001)	false
Apr 17, 2024 08:34:45.374342918 CEST	8.8.8.8	192.168.2.20	0xde47	No error (0)	d38psrni17bvxu.cloudfront.net			28	IN (0x0001)	false
Apr 17, 2024 08:34:45.520551920 CEST	8.8.8.8	192.168.2.20	0x2344	No error (0)	d228z91au11ukj.cloudfront.net		3.163.115.26	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:34:45.520551920 CEST	8.8.8.8	192.168.2.20	0x2344	No error (0)	d228z91au11ukj.cloudfront.net		3.163.115.80	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:34:45.520551920 CEST	8.8.8.8	192.168.2.20	0x2344	No error (0)	d228z91au11ukj.cloudfront.net		3.163.115.82	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:34:45.520551920 CEST	8.8.8.8	192.168.2.20	0x2344	No error (0)	d228z91au11ukj.cloudfront.net		3.163.115.8	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:34:45.651757956 CEST	8.8.8.8	192.168.2.20	0xac50	No error (0)	www.google.com			28	IN (0x0001)	false
Apr 17, 2024 08:34:45.651885986 CEST	8.8.8.8	192.168.2.20	0xd92b	No error (0)	www.google.com		142.250.217.164	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:34:46.431735992 CEST	8.8.8.8	192.168.2.20	0x6e11	No error (0)	www.adsensecustomsearchads.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:34:46.431735992 CEST	8.8.8.8	192.168.2.20	0x6e11	No error (0)	www3.l.google.com			28	IN (0x0001)	false
Apr 17, 2024 08:34:46.431752920 CEST	8.8.8.8	192.168.2.20	0x6daa	No error (0)	www.adsensecustomsearchads.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:34:46.431752920 CEST	8.8.8.8	192.168.2.20	0x6daa	No error (0)	www3.l.google.com		142.250.217.174	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:35:04.123548985 CEST	8.8.8.8	192.168.2.20	0xc150	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:35:04.123548985 CEST	8.8.8.8	192.168.2.20	0xc150	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Apr 17, 2024 08:35:04.123774052 CEST	8.8.8.8	192.168.2.20	0x84dc	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:35:04.125802040 CEST	8.8.8.8	192.168.2.20	0xfe4f	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:35:04.125817060 CEST	8.8.8.8	192.168.2.20	0xe21a	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:35:04.255084038 CEST	8.8.8.8	192.168.2.20	0xa5ed	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:35:04.255369902 CEST	8.8.8.8	192.168.2.20	0xec0d	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:35:04.943914890 CEST	8.8.8.8	192.168.2.20	0xaa36	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:35:04.943914890 CEST	8.8.8.8	192.168.2.20	0xaa36	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:35:04.969316959 CEST	8.8.8.8	192.168.2.20	0xde3b	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:35:04.969316959 CEST	8.8.8.8	192.168.2.20	0xde3b	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:35:09.864120007 CEST	8.8.8.8	192.168.2.20	0xd63d	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:35:09.864181042 CEST	8.8.8.8	192.168.2.20	0x5097	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:35:09.864862919 CEST	8.8.8.8	192.168.2.20	0xfdaa	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:35:20.480036020 CEST	8.8.8.8	192.168.2.20	0xb749	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:35:20.481559992 CEST	8.8.8.8	192.168.2.20	0x77d0	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:35:20.482378006 CEST	8.8.8.8	192.168.2.20	0x9076	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:35:41.086472034 CEST	8.8.8.8	192.168.2.20	0xb3d	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:35:41.086678982 CEST	8.8.8.8	192.168.2.20	0xbfc8	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:35:41.089035988 CEST	8.8.8.8	192.168.2.20	0x4b55	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:36:21.699110985 CEST	8.8.8.8	192.168.2.20	0xfbc2	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:36:21.699465990 CEST	8.8.8.8	192.168.2.20	0x3be2	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 08:36:21.699481010 CEST	8.8.8.8	192.168.2.20	0xfe15	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

snippets.cdn.mozilla.net

selfservicegeneraligroup.com

www.adsensecustomsearchads.com

www.google.com

d38psrni17bvxu.cloudfront.net

https:

aus5.mozilla.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.20	56228	104.247.82.170	80

Timestamp	Bytes transferred	Direction	Data
Apr 17, 2024 08:34:44.551054955 CEST	336	OUT	GET / HTTP/1.1 Host: selfservicegeneraligroup.com User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1
Apr 17, 2024 08:34:44.811718941 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 17 Apr 2024 06:34:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_gDM0lS5C7t1LlVsu3Tx48daCiJoFIVdhQCRD22FuDh/R7JwtdI1+6VC7mSoXa/Y+ggzxQy1Vf9ai2BaNysmKDw== Accept-CH: viewport-width Accept-CH: dpr Accept-CH: device-memory Accept-CH: rtt Accept-CH: downlink Accept-CH: ect Accept-CH: ua Accept-CH: ua-full-version Accept-CH: ua-platform Accept-CH: ua-platform-version Accept-CH: ua-arch Accept-CH: ua-model Accept-CH: ua-mobile Accept-CH-Lifetime: 30 X-Domain: selfservicegeneraligroup.com X-Subdomain: Content-Encoding: gzip Data Raw: 31 38 34 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 5b e9 76 e2 c8 92 fe 7d fd 14 59 f4 b9 05 9e 62 91 00 af 98 aa 01 e3 05 77 01 5e f0 02 75 6a ea 08 29 01 81 16 5a 12 66 e9 eb 73 e6 79 e6 b1 e6 49 e6 8b d4 82 c0 b8 ba eb 4e d7 9d 3f e3 ee 02 29 97 88 c8 c8 88 c8 58 92 93 77 b5 d6 69 bb 73 7d c6 86 9e 69 7c dc 39 a1 2f a6 29 9e 92 51 b4 9e 61 ab e3 31 5f 94 13 8d f3 d9 ac 76 d3 b9 fa d5 ee d6 87 cf 6a b3 72 73 56 ad de 54 6a 77 b3 ca ec ae 72 55 ad 7c fe 6d 5a 3b 3f 6b 3f dd 5a d2 a5 23 ed f5 ef af 0f ce ae da 07 07 f3 8e 75 6d de f6 26 8d 45 f1 79 7c f8 6b 47 bf b4 c6 cd 09 d7 ac 51 ab d2 bc 52 95 a7 da 93 fa eb cd 55 53 b2 9e 7e ed 5e 7d 3e 68 ab fa 55 ed b0 62 5f 3e fd 2a ef 1d 9e 56 66 67 95 ca 4d b9 fc 6d 50 6b 48 c6 dd de e9 81 27 7f 36 1e dc 69 a1 3d 2f 1e 6a ca a9 7e 65 9f d7 1f b4 e1 cd e9 6d 2d 9f 3f 9f d6 86 b9 db 83 ab 99 a7 d5 e5 0f fb 0f a7 07 e6 9d fd a4 e4 3a 1f 06 83 e5 fc 66 21 3f f4 8f 14 3d 5f 55 9a 0b d7 fc b5 36 2b 97 13 6c 6e 1a 96 5b 4e 0c 3d 6f 72 9c cb cd 66 b3 ec ac 90 b5 9d 41 4e 3e 3a 3a ca cd 89 1f 09 66 28 d6 a0 9c e0 56 82 38 c4 15 ed e3 0e c3 df 89 c9 3d 05 8c f3 26 19 fe db 54 7f 2e 27 4e 6d cb e3 96 97 69 2f 26 3c c1 54 ff ad 9c f0 f8 dc cb 11 a4 12 53 87 8a e3 72 af 3c f5 fa 99 c3 44 2e 0e c8 52 4c 5e 4e 3c eb 7c 36 b1 1d 2f 36 7d a6 6b de b0 ac f1 67 5d e5 19 f1 92 66 ba a5 7b ba 62 64 5c 55 31 78 59 4e 33 77 e8 e8 d6 38 e3 d9 99 be ee 95 2d 3b 82 ed e9 9e c1 3f ba dc e8 bb dc 21 10 03 Data Ascii: 1840[v}Ybw^uj)ZfsyIN?)Xwis}i\|9/)Qa1_vjrsVTjwrU\|mZ;?k?Z#um&Ey\|kGQRUS~^}>hUb_>*VfgMmPkH'6i=/j~em-?:f!?=_U6+ln[N=orfAN>::f(V8=&T.'Nmi/&<TSr<D.RL^N<\|6/6}kg]f{bd\U1xYN3w8-;?!
Apr 17, 2024 08:34:44.811739922 CEST	1289	IN	Data Raw: 6e 71 47 31 f4 81 63 4f 27 59 d5 36 4f 72 fe 18 7f 51 ae b7 30 38 33 b9 a6 2b e5 84 ab 3a 5c 2c 3b ab b8 20 fb 9b eb 29 8e c4 7e df f9 5b 4f 51 c7 04 c0 d2 8e d9 d4 31 52 c9 5c 4e 2b 1c 4e 5c c7 d2 e5 83 de f3 7c 9a 55 0d 7b aa f5 1d f0 20 6b 71 Data Ascii: nqG1cO'Y6OrQ083+:\,; )~[OQ1R\N+N\\|U{ kq/@'weg>T;E30mk^j;11x`1-""I_D_O{Etkqmm vC*z]gi[z3w+?sMj;b[C&
Apr 17, 2024 08:34:44.811753035 CEST	1289	IN	Data Raw: 57 2e 6f 25 b5 66 3f 7f 2e 68 05 6d b1 57 68 2c f6 9e 55 53 7d 6e 8c 2a b3 c6 e9 d1 52 33 55 bd 7e 31 34 94 47 cd d6 6a 92 de 18 dd e8 f5 cb ee a4 fb a4 9d f6 0a 83 a3 fa a8 32 68 9c 56 16 4d f1 af 3e d0 f2 c6 58 bb a0 f6 ba 54 1f 15 0f d5 8b 73 Data Ascii: W.o%f?.hmWh,US}n*R3U~14Gj2hVM>XTsI97SjuIC]:Q?\_V?W}?miqHze0g^sQ,N+A1hWF@Y-tA\|DJ?Rl{pqXt}BE,;?Ffwv)O]57E+-
Apr 17, 2024 08:34:44.811765909 CEST	1289	IN	Data Raw: 3f 97 bb 67 da 23 7f bc f2 1e 46 d5 e6 ed f9 95 d9 6e 37 e1 22 ce c1 a8 2b 13 0c 9d 03 b7 d9 78 3c 5b 74 f2 b7 7a ab fd 30 ea 8e d4 7c f7 a2 91 6f 2e 1b 73 ac 6f dc 1c 35 8d ee e3 bd dc cc 5f 8d fb 01 2e 81 cf 7f 7e 82 7b 77 84 f5 cf fb e7 d8 ec Data Ascii: ?g#Fn7"+x<[tz0\|o.so5_.~{w5E/somhN5Gylqtq;tktI5Tsji)\|Mr{UZAfSWNPO>r9\|D*{l'PlI+r
Apr 17, 2024 08:34:44.811779022 CEST	1289	IN	Data Raw: 71 f2 fc f9 61 da d5 f2 84 e5 8b f1 d2 c2 d6 b8 0e 2e 49 f1 d9 36 83 b3 de 1d 98 0e f0 fb e7 a9 45 0c e3 3f 63 16 42 69 56 28 72 de b6 a2 b0 23 5a 0b d9 8d 20 d2 fe a9 0b 13 88 7f 74 49 2b d7 e1 f5 c2 84 a3 19 b3 fe ab 95 89 1e 08 1e 96 f6 af 58 Data Ascii: qa.I6E?cBiV(r#Z tI+X{H7X@L8'=}Jmqj%!7;Hru.k/lj8}9faQu?#ab_D5,eF\|*ADtj'l] Fad9dNpor
Apr 17, 2024 08:34:44.811790943 CEST	578	IN	Data Raw: bf e6 f8 ae 1c d0 cd 4a 4b 58 54 58 cd 08 5b 28 1e f8 a1 bb 10 86 28 57 86 55 b0 f9 d0 c1 59 82 7a 6d 1a b5 df 31 b7 80 40 dc b2 40 3b 36 18 2e a8 86 0b 84 70 03 e9 64 1a 50 55 6b 6d b3 a3 5b 46 24 d1 34 45 4c b8 a3 09 22 63 b4 1e ba 64 6b ad e6 Data Ascii: JKXTX[((WUYzm1@@;6.pdPUkm[F$4EL"cdkY g[\xRFp+(~,Z&DIgl}duA*V63K\=g3H_2S}Y5(>+ct<gF8q{}
Apr 17, 2024 08:34:44.811804056 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Apr 17, 2024 08:34:45.304807901 CEST	492	OUT	GET /track.php?domain=selfservicegeneraligroup.com&toggle=browserjs&uid=MTcxMzMzNTY4NC42Mzg2OjVmMjExNDhkOTQ3ODAyM2UyODBlYzE0YWFmNmIyNDhlOTQ5YWEzMTNiYmM4MzYzM2IxMjg1OThkYzlmNTBmOTg6NjYxZjZkODQ5YmU5Yg%3D%3D HTTP/1.1 Host: selfservicegeneraligroup.com User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://selfservicegeneraligroup.com/ Connection: keep-alive
Apr 17, 2024 08:34:45.468542099 CEST	608	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 17 Apr 2024 06:34:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Custom-Track: browserjs Accept-CH: viewport-width Accept-CH: dpr Accept-CH: device-memory Accept-CH: rtt Accept-CH: downlink Accept-CH: ect Accept-CH: ua Accept-CH: ua-full-version Accept-CH: ua-platform Accept-CH: ua-platform-version Accept-CH: ua-arch Accept-CH: ua-model Accept-CH: ua-mobile Accept-CH-Lifetime: 30 Access-Control-Allow-Origin: * Content-Encoding: gzip Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 04 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 140
Apr 17, 2024 08:34:45.549747944 CEST	357	OUT	GET /ls.php?t=661f6d84&token=10021f01e7cae7e812aa3877ca8fac12fac0f1d8 HTTP/1.1 Host: selfservicegeneraligroup.com User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://selfservicegeneraligroup.com/ Connection: keep-alive
Apr 17, 2024 08:34:45.712116003 CEST	865	IN	HTTP/1.1 201 Created Server: nginx Date: Wed, 17 Apr 2024 06:34:45 GMT Content-Type: text/javascript;charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Accept-CH: viewport-width Accept-CH: dpr Accept-CH: device-memory Accept-CH: rtt Accept-CH: downlink Accept-CH: ect Accept-CH: ua Accept-CH: ua-full-version Accept-CH: ua-platform Accept-CH: ua-platform-version Accept-CH: ua-arch Accept-CH: ua-model Accept-CH: ua-mobile Accept-CH-Lifetime: 30 Charset: utf-8 Access-Control-Allow-Origin: Access-Control-Allow-Methods: POST, OPTIONS Access-Control-Max-Age: 86400 X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_VCdnHgmpAzay/uwnXrphv8iHFwoWyD4KmzHqXFTgkiFyZ2UUr3YvOgRiFjjsZdMclLzkqpPl2Yo9LmNcDrAs/w== Data Raw: 31 30 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 10{"success":true}0
Apr 17, 2024 08:34:45.910315037 CEST	268	OUT	GET /favicon.ico HTTP/1.1 Host: selfservicegeneraligroup.com User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive
Apr 17, 2024 08:34:46.065947056 CEST	230	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 17 Apr 2024 06:34:45 GMT Content-Type: image/x-icon Content-Length: 0 Last-Modified: Thu, 30 Nov 2023 13:41:22 GMT Connection: keep-alive ETag: "65689102-0" Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.20	40096	18.160.64.187	80

Timestamp	Bytes transferred	Direction	Data
Apr 17, 2024 08:34:45.484407902 CEST	368	OUT	GET /themes/cleanPeppermintBlack_657d9013/img/arrows.png HTTP/1.1 Host: d38psrni17bvxu.cloudfront.net User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://selfservicegeneraligroup.com/ Connection: keep-alive
Apr 17, 2024 08:34:45.588619947 CEST	454	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 11375 Connection: keep-alive Server: nginx Date: Tue, 16 Apr 2024 20:00:17 GMT Last-Modified: Thu, 21 Mar 2024 11:48:11 GMT Accept-Ranges: bytes ETag: "65fc1e7b-2c6f" X-Cache: Hit from cloudfront Via: 1.1 25c2d012c44ba6cb533e8b1ea03e42da.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P1 X-Amz-Cf-Id: nfH04n9lSucOWyDjL7osH_8lNt2TDnpIKUNydKKfoF669P95qs3cZQ== Age: 38068
Apr 17, 2024 08:34:45.588835955 CEST	1289	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 dc 00 00 02 58 08 03 00 00 00 4f 6d d4 16 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 00 50 4c 54 45 00 00 00 ff Data Ascii: PNGIHDRXOmtEXtSoftwareAdobe ImageReadyqe<PLTEcdtIK^IK]IK\03IHK_acsceubdtcet0=@SHK]IL]HK\MPbNQbORc.0"&;(,@+/B04I.2F/3G-1D04H.2E04G15H26I59L8<P6:M9=Q7;N:>R:>Q;?R<@SIL\beuadtbetcftbes-0 5!6"7#8
Apr 17, 2024 08:34:45.588857889 CEST	1289	IN	Data Raw: de 89 88 54 d2 3e 0a 77 78 27 22 12 d9 08 bb 47 e2 0e ef 44 44 ea 68 af 83 3b bc 13 11 29 a3 bd 1e ee f0 4e 44 a4 8a f6 ba b8 c3 3b 11 91 22 da eb e3 0e ef 44 44 6a 68 6f 82 7b 27 7e 58 22 22 0d b4 37 c4 1d de 89 88 34 d0 de 18 77 78 27 22 92 4f Data Ascii: T>wx'"GDDh;)ND;"DDjho{'~X""74wx'"OND$v/H6;dqw""}+DD2io;ND$;@DDh;=ND$P;Q~GND$;DD"h;=<ND;Q"8wx'"
Apr 17, 2024 08:34:45.588875055 CEST	1289	IN	Data Raw: b2 5a d2 e2 9e 86 f6 64 b8 27 e2 1d dc 57 e3 c0 3b f1 dd 2e 10 f7 54 b4 27 c4 7d 7e fe e4 97 c1 1d dd 09 db 4b c6 3d 1d ed 49 71 4f c0 3b b8 a3 3b 61 bb 58 dc 53 d2 9e 18 f7 e8 bc 83 3b 87 66 a8 49 5c 5d 4a 88 7b 5a da 93 e3 1e 99 77 70 47 77 6a Data Ascii: Zd'W;.T'}~K=IqO;;aXS;fI\]J{ZwpGwj+$i{Tf="py[gwp2=p;W{1\|=#QxJ}q-5-q;Ww=wkVfwYqL{vU)~{v
Apr 17, 2024 08:34:45.588891029 CEST	1289	IN	Data Raw: 02 70 4f c5 fb dc 03 01 41 0e 89 7b 0a de 57 e6 0c 14 83 3b 07 de 49 6a 17 26 4b c2 3d 05 ef 41 69 0f 8d 7b 64 de 2f 0d a7 dd 24 ee 1c 89 24 99 59 5c 6b 13 c3 7d 89 cb 7b 60 da c3 e3 1e 91 f7 91 b4 1b c5 1d dd 09 db 45 e0 1e 93 f7 6f 3f 10 9c e2 Data Ascii: pOA{W;Ij&K=Ai{d/$$Y\k}{`Eo?GVqGwvq{-$OO{Kh{`knwn,G=vs$d_4c~7v;aCH{\v;$=*qoGLpo{d
Apr 17, 2024 08:34:45.588908911 CEST	1289	IN	Data Raw: 90 f6 e6 bc 0f a2 7d 08 ee 8d 4e 46 a6 a5 7d f0 73 4d 13 d8 4e 84 ee 41 71 4f 4c 7b b3 e7 9a 9e 79 7f b0 e0 43 70 af cd 7b 7a da 07 f1 6e 0b 77 e8 20 f9 59 c7 3d 03 ed b5 79 ef 3f 20 53 1f f7 0e ef df 7f 4b 26 ed 3d de ff c4 32 ee 5c 4b 25 15 5d Data Ascii: }NF}sMNAqOL{yCp{znw Y=y? SK&=2\K%]{&k7<NpH}yi\K%5]gF]>&O`;2\|;l'BK: W-q:X{k5'#
Apr 17, 2024 08:34:45.588924885 CEST	1289	IN	Data Raw: ba 13 b6 eb c7 7d 99 f7 ac b4 67 c6 bd c3 fb 37 1e 9a 9d 05 f7 35 7d 84 11 a4 b3 6d e0 be ae 7f fd c6 d7 f2 ea 9a 15 f7 f1 b3 fb f7 7f ed fe 87 c0 9d 0f 77 e2 d3 dd 16 ee cf df 3f be 7f ff d9 f1 42 71 ef d2 de 2d 20 ef da 71 7f 11 1f 48 73 2f 82 Data Ascii: }g75}mw?Bq- qHs/{{c;Wi@{8uv;#p_O{F=sNq=Naxv"t{5xwbhb}w=q?DxW;&n,aGw^b"}4ywhoVo'Sm+
Apr 17, 2024 08:34:45.588942051 CEST	1289	IN	Data Raw: bd b9 28 0a f7 d4 bc d7 a7 7d 24 ef ae ce 75 54 79 bc 57 d2 9e 19 77 74 27 52 6d 7b 35 ee 29 79 6f 46 fb 08 de 5d 30 da 13 f2 3e 80 f6 dc b8 a3 3b 91 66 db 07 e1 9e 8a f7 e6 b4 0f e5 dd 05 a4 bd c7 7b 46 da b3 e3 8e ee 44 ad ca bc 80 17 06 db 32 Data Ascii: (}$uTyWwt'Rm{5)yoF]0>;f{FD2.!'}qGw"=6=2Ci;}81yoG]p#>v;VGW">(R!=5h;w>RA=0hXD>ZJ
Apr 17, 2024 08:34:45.588959932 CEST	1289	IN	Data Raw: 7d 01 db 89 d0 3d 0c ee d9 68 0f c4 bb 53 4c 7b 3f ef 99 70 67 9c 0c 91 05 dd 17 a4 d0 1e 84 77 a7 9a f6 8d bc 2f 60 3b 91 85 0e 64 c6 3d 3b ed 01 78 77 ca 69 5f cf 7b 16 dc 19 27 43 14 bc df e6 c4 5d 04 ed ad 79 77 ea 69 5f cb fb 02 b6 13 d9 e8 Data Ascii: }=hSL{?pgw/`;d=;xwi_{'C]ywi_7pC{KWy;#IEwg+/`;.^O&]"v"tBmk,+"Mf?1T<xwh\|4agGSpGwlqftP,JqGw
Apr 17, 2024 08:34:45.588978052 CEST	1171	IN	Data Raw: cc a7 51 33 e3 ce 4a 22 2a 42 f7 fc b8 87 e4 dd 85 a2 7d 4a 42 47 a0 9d 08 de 35 e3 1e 8e f7 20 b8 ff 83 0c da 63 e0 ce 38 19 22 a1 5d 36 8a 7b 28 de 03 e0 3e 23 e5 17 89 80 3b b6 13 95 a3 bb 1c ca 42 f0 ee 0c d1 1e 1e 77 46 0e 10 09 ee 31 b3 b8 Data Ascii: Q3J"*B}JBG5 c8"]6{(>#;BwF1=8NT8{b&#h;8f2.rgv;Cz7{Aqg?!qvvf3OMCTG3D{@Y/D~D0nyokh'wNO}?

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.20	38238	142.250.217.164	80

Timestamp	Bytes transferred	Direction	Data
Apr 17, 2024 08:34:45.782150030 CEST	319	OUT	GET /adsense/domains/caf.js?abp=1 HTTP/1.1 Host: www.google.com User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://selfservicegeneraligroup.com/ Connection: keep-alive
Apr 17, 2024 08:34:45.919459105 CEST	1289	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="ads-afs-ui" Report-To: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]} Date: Wed, 17 Apr 2024 06:34:45 GMT Expires: Wed, 17 Apr 2024 06:34:45 GMT Cache-Control: private, max-age=3600 ETag: "5826238003958730145" X-Content-Type-Options: nosniff Link: <https://www.adsensecustomsearchads.com>; rel="preconnect" Content-Encoding: gzip Transfer-Encoding: chunked Server: sffe X-XSS-Protection: 0 Data Raw: 31 37 62 31 0d 0a 1f 8b 08 00 00 00 00 00 02 ff a4 3b 6b 77 9b 38 d3 df f3 2b 1c 76 8f 0b 35 71 ed a4 97 0d 84 fa b4 69 da 66 9b 26 dd 5c da ee 7a bd 39 12 08 4c 6d 83 0b 38 97 4d f8 ef ef 8c 2e 20 1c a7 9b be 4f 4f 4f 10 42 1a cd 7d 46 23 39 0e cd f5 cb 38 09 d2 cb e1 a3 28 4d a3 29 3b 7c 73 7a fe 68 64 dd ac ea f5 cc 84 5d b6 de 90 82 99 96 d5 8d 58 71 1a cf a0 e9 96 66 b8 48 fc 22 4e 13 d3 6a c9 99 5d 31 f1 d5 b4 38 48 49 c0 32 6f cb bd 20 59 2b 0f 43 06 00 c8 b9 77 93 b3 ec 22 f6 d9 f9 38 cd 0b c7 b8 bc 54 53 ba 7e 3a 33 ec 31 c9 c7 8e d1 ef bd d8 7a ba f5 db f6 6f 4f 5f 6c bd d8 7c d6 db 7e be fd 9b 61 cf 89 3f 21 11 cb 1d 23 48 67 24 4e 72 c3 9e a5 c1 62 ca 1c 83 04 f0 72 c1 b2 1c 90 81 e9 f0 c1 b9 f1 59 0c cd 17 5b 3d f8 b7 69 63 a3 ff 74 eb 85 6a 6c cb c6 53 f5 e9 a9 fa f4 1b 4c 27 63 a7 c8 16 cc 5e 90 62 e6 3c eb f5 6c e6 87 fe a6 e8 9b 4e b3 99 d3 07 a0 d0 0a a6 8e 41 4f 9e fd fb d7 97 b7 d7 fe f5 b3 6f 74 b3 e7 c1 6c 1a 3a 37 c6 79 10 e7 84 02 2f 82 63 f6 7d c1 f2 e2 6d 9a 1d b2 cb dd 34 c9 59 52 9c 14 19 30 34 ba 36 04 50 e3 9c 25 38 f8 07 03 c2 f8 6a b7 f0 0f e2 64 92 1f 25 fb 69 5e 7d 40 fe ed f1 d9 7f 2c e6 55 6f 7e 19 17 fe f8 dd 65 2e 57 3f 4d cf 72 c0 05 40 e7 ec 0d e7 5f 35 74 91 b3 13 90 0a cb 3e 65 e9 45 1c b0 60 e9 fb 25 89 8b a3 44 e2 05 54 bc 8d b3 bc f8 44 b2 e2 7a 37 4d 27 31 53 03 05 09 7b c9 98 24 3e 0b 4e 49 06 ba 12 27 d1 71 9e 26 7e 73 cc 61 9a d0 69 ea 4f e0 eb Data Ascii: 17b1;kw8+v5qif&\z9Lm8M. OOOB}F#98(M);\|szhd]XqfH"Nj]18HI2o Y+Cw"8TS~:31zoO_l\|~a?!#Hg$NrbrY[=ictjlSL'c^b<lNAOotl:7y/c}m4YR046P%8jd%i^}@,Uo~e.W?Mr@_5t>eE`%DTDz7M'1S{$>NI'q&~saiO
Apr 17, 2024 08:34:45.919487000 CEST	1289	IN	Data Raw: 09 c9 75 28 a5 3d 0b e6 4e ff 37 94 5a cf ce 73 e4 f0 9f 5f 5f 5f fa 5b af 2f 82 5d ce e1 fc cf d9 d5 c5 5f 5b 87 97 74 eb 8f c5 9f 9b db c5 c1 bb df af 0f 66 87 17 f4 e4 ea 1b bd 96 63 36 af 2e 82 2f c7 33 7f b6 bd 80 79 8b bf be fe 91 ff f5 f5 Data Ascii: u(=N7Zs___[/]_[tfc6./3yL_/f]_i,0`\M?b5@B2@o>seb;s3V,U;;eIT7A0go_9dH;Q^YP`+,[Gn8a 9UN
Apr 17, 2024 08:34:45.919506073 CEST	1289	IN	Data Raw: dc 47 bc 7a 65 a1 8b e1 84 78 ba 4d 28 34 31 ed 6b 8c fb ba 62 1c e0 78 73 06 59 ad fd 3d 44 05 ae 88 92 a4 dc de 4a da e0 8b 0e 4a 28 d3 6a 70 e2 1b fa dd 06 30 84 51 7b 4d 52 4d d9 f5 90 05 05 11 a3 df 86 80 f7 e5 0f a8 bb 10 de bf bb cb 3d a3 Data Ascii: GzexM(41kbxsY=DJJ(jp0Q{MRM=hiE#6VD&].'Q$S?T]*}+>U!Hgy34dSn`7D_mJ("LZm22/ESI=xU<e<Tf
Apr 17, 2024 08:34:45.919523001 CEST	1289	IN	Data Raw: 4c 6a 2c 82 0e 69 69 99 ba dc 67 66 76 a1 42 ca 0a cf 94 d5 45 9a 85 d8 f8 4c cd 0c 9a 6a e1 0b eb 26 81 3f 65 e9 14 3c da 4c ed c4 9e 7b 4b 19 08 5f 62 ea 65 2e 08 b4 94 0c 06 ee 80 34 ed a9 65 4f 44 b4 52 32 9e 37 91 e7 cb 34 38 ad 17 b8 79 e6 Data Ascii: Lj,iigfvBELj&?e<L{K_be.4eODR2748y(seFuT[72L)X7EBMgT1 eqo_DSZFM-U=Fxqg"R>G\|Y\%o*qw=5D0_,48@p2iaI
Apr 17, 2024 08:34:45.919540882 CEST	1289	IN	Data Raw: a6 f9 22 63 ad 83 98 66 24 bb 6e bd 5a 14 e3 34 cb bb 6b ad 93 4f 6f be 6e 1c c4 3e de 93 dd d8 0f 20 49 8d c3 98 65 4e eb d5 9c f8 63 b6 b1 d9 ed ad 3d 7e b2 86 78 5e 71 e3 bf bd c5 4a 6a 9d c5 bc d3 6e 7c aa eb 33 2e f5 54 9d 14 22 dc 80 3a 64 Data Ascii: "cf$nZ4kOon> IeNc=~x^qJjn\|3.T":d 3I&__n{I>xV%*6O/Hwn;W8dK{-%$eMw\|w6a~4Kcl%Vs%Q4\|\|~?,
Apr 17, 2024 08:34:45.919559002 CEST	505	IN	Data Raw: cb 10 d8 30 f2 c6 d5 01 8a 6e d6 6f 34 b3 ae 34 00 4b 6d 3b 0d 94 85 77 a4 96 2d 7e 6a 45 f9 2f ac d0 83 8a df 57 55 7b 69 d1 18 8e b4 15 f6 b4 15 f8 45 b8 9e 5e 0f 23 78 fd 0d d1 0b 6a 3f a2 95 bc eb 60 7e 88 c1 fc ed cf b8 af c3 40 8b d3 1a d0 Data Ascii: 0no44Km;w-~jE/WU{iE^#xj?`~@w5d>(vG'g{o^;1F~@w~T>F@Tl>#!7^b>Rg_}XgW\V+WGe"&BQmL:'
Apr 17, 2024 08:34:45.920181036 CEST	1289	IN	Data Raw: 31 36 30 62 0d 0a a4 3d 5b 7b db 38 ae ef fd 15 b1 76 4f 57 aa 15 27 6e 67 66 67 ec b2 fe 12 e7 da e6 76 e2 34 97 49 bc fd 24 52 72 dc fa 16 5f 92 b8 4d fe fb 01 c0 ab 64 39 d3 39 fb 92 88 14 09 52 20 08 02 20 00 a7 d8 f8 6e 36 2c 84 fd af 05 d8 Data Ascii: 160b=[{8vOW'ngfgv4I$Rr_Md99R n6,lwFlW0b"%9'<;]IAJUnG9#e3/mDd\oh]&.7+oh1VM+2hXk(hy+b0Y5x'1>+_$Nf
Apr 17, 2024 08:34:45.920201063 CEST	1289	IN	Data Raw: d1 3e 2f 0b 91 88 61 58 5c e1 74 6a ab e6 58 35 1d 8e 6c cd 2d d6 dc 26 78 73 6e 2b 31 f5 51 e5 a1 2b 70 8f e9 ba 88 5a 72 07 fe 80 80 25 aa 22 89 1e 46 58 71 6a 2a c6 e3 7b ac d8 d4 15 7c 12 f5 22 ac f9 9e aa 9a 5e 0f 85 c2 4a bf d3 a8 d6 d6 55 Data Ascii: >/aX\tjX5l-&xsn+1Q+pZr%"FXqj{\|"^JU]7^!+!4~G+LYS?47yv$Xt'hrcBGHB9=XxhThjx6ymyUnAaQhj+=#EEm%`VS*
Apr 17, 2024 08:34:45.920217037 CEST	1289	IN	Data Raw: e2 f1 d1 bd 3e 31 aa da d9 82 a4 12 e1 39 77 86 89 51 f5 31 47 05 cc 1f 58 79 50 29 e6 54 40 e5 d3 13 af 1c cb 0e ea 44 63 11 2a 9a 11 d9 b7 ac 60 70 a4 8d e2 11 f6 51 52 4a 82 22 4a 60 8d 71 56 ca e2 20 47 69 29 8b 4b 29 cb 56 91 bf 0a 03 51 44 Data Ascii: >19wQ1GXyP)T@Dc*`pQRJ"J`qV Gi)K)VQDQ1BxD3n";R])Cf\i]n5z)XXktNCD}cAHP1v6Dqo &NR>\$-l:aN0Tk\9
Apr 17, 2024 08:34:45.920236111 CEST	1289	IN	Data Raw: b2 19 49 73 82 cd 44 63 86 ba 2e 3a 38 aa f9 11 02 ee 05 43 fc d6 8d 77 dc 3d 74 b8 17 1f 48 3c a6 9f c6 80 de a0 8d 4d 4c ba 88 7b 11 d8 94 39 50 3d 15 84 ec 07 c1 26 22 7c 14 08 c9 2e d3 eb d7 7a a0 b9 1a e8 51 b0 b9 68 cc 45 cd 08 e0 0f 02 25 Data Ascii: IsDc.:8Cw=tH<ML{9P=&"\|.zQhE%'rrhc`{,MY]kggm:@*C#o.!Ce2+BjXj(\|:/R]}+V\2>yd_\|YFd ]`\/EumL~<Q%ZT
Apr 17, 2024 08:34:46.041328907 CEST	1289	IN	Data Raw: 75 8e 37 5d e4 70 86 99 2b b5 07 23 f3 3c 2d 32 70 72 45 e3 b3 f1 98 7e 1f 19 40 36 b2 45 80 49 cb 19 20 e6 27 72 5a ea 01 5e 59 06 7a 24 19 a8 eb a8 0a f3 d8 44 01 1a 38 4c 93 c4 84 53 4c e4 ae 5d 56 0d 6f fc 81 a6 a9 da 7a 38 1d 8e e0 2f 99 a6 Data Ascii: u7]p+#<-2prE~@6EI 'rZ^Yz$D8LSL]Voz8/5czXh]goOz~JUT2%hiZc#H"-=JPGJP"K>.ywG!>/ZBk^JCVHtK3Ec

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.20	57378	3.163.115.26	443

Timestamp	Bytes transferred	Direction	Data
2024-04-17 06:34:45 UTC	397	OUT	GET /6/Firefox/66.0.3/20190410113011/Linux_x86_64-gcc3/en-US/release-cck-ubuntu/Linux%204.4.0-116-generic%20(GTK%203.18.9%2Clibpulse%208.0.0)/canonical/1.0/ HTTP/1.1 Host: snippets.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive
2024-04-17 06:34:46 UTC	567	IN	HTTP/1.1 303 See Other Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Cache-Control: public, max-age=86400 Date: Wed, 17 Apr 2024 06:34:46 GMT Location: https://snippets.cdn.mozilla.net/us-west/bundles-pregen/Firefox/en-us/default.json Server: meinheld/1.0.2 X-Backend-Server: frankfurt/snippets-prod/snippets-prod-676f79884-z9k2g X-Cache: Miss from cloudfront Via: 1.1 5cabc8d73bac46f75ce624c7173d34f2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P9 X-Amz-Cf-Id: pyvBb8OAgvcRirSrHVdi7txs_3wkDbUK-lL_M6By7r6lj8WujzwACw==

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.20	57386	3.163.115.26	443

Timestamp	Bytes transferred	Direction	Data
2024-04-17 06:34:46 UTC	295	OUT	GET /us-west/bundles-pregen/Firefox/en-us/default.json HTTP/1.1 Host: snippets.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive
2024-04-17 06:34:47 UTC	504	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 3 Connection: close Date: Wed, 17 Apr 2024 06:34:48 GMT Last-Modified: Wed, 30 Oct 2019 08:26:45 GMT ETag: "8a80554c91d9fca8acb82f023de02f11" Cache-Control: max-age=600 x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Error from cloudfront Via: 1.1 66f329715210d11f7f450b703957691a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P9 X-Amz-Cf-Id: o3mFLWIA3EMoZ-25fdBhUDUyw2nGbinoYJvJVgiXPX773UsdY0RD8Q==
2024-04-17 06:34:47 UTC	3	IN	Data Raw: 7b 7d 0a Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.20	45366	142.250.217.174	443

Timestamp	Bytes transferred	Direction	Data
2024-04-17 06:34:46 UTC	1634	OUT	GET /afs/ads?adtest=off&psid=1167268112&pcsa=false&channel=000002%2C000003%2C002843%2Cbucket003&client=dp-teaminternet04_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fselfservicegeneraligroup.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMDN8fHx8fHw2NjFmNmQ4NDliZTQ3fHx8MTcxMzMzNTY4NC43MjYxfGQzNmE5ZjgxODMwYTBiNmNhNDkwMWY4MjU0MzQzODUzNTIyYjUxN2J8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fFpIQXRkR1ZoYldsdWRHVnlibVYwTURSZk0zQm98ZDgyZjM2MWZiZjFhMmNkYjk1Y2Y3NmRjNjczMTAzZDYzZWVlNTdiZHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fDEwMDIxZjAxZTdjYWU3ZTgxMmFhMzg3N2NhOGZhYzEyZmFjMGYxZDh8MHxkcC10ZWFtaW50ZXJuZXQwNF8zcGh8MHwwfHw%253D&terms=Self%20Service%20Software%2C%E2%80%AASAP%20Netweaver%2COnline%20Registration%20Software%2CHelp%20Desk%20Ticket%20System%2COnboarding%20Software&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2105895058331848&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002%2C17301437%2C17301439%2C17301442%2C17301447%2C17301481&client_gdprApplies=0&format=r3%7Cs&nocache=6991713335685068&num=0&output=afd_ads&domain_name=selfservicegeneraligroup.com&v=3&bsl=8&pac=2&u_his=1&u_tz=120&dt=1713335685071&u_w=1024&u_h=768&biw=1009&bih=616&psw=1009&psh=760&frm=0&uio=--&cont=tc&drt=0&jsid=caf&jsv=623135625&rurl=http%3A%2F%2Fselfservicegeneraligroup.com%2F HTTP/1.1 Host: www.adsensecustomsearchads.com User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: http://selfservicegeneraligroup.com/ Connection: keep-alive Upgrade-Insecure-Requests: 1
2024-04-17 06:34:47 UTC	2450	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fadtest%3Doff%26psid%3D1167268112%26pcsa%3Dfalse%26channel%3D000002%252C000003%252C002843%252Cbucket003%26client%3Ddp-teaminternet04_3ph%26r%3Dm%26hl%3Den%26rpbu%3Dhttp%253A%252F%252Fselfservicegeneraligroup.com%252F%253Fts%253DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMDN8fHx8fHw2NjFmNmQ4NDliZTQ3fHx8MTcxMzMzNTY4NC43MjYxfGQzNmE5ZjgxODMwYTBiNmNhNDkwMWY4MjU0MzQzODUzNTIyYjUxN2J8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fFpIQXRkR1ZoYldsdWRHVnlibVYwTURSZk0zQm98ZDgyZjM2MWZiZjFhMmNkYjk1Y2Y3NmRjNjczMTAzZDYzZWVlNTdiZHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fDEwMDIxZjAxZTdjYWU3ZTgxMmFhMzg3N2NhOGZhYzEyZmFjMGYxZDh8MHxkcC10ZWFtaW50ZXJuZXQwNF8zcGh8MHwwfHw%25253D%26terms%3DSelf%2520Service%2520Software%252C%25E2%2580%25AASAP%2520Netweaver%252COnline%2520Registration%2520Software%252CHelp%2520Desk%2520Ticket%2520System%252COnboarding%2520Software%26max_radlink_len%3D40%26type%3D3%26uiopt%3Dtrue%26swp%3Das-drid-2105895058331848%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301437%252C17301439%252C17301442%252C17301447%252C17301481%26client_gdprApplies%3D0%26format%3Dr3%257Cs%26nocache%3D6991713335685068%26num%3D0%26output%3Dafd_ads%26domain_name%3Dselfservicegeneraligroup.com%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D120%26dt%3D1713335685071%26u_w%3D1024%26u_h%3D768%26biw%3D1009%26bih%3D616%26psw%3D1009%26psh%3D760%26frm%3D0%26uio%3D--%26cont%3Dtc%26drt%3D0%26jsid%3Dcaf%26jsv%3D623135625%26rurl%3Dhttp%253A%252F%252Fselfservicegeneraligroup.com%252F&hl=en&q=EgRRtTk0GIbb_bAGIjACT3pJr805dBCkFxpsUUbhs3ktDDg8TsCyOJ_pdYRyWxV3VGpU2xuczbiWeH2bz_IyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwIh9v9sAYQx4OMnAESBFG1OTQ Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-9Cv05t3W4XgNeS507imuuA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Date: Wed, 17 Apr 2024 06:34:47 GMT Server: gws Content-Length: 1907 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-17 06:34:47 UTC	1907	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 64 73 65 6e 73 65 63 75 73 74 6f 6d 73 65 61 72 63 68 61 64 73 2e 63 6f 6d 2f 61 66 73 2f Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.20	35052	142.250.217.164	443

Timestamp	Bytes transferred	Direction	Data
2024-04-17 06:34:47 UTC	2052	OUT	GET /sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fadtest%3Doff%26psid%3D1167268112%26pcsa%3Dfalse%26channel%3D000002%252C000003%252C002843%252Cbucket003%26client%3Ddp-teaminternet04_3ph%26r%3Dm%26hl%3Den%26rpbu%3Dhttp%253A%252F%252Fselfservicegeneraligroup.com%252F%253Fts%253DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMDN8fHx8fHw2NjFmNmQ4NDliZTQ3fHx8MTcxMzMzNTY4NC43MjYxfGQzNmE5ZjgxODMwYTBiNmNhNDkwMWY4MjU0MzQzODUzNTIyYjUxN2J8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fFpIQXRkR1ZoYldsdWRHVnlibVYwTURSZk0zQm98ZDgyZjM2MWZiZjFhMmNkYjk1Y2Y3NmRjNjczMTAzZDYzZWVlNTdiZHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fDEwMDIxZjAxZTdjYWU3ZTgxMmFhMzg3N2NhOGZhYzEyZmFjMGYxZDh8MHxkcC10ZWFtaW50ZXJuZXQwNF8zcGh8MHwwfHw%25253D%26terms%3DSelf%2520Service%2520Software%252C%25E2%2580%25AASAP%2520Netweaver%252COnline%2520Registration%2520Software%252CHelp%2520Desk%2520Ticket%2520System%252COnboarding%2520Software%26max_radlink_len%3D40%26type%3D3%26uiopt%3Dtrue%26swp%3Das-drid-2105895058331848%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301437%252C17301439%252C17301442%252C17301447%252C17301481%26client_gdprApplies%3D0%26format%3Dr3%257Cs%26nocache%3D6991713335685068%26num%3D0%26output%3Dafd_ads%26domain_name%3Dselfservicegeneraligroup.com%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D120%26dt%3D1713335685071%26u_w%3D1024%26u_h%3D768%26biw%3D1009%26bih%3D616%26psw%3D1009%26psh%3D760%26frm%3D0%26uio%3D--%26cont%3Dtc%26drt%3D0%26jsid%3Dcaf%26jsv%3D623135625%26rurl%3Dhttp%253A%252F%252Fselfservicegeneraligroup.com%252F&hl=en&q=EgRRtTk0GIbb_bAGIjACT3pJr805dBCkFxpsUUbhs3ktDDg8TsCyOJ_pdYRyWxV3VGpU2xuczbiWeH2bz_IyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: http://selfservicegeneraligroup.com/ Connection: keep-alive Upgrade-Insecure-Requests: 1
2024-04-17 06:34:47 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 17 Apr 2024 06:34:47 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 7317 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-17 06:34:47 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 64 73 65 6e 73 65 63 75 73 74 6f 6d 73 65 61 72 63 68 61 64 73 2e 63 6f 6d 2f 61 66 73 2f 61 64 73 3f 61 64 74 65 73 74 3d 6f 66 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.adsensecustomsearchads.com/afs/ads?adtest=of
2024-04-17 06:34:47 UTC	1255	IN	Data Raw: 69 63 65 25 32 30 53 6f 66 74 77 61 72 65 25 32 43 25 45 32 25 38 30 25 41 41 53 41 50 25 32 30 4e 65 74 77 65 61 76 65 72 25 32 43 4f 6e 6c 69 6e 65 25 32 30 52 65 67 69 73 74 72 61 74 69 6f 6e 25 32 30 53 6f 66 74 77 61 72 65 25 32 43 48 65 6c 70 25 32 30 44 65 73 6b 25 32 30 54 69 63 6b 65 74 25 32 30 53 79 73 74 65 6d 25 32 43 4f 6e 62 6f 61 72 64 69 6e 67 25 32 30 53 6f 66 74 77 61 72 65 26 61 6d 70 3b 6d 61 78 5f 72 61 64 6c 69 6e 6b 5f 6c 65 6e 3d 34 30 26 61 6d 70 3b 74 79 70 65 3d 33 26 61 6d 70 3b 75 69 6f 70 74 3d 74 72 75 65 26 61 6d 70 3b 73 77 70 3d 61 73 2d 64 72 69 64 2d 32 31 30 35 38 39 35 30 35 38 33 33 31 38 34 38 26 61 6d 70 3b 6f 65 3d 55 54 46 2d 38 26 61 6d 70 3b 69 65 3d 55 54 46 2d 38 26 61 6d 70 3b 66 65 78 70 3d 32 31 34 30 34 Data Ascii: ice%20Software%2C%E2%80%AASAP%20Netweaver%2COnline%20Registration%20Software%2CHelp%20Desk%20Ticket%20System%2COnboarding%20Software&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2105895058331848&oe=UTF-8&ie=UTF-8&fexp=21404
2024-04-17 06:34:47 UTC	1255	IN	Data Raw: 61 73 63 72 69 70 74 20 6f 6e 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 2e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 2e 6a 73 22 20 61 73 79 6e 63 20 64 65 66 65 72 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 76 61 72 20 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 Data Ascii: ascript on your web browser.</div></noscript><script src="https://www.google.com/recaptcha/api.js" async defer></script><script>var submitCallback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" c
2024-04-17 06:34:47 UTC	1255	IN	Data Raw: 44 6b 77 4d 57 59 34 4d 6a 55 30 4d 7a 51 7a 4f 44 55 7a 4e 54 49 79 59 6a 55 78 4e 32 4a 38 66 48 78 38 66 44 46 38 66 44 42 38 4d 48 78 38 66 48 77 78 66 48 78 38 66 48 77 77 66 44 42 38 66 48 78 38 66 48 78 38 66 46 70 49 51 58 52 6b 52 31 5a 6f 59 6c 64 73 64 57 52 48 56 6e 6c 69 62 56 59 77 54 55 52 53 5a 6b 30 7a 51 6d 39 38 5a 44 67 79 5a 6a 4d 32 4d 57 5a 69 5a 6a 46 68 4d 6d 4e 6b 59 6a 6b 31 59 32 59 33 4e 6d 52 6a 4e 6a 63 7a 4d 54 41 7a 5a 44 59 7a 5a 57 56 6c 4e 54 64 69 5a 48 77 77 66 44 42 38 66 44 42 38 66 48 77 77 66 44 42 38 56 7a 45 77 50 58 78 38 4d 58 78 58 4d 54 41 39 66 44 45 77 4d 44 49 78 5a 6a 41 78 5a 54 64 6a 59 57 55 33 5a 54 67 78 4d 6d 46 68 4d 7a 67 33 4e 32 4e 68 4f 47 5a 68 59 7a 45 79 5a 6d 46 6a 4d 47 59 78 5a 44 68 38 Data Ascii: DkwMWY4MjU0MzQzODUzNTIyYjUxN2J8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fFpIQXRkR1ZoYldsdWRHVnlibVYwTURSZk0zQm98ZDgyZjM2MWZiZjFhMmNkYjk1Y2Y3NmRjNjczMTAzZDYzZWVlNTdiZHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fDEwMDIxZjAxZTdjYWU3ZTgxMmFhMzg3N2NhOGZhYzEyZmFjMGYxZDh8
2024-04-17 06:34:47 UTC	1255	IN	Data Raw: 70 6c 61 69 6e 74 73 20 61 62 6f 75 74 20 6d 61 6c 69 63 69 6f 75 73 20 62 65 68 61 76 69 6f 72 2e 20 54 68 69 73 20 70 61 67 65 20 63 68 65 63 6b 73 20 74 6f 20 73 65 65 20 69 66 20 69 74 27 73 20 72 65 61 6c 6c 79 20 61 20 68 75 6d 61 6e 20 73 65 6e 64 69 6e 67 20 74 68 65 20 72 65 71 75 65 73 74 73 20 61 6e 64 20 6e 6f 74 20 61 20 72 6f 62 6f 74 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 74 68 69 73 20 6e 65 74 77 6f 72 6b 2e 20 3c 62 72 3e 3c 62 72 3e 0a 3c 64 69 76 20 69 64 3d 22 69 6e 66 6f 44 69 76 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 20 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 20 6d 61 72 67 69 6e 3a 30 20 30 20 31 35 70 78 20 30 3b 20 6c 69 6e 65 2d 68 65 Data Ascii: plaints about malicious behavior. This page checks to see if it's really a human sending the requests and not a robot coming from this network. <br><br><div id="infoDiv" style="display:none; background-color:#eee; padding:10px; margin:0 0 15px 0; line-he
2024-04-17 06:34:47 UTC	1255	IN	Data Raw: 3b 70 63 73 61 3d 66 61 6c 73 65 26 61 6d 70 3b 63 68 61 6e 6e 65 6c 3d 30 30 30 30 30 32 25 32 43 30 30 30 30 30 33 25 32 43 30 30 32 38 34 33 25 32 43 62 75 63 6b 65 74 30 30 33 26 61 6d 70 3b 63 6c 69 65 6e 74 3d 64 70 2d 74 65 61 6d 69 6e 74 65 72 6e 65 74 30 34 5f 33 70 68 26 61 6d 70 3b 72 3d 6d 26 61 6d 70 3b 68 6c 3d 65 6e 26 61 6d 70 3b 72 70 62 75 3d 68 74 74 70 25 33 41 25 32 46 25 32 46 73 65 6c 66 73 65 72 76 69 63 65 67 65 6e 65 72 61 6c 69 67 72 6f 75 70 2e 63 6f 6d 25 32 46 25 33 46 74 73 25 33 44 66 45 4e 73 5a 57 46 75 55 47 56 77 63 47 56 79 62 57 6c 75 64 45 4a 73 59 57 4e 72 66 48 77 31 59 32 55 34 4e 48 78 69 64 57 4e 72 5a 58 51 77 4d 44 4e 38 66 48 78 38 66 48 77 32 4e 6a 46 6d 4e 6d 51 34 4e 44 6c 69 5a 54 51 33 66 48 78 38 4d 54 Data Ascii: ;pcsa=false&channel=000002%2C000003%2C002843%2Cbucket003&client=dp-teaminternet04_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fselfservicegeneraligroup.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMDN8fHx8fHw2NjFmNmQ4NDliZTQ3fHx8MT
2024-04-17 06:34:47 UTC	143	IN	Data Raw: 2d 26 61 6d 70 3b 63 6f 6e 74 3d 74 63 26 61 6d 70 3b 64 72 74 3d 30 26 61 6d 70 3b 6a 73 69 64 3d 63 61 66 26 61 6d 70 3b 6a 73 76 3d 36 32 33 31 33 35 36 32 35 26 61 6d 70 3b 72 75 72 6c 3d 68 74 74 70 25 33 41 25 32 46 25 32 46 73 65 6c 66 73 65 72 76 69 63 65 67 65 6e 65 72 61 6c 69 67 72 6f 75 70 2e 63 6f 6d 25 32 46 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: -&cont=tc&drt=0&jsid=caf&jsv=623135625&rurl=http%3A%2F%2Fselfservicegeneraligroup.com%2F<br></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.20	35054	142.250.217.164	443

Timestamp	Bytes transferred	Direction	Data
2024-04-17 06:34:48 UTC	1965	OUT	GET /recaptcha/api.js HTTP/1.1 Host: www.google.com User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fadtest%3Doff%26psid%3D1167268112%26pcsa%3Dfalse%26channel%3D000002%252C000003%252C002843%252Cbucket003%26client%3Ddp-teaminternet04_3ph%26r%3Dm%26hl%3Den%26rpbu%3Dhttp%253A%252F%252Fselfservicegeneraligroup.com%252F%253Fts%253DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMDN8fHx8fHw2NjFmNmQ4NDliZTQ3fHx8MTcxMzMzNTY4NC43MjYxfGQzNmE5ZjgxODMwYTBiNmNhNDkwMWY4MjU0MzQzODUzNTIyYjUxN2J8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fFpIQXRkR1ZoYldsdWRHVnlibVYwTURSZk0zQm98ZDgyZjM2MWZiZjFhMmNkYjk1Y2Y3NmRjNjczMTAzZDYzZWVlNTdiZHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fDEwMDIxZjAxZTdjYWU3ZTgxMmFhMzg3N2NhOGZhYzEyZmFjMGYxZDh8MHxkcC10ZWFtaW50ZXJuZXQwNF8zcGh8MHwwfHw%25253D%26terms%3DSelf%2520Service%2520Software%252C%25E2%2580%25AASAP%2520Netweaver%252COnline%2520Registration%2520Software%252CHelp%2520Desk%2520Ticket%2520System%252COnboarding%2520Software%26max_radlink_len%3D40%26type%3D3%26uiopt%3Dtrue%26swp%3Das-drid-2105895058331848%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301437%252C17301439%252C17301442%252C17301447%252C17301481%26client_gdprApplies%3D0%26format%3Dr3%257Cs%26nocache%3D6991713335685068%26num%3D0%26output%3Dafd_ads%26domain_name%3Dselfservicegeneraligroup.com%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D120%26dt%3D1713335685071%26u_w%3D1024%26u_h%3D768%26biw%3D1009%26bih%3D616%26psw%3D1009%26psh%3D760%26frm%3D0%26uio%3D--%26cont%3Dtc%26drt%3D0%26jsid%3Dcaf%26jsv%3D623135625%26rurl%3Dhttp%253A%252F%252Fselfservicegeneraligroup.com%252F&hl=en&q=EgRRtTk0GIbb_bAGIjACT3pJr805dBCkFxpsUUbhs3ktDDg8TsCyOJ_pdYRyWxV3VGpU2xuczbiWeH2bz_IyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Connection: keep-alive
2024-04-17 06:34:48 UTC	528	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Wed, 17 Apr 2024 06:34:48 GMT Date: Wed, 17 Apr 2024 06:34:48 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-17 06:34:48 UTC	727	IN	Data Raw: 33 35 32 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 352/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-04-17 06:34:48 UTC	130	IN	Data Raw: 75 74 65 28 27 6e 6f 6e 63 65 27 29 29 3b 69 66 28 6e 29 7b 70 6f 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 6e 6f 6e 63 65 27 2c 6e 29 3b 7d 76 61 72 20 73 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 73 63 72 69 70 74 27 29 5b 30 5d 3b 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 70 6f 2c 20 73 29 3b 7d 29 28 29 3b 0d 0a Data Ascii: ute('nonce'));if(n){po.setAttribute('nonce',n);}var s=d.getElementsByTagName('script')[0];s.parentNode.insertBefore(po, s);})();
2024-04-17 06:34:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.20	35058	142.250.217.164	443

Timestamp	Bytes transferred	Direction	Data
2024-04-17 06:34:50 UTC	2499	OUT	GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=jkYMcceTXa5O0Ql5TftRgDmCgYkPz5gGnrn2IIvbdOT5roe8FKflJH_PAW-QVZa5Jwb9eM13c_0L5Xi4NoFS5624IVNSJIkoPhiOXF6CApz132Cvk-SDE7By3vUrqTv1kZs2ozuzya1IxyTNJn5SQzaL5kDm2Pev9GvHZppY7Sm0XFSYrqIwuN1tSab_ilre7pcGth-Hes5VC3LxDbe7XIbvTKm1-36FKWTciH9JkpVGWXvckVfM5KxkkqBi4PrNUa4aVXYgvR7o70yzur7iGGautLlBMog&cb=yc2zn4iualcv HTTP/1.1 Host: www.google.com User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fadtest%3Doff%26psid%3D1167268112%26pcsa%3Dfalse%26channel%3D000002%252C000003%252C002843%252Cbucket003%26client%3Ddp-teaminternet04_3ph%26r%3Dm%26hl%3Den%26rpbu%3Dhttp%253A%252F%252Fselfservicegeneraligroup.com%252F%253Fts%253DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMDN8fHx8fHw2NjFmNmQ4NDliZTQ3fHx8MTcxMzMzNTY4NC43MjYxfGQzNmE5ZjgxODMwYTBiNmNhNDkwMWY4MjU0MzQzODUzNTIyYjUxN2J8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fFpIQXRkR1ZoYldsdWRHVnlibVYwTURSZk0zQm98ZDgyZjM2MWZiZjFhMmNkYjk1Y2Y3NmRjNjczMTAzZDYzZWVlNTdiZHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fDEwMDIxZjAxZTdjYWU3ZTgxMmFhMzg3N2NhOGZhYzEyZmFjMGYxZDh8MHxkcC10ZWFtaW50ZXJuZXQwNF8zcGh8MHwwfHw%25253D%26terms%3DSelf%2520Service%2520Software%252C%25E2%2580%25AASAP%2520Netweaver%252COnline%2520Registration%2520Software%252CHelp%2520Desk%2520Ticket%2520System%252COnboarding%2520Software%26max_radlink_len%3D40%26type%3D3%26uiopt%3Dtrue%26swp%3Das-drid-2105895058331848%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301437%252C17301439%252C17301442%252C17301447%252C17301481%26client_gdprApplies%3D0%26format%3Dr3%257Cs%26nocache%3D6991713335685068%26num%3D0%26output%3Dafd_ads%26domain_name%3Dselfservicegeneraligroup.com%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D120%26dt%3D1713335685071%26u_w%3D1024%26u_h%3D768%26biw%3D1009%26bih%3D616%26psw%3D1009%26psh%3D760%26frm%3D0%26uio%3D--%26cont%3Dtc%26drt%3D0%26jsid%3Dcaf%26jsv%3D623135625%26rurl%3Dhttp%253A%252F%252Fselfservicegeneraligroup.com%252F&hl=en&q=EgRRtTk0GIbb_bAGIjACT3pJr805dBCkFxpsUUbhs3ktDDg8TsCyOJ_pdYRyWxV3VGpU2xuczbiWeH2bz_IyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Connection: keep-alive Upgrade-Insecure-Requests: 1
2024-04-17 06:34:50 UTC	875	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Apr 2024 06:34:50 GMT Content-Security-Policy: script-src 'nonce-2LAYaYIc_tg4qVnoqVdsRg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-17 06:34:50 UTC	380	IN	Data Raw: 32 61 64 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b Data Ascii: 2ad5<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face {
2024-04-17 06:34:50 UTC	1255	IN	Data Raw: 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f Data Ascii: 1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/
2024-04-17 06:34:50 UTC	1255	IN	Data Raw: 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 30 30 2d 31 45 39 46 2c 20 55 2b 31 45 46 32 2d 31 45 Data Ascii: ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1E
2024-04-17 06:34:50 UTC	1255	IN	Data Raw: 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a Data Ascii: 16;}/* greek-ext /@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/ greek */@font-face {
2024-04-17 06:34:50 UTC	1255	IN	Data Raw: 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 Data Ascii: y: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0
2024-04-17 06:34:50 UTC	1255	IN	Data Raw: 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 39 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c Data Ascii: v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 900; src: url
2024-04-17 06:34:50 UTC	1255	IN	Data Raw: 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 72 7a 34 44 76 55 2d 63 59 32 4a 59 43 77 48 53 54 63 6b 30 5f 71 6d 2d 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 32 4c 41 59 61 59 49 63 5f 74 67 34 71 56 6e 6f 71 56 64 73 52 67 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 32 2f Data Ascii: rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/styles__ltr.css"><script nonce="2LAYaYIc_tg4qVnoqVdsRg" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.com/recaptcha/api2/
2024-04-17 06:34:50 UTC	1255	IN	Data Raw: 4d 56 46 35 4c 35 6f 52 58 6d 6e 44 43 72 57 74 36 75 4c 45 48 43 58 7a 61 58 49 32 75 48 61 38 5a 48 6b 49 79 54 49 7a 67 75 4f 64 42 53 45 6f 50 65 37 53 39 49 6e 72 64 51 51 38 54 71 44 2d 6c 73 5a 53 62 35 48 54 36 7a 5a 61 76 70 4c 72 45 4c 44 42 6b 62 4c 4a 49 71 4a 6c 6a 56 35 5f 34 55 61 42 75 50 33 50 66 43 6f 77 33 55 71 59 4d 45 78 4b 47 32 71 4b 36 4b 4c 6f 37 72 36 52 6e 45 52 56 67 6f 4e 66 41 70 54 4b 43 57 56 48 56 65 52 6b 61 4d 72 32 4c 59 6b 6e 64 5f 48 47 61 67 77 78 69 76 4d 50 30 51 53 56 74 2d 71 6a 31 66 65 4d 37 4a 4f 73 77 6c 30 4a 66 4b 75 63 4b 36 50 66 53 67 41 4c 31 41 4a 4e 4c 37 58 61 72 74 32 6b 69 74 72 56 73 39 33 37 67 48 73 53 32 4f 36 59 49 61 50 71 78 51 31 58 33 44 78 52 47 34 67 43 43 6c 33 50 6f 5a 34 77 74 74 52 Data Ascii: MVF5L5oRXmnDCrWt6uLEHCXzaXI2uHa8ZHkIyTIzguOdBSEoPe7S9InrdQQ8TqD-lsZSb5HT6zZavpLrELDBkbLJIqJljV5_4UaBuP3PfCow3UqYMExKG2qK6KLo7r6RnERVgoNfApTKCWVHVeRkaMr2LYknd_HGagwxivMP0QSVt-qj1feM7JOswl0JfKucK6PfSgAL1AJNL7Xart2kitrVs937gHsS2O6YIaPqxQ1X3DxRG4gCCl3PoZ4wttR
2024-04-17 06:34:50 UTC	1255	IN	Data Raw: 4a 51 5f 79 56 75 33 74 5a 78 2d 73 48 5f 69 67 47 52 75 49 32 36 4f 54 78 4f 42 32 34 52 77 41 6d 62 79 37 4b 66 4e 4b 43 30 47 4a 35 6d 69 35 5f 51 5a 76 56 66 6d 58 37 61 66 6a 43 71 51 5f 4c 5a 42 31 59 65 69 4d 54 58 74 41 6b 52 4c 39 48 6d 42 34 70 32 4e 42 43 46 37 6d 4e 65 61 75 71 63 68 58 6d 54 75 2d 6b 76 30 31 33 74 69 6f 62 49 52 7a 74 35 65 67 67 5a 31 48 6e 6e 62 61 76 37 75 42 5f 70 77 22 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 32 4c 41 59 61 59 49 63 5f 74 67 34 71 56 6e 6f 71 56 64 73 52 67 22 3e 0a 20 20 20 20 20 20 72 65 63 61 70 74 63 68 61 2e 61 6e 63 68 6f 72 2e 4d 61 69 6e 2e 69 6e 69 74 28 22 5b 5c 78 32 32 61 69 6e 70 75 74 5c 78 32 32 2c 5b 5c 78 32 Data Ascii: JQ_yVu3tZx-sH_igGRuI26OTxOB24RwAmby7KfNKC0GJ5mi5_QZvVfmX7afjCqQ_LZB1YeiMTXtAkRL9HmB4p2NBCF7mNeauqchXmTu-kv013tiobIRzt5eggZ1Hnnbav7uB_pw"><script type="text/javascript" nonce="2LAYaYIc_tg4qVnoqVdsRg"> recaptcha.anchor.Main.init("[\x22ainput\x22,[\x2
2024-04-17 06:34:50 UTC	553	IN	Data Raw: 5a 59 65 47 52 55 53 43 39 59 56 31 4e 57 62 56 56 61 64 56 4e 4e 64 30 52 74 62 33 42 52 64 58 6c 70 4d 45 4a 79 64 53 74 73 62 30 46 4b 55 56 52 46 4e 55 56 75 55 44 4d 35 61 33 42 57 52 55 39 78 61 43 74 56 52 6a 63 78 53 6b 46 73 54 53 39 31 65 54 4e 79 64 58 68 4b 55 54 6c 4f 63 58 4a 52 51 31 56 58 4d 33 49 31 55 57 55 77 51 31 5a 6e 4e 6a 4e 79 51 55 52 34 55 6c 4d 78 65 58 52 48 62 6c 52 61 4e 6b 56 36 63 7a 6c 61 53 44 6c 55 51 7a 42 45 5a 6b 39 34 54 44 56 32 4e 44 4e 4f 4d 79 74 61 4d 45 68 42 59 58 4a 44 5a 55 64 4f 62 6e 6b 32 59 31 55 72 51 55 56 5a 4c 30 70 42 54 46 70 6e 62 6c 70 58 5a 45 4e 50 4d 54 46 44 59 56 5a 75 55 6c 6c 7a 59 6a 5a 5a 54 54 51 35 65 57 4e 78 64 58 52 4f 61 47 64 34 51 58 6c 44 4c 33 64 5a 53 6d 68 75 55 58 42 34 53 Data Ascii: ZYeGRUSC9YV1NWbVVadVNNd0Rtb3BRdXlpMEJydStsb0FKUVRFNUVuUDM5a3BWRU9xaCtVRjcxSkFsTS91eTNydXhKUTlOcXJRQ1VXM3I1UWUwQ1ZnNjNyQUR4UlMxeXRHblRaNkV6czlaSDlUQzBEZk94TDV2NDNOMytaMEhBYXJDZUdObnk2Y1UrQUVZL0pBTFpnblpXZENPMTFDYVZuUllzYjZZTTQ5eWNxdXROaGd4QXlDL3dZSmhuUXB4S

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.20	35066	142.250.217.164	443

Timestamp	Bytes transferred	Direction	Data
2024-04-17 06:34:52 UTC	790	OUT	GET /recaptcha/api2/webworker.js?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm- HTTP/1.1 Host: www.google.com User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=jkYMcceTXa5O0Ql5TftRgDmCgYkPz5gGnrn2IIvbdOT5roe8FKflJH_PAW-QVZa5Jwb9eM13c_0L5Xi4NoFS5624IVNSJIkoPhiOXF6CApz132Cvk-SDE7By3vUrqTv1kZs2ozuzya1IxyTNJn5SQzaL5kDm2Pev9GvHZppY7Sm0XFSYrqIwuN1tSab_ilre7pcGth-Hes5VC3LxDbe7XIbvTKm1-36FKWTciH9JkpVGWXvckVfM5KxkkqBi4PrNUa4aVXYgvR7o70yzur7iGGautLlBMog&cb=yc2zn4iualcv Connection: keep-alive
2024-04-17 06:34:52 UTC	655	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Expires: Wed, 17 Apr 2024 06:34:52 GMT Date: Wed, 17 Apr 2024 06:34:52 GMT Cache-Control: private, max-age=300 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-17 06:34:52 UTC	108	IN	Data Raw: 36 36 0d 0a 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 72 7a 34 44 76 55 2d 63 59 32 4a 59 43 77 48 53 54 63 6b 30 5f 71 6d 2d 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 29 3b 0d 0a Data Ascii: 66importScripts('https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__en.js');
2024-04-17 06:34:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.20	35068	142.250.217.164	443

Timestamp	Bytes transferred	Direction	Data
2024-04-17 06:34:52 UTC	782	OUT	GET /js/bg/KTA1qoE7ZDz05UuzGBms7CVmuC34sZ4nnXwNjg065Po.js HTTP/1.1 Host: www.google.com User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=jkYMcceTXa5O0Ql5TftRgDmCgYkPz5gGnrn2IIvbdOT5roe8FKflJH_PAW-QVZa5Jwb9eM13c_0L5Xi4NoFS5624IVNSJIkoPhiOXF6CApz132Cvk-SDE7By3vUrqTv1kZs2ozuzya1IxyTNJn5SQzaL5kDm2Pev9GvHZppY7Sm0XFSYrqIwuN1tSab_ilre7pcGth-Hes5VC3LxDbe7XIbvTKm1-36FKWTciH9JkpVGWXvckVfM5KxkkqBi4PrNUa4aVXYgvR7o70yzur7iGGautLlBMog&cb=yc2zn4iualcv Connection: keep-alive
2024-04-17 06:34:52 UTC	812	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs" Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} Content-Length: 18274 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 12 Apr 2024 01:46:42 GMT Expires: Sat, 12 Apr 2025 01:46:42 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 04 Apr 2024 18:30:00 GMT Content-Type: text/javascript Vary: Accept-Encoding Age: 449290 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-17 06:34:52 UTC	443	IN	Data Raw: 2f 2a 20 41 6e 74 69 2d 73 70 61 6d 2e 20 57 61 6e 74 20 74 6f 20 73 61 79 20 68 65 6c 6c 6f 3f 20 43 6f 6e 74 61 63 74 20 28 62 61 73 65 36 34 29 20 59 6d 39 30 5a 33 56 68 63 6d 51 74 59 32 39 75 64 47 46 6a 64 45 42 6e 62 32 39 6e 62 47 55 75 59 32 39 74 20 2a 2f 20 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 4d 3d 66 75 6e 63 74 69 6f 6e 28 4a 29 7b 72 65 74 75 72 6e 20 4a 7d 2c 64 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 4b 3d 66 75 6e 63 74 69 6f 6e 28 4a 2c 54 29 7b 69 66 28 28 4a 3d 28 54 3d 64 2e 74 72 75 73 74 65 64 54 79 70 65 73 2c 6e 75 6c 6c 29 2c 21 54 29 7c 7c 21 54 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 4a 3b 74 72 79 7b 4a 3d 54 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 62 67 22 2c 7b 63 72 65 61 74 65 48 54 4d Data Ascii: /* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */ (function(){var M=function(J){return J},d=this\|\|self,K=function(J,T){if((J=(T=d.trustedTypes,null),!T)\|\|!T.createPolicy)return J;try{J=T.createPolicy("bg",{createHTM
2024-04-17 06:34:52 UTC	1255	IN	Data Raw: 72 65 61 74 65 53 63 72 69 70 74 28 74 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 22 22 2b 74 7d 7d 28 64 29 28 41 72 72 61 79 28 37 38 32 34 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 7c 30 29 2e 6a 6f 69 6e 28 22 5c 6e 22 29 2b 5b 27 28 66 75 6e 63 74 69 6f 6e 28 29 7b 2f 2a 27 2c 0a 27 27 2c 0a 27 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 27 2c 0a 27 2a 2f 27 2c 0a 27 76 61 72 20 4a 56 3d 66 75 6e 63 74 69 6f 6e 28 4a 2c 54 29 7b 72 65 74 75 72 6e 5b 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4a 7d 2c 28 54 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 28 4a 29 7d 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 5d 7d 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 4a 2c 54 2c Data Ascii: reateScript(t)}:function(t){return""+t}}(d)(Array(7824Math.random()\|0).join("\n")+['(function(){/','',' SPDX-License-Identifier: Apache-2.0','*/','var JV=function(J,T){return[function(){return J},(T(function(t){t(J)}),function(){})]},P=function(J,T,
2024-04-17 06:34:52 UTC	1255	IN	Data Raw: 2e 6e 3d 30 2c 5b 5d 29 7d 72 65 74 75 72 6e 5b 66 75 6e 63 74 69 6f 6e 28 64 29 7b 28 54 2e 51 6e 28 64 29 2c 4a 29 2e 51 6e 28 64 29 7d 2c 28 4a 3d 28 54 3d 28 28 74 2e 70 72 6f 74 6f 74 79 70 65 2e 51 6e 3d 66 75 6e 63 74 69 6f 6e 28 64 2c 57 29 7b 35 30 3e 28 74 68 69 73 2e 6e 2b 2b 2c 74 68 69 73 29 2e 6a 2e 6c 65 6e 67 74 68 3f 74 68 69 73 2e 6a 2e 70 75 73 68 28 64 29 3a 28 57 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 74 68 69 73 2e 6e 29 2c 35 30 3e 57 26 26 28 74 68 69 73 2e 6a 5b 57 5d 3d 64 29 29 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 29 2e 4f 43 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 30 3d 3d 3d 74 68 69 73 2e 6e 29 72 65 74 75 72 6e 5b 30 2c 30 5d 3b 72 65 74 75 72 6e 5b 28 74 68 69 73 2e 6a 2e 73 6f Data Ascii: .n=0,[])}return[function(d){(T.Qn(d),J).Qn(d)},(J=(T=((t.prototype.Qn=function(d,W){50>(this.n++,this).j.length?this.j.push(d):(W=Math.floor(Math.random()*this.n),50>W&&(this.j[W]=d))},t.prototype).OC=function(){if(0===this.n)return[0,0];return[(this.j.so
2024-04-17 06:34:52 UTC	1255	IN	Data Raw: 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 4a 29 2c 54 29 29 72 65 74 75 72 6e 22 6f 62 6a 65 63 74 22 3b 69 66 28 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 5d 22 3d 3d 54 7c 7c 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 4a 2e 6c 65 6e 67 74 68 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 4a 2e 73 70 6c 69 63 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 4a 2e 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 26 26 21 4a 2e 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 28 22 73 70 6c 69 63 65 22 29 29 72 65 74 75 72 6e 22 61 72 72 61 79 22 3b 69 66 28 22 5b 6f 62 6a 65 63 74 20 46 75 6e 63 74 69 6f 6e 5d 22 3d 3d 54 7c 7c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 Data Ascii: type.toString.call(J),T))return"object";if("[object Array]"==T\|\|"number"==typeof J.length&&"undefined"!=typeof J.splice&&"undefined"!=typeof J.propertyIsEnumerable&&!J.propertyIsEnumerable("splice"))return"array";if("[object Function]"==T\|\|"undefined"!=ty
2024-04-17 06:34:52 UTC	1255	IN	Data Raw: 29 7b 74 3d 54 5b 4a 2e 54 3d 74 72 75 65 2c 31 5d 3b 74 72 79 7b 64 3d 4a 2e 4f 7c 7c 4a 2e 4e 28 54 29 7d 63 61 74 63 68 28 71 29 7b 6d 28 71 2c 4a 29 2c 64 3d 4a 2e 4f 7d 74 28 64 29 7d 65 6c 73 65 20 69 66 28 57 3d 3d 45 69 29 54 5b 33 5d 26 26 28 4a 2e 44 3d 74 72 75 65 29 2c 54 5b 34 5d 26 26 28 4a 2e 67 3d 74 72 75 65 29 2c 54 5b 35 5d 26 26 28 4a 2e 55 3d 74 72 75 65 29 2c 54 5b 36 5d 26 26 28 4a 2e 54 3d 74 72 75 65 29 2c 4a 2e 4e 28 54 29 3b 65 6c 73 65 20 69 66 28 57 3d 3d 46 49 29 4a 2e 44 3d 74 72 75 65 2c 4a 2e 4e 28 54 29 3b 65 6c 73 65 20 69 66 28 57 3d 3d 47 41 29 7b 4a 2e 55 3d 74 72 75 65 3b 74 72 79 7b 66 6f 72 28 64 3d 30 3b 64 3c 4a 2e 69 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 74 72 79 7b 74 3d 4a 2e 69 5b 64 5d 2c 74 5b 30 5d 5b 74 5b Data Ascii: ){t=T[J.T=true,1];try{d=J.O\|\|J.N(T)}catch(q){m(q,J),d=J.O}t(d)}else if(W==Ei)T[3]&&(J.D=true),T[4]&&(J.g=true),T[5]&&(J.U=true),T[6]&&(J.T=true),J.N(T);else if(W==FI)J.D=true,J.N(T);else if(W==GA){J.U=true;try{for(d=0;d<J.i.length;d++)try{t=J.i[d],t[0][t[
2024-04-17 06:34:52 UTC	1255	IN	Data Raw: 2c 4d 2c 4b 2c 75 2c 79 2c 44 2c 52 2c 49 29 7b 69 66 28 52 3d 67 28 74 2c 33 36 35 29 2c 52 3e 3d 74 2e 76 29 74 68 72 6f 77 5b 65 2c 33 31 5d 3b 66 6f 72 28 49 3d 28 75 3d 28 64 3d 28 4d 3d 54 2c 74 2e 61 39 2e 6c 65 6e 67 74 68 29 2c 52 29 2c 30 29 3b 30 3c 4d 3b 29 71 3d 75 25 38 2c 57 3d 75 3e 3e 33 2c 63 3d 38 2d 28 71 7c 30 29 2c 4b 3d 74 2e 48 5b 57 5d 2c 63 3d 63 3c 4d 3f 63 3a 4d 2c 4a 26 26 28 44 3d 74 2c 79 3d 75 2c 44 2e 59 21 3d 79 3e 3e 36 26 26 28 44 2e 59 3d 79 3e 3e 36 2c 79 3d 67 28 44 2c 38 31 29 2c 44 2e 66 69 3d 73 69 28 44 2e 59 2c 44 2e 53 2c 5b 30 2c 30 2c 79 5b 31 5d 2c 79 5b 32 5d 5d 29 29 2c 4b 5e 3d 74 2e 66 69 5b 57 26 64 5d 29 2c 49 7c 3d 28 4b 3e 3e 38 2d 28 71 7c 30 29 2d 28 63 7c 30 29 26 28 31 3c 3c 63 29 2d 31 29 3c 3c Data Ascii: ,M,K,u,y,D,R,I){if(R=g(t,365),R>=t.v)throw[e,31];for(I=(u=(d=(M=T,t.a9.length),R),0);0<M;)q=u%8,W=u>>3,c=8-(q\|0),K=t.H[W],c=c<M?c:M,J&&(D=t,y=u,D.Y!=y>>6&&(D.Y=y>>6,y=g(D,81),D.fi=si(D.Y,D.S,[0,0,y[1],y[2]])),K^=t.fi[W&d]),I\|=(K>>8-(q\|0)-(c\|0)&(1<<c)-1)<<
2024-04-17 06:34:52 UTC	1255	IN	Data Raw: 63 65 28 30 2c 32 30 34 38 29 7d 2c 24 67 3d 66 75 6e 63 74 69 6f 6e 28 4a 2c 54 2c 74 2c 64 2c 57 2c 71 2c 63 29 7b 66 6f 72 28 28 74 2e 7a 48 3d 4d 6d 28 74 2e 57 2c 28 74 2e 61 39 3d 28 74 2e 48 77 3d 65 38 2c 74 5b 74 2e 5a 64 3d 5a 41 2c 56 5d 29 2c 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 63 6f 6e 63 61 74 28 29 7d 7d 29 29 2c 74 29 2e 79 6e 3d 6b 5b 74 2e 57 5d 28 74 2e 7a 48 2c 7b 76 61 6c 75 65 3a 7b 76 61 6c 75 65 3a 7b 7d 7d 7d 29 2c 63 3d 30 2c 71 3d 5b 5d 3b 32 38 38 3e 63 3b 63 2b 2b 29 71 5b 63 5d 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 63 29 3b 6c 28 74 72 75 65 2c 74 2c 28 76 28 74 2c 28 28 76 28 28 50 28 31 32 39 2c 66 75 6e 63 74 69 6f 6e 28 4d 2c 4b 2c 75 2c 79 2c 44 2c Data Ascii: ce(0,2048)},$g=function(J,T,t,d,W,q,c){for((t.zH=Mm(t.W,(t.a9=(t.Hw=e8,t[t.Zd=ZA,V]),{get:function(){return this.concat()}})),t).yn=k[t.W](t.zH,{value:{value:{}}}),c=0,q=[];288>c;c++)q[c]=String.fromCharCode(c);l(true,t,(v(t,((v((P(129,function(M,K,u,y,D,
2024-04-17 06:34:52 UTC	1255	IN	Data Raw: 33 30 39 2c 28 58 28 28 74 2e 4e 4b 3d 28 58 28 74 2c 34 32 38 2c 28 28 58 28 74 2c 33 36 35 2c 28 74 2e 46 46 3d 28 28 74 2e 4f 3d 76 6f 69 64 20 30 2c 74 2e 4c 3d 5b 5d 2c 74 2e 58 46 3d 64 2c 74 2e 45 43 3d 28 74 2e 66 69 3d 76 6f 69 64 20 30 2c 32 35 29 2c 74 2e 70 69 3d 54 2c 74 2e 42 3d 28 74 2e 68 6b 3d 30 2c 74 2e 44 3d 66 61 6c 73 65 2c 30 29 2c 74 29 2e 5a 3d 28 28 74 2e 6c 4e 3d 30 2c 74 29 2e 68 3d 30 2c 74 2e 54 3d 66 61 6c 73 65 2c 28 74 2e 4a 3d 28 74 2e 53 73 3d 28 28 74 2e 41 3d 5b 5d 2c 74 29 2e 47 3d 30 2c 66 75 6e 63 74 69 6f 6e 28 4d 29 7b 74 68 69 73 2e 6c 3d 4d 7d 29 2c 76 6f 69 64 20 30 29 2c 28 28 74 2e 46 3d 76 6f 69 64 20 30 2c 74 29 2e 58 3d 66 61 6c 73 65 2c 74 2e 56 3d 5b 5d 2c 74 2e 6f 3d 6e 75 6c 6c 2c 74 29 2e 48 3d 5b 5d Data Ascii: 309,(X((t.NK=(X(t,428,((X(t,365,(t.FF=((t.O=void 0,t.L=[],t.XF=d,t.EC=(t.fi=void 0,25),t.pi=T,t.B=(t.hk=0,t.D=false,0),t).Z=((t.lN=0,t).h=0,t.T=false,(t.J=(t.Ss=((t.A=[],t).G=0,function(M){this.l=M}),void 0),((t.F=void 0,t).X=false,t.V=[],t.o=null,t).H=[]
2024-04-17 06:34:52 UTC	1255	IN	Data Raw: 28 34 29 29 2c 74 29 29 2c 31 31 38 29 2c 66 75 6e 63 74 69 6f 6e 28 4d 29 7b 53 38 28 4d 2c 34 29 7d 2c 74 29 2c 50 28 32 33 39 2c 66 75 6e 63 74 69 6f 6e 28 4d 2c 4b 2c 75 2c 79 29 7b 21 4c 28 74 72 75 65 2c 4d 2c 66 61 6c 73 65 2c 4b 29 26 26 28 4b 3d 63 43 28 4d 29 2c 79 3d 4b 2e 57 77 2c 75 3d 4b 2e 56 6e 2c 4d 2e 6c 3d 3d 4d 7c 7c 75 3d 3d 4d 2e 53 73 26 26 79 3d 3d 4d 29 26 26 28 58 28 4d 2c 4b 2e 76 77 2c 75 2e 61 70 70 6c 79 28 79 2c 4b 2e 73 29 29 2c 4d 2e 5a 3d 4d 2e 4b 28 29 29 7d 2c 74 29 2c 66 75 6e 63 74 69 6f 6e 28 4d 2c 4b 2c 75 2c 79 2c 44 2c 52 2c 49 2c 45 2c 61 2c 42 2c 59 2c 62 29 7b 66 75 6e 63 74 69 6f 6e 20 48 28 46 2c 72 29 7b 66 6f 72 28 3b 62 3c 46 3b 29 4b 7c 3d 47 28 4d 29 3c 3c 62 2c 62 2b 3d 38 3b 72 65 74 75 72 6e 20 72 3d Data Ascii: (4)),t)),118),function(M){S8(M,4)},t),P(239,function(M,K,u,y){!L(true,M,false,K)&&(K=cC(M),y=K.Ww,u=K.Vn,M.l==M\|\|u==M.Ss&&y==M)&&(X(M,K.vw,u.apply(y,K.s)),M.Z=M.K())},t),function(M,K,u,y,D,R,I,E,a,B,Y,b){function H(F,r){for(;b<F;)K\|=G(M)<<b,b+=8;return r=
2024-04-17 06:34:52 UTC	1255	IN	Data Raw: 29 29 2c 78 29 28 4d 29 2c 4d 29 29 2c 44 3d 67 28 4d 2c 44 29 2c 67 28 4d 2c 79 29 29 2c 67 29 28 4d 2c 75 29 2c 67 28 4d 2e 6c 2c 4b 29 29 2c 30 21 3d 3d 4b 29 26 26 28 44 3d 42 43 28 31 2c 4d 2c 44 2c 79 2c 4b 2c 75 29 2c 4b 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 75 2c 44 2c 6e 29 2c 58 28 4d 2c 32 31 39 2c 5b 4b 2c 75 2c 44 5d 29 29 7d 29 2c 74 29 2c 74 29 29 2c 66 75 6e 63 74 69 6f 6e 28 4d 29 7b 53 38 28 4d 2c 33 29 7d 29 2c 74 29 2c 74 29 29 2c 33 31 29 2c 74 29 2c 4f 28 34 29 29 29 2c 50 29 28 32 38 30 2c 66 75 6e 63 74 69 6f 6e 28 4d 29 7b 44 41 28 31 2c 4d 29 7d 2c 74 29 2c 66 75 6e 63 74 69 6f 6e 28 4d 2c 4b 2c 75 29 7b 4b 3d 78 28 28 75 3d 78 28 4d 29 2c 4d 29 29 2c 4b 3d 67 28 4d 2c 4b 29 2c 30 21 3d 67 28 4d 2c 75 29 26 26 58 Data Ascii: )),x)(M),M)),D=g(M,D),g(M,y)),g)(M,u),g(M.l,K)),0!==K)&&(D=BC(1,M,D,y,K,u),K.addEventListener(u,D,n),X(M,219,[K,u,D]))}),t),t)),function(M){S8(M,3)}),t),t)),31),t),O(4))),P)(280,function(M){DA(1,M)},t),function(M,K,u){K=x((u=x(M),M)),K=g(M,K),0!=g(M,u)&&X

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.20	35078	142.250.217.164	443

Timestamp	Bytes transferred	Direction	Data
2024-04-17 06:34:53 UTC	2136	OUT	GET /recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://www.google.com/sorry/index?continue=https://www.adsensecustomsearchads.com/afs/ads%3Fadtest%3Doff%26psid%3D1167268112%26pcsa%3Dfalse%26channel%3D000002%252C000003%252C002843%252Cbucket003%26client%3Ddp-teaminternet04_3ph%26r%3Dm%26hl%3Den%26rpbu%3Dhttp%253A%252F%252Fselfservicegeneraligroup.com%252F%253Fts%253DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMDN8fHx8fHw2NjFmNmQ4NDliZTQ3fHx8MTcxMzMzNTY4NC43MjYxfGQzNmE5ZjgxODMwYTBiNmNhNDkwMWY4MjU0MzQzODUzNTIyYjUxN2J8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fFpIQXRkR1ZoYldsdWRHVnlibVYwTURSZk0zQm98ZDgyZjM2MWZiZjFhMmNkYjk1Y2Y3NmRjNjczMTAzZDYzZWVlNTdiZHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fDEwMDIxZjAxZTdjYWU3ZTgxMmFhMzg3N2NhOGZhYzEyZmFjMGYxZDh8MHxkcC10ZWFtaW50ZXJuZXQwNF8zcGh8MHwwfHw%25253D%26terms%3DSelf%2520Service%2520Software%252C%25E2%2580%25AASAP%2520Netweaver%252COnline%2520Registration%2520Software%252CHelp%2520Desk%2520Ticket%2520System%252COnboarding%2520Software%26max_radlink_len%3D40%26type%3D3%26uiopt%3Dtrue%26swp%3Das-drid-2105895058331848%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300002%252C17301437%252C17301439%252C17301442%252C17301447%252C17301481%26client_gdprApplies%3D0%26format%3Dr3%257Cs%26nocache%3D6991713335685068%26num%3D0%26output%3Dafd_ads%26domain_name%3Dselfservicegeneraligroup.com%26v%3D3%26bsl%3D8%26pac%3D2%26u_his%3D1%26u_tz%3D120%26dt%3D1713335685071%26u_w%3D1024%26u_h%3D768%26biw%3D1009%26bih%3D616%26psw%3D1009%26psh%3D760%26frm%3D0%26uio%3D--%26cont%3Dtc%26drt%3D0%26jsid%3Dcaf%26jsv%3D623135625%26rurl%3Dhttp%253A%252F%252Fselfservicegeneraligroup.com%252F&hl=en&q=EgRRtTk0GIbb_bAGIjACT3pJr805dBCkFxpsUUbhs3ktDDg8TsCyOJ_pdYRyWxV3VGpU2xuczbiWeH2bz_IyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Connection: keep-alive Upgrade-Insecure-Requests: 1
2024-04-17 06:34:53 UTC	875	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 17 Apr 2024 06:34:53 GMT Content-Security-Policy: script-src 'nonce-AVBBsBdxmu9q-Sh7ULprTg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-17 06:34:53 UTC	380	IN	Data Raw: 31 64 31 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 Data Ascii: 1d14<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face
2024-04-17 06:34:53 UTC	1255	IN	Data Raw: 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 Data Ascii: r1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s
2024-04-17 06:34:53 UTC	1255	IN	Data Raw: 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 30 30 2d 31 45 39 46 2c 20 55 2b 31 45 46 32 2d 31 Data Ascii: -ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1
2024-04-17 06:34:53 UTC	1255	IN	Data Raw: 31 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b Data Ascii: 116;}/* greek-ext /@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/ greek */@font-face {
2024-04-17 06:34:53 UTC	1255	IN	Data Raw: 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b Data Ascii: ly: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+
2024-04-17 06:34:53 UTC	1255	IN	Data Raw: 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 39 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 Data Ascii: /v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 900; src: ur
2024-04-17 06:34:53 UTC	797	IN	Data Raw: 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 72 7a 34 44 76 55 2d 63 59 32 4a 59 43 77 48 53 54 63 6b 30 5f 71 6d 2d 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 41 56 42 42 73 42 64 78 6d 75 39 71 2d 53 68 37 55 4c 70 72 54 67 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 32 Data Ascii: k rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/styles__ltr.css"><script nonce="AVBBsBdxmu9q-Sh7ULprTg" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.com/recaptcha/api2
2024-04-17 06:34:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.20	58570	35.244.181.201	443

Timestamp	Bytes transferred	Direction	Data
2024-04-17 06:35:04 UTC	444	OUT	GET /update/3/GMP/66.0.3/20190410113011/Linux_x86_64-gcc3/null/release-cck-ubuntu/Linux%204.4.0-116-generic%20(GTK%203.18.9%2Clibpulse%208.0.0)/canonical/1.0/update.xml HTTP/1.1 Host: aus5.mozilla.org User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
2024-04-17 06:35:04 UTC	737	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 17 Apr 2024 06:35:04 GMT Content-Type: text/xml; charset=utf-8 Content-Length: 718 Vary: Accept-Encoding Rule-ID: unknown Rule-Data-Version: unknown Content-Signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2024-05-20-00-15-28.chain; p384ecdsa=dVN56VlKO94q01DEq0vs22KcXLPMNyRrqQYSfJEqlcTKFE-e422yxgqNCqQAYmdOiucZatH1DUQW24yjZUWWy3AF8CkDL1EXAcLAZEpv2TJsVQRLSOE8KnCs3ufMQs71 Strict-Transport-Security: max-age=31536000; X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'none'; frame-ancestors 'none' X-Proxy-Cache-Status: MISS Via: 1.1 google Cache-Control: public,max-age=90 Alt-Svc: clear Connection: close
2024-04-17 06:35:04 UTC	718	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3f 3e 0a 3c 75 70 64 61 74 65 73 3e 0a 20 20 20 20 3c 61 64 64 6f 6e 73 3e 0a 20 20 20 20 20 20 20 20 3c 61 64 64 6f 6e 20 69 64 3d 22 67 6d 70 2d 67 6d 70 6f 70 65 6e 68 32 36 34 22 20 55 52 4c 3d 22 68 74 74 70 3a 2f 2f 63 69 73 63 6f 62 69 6e 61 72 79 2e 6f 70 65 6e 68 32 36 34 2e 6f 72 67 2f 6f 70 65 6e 68 32 36 34 2d 6c 69 6e 75 78 36 34 2d 36 63 32 65 37 30 30 38 66 38 62 62 65 32 66 66 39 30 31 30 30 39 37 32 66 39 37 30 37 31 65 62 38 37 65 63 33 37 63 62 2e 7a 69 70 22 20 68 61 73 68 46 75 6e 63 74 69 6f 6e 3d 22 73 68 61 35 31 32 22 20 68 61 73 68 56 61 6c 75 65 3d 22 32 36 61 66 66 37 32 63 33 64 35 34 36 65 32 61 37 35 39 66 30 31 63 36 65 37 33 32 39 66 33 32 64 32 65 63 33 39 39 33 64 Data Ascii: <?xml version="1.0"?><updates> <addons> <addon id="gmp-gmpopenh264" URL="http://ciscobinary.openh264.org/openh264-linux64-6c2e7008f8bbe2ff90100972f97071eb87ec37cb.zip" hashFunction="sha512" hashValue="26aff72c3d546e2a759f01c6e7329f32d2ec3993d

System Behavior

Analysis Process: exo-open PID: 4785, Parent PID: 4725

General

Start time (UTC):	06:34:40
Start date (UTC):	17/04/2024
Path:	/usr/bin/exo-open
Arguments:	exo-open http://selfservicegeneraligroup.com
File size:	22856 bytes
MD5 hash:	39c5fa78f1cb3d950b9944f784018d3a

Chronological Activities

Analysis Process: exo-open PID: 4792, Parent PID: 4785

General

Start time (UTC):	06:34:40
Start date (UTC):	17/04/2024
Path:	/usr/bin/exo-open
Arguments:	-
File size:	22856 bytes
MD5 hash:	39c5fa78f1cb3d950b9944f784018d3a

Chronological Activities

Analysis Process: exo-open PID: 4793, Parent PID: 4792

General

Start time (UTC):	06:34:40
Start date (UTC):	17/04/2024
Path:	/usr/bin/exo-open
Arguments:	-
File size:	22856 bytes
MD5 hash:	39c5fa78f1cb3d950b9944f784018d3a

Chronological Activities

Analysis Process: exo-helper-1 PID: 4793, Parent PID: 1656

General

Start time (UTC):	06:34:40
Start date (UTC):	17/04/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 --launch WebBrowser http://selfservicegeneraligroup.com
File size:	63560 bytes
MD5 hash:	c27a648e34ba5ce625d064af015be147

Chronological Activities

Analysis Process: exo-helper-1 PID: 4800, Parent PID: 4793

General

Start time (UTC):	06:34:40
Start date (UTC):	17/04/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1
Arguments:	-
File size:	63560 bytes
MD5 hash:	c27a648e34ba5ce625d064af015be147

Chronological Activities

Analysis Process: sensible-browser PID: 4800, Parent PID: 4793

General

Start time (UTC):	06:34:40
Start date (UTC):	17/04/2024
Path:	/usr/bin/sensible-browser
Arguments:	/bin/sh /usr/bin/sensible-browser http://selfservicegeneraligroup.com
File size:	0 bytes
MD5 hash:	unknown

Chronological Activities

Analysis Process: x-www-browser PID: 4800, Parent PID: 4793

General

Start time (UTC):	06:34:40
Start date (UTC):	17/04/2024
Path:	/usr/bin/x-www-browser
Arguments:	/bin/sh /usr/bin/x-www-browser http://selfservicegeneraligroup.com
File size:	0 bytes
MD5 hash:	unknown

Chronological Activities

Analysis Process: x-www-browser PID: 4801, Parent PID: 4800

General

Start time (UTC):	06:34:40
Start date (UTC):	17/04/2024
Path:	/usr/bin/x-www-browser
Arguments:	-
File size:	0 bytes
MD5 hash:	unknown

Chronological Activities

Analysis Process: which PID: 4801, Parent PID: 4800

General

Start time (UTC):	06:34:40
Start date (UTC):	17/04/2024
Path:	/usr/bin/which
Arguments:	/bin/sh /usr/bin/which /usr/bin/x-www-browser
File size:	0 bytes
MD5 hash:	unknown

Chronological Activities

Analysis Process: firefox PID: 4800, Parent PID: 4793

General

Start time (UTC):	06:34:40
Start date (UTC):	17/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	/usr/lib/firefox/firefox http://selfservicegeneraligroup.com
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: firefox PID: 4802, Parent PID: 4800

General

Start time (UTC):	06:34:40
Start date (UTC):	17/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	-
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Analysis Process: firefox PID: 4828, Parent PID: 4800

General

Start time (UTC):	06:34:40
Start date (UTC):	17/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	-
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: firefox PID: 4842, Parent PID: 4800

General

Start time (UTC):	06:34:40
Start date (UTC):	17/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	-
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: lsb_release PID: 4842, Parent PID: 4800

General

Start time (UTC):	06:34:40
Start date (UTC):	17/04/2024
Path:	/usr/bin/lsb_release
Arguments:	/usr/bin/python3 -Es /usr/bin/lsb_release -idrc
File size:	3638 bytes
MD5 hash:	18cba7de7bfedd0d9f027bd1c54cc2b2

Chronological Activities

Analysis Process: firefox PID: 4862, Parent PID: 4800

General

Start time (UTC):	06:34:41
Start date (UTC):	17/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	-
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: dbus-launch PID: 4862, Parent PID: 4800

General

Start time (UTC):	06:34:41
Start date (UTC):	17/04/2024
Path:	/usr/bin/dbus-launch
Arguments:	dbus-launch --autolaunch=11ced2f07072c6ae389b731c5cc84014 --binary-syntax --close-stderr
File size:	26616 bytes
MD5 hash:	e4a469f27d130d783c21ce9c1c4456c3

Chronological Activities

Analysis Process: firefox PID: 4929, Parent PID: 4800

General

Start time (UTC):	06:34:41
Start date (UTC):	17/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	-
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: firefox PID: 4930, Parent PID: 4929

General

Start time (UTC):	06:34:41
Start date (UTC):	17/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	-
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: firefox PID: 4929, Parent PID: 4800

General

Start time (UTC):	06:34:41
Start date (UTC):	17/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 1 -prefMapSize 172334 -parentBuildID 20190410113011 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 4800 true tab
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: firefox PID: 4977, Parent PID: 4800

General

Start time (UTC):	06:34:43
Start date (UTC):	17/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	-
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: firefox PID: 4978, Parent PID: 4977

General

Start time (UTC):	06:34:43
Start date (UTC):	17/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	-
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: firefox PID: 4977, Parent PID: 4800

General

Start time (UTC):	06:34:43
Start date (UTC):	17/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 6115 -prefMapSize 172334 -parentBuildID 20190410113011 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 4800 true tab
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: firefox PID: 5019, Parent PID: 4800

General

Start time (UTC):	06:34:46
Start date (UTC):	17/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	-
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: firefox PID: 5021, Parent PID: 5019

General

Start time (UTC):	06:34:46
Start date (UTC):	17/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	-
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: firefox PID: 5019, Parent PID: 4800

General

Start time (UTC):	06:34:46
Start date (UTC):	17/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 6934 -prefMapSize 172334 -parentBuildID 20190410113011 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 4800 true tab
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Description:	Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Creation, File: File Metadata, File: File Modification, Firmware: Firmware Modification, Process: OS API Execution, Process: Process Creation, Script: Script Execution, Service: Service Creation, User Account: User Account Creation, User Account: User Account Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report http://selfservicegeneraligroup.com

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Process Tree

Yara Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/james/.cache/dconf/user

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/1DBCF2C5F4A9AAB308F13D41AB219EA85A810612

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/27384B62E4E2FBED7D3E85C6EAB6BF998474793D

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/2F4087E4267A59C0FFA634FA9D0E00268729B4DC

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/37D23FAB5FB546A476E38CD3870F42D926504EC7

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/4098689E1EA45FF0094F1C8088E49251FFFF7585

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/8C0900F504EEA56B743B4031F3F815083E14491B

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/8E6243BCB240F8914D10249076C524BAE347081E

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/A63C11DE5F2C5CEF985CF75DF4EFB9ECC9BF06B8

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/B13A714441C11853FE6BA40EFF6C7097378009F7

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/C296EE2E7F76140275BFE32DF9712B635E6BB55B

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/C389DE279BF5275924497D5B33D1F1900116E591

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/D2A64B5E2F392B99B4EBC1553A17EA010F0E8891

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/E6D3854E385D14EBC6F74CDE30437FFAD732EA8E

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/allow-flashallow-digest256.pset

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/allow-flashallow-digest256.sbstore

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/base-track-digest256.pset

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/base-track-digest256.sbstore

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/block-flash-digest256.pset

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/block-flash-digest256.sbstore

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/block-flashsubdoc-digest256.pset

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/block-flashsubdoc-digest256.sbstore

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flash-digest256.pset

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flash-digest256.sbstore

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flashallow-digest256.pset

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flashallow-digest256.sbstore

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flashsubdoc-digest256.pset

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flashsubdoc-digest256.sbstore

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/mozplugin-block-digest256.pset

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/mozplugin-block-digest256.sbstore

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/mozstd-trackwhite-digest256.pset

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/mozstd-trackwhite-digest256.sbstore

Linux Analysis Report
http://selfservicegeneraligroup.com