Edit tour

Windows Analysis Report
OPEN FOR MORE INFORMATION (1) (1).docx

Overview

General Information

Sample name:	OPEN FOR MORE INFORMATION (1) (1).docx
Analysis ID:	1546261
MD5:	6d8cdd881a9e07eb6d30ffbdf99330eb
SHA1:	5685bd70b2b7f15bf64e9eff9213c18d6d68bdcd
SHA256:	0a043edbc81f3c5944dceb6177191e18c2ca7c8ba529d517d38af51a0f6413fa
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected suspicious crossdomain redirect

Document misses a certain OLE stream usually present in this Microsoft Office document type

IP address seen in connection with other malware

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 3576 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

chrome.exe (PID: 3776 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

chrome.exe (PID: 3960 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=876 --field-trial-handle=1344,i,2167696845176286236,13665372515853021969,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

chrome.exe (PID: 1236 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "https://forms.gle/wsUZLdhHG5bDpNyj6" MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

cleanup

Sigma Signatures

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 3576, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://docs.google.com/forms/d/e/1FAIpQLSeC_0Id_PGmRkuSPuck_fyi9ACKGBvbaZTzhoVmvM7jUAlm8w/viewform?usp=send_form

SlashNext: Label: Fraudulent Website type: Phishing & Social Engineering

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\GoogleUpdater	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_3776_1972645428	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: forms.gle to https://docs.google.com/forms/d/e/1faipqlsec_0id_pgmrkuspuck_fyi9ackgbvbaztzhovmvm7jualm8w/viewform?usp=send_form

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{1DF94741-352D-4801-8303-700CFAC82726}.tmp

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /wsUZLdhHG5bDpNyj6 HTTP/1.1Host: forms.gleConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /forms/d/e/1FAIpQLSeC_0Id_PGmRkuSPuck_fyi9ACKGBvbaZTzhoVmvM7jUAlm8w/viewform?usp=send_form HTTP/1.1Host: docs.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962
Source: global traffic	HTTP traffic detected: GET /S3RLLtv19W1xxd4kOlbDqF6qrW37Ph00WYzt_zglN8T_thqo-ZrkO372sQDb5jhH3OWZXH9oCDjXWAgaGvJqW-RlWv5KLQCQ_kRHRYg16l92d61UtHJCkSKDaMZUGcp0Wg=w1200 HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIlKHLAQiFoM0BCNy9zQEIuMjNAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /S3RLLtv19W1xxd4kOlbDqF6qrW37Ph00WYzt_zglN8T_thqo-ZrkO372sQDb5jhH3OWZXH9oCDjXWAgaGvJqW-RlWv5KLQCQ_kRHRYg16l92d61UtHJCkSKDaMZUGcp0Wg=w1200 HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIlKHLAQiFoM0BCLjIzQE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIlKHLAQiFoM0BCLjIzQE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962; NID=518=pfY9vydiR6cbAkNmJiz2fNbbqSUCKveyHH_H0S-4j_YInXIGIGlaSsNpyaRs8YgXv1nM3hgYuI0Jrrpw-oXjXp-TT2q9WhP4nmBEFaMMlzz3nT0irkgg2lo67WeCcD-0uYPqkrIYco2Xygb2QEIcZ28a4n2rY1uAiTvUidP_Iu3QzxC5h87GvtFxDg
Source: global traffic	HTTP traffic detected: GET /forms/d/e/1FAIpQLSeC_0Id_PGmRkuSPuck_fyi9ACKGBvbaZTzhoVmvM7jUAlm8w/font/getmetadata HTTP/1.1Host: docs.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIlKHLAQiFoM0BCLjIzQE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: S=spreadsheet_forms=zLjYZucY4wqZ5nFgan1ZnD16NtFWLVWRiAG6kT5dF9w; COMPASS=spreadsheet_forms=CjIACWuJVzFLN2yB295p6jUtBNmJOBySvjonGxSjmGRm-FxXVOAKmJ5ugIl9KItE5KOq-BDE9I65Bho0AAlriVcI2on9aJvDUXq2Gqv9HAojAuPKTPyPRvGvsGKdkJDO711hkexEqtEkRla3QZ3ljQ==; CONSENT=PENDING+962; NID=518=pfY9vydiR6cbAkNmJiz2fNbbqSUCKveyHH_H0S-4j_YInXIGIGlaSsNpyaRs8YgXv1nM3hgYuI0Jrrpw-oXjXp-TT2q9WhP4nmBEFaMMlzz3nT0irkgg2lo67WeCcD-0uYPqkrIYco2Xygb2QEIcZ28a4n2rY1uAiTvUidP_Iu3QzxC5h87GvtFxDg

Source: chromecache_212.3.dr, chromecache_217.3.dr

String found in binary or memory: Pf=w(["https://sandbox.google.com/tools/feedback/"]),Qf=w(["https://www.google.cn/tools/feedback/"]),Rf=w(["https://help.youtube.com/tools/feedback/"]),Sf=w(["https://asx-frontend-staging.corp.google.com/inapp/"]),Tf=w(["https://asx-frontend-staging.corp.google.com/tools/feedback/"]),Uf=w(["https://localhost.corp.google.com/inapp/"]),Vf=w(["https://localhost.proxy.googlers.com/inapp/"]),Wf=U(yf),Xf=[U(zf),U(Af)],Yf=[U(Bf),U(Cf),U(Df),U(Ef),U(Ff),U(Gf),U(Hf),U(If),U(Jf),U(Kf)],Zf=[U(Lf),U(Mf)],$f= equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: forms.gle
Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: lh3.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /forms/d/e/1FAIpQLSeC_0Id_PGmRkuSPuck_fyi9ACKGBvbaZTzhoVmvM7jUAlm8w/naLogImpressions HTTP/1.1Host: docs.google.comConnection: keep-aliveContent-Length: 5456sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"X-Same-Domain: 1Content-Type: application/x-www-form-urlencoded;charset=UTF-8sec-ch-ua-mobile: ?0X-Client-Deadline-Ms: 20000User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://docs.google.comX-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIlKHLAQiFoM0BCNy9zQEIuMjNAQ==Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://docs.google.com/forms/d/e/1FAIpQLSeC_0Id_PGmRkuSPuck_fyi9ACKGBvbaZTzhoVmvM7jUAlm8w/viewform?usp=send_formAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: S=spreadsheet_forms=zLjYZucY4wqZ5nFgan1ZnD16NtFWLVWRiAG6kT5dF9w; COMPASS=spreadsheet_forms=CjIACWuJVzFLN2yB295p6jUtBNmJOBySvjonGxSjmGRm-FxXVOAKmJ5ugIl9KItE5KOq-BDE9I65Bho0AAlriVcI2on9aJvDUXq2Gqv9HAojAuPKTPyPRvGvsGKdkJDO711hkexEqtEkRla3QZ3ljQ==; CONSENT=PENDING+962; NID=518=iv2Bx9YQZjR75UnDBe4XsD3LU3oXAYfW9WPuZwHHL5Tf--c9AJTjSNV6-lT31aQRz4OQ3kT8xO4KxTdH7IKBTeEwTeRKYK-ifXAwocV73pt24mkTnb5BOG2UIQp-ZpbhKsUzRLwybPpJsEgfg2bzxkXQTxw2ONJR_n8iodmocwVHZU7RMQ

Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: http://localhost.corp.google.com/inapp/
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: http://localhost.proxy.googlers.com/inapp/
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.co.uk/inapp/
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.com/inapp/
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.com/tools/feedback/
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.de/inapp/
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.de/tools/feedback/
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://asx-frontend-autopush.corp.youtube.com/inapp/
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://asx-frontend-autopush.corp.youtube.com/tools/feedback/
Source: chromecache_217.3.dr	String found in binary or memory: https://asx-frontend-staging.corp.google.com/inapp/
Source: chromecache_217.3.dr	String found in binary or memory: https://asx-frontend-staging.corp.google.com/tools/feedback/
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://asx-help-frontend-autopush.corp.youtube.com/inapp/
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://asx-help-frontend-autopush.corp.youtube.com/tools/feedback/
Source: chromecache_217.3.dr	String found in binary or memory: https://feedback-pa.clients6.google.com
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://feedback.googleusercontent.com/resources/annotator.css
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://feedback.googleusercontent.com/resources/render_frame2.html
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://feedback2-test.corp.google.com/inapp/%
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://feedback2-test.corp.google.com/tools/feedback/%
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://feedback2-test.corp.googleusercontent.com/inapp/%
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://feedback2-test.corp.googleusercontent.com/tools/feedback/%
Source: chromecache_161.3.dr, chromecache_232.3.dr	String found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v60/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RP
Source: chromecache_237.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/materialiconsextended/v151/kJEjBvgX7BgnkSrUwT8UnLVc38YydejYY-oE_LvJ.woff
Source: chromecache_232.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVE9eOcEg.woff2)
Source: chromecache_232.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVF9eO.woff2)
Source: chromecache_232.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVFNeOcEg.woff2)
Source: chromecache_232.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVGdeOcEg.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xEIzIFKw.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xFIzIFKw.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xGIzIFKw.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xHIzIFKw.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xIIzI.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xLIzIFKw.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xMIzIFKw.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fBBc4.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fBBc4.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_161.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: ~WRS{466CE3F4-1C30-4601-B694-59C14432DFE5}.tmp.0.dr	String found in binary or memory: https://forms.gle/wsUZLdhHG5bDpNyj6
Source: chromecache_217.3.dr	String found in binary or memory: https://gstatic.com/uservoice/surveys/resources/
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://help.youtube.com/tools/feedback/
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://localhost.corp.google.com/inapp/
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://localhost.proxy.googlers.com/inapp/
Source: chromecache_156.3.dr, chromecache_220.3.dr	String found in binary or memory: https://play.google.com
Source: chromecache_189.3.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://sandbox.google.com/inapp/
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://sandbox.google.com/inapp/%
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://sandbox.google.com/tools/feedback/
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://sandbox.google.com/tools/feedback/%
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://scone-pa.clients6.google.com
Source: chromecache_156.3.dr, chromecache_220.3.dr	String found in binary or memory: https://ssl.gstatic.com/docs/common/cleardot.gif
Source: chromecache_217.3.dr	String found in binary or memory: https://stagingqual-feedback-pa-googleapis.sandbox.google.com
Source: chromecache_156.3.dr, chromecache_220.3.dr	String found in binary or memory: https://support.google.com
Source: chromecache_217.3.dr, chromecache_156.3.dr, chromecache_220.3.dr	String found in binary or memory: https://support.google.com/
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://support.google.com/inapp/
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://support.google.com/inapp/%
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://test-scone-pa-googleapis.sandbox.google.com
Source: chromecache_190.3.dr, chromecache_189.3.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://www.google.cn/tools/feedback/
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://www.google.cn/tools/feedback/%
Source: chromecache_156.3.dr, chromecache_220.3.dr	String found in binary or memory: https://www.google.com
Source: chromecache_217.3.dr, chromecache_156.3.dr, chromecache_220.3.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://www.google.com/tools/feedback/
Source: chromecache_212.3.dr, chromecache_217.3.dr	String found in binary or memory: https://www.google.com/tools/feedback/%
Source: chromecache_217.3.dr	String found in binary or memory: https://www.google.com/tools/feedback/help_panel_binary.js
Source: chromecache_156.3.dr, chromecache_220.3.dr	String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: chromecache_220.3.dr	String found in binary or memory: https://www.gstatic.com/uservoice/feedback/client/web/
Source: chromecache_217.3.dr	String found in binary or memory: https://www.gstatic.com/uservoice/surveys/resources/
Source: chromecache_156.3.dr, chromecache_220.3.dr	String found in binary or memory: https://youtube.com/embed/
Source: chromecache_156.3.dr, chromecache_220.3.dr	String found in binary or memory: https://youtube.com/embed/?rel=0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49281
Source: unknown	Network traffic detected: HTTP traffic on port 49204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49180
Source: unknown	Network traffic detected: HTTP traffic on port 49207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49281 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49211
Source: unknown	Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49198
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49194
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49192
Source: unknown	Network traffic detected: HTTP traffic on port 49198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49207

Source: ~WRF{ABB1F47D-A9F2-44B4-B333-BFE396DC610E}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{ABB1F47D-A9F2-44B4-B333-BFE396DC610E}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{ABB1F47D-A9F2-44B4-B333-BFE396DC610E}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=876 --field-trial-handle=1344,i,2167696845176286236,13665372515853021969,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "https://forms.gle/wsUZLdhHG5bDpNyj6"
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=876 --field-trial-handle=1344,i,2167696845176286236,13665372515853021969,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	1 File and Directory Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
http://localhost.corp.google.com/inapp/	0%	URL Reputation	safe
https://feedback.googleusercontent.com/resources/annotator.css	0%	URL Reputation	safe
https://apis.google.com/js/client.js	0%	URL Reputation	safe
https://feedback2-test.corp.googleusercontent.com/tools/feedback/%	0%	URL Reputation	safe
https://support.google.com	0%	URL Reputation	safe
http://localhost.proxy.googlers.com/inapp/	0%	URL Reputation	safe
https://stagingqual-feedback-pa-googleapis.sandbox.google.com	0%	URL Reputation	safe
https://support.google.com/inapp/%	0%	URL Reputation	safe
https://asx-help-frontend-autopush.corp.youtube.com/inapp/	0%	URL Reputation	safe
https://help.youtube.com/tools/feedback/	0%	URL Reputation	safe
https://asx-frontend-staging.corp.google.com/tools/feedback/	0%	URL Reputation	safe
https://support.google.com/	0%	URL Reputation	safe
https://scone-pa.clients6.google.com	0%	URL Reputation	safe
https://support.google.com/inapp/	0%	URL Reputation	safe
https://asx-frontend-autopush.corp.google.co.uk/inapp/	0%	URL Reputation	safe
https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/	0%	URL Reputation	safe
https://asx-frontend-autopush.corp.google.com/tools/feedback/	0%	URL Reputation	safe
https://asx-frontend-autopush.corp.youtube.com/tools/feedback/	0%	URL Reputation	safe
https://feedback2-test.corp.google.com/inapp/%	0%	URL Reputation	safe
https://sandbox.google.com/inapp/%	0%	URL Reputation	safe
https://feedback2-test.corp.googleusercontent.com/inapp/%	0%	URL Reputation	safe
https://localhost.proxy.googlers.com/inapp/	0%	URL Reputation	safe
https://www.google.cn/tools/feedback/	0%	URL Reputation	safe
https://asx-frontend-autopush.corp.google.de/inapp/	0%	URL Reputation	safe
https://www.google.cn/tools/feedback/%	0%	URL Reputation	safe
https://feedback2-test.corp.google.com/tools/feedback/%	0%	URL Reputation	safe
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	0%	URL Reputation	safe
https://asx-frontend-autopush.corp.google.de/tools/feedback/	0%	URL Reputation	safe
https://sandbox.google.com/inapp/	0%	URL Reputation	safe
https://test-scone-pa-googleapis.sandbox.google.com	0%	URL Reputation	safe
https://asx-help-frontend-autopush.corp.youtube.com/tools/feedback/	0%	URL Reputation	safe
https://asx-frontend-autopush.corp.google.com/inapp/	0%	URL Reputation	safe
https://feedback.googleusercontent.com/resources/render_frame2.html	0%	URL Reputation	safe
https://sandbox.google.com/tools/feedback/%	0%	URL Reputation	safe
https://sandbox.google.com/tools/feedback/	0%	URL Reputation	safe
https://localhost.corp.google.com/inapp/	0%	URL Reputation	safe
https://asx-frontend-autopush.corp.youtube.com/inapp/	0%	URL Reputation	safe
https://feedback-pa.clients6.google.com	0%	URL Reputation	safe
https://asx-frontend-staging.corp.google.com/inapp/	0%	URL Reputation	safe
https://fonts.google.com/license/googlerestricted	0%	URL Reputation	safe
https://docs.google.com/forms/d/e/1FAIpQLSeC_0Id_PGmRkuSPuck_fyi9ACKGBvbaZTzhoVmvM7jUAlm8w/viewform?usp=send_form	100%	SlashNext	Fraudulent Website type: Phishing & Social Engineering

Name	IP	Active	Malicious	Reputation
docs.google.com	172.217.16.206	true	false	unknown
play.google.com	216.58.206.46	true	false	unknown
forms.gle	199.36.158.100	true	false	unknown
www.google.com	172.217.16.196	true	false	unknown
googlehosted.l.googleusercontent.com	142.250.184.193	true	false	unknown
lh3.googleusercontent.com	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://lh3.googleusercontent.com/S3RLLtv19W1xxd4kOlbDqF6qrW37Ph00WYzt_zglN8T_thqo-ZrkO372sQDb5jhH3OWZXH9oCDjXWAgaGvJqW-RlWv5KLQCQ_kRHRYg16l92d61UtHJCkSKDaMZUGcp0Wg=w1200	false		unknown
https://forms.gle/wsUZLdhHG5bDpNyj6	false		unknown
https://docs.google.com/forms/d/e/1FAIpQLSeC_0Id_PGmRkuSPuck_fyi9ACKGBvbaZTzhoVmvM7jUAlm8w/viewform?usp=send_form	false	SlashNext: Fraudulent Website type: Phishing & Social Engineering	unknown
https://docs.google.com/forms/d/e/1FAIpQLSeC_0Id_PGmRkuSPuck_fyi9ACKGBvbaZTzhoVmvM7jUAlm8w/naLogImpressions	false		unknown
https://docs.google.com/forms/d/e/1FAIpQLSeC_0Id_PGmRkuSPuck_fyi9ACKGBvbaZTzhoVmvM7jUAlm8w/font/getmetadata	false		unknown
https://docs.google.com/forms/d/e/1FAIpQLSeC_0Id_PGmRkuSPuck_fyi9ACKGBvbaZTzhoVmvM7jUAlm8w/viewform	false		unknown
https://play.google.com/log?format=json&hasfast=true&authuser=0	false		unknown

Name	Source	Malicious	Antivirus Detection	Reputation
http://localhost.corp.google.com/inapp/	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://feedback.googleusercontent.com/resources/annotator.css	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://youtube.com/embed/?rel=0	chromecache_156.3.dr, chromecache_220.3.dr	false		unknown
https://apis.google.com/js/client.js	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://feedback2-test.corp.googleusercontent.com/tools/feedback/%	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://support.google.com	chromecache_156.3.dr, chromecache_220.3.dr	false	URL Reputation: safe	unknown
https://play.google.com	chromecache_156.3.dr, chromecache_220.3.dr	false		unknown
https://youtube.com/embed/	chromecache_156.3.dr, chromecache_220.3.dr	false		unknown
http://localhost.proxy.googlers.com/inapp/	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://stagingqual-feedback-pa-googleapis.sandbox.google.com	chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://support.google.com/inapp/%	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://asx-help-frontend-autopush.corp.youtube.com/inapp/	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://help.youtube.com/tools/feedback/	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://asx-frontend-staging.corp.google.com/tools/feedback/	chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://support.google.com/	chromecache_217.3.dr, chromecache_156.3.dr, chromecache_220.3.dr	false	URL Reputation: safe	unknown
https://www.google.com	chromecache_156.3.dr, chromecache_220.3.dr	false		unknown
https://scone-pa.clients6.google.com	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://support.google.com/inapp/	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://asx-frontend-autopush.corp.google.co.uk/inapp/	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://asx-frontend-autopush.corp.google.com/tools/feedback/	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://asx-frontend-autopush.corp.youtube.com/tools/feedback/	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://feedback2-test.corp.google.com/inapp/%	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://www.google.com/tools/feedback	chromecache_217.3.dr, chromecache_156.3.dr, chromecache_220.3.dr	false		unknown
https://sandbox.google.com/inapp/%	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://feedback2-test.corp.googleusercontent.com/inapp/%	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://localhost.proxy.googlers.com/inapp/	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://www.google.com/tools/feedback/	chromecache_212.3.dr, chromecache_217.3.dr	false		unknown
https://www.google.cn/tools/feedback/	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://asx-frontend-autopush.corp.google.de/inapp/	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://www.google.cn/tools/feedback/%	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://feedback2-test.corp.google.com/tools/feedback/%	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://www.google.com/tools/feedback/help_panel_binary.js	chromecache_217.3.dr	false		unknown
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	chromecache_190.3.dr, chromecache_189.3.dr	false	URL Reputation: safe	unknown
https://asx-frontend-autopush.corp.google.de/tools/feedback/	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://sandbox.google.com/inapp/	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://test-scone-pa-googleapis.sandbox.google.com	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://asx-help-frontend-autopush.corp.youtube.com/tools/feedback/	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://play.google.com/log?format=json&hasfast=true	chromecache_189.3.dr	false		unknown
https://asx-frontend-autopush.corp.google.com/inapp/	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://feedback.googleusercontent.com/resources/render_frame2.html	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://sandbox.google.com/tools/feedback/%	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://sandbox.google.com/tools/feedback/	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://localhost.corp.google.com/inapp/	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://asx-frontend-autopush.corp.youtube.com/inapp/	chromecache_212.3.dr, chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://feedback-pa.clients6.google.com	chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://asx-frontend-staging.corp.google.com/inapp/	chromecache_217.3.dr	false	URL Reputation: safe	unknown
https://www.google.com/tools/feedback/%	chromecache_212.3.dr, chromecache_217.3.dr	false		unknown
https://fonts.google.com/license/googlerestricted	chromecache_161.3.dr, chromecache_232.3.dr	false	URL Reputation: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.16.206	docs.google.com	United States	15169	GOOGLEUS	false
142.250.184.193	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
216.58.206.65	unknown	United States	15169	GOOGLEUS	false
216.58.206.46	play.google.com	United States	15169	GOOGLEUS	false
199.36.158.100	forms.gle	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546261
Start date and time:	2024-10-31 17:10:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	2
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	OPEN FOR MORE INFORMATION (1) (1).docx
Detection:	MAL
Classification:	mal48.winDOCX@20/202@16/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .docx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Browse link: https://forms.gle/wsUZLdhHG5bDpNyj6 Scroll down Close Viewer

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	(No subject) - 2024-10-31T090531.704.eml	Get hash	malicious	Unknown	Browse
	Fw Message from Kevin - Update on Coles Supply Chain Modernisation 31-10-24.eml	Get hash	malicious	Unknown	Browse
	https://t.ly/4Nq2x	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	Metro Plastics Technologies.pdf	Get hash	malicious	Unknown	Browse
	https://concursolutions.us.com/a25kQvF4zrkinsa51n0h3rdanW1d07r9s0h3nW1	Get hash	malicious	Unknown	Browse
	SilverSEAL Corporation -RFQ_RFP_FSR Proposal.pdf	Get hash	malicious	Phisher	Browse
	https://my.toruftuiov.com/a43a39c3-796e-468c-aae4-b83c862e0918	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://hidrive.ionos.com/lnk/FamigcCEF	Get hash	malicious	Unknown	Browse
	https://growph.me/?gad_source=1&gclid=EAIaIQobChMI4cSUu72diQMVqGFIAB2rcRJoEAMYAiAAEgJQO_D_BwE	Get hash	malicious	HTMLPhisher	Browse

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	1.4283975457141798
Encrypted:	false
SSDEEP:	12:rl3lTpFQGlXIwKWwKWCIpLWpLWCICICb77:rnltq
MD5:	758931B881F6EFCEA430E5BA2F338139
SHA1:	D5E3F2E24947A0E2405C77C3981B25BB512D3457
SHA-256:	643336E0233D886CE73210AE61AA17C86420ADEC7DE5E564984CC20B7A56F467
SHA-512:	918CC7901960BD6C9585499B7914DA5B113D97F05DCF0933435CD91D0B4F8BEF4A8BBC379884B5A3716D56FB06014D5A48970D70D7FEA8007ED97E45D7D0DA21
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 72896, version 1.0
Category:	downloaded
Size (bytes):	72896
Entropy (8bit):	7.99302309612498
Encrypted:	true
SSDEEP:	1536:l+/lJ4+lxFkpiySl5jIWJ2wLyusIoQh8TKiZeWwn483A16TMVo0MVuJ:SJ4+DFAPSDjb2wLuIOkRn483APDSy
MD5:	8AFBBEF49E32F6382F8C029DDA485679
SHA1:	2FBD600C537D820F23D492D907DAC0BD98F0778E
SHA-256:	D4C4F413055D77B989E4D3BCE7E3CBB45427F251387EABFF8F9709F4EE1B2BF0
SHA-512:	A18299FDA6BDDE29D6036FADE0A234205D8BAA352BC15BB4AA846730D367EEA737DBB625D65FC49414906B2431290C14AB79A1C36241A206FABF80CECE385D29
Malicious:	false
URL:	https://fonts.gstatic.com/s/robotoserif/v15/R71XjywflP6FLr3gZx7K8UyEVQnyR1E7VN-f51xYuGCQepOvB0KLc2v0wKKB0Q4MSZxyqf2CgAchbDJ69BcVZxkDg-JuqON8AA.woff2
Preview:	wOF2..............e(...\.................................4.`?STAT....P..............6.$.... ..x..g..[...e..c....Vl#Q.....hsH.-3......7:.............].....u.....................%?"7......^.C.....A..jbl)...M..S>D.8.b...gl%g.Z.&\MHZW..{.p.....Yi5..&....[.LI..ye.j...W.0.p...xR..!E....k.8...Y...+....[...!ye...o#.>....'.T..s.a4.[Lk.k!......d..p.i....k....lF..5~Z..zJ..X.T..lB.1...(X..Uf.k...\|K1:..6....a...3W......;SvG.J.@!./..^....v.'N.sB...7..o...a6q.x@k..Z.E-!W..n.K.m'......eu1 7..lG".3......+.A.\.]r..wp.\.\.... 3..V!.x.BP.-+M..BR.N....^F..h.{..uas....0.....Xr...x...=.C....c.A..<.#...#d.w...<.d........ .G5\m..0RNqivB.xwD...>2s.E.].u....3.....P..`...-..pJ...$Fg...+.1.L;[..s...6.(.Y.+!f..}d..DDh.].3yMPN#3.}.p....P.8].g..-5OI...'..Il]i.D..oR.g+.+t..G..32..3O...../..I ..bk........(.\.O.....1..c.....Io....e....W...*.I.AG...r:.E.4.......M>.[....!.._.?:$......'.oS...Fw.-...L..J,.z.(......}k.l9._&./d5.l...Vm.z...=...~..D.I......r9..k.6..b...

File type:	Microsoft Word 2007+
Entropy (8bit):	7.781937526283547
TrID:	Word Microsoft Office Open XML Format document (27504/1) 77.47% ZIP compressed archive (8000/1) 22.53%
File name:	OPEN FOR MORE INFORMATION (1) (1).docx
File size:	7'160 bytes
MD5:	6d8cdd881a9e07eb6d30ffbdf99330eb
SHA1:	5685bd70b2b7f15bf64e9eff9213c18d6d68bdcd
SHA256:	0a043edbc81f3c5944dceb6177191e18c2ca7c8ba529d517d38af51a0f6413fa
SHA512:	f37d11b4bdb8097a64a002e4c21a96edd6428ed4d86edb6abb1c4ce4fbcf920d2789094342319b98d4555d9846cb7898499a1edaa3996d88726cbcd4f0e92594
SSDEEP:	192:BxzNcvRv+tEPqgBrXiiLgWxscDJsg8xFc67+7yRjWT:BovRv+tdeXiiLgWxXDJt8p7KGWT
TLSH:	FDE19D6CBDC9E62DE21B9731445CE256F22D2607D11EB2DA32D4A2C80CE6CE19735DAC
File Content Preview:	PK........$.^Y................word/numbering.xml..Kn.0..O.; .!...F..E......l.X......u ..U..U...o...3_....8:atJ.............u8#..A3.F....#...\|..B.9.}....Q4%..6."Gs.....:.7.....Y.....R.,x..R.c4..).0&%...B...h...R...FP^=j.v.{...-....1B.C.F.\XW.T_Z..5d..!vJ..

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 17:11:27.850687981 CET	53	62751	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:27.854963064 CET	53	49881	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:29.328986883 CET	53	63926	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:30.042859077 CET	62672	53	192.168.2.22	8.8.8.8
Oct 31, 2024 17:11:30.049173117 CET	56475	53	192.168.2.22	8.8.8.8
Oct 31, 2024 17:11:30.049582958 CET	53	62672	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:30.056675911 CET	53	56475	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:30.889679909 CET	54842	53	192.168.2.22	8.8.8.8
Oct 31, 2024 17:11:30.890074015 CET	58105	53	192.168.2.22	8.8.8.8
Oct 31, 2024 17:11:30.896910906 CET	53	54842	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:30.898706913 CET	53	58105	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:32.111274958 CET	57390	53	192.168.2.22	8.8.8.8
Oct 31, 2024 17:11:32.111429930 CET	58095	53	192.168.2.22	8.8.8.8
Oct 31, 2024 17:11:32.119158030 CET	53	57390	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:32.119426966 CET	53	58095	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:32.390327930 CET	53	60507	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:37.701786995 CET	61826	53	192.168.2.22	8.8.8.8
Oct 31, 2024 17:11:37.701977015 CET	56329	53	192.168.2.22	8.8.8.8
Oct 31, 2024 17:11:37.708960056 CET	53	56329	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:37.709043980 CET	53	61826	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:37.712582111 CET	53	59447	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:37.855288982 CET	53	53406	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:39.593368053 CET	53	64956	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:40.363409042 CET	49750	53	192.168.2.22	8.8.8.8
Oct 31, 2024 17:11:40.363553047 CET	64687	53	192.168.2.22	8.8.8.8
Oct 31, 2024 17:11:40.370143890 CET	53	49750	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:40.370672941 CET	53	64687	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:40.605094910 CET	65084	53	192.168.2.22	8.8.8.8
Oct 31, 2024 17:11:40.605696917 CET	63373	53	192.168.2.22	8.8.8.8
Oct 31, 2024 17:11:40.612258911 CET	53	65084	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:40.615060091 CET	53	63373	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:43.668920994 CET	51014	53	192.168.2.22	8.8.8.8
Oct 31, 2024 17:11:43.669327974 CET	49690	53	192.168.2.22	8.8.8.8
Oct 31, 2024 17:11:43.788969994 CET	53	49690	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:43.788983107 CET	53	51014	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:44.022892952 CET	53060	53	192.168.2.22	8.8.8.8
Oct 31, 2024 17:11:44.023014069 CET	49949	53	192.168.2.22	8.8.8.8
Oct 31, 2024 17:11:44.030759096 CET	53	53060	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:44.030803919 CET	53	49949	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:46.378537893 CET	53	54738	8.8.8.8	192.168.2.22
Oct 31, 2024 17:11:53.403819084 CET	53	54950	8.8.8.8	192.168.2.22
Oct 31, 2024 17:12:04.451066017 CET	53	62439	8.8.8.8	192.168.2.22
Oct 31, 2024 17:12:22.720177889 CET	53	59475	8.8.8.8	192.168.2.22
Oct 31, 2024 17:12:27.579735994 CET	53	55388	8.8.8.8	192.168.2.22
Oct 31, 2024 17:12:32.186690092 CET	53	51161	8.8.8.8	192.168.2.22
Oct 31, 2024 17:12:41.455773115 CET	53	63036	8.8.8.8	192.168.2.22
Oct 31, 2024 17:12:42.778038025 CET	53	49339	8.8.8.8	192.168.2.22

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:11:30 UTC	670	OUT	GET /wsUZLdhHG5bDpNyj6 HTTP/1.1 Host: forms.gle Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 16:11:30 UTC	1207	IN	HTTP/1.1 302 Found Connection: close Content-Length: 0 Accept-Ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cache-Control: no-cache, no-store, max-age=0, must-revalidate Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DurableDeepLinkUi/cspreport,script-src 'report-sample' 'nonce-cF9iv-QVfQGpJwxcg-SLtQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DurableDeepLinkUi/cspreport;worker-src 'self',script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/DurableDeepLinkUi/cspreport/allowlist Content-Type: application/binary Cross-Origin-Opener-Policy: unsafe-none Cross-Origin-Resource-Policy: same-site Expires: Mon, 01 Jan 1990 00:00:00 GMT Location: https://docs.google.com/forms/d/e/1FAIpQLSeC_0Id_PGmRkuSPuck_fyi9ACKGBvbaZTzhoVmvM7jUAlm8w/viewform?usp=send_form
2024-10-31 16:11:30 UTC	550	IN	Data Raw: 50 65 72 6d 69 73 73 69 6f 6e 73 2d 50 6f 6c 69 63 79 3a 20 63 68 2d 75 61 2d 61 72 63 68 3d 2a 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 2a 2c 20 63 68 2d 75 61 2d 66 75 6c 6c 2d 76 65 72 73 69 6f 6e 3d 2a 2c 20 63 68 2d 75 61 2d 66 75 6c 6c 2d 76 65 72 73 69 6f 6e 2d 6c 69 73 74 3d 2a 2c 20 63 68 2d 75 61 2d 6d 6f 64 65 6c 3d 2a 2c 20 63 68 2d 75 61 2d 77 6f 77 36 34 3d 2a 2c 20 63 68 2d 75 61 2d 66 6f 72 6d 2d 66 61 63 74 6f 72 73 3d 2a 2c 20 63 68 2d 75 61 2d 70 6c 61 74 66 6f 72 6d 3d 2a 2c 20 63 68 2d 75 61 2d 70 6c 61 74 66 6f 72 6d 2d 76 65 72 73 69 6f 6e 3d 2a 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 41 63 63 65 70 74 2d 52 61 6e 67 65 73 3a 20 62 79 74 65 73 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 33 31 20 4f 63 74 20 32 Data Ascii: Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Pragma: no-cacheAccept-Ranges: bytesDate: Thu, 31 Oct 2

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:11:31 UTC	777	OUT	GET /forms/d/e/1FAIpQLSeC_0Id_PGmRkuSPuck_fyi9ACKGBvbaZTzhoVmvM7jUAlm8w/viewform?usp=send_form HTTP/1.1 Host: docs.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962
2024-10-31 16:11:32 UTC	3693	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Robots-Tag: noindex, nofollow, nosnippet Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 31 Oct 2024 16:11:32 GMT Content-Security-Policy-Report-Only: report-uri https://csp.withgoogle.com/csp/forms/prod;frame-ancestors 'none' P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-wKaeMWqwpDrptE9d48gzdA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval' Reporting-Endpoints: default="/forms/d/e/1FAIpQLSeC_0Id_PGmRkuSPuck_fyi9ACKGBvbaZTzhoVmvM7jUAlm8w/web-reports?bl=apps-forms.freebird_20241022.09_p2&clss=1&context=eJwNy39M1HUcx_FPn-_7_VVBTsRmSx0NMrc0ES6Xvw_luAuYiWLwuRXkL47lDwRPBmGaP2b5ow5NQ82mHIhIwteRypKKaTlMKzesKNLlEhXl7pIOOREsrtcfj-35zzOsPSwolKgYqoQRrkRfhBLHIpWIjlKiZbQSk59RYsMLSkyarMS-OCUKpiqxI0mJQ_CzTYkO-H2ZEvdgWK4Sz0JvvhK0Von3ipQog7wNShRD-xYl7sN0txIp8MdeJbogs1wJJwweUsL0qRIxl5RIgMuteMDbq8QAFAeV-AAaxjrEBXg12iEU5Kc6xCYQxQ4RCY9e9MlBCGUH5JCcgLS8HZB2MC4GZCN03-qRfeDPfCh7IRQXlEOmBKURH5SNsGZLUBaBti0owyGwuk_2A895LCPgDvihw_lYemHz7sdyBwxe6Zf6D_3yw6gBuR-iKwfkBLiQMSgvQ5gIySi4My4k_eAoDcmlULYhJA9AdvVTWi4UuKVWAukeqSmY2CI1M5RomrYZxu3QtPFQdlfTDsDC7pnkgEzvLMqB_cFZ9BlcPzibOmCYMZtGwoSXLRQHJqeFRkMaJ1IGLLiSSFmwq20ufQw7U-bRXnCnzaNyKPh7HpXA1kNJtAter0uibGipT6Kr4LZYqRw-L7TSF5BebCUFCVutNAMmNljJDOWnrXQEuhqtFIA1bVYqglSflRZBc8BKLTAQk0wyNplurkqm3AfJVARzR9poITyIsdEg3J5kIx_Ur7TRWWhZZ6Or0Npso3a432mjf8AWaycXjF1qp-ch5h07JcCVPXa6Brb0FMqExVkp9CbUHE2hU9DTlkLho1JpFDwsTaUnMHtIGiXDgrA0yoL0xRWsoOjLC [TRUNCATED] Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: S=spreadsheet_forms=zLjYZucY4wqZ5nFgan1ZnD16NtFWLVWRiAG6kT5dF9w; Domain=.docs.google.com; Expires=Thu, 31-Oct-2024 17:11:32 GMT; Path=/forms/d/e/1FAIpQLSeC_0Id_PGmRkuSPuck_fyi9ACKGBvbaZTzhoVmvM7jUAlm8w; Secure; HttpOnly; Priority=LOW; SameSite=none Set-Cookie: COMPASS=spreadsheet_forms=CjIACWuJVzFLN2yB295p6jUtBNmJOBySvjonGxSjmGRm-FxXVOAKmJ5ugIl9KItE5KOq-BDE9I65Bho0AAlriVcI2on9aJvDUXq2Gqv9HAojAuPKTPyPRvGvsGKdkJDO711hkexEqtEkRla3QZ3ljQ==; Domain=.docs.google.com; Expires=Thu, 31-Oct-2024 17:11:32 GMT; Path=/forms/d/e/1FAIpQLSeC_0Id_PGmRkuSPuck_fyi9ACKGBvbaZTzhoVmvM7jUAlm8w; Secure; HttpOnly; Priority=LOW; SameSite=none Set-Cookie: NID=518=iv2Bx9YQZjR75UnDBe4XsD3LU3oXAYfW9WPuZwHHL5Tf--c9AJTjSNV6-lT31aQRz4OQ3kT8xO4KxTdH7IKBTeEwTeRKYK-ifXAwocV73pt24mkTnb5BOG2UIQp-ZpbhKsUzRLwybPpJsEgfg2bzxkXQTxw2ONJR_n8iodmocwVHZU7RMQ; expires=Fri, 02-May-2025 16:11:32 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 16:11:32 UTC	3693	IN	Data Raw: 36 37 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 48 42 31 65 43 64 2d 55 4d 72 6e 6d 62 22 3e 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 64 6f 63 73 2f 73 70 72 65 61 64 73 68 65 65 74 73 2f 66 6f 72 6d 73 2f 66 61 76 69 63 6f 6e 5f 71 70 32 2e 70 6e 67 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 69 63 6f 6e 3f 66 61 6d 69 6c 79 3d 4d 61 74 65 72 69 61 6c 2b 49 63 6f 6e 73 2b 45 78 74 65 6e 64 65 64 22 20 72 Data Ascii: 6764<!DOCTYPE html><html lang="en" class="HB1eCd-UMrnmb"><head><link rel="shortcut icon" sizes="16x16" href="https://ssl.gstatic.com/docs/spreadsheets/forms/favicon_qp2.png"><link href="https://fonts.googleapis.com/icon?family=Material+Icons+Extended" r
2024-10-31 16:11:32 UTC	3693	IN	Data Raw: 20 2e 4e 32 52 70 42 65 2e 52 44 50 5a 45 20 2e 49 64 35 56 31 2c 20 2e 45 43 76 42 52 62 20 2e 4e 32 52 70 42 65 2e 52 44 50 5a 45 20 2e 6e 51 4f 72 45 62 20 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 72 67 62 28 34 31 2c 20 31 33 37 2c 20 34 29 3b 7d 2e 45 43 76 42 52 62 20 2e 52 44 50 5a 45 3a 6e 6f 74 28 2e 4e 32 52 70 42 65 29 20 2e 49 64 35 56 31 20 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 39 41 41 30 41 36 3b 7d 2e 64 61 38 62 6d 64 20 2e 45 43 76 42 52 62 20 2e 4e 32 52 70 42 65 2e 52 44 50 5a 45 20 2e 49 64 35 56 31 2c 20 2e 64 61 38 62 6d 64 20 2e 45 43 76 42 52 62 20 2e 4e 32 52 70 42 65 2e 52 44 50 5a 45 20 2e 6e 51 4f 72 45 62 2c 20 2e 77 4d 55 41 76 64 20 2e 45 43 76 42 52 62 20 2e 52 44 50 5a 45 20 2e 49 64 35 56 31 20 7b 62 6f 72 Data Ascii: .N2RpBe.RDPZE .Id5V1, .ECvBRb .N2RpBe.RDPZE .nQOrEb {border-color: rgb(41, 137, 4);}.ECvBRb .RDPZE:not(.N2RpBe) .Id5V1 {border-color: #9AA0A6;}.da8bmd .ECvBRb .N2RpBe.RDPZE .Id5V1, .da8bmd .ECvBRb .N2RpBe.RDPZE .nQOrEb, .wMUAvd .ECvBRb .RDPZE .Id5V1 {bor
2024-10-31 16:11:32 UTC	3693	IN	Data Raw: 72 67 62 28 34 31 2c 20 31 33 37 2c 20 34 29 3b 7d 2e 79 71 51 53 31 20 2e 63 58 72 64 71 64 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 28 34 31 2c 20 31 33 37 2c 20 34 29 3b 7d 2e 79 71 51 53 31 20 2e 49 73 37 46 68 62 20 7b 63 6f 6c 6f 72 3a 20 72 67 62 28 34 31 2c 20 31 33 37 2c 20 34 29 3b 7d 2e 79 71 51 53 31 2e 49 59 65 77 72 20 2e 6f 4a 65 57 75 66 2e 6d 49 5a 68 31 63 2c 20 2e 79 71 51 53 31 2e 49 59 65 77 72 20 2e 6f 4a 65 57 75 66 2e 63 58 72 64 71 64 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 28 32 30 37 2c 20 32 32 37 2c 20 32 30 33 29 3b 7d 2e 74 6f 54 32 75 2e 52 44 50 5a 45 20 2e 7a 48 51 6b 42 66 5b 64 69 73 61 62 6c 65 64 5d 20 7b 63 6f 6c 6f 72 3a 20 72 67 62 61 28 30 2c 20 30 2c 20 30 Data Ascii: rgb(41, 137, 4);}.yqQS1 .cXrdqd {background-color: rgb(41, 137, 4);}.yqQS1 .Is7Fhb {color: rgb(41, 137, 4);}.yqQS1.IYewr .oJeWuf.mIZh1c, .yqQS1.IYewr .oJeWuf.cXrdqd {background-color: rgb(207, 227, 203);}.toT2u.RDPZE .zHQkBf[disabled] {color: rgba(0, 0, 0
2024-10-31 16:11:32 UTC	3693	IN	Data Raw: 67 4e 63 51 65 2c 20 2e 4c 67 4e 63 51 65 20 2e 57 69 63 30 33 63 20 2e 74 4c 39 51 34 63 2c 20 2e 4c 67 4e 63 51 65 20 2e 49 39 4f 4a 48 65 20 2e 4b 52 6f 71 52 63 2c 20 2e 4c 67 4e 63 51 65 20 2e 50 79 72 42 34 2c 20 2e 4c 67 4e 63 51 65 20 2e 73 6e 42 79 61 63 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 74 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 64 6f 63 73 2d 52 6f 62 6f 74 6f 27 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 30 3b 7d 2e 4d 37 65 4d 65 2c 20 2e 4d 37 65 4d 65 20 2e 57 69 63 30 33 63 20 2e 74 4c 39 51 34 63 2c 20 2e 4d 37 65 4d 65 20 2e 49 39 4f 4a 48 65 20 2e 4b 52 6f 71 52 63 2c 20 2e 4d 37 65 4d 65 20 2e 50 79 72 42 34 2c 20 2e 4d Data Ascii: gNcQe, .LgNcQe .Wic03c .tL9Q4c, .LgNcQe .I9OJHe .KRoqRc, .LgNcQe .PyrB4, .LgNcQe .snByac {font-size: 24pt;font-family: 'docs-Roboto', Helvetica, Arial, sans-serif;letter-spacing: 0;}.M7eMe, .M7eMe .Wic03c .tL9Q4c, .M7eMe .I9OJHe .KRoqRc, .M7eMe .PyrB4, .M
2024-10-31 16:11:32 UTC	3693	IN	Data Raw: 34 33 2c 35 30 35 32 39 31 35 31 2c 35 30 35 36 32 38 34 34 2c 35 30 35 36 32 38 35 32 2c 35 30 35 38 37 30 32 32 2c 35 30 35 38 37 30 33 30 2c 37 30 39 37 31 32 31 36 2c 37 30 39 37 31 32 32 34 2c 37 31 30 33 35 34 37 37 2c 37 31 30 33 35 34 38 35 2c 37 31 30 33 38 33 35 35 2c 37 31 30 33 38 33 36 33 2c 37 31 30 37 39 38 39 38 2c 37 31 30 37 39 39 30 36 2c 37 31 30 38 35 33 32 31 2c 37 31 30 38 35 33 32 39 2c 37 31 31 38 35 31 39 30 2c 37 31 31 38 35 31 39 38 2c 37 31 31 39 37 39 36 36 2c 37 31 31 39 37 39 37 34 2c 37 31 32 33 38 39 38 36 2c 37 31 32 33 38 39 39 34 2c 37 31 32 38 39 31 36 36 2c 37 31 32 38 39 31 37 34 2c 37 31 33 35 37 38 33 33 2c 37 31 33 35 37 38 34 31 2c 37 31 33 38 37 32 37 32 2c 37 31 33 38 37 32 38 30 2c 37 31 33 38 37 37 38 39 2c Data Ascii: 43,50529151,50562844,50562852,50587022,50587030,70971216,70971224,71035477,71035485,71038355,71038363,71079898,71079906,71085321,71085329,71185190,71185198,71197966,71197974,71238986,71238994,71289166,71289174,71357833,71357841,71387272,71387280,71387789,
2024-10-31 16:11:32 UTC	3693	IN	Data Raw: 37 31 37 33 33 32 30 31 2c 37 31 34 37 38 34 37 37 2c 39 39 32 33 37 36 30 39 2c 37 31 38 36 38 30 37 38 2c 39 34 33 36 38 32 39 32 2c 35 30 32 36 36 31 33 30 2c 37 31 38 34 37 37 36 35 2c 37 31 35 32 38 36 32 35 2c 35 37 31 31 32 32 36 2c 37 31 35 33 32 38 35 37 2c 37 31 36 32 36 33 35 36 2c 37 31 37 30 35 32 30 32 2c 39 35 31 39 39 37 33 34 2c 35 37 37 34 32 37 32 2c 39 35 32 36 36 37 30 38 2c 35 30 35 36 32 38 35 32 2c 34 39 33 37 32 34 32 33 2c 39 35 32 32 35 30 34 34 2c 37 31 35 34 35 35 30 31 2c 39 34 39 32 39 32 39 30 2c 39 35 32 37 31 32 32 33 2c 37 31 36 33 35 32 36 34 2c 39 34 33 35 33 32 36 38 2c 37 31 36 37 39 34 34 30 2c 39 35 32 33 34 37 39 31 2c 37 31 35 34 36 33 34 35 2c 39 35 33 31 37 39 34 35 2c 35 37 33 37 37 38 34 2c 34 39 37 36 39 34 Data Ascii: 71733201,71478477,99237609,71868078,94368292,50266130,71847765,71528625,5711226,71532857,71626356,71705202,95199734,5774272,95266708,50562852,49372423,95225044,71545501,94929290,95271223,71635264,94353268,71679440,95234791,71546345,95317945,5737784,497694
2024-10-31 16:11:32 UTC	3693	IN	Data Raw: 38 5a 69 30 6d 45 52 71 53 47 6b 47 66 30 57 32 74 64 79 70 55 46 22 2c 22 77 46 38 53 6b 32 34 31 65 30 6d 45 52 71 53 47 6b 47 66 30 59 4e 74 4e 36 67 70 56 22 2c 22 69 6a 55 68 64 78 32 51 4e 30 6d 45 52 71 53 47 6b 47 66 30 54 53 44 32 36 69 42 4a 22 2c 22 33 69 42 4c 61 4d 6e 75 47 30 6d 45 52 71 53 47 6b 47 66 30 56 64 59 38 58 75 4c 53 22 2c 22 63 46 52 37 37 59 45 47 6f 30 69 53 46 54 43 62 69 45 42 30 50 63 4d 44 57 6a 58 32 22 2c 22 65 76 55 59 75 4e 43 53 38 30 6d 45 52 71 53 47 6b 47 66 30 50 73 69 38 6a 33 44 77 22 2c 22 73 6f 57 6e 63 52 56 37 43 30 6d 45 52 71 53 47 6b 47 66 30 50 5a 68 65 58 72 57 41 22 2c 22 54 76 6a 6f 69 43 61 61 72 30 6d 45 52 71 53 47 6b 47 66 30 53 39 71 53 35 61 64 6a 22 2c 22 74 78 4c 35 34 78 57 4c 43 30 6d 45 52 Data Ascii: 8Zi0mERqSGkGf0W2tdypUF","wF8Sk241e0mERqSGkGf0YNtN6gpV","ijUhdx2QN0mERqSGkGf0TSD26iBJ","3iBLaMnuG0mERqSGkGf0VdY8XuLS","cFR77YEGo0iSFTCbiEB0PcMDWjX2","evUYuNCS80mERqSGkGf0Psi8j3Dw","soWncRV7C0mERqSGkGf0PZheXrWA","TvjoiCaar0mERqSGkGf0S9qS5adj","txL54xWLC0mER
2024-10-31 16:11:32 UTC	625	IN	Data Raw: 63 73 2d 65 72 64 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 75 6f 6f 74 75 6e 73 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 61 6d 61 77 73 6f 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 6f 66 6d 70 70 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 61 6e 6c 70 66 64 6f 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 73 6c 61 72 73 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 65 6d 73 22 3a 22 53 48 41 52 45 5f 53 55 42 4d 45 4e 55 22 2c 22 64 6f 63 73 2d 67 6c 75 22 3a 22 22 2c 22 64 6f 63 73 2d 77 73 75 22 3a 22 22 2c 22 64 6f 63 73 2d 77 73 75 70 22 3a 22 22 2c 22 64 6f 63 73 2d 73 63 63 66 6f 22 3a 22 50 52 4f 44 22 2c 22 64 6f 63 73 2d 66 65 63 67 64 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 70 69 64 22 3a 22 22 2c 22 64 6f 63 73 2d 72 69 63 6f 63 70 62 22 3a 66 61 6c Data Ascii: cs-erd":false,"docs-uootuns":false,"docs-amawso":false,"docs-ofmpp":false,"docs-anlpfdo":false,"docs-eslars":true,"docs-ems":"SHARE_SUBMENU","docs-glu":"","docs-wsu":"","docs-wsup":"","docs-sccfo":"PROD","docs-fecgd":false,"docs-pid":"","docs-ricocpb":fal
2024-10-31 16:11:32 UTC	1378	IN	Data Raw: 38 61 32 0d 0a 22 3a 22 68 74 74 70 73 22 2c 22 64 6f 63 73 2d 65 6d 6d 64 61 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 63 6c 69 62 73 22 3a 31 2c 22 64 6f 63 73 2d 63 69 72 74 73 22 3a 32 30 30 30 30 2c 22 64 6f 63 73 2d 63 69 64 65 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 63 6e 22 3a 22 22 2c 22 64 6f 63 73 2d 64 70 72 66 6f 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 64 6f 6d 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 61 63 72 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 61 63 77 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 63 65 72 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 63 69 72 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 65 63 73 73 6c 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 63 73 73 69 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 63 70 65 64 22 Data Ascii: 8a2":"https","docs-emmda":false,"docs-clibs":1,"docs-cirts":20000,"docs-cide":true,"docs-cn":"","docs-dprfo":false,"docs-dom":false,"docs-eacr":false,"docs-eacw":false,"docs-ecer":false,"docs-ecir":true,"docs-ecssl":false,"docs-ecssi":false,"docs-ecped"
2024-10-31 16:11:32 UTC	839	IN	Data Raw: 6f 70 72 75 22 3a 22 68 74 74 70 73 3a 2f 2f 64 6f 63 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 6c 61 79 2e 68 74 6d 6c 22 2c 22 6f 70 64 75 22 3a 66 61 6c 73 65 2c 22 6f 70 68 69 22 3a 22 74 72 69 78 5f 66 6f 72 6d 73 22 2c 22 6f 70 73 74 22 3a 22 22 2c 22 6f 70 75 63 69 22 3a 22 22 2c 22 6f 70 73 6d 75 22 3a 22 68 74 74 70 73 3a 2f 2f 64 6f 63 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 69 63 6b 65 72 22 2c 22 64 6f 63 73 2d 65 68 69 70 6f 22 3a 66 61 6c 73 65 2c 22 70 72 6f 6a 65 63 74 6f 72 5f 62 61 73 65 5f 75 72 6c 22 3a 22 2f 2f 64 72 69 76 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 22 64 6f 63 73 2d 64 72 6b 22 3a 5b 5d 2c 22 64 6f 63 73 2d 65 72 6b 70 70 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 72 6b 66 73 75 22 3a 74 72 75 65 2c 22 6d 61 65 Data Ascii: opru":"https://docs.google.com/relay.html","opdu":false,"ophi":"trix_forms","opst":"","opuci":"","opsmu":"https://docs.google.com/picker","docs-ehipo":false,"projector_base_url":"//drive.google.com","docs-drk":[],"docs-erkpp":false,"docs-erkfsu":true,"mae

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:11:38 UTC	794	OUT	GET /S3RLLtv19W1xxd4kOlbDqF6qrW37Ph00WYzt_zglN8T_thqo-ZrkO372sQDb5jhH3OWZXH9oCDjXWAgaGvJqW-RlWv5KLQCQ_kRHRYg16l92d61UtHJCkSKDaMZUGcp0Wg=w1200 HTTP/1.1 Host: lh3.googleusercontent.com Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIlKHLAQiFoM0BCNy9zQEIuMjNAQ== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 16:11:39 UTC	523	IN	HTTP/1.1 200 OK Content-Type: image/png Vary: Origin Access-Control-Allow-Origin: * Timing-Allow-Origin: * Access-Control-Expose-Headers: Content-Length ETag: "v1" Expires: Fri, 01 Nov 2024 16:11:39 GMT Cache-Control: public, max-age=86400, no-transform Content-Disposition: inline;filename="Untitled.png" X-Content-Type-Options: nosniff Date: Thu, 31 Oct 2024 16:11:39 GMT Server: fife Content-Length: 266662 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-31 16:11:39 UTC	855	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 b0 00 00 01 2c 08 02 00 00 00 5c df dd 07 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 68 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 Data Ascii: PNGIHDR,\tEXtSoftwareAdobe ImageReadyqe<hiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27
2024-10-31 16:11:39 UTC	1378	IN	Data Raw: 44 33 35 37 30 30 45 32 30 36 38 31 31 38 32 32 41 46 41 44 36 31 37 38 35 32 33 45 43 22 2f 3e 20 3c 2f 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 3e 20 3c 2f 72 64 66 3a 52 44 46 3e 20 3c 2f 78 3a 78 6d 70 6d 65 74 61 3e 20 3c 3f 78 70 61 63 6b 65 74 20 65 6e 64 3d 22 72 22 3f 3e 0a 3b 5e 1a 00 04 0d d4 49 44 41 54 78 da 8c bd 6d 96 e5 c8 8e 24 e6 70 de c8 aa ee 56 6b f6 20 fd 95 36 21 69 0f 9a d9 a3 ce 91 56 36 d3 d3 ef ab 32 23 e8 d0 a5 03 30 18 40 46 f5 d4 79 af 4e 56 e4 0d 5e d2 e9 8e 0f 83 c1 20 ff e5 ff fb bf c6 18 ba f4 fd 6f 99 82 3f 8c f8 67 7d ad eb 3f 45 86 aa 9e 3a 3f a6 7d 5e 75 cc 63 7f 5e de ff ec 4f be ff f6 c8 5f c4 3f ef cf d8 05 f5 fa ec f8 93 7f de 17 7d 5f 6b 7d e9 7c 09 ff fa 78 ff e2 be 32 be ee 7d a9 eb ff fb e7 76 87 76 3f df Data Ascii: D35700E206811822AFAD6178523EC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>;^IDATxm$pVk 6!iV62#0@FyNV^ o?g}?E:?}^uc^O_?}_k}\|x2}vv?
2024-10-31 16:11:39 UTC	1378	IN	Data Raw: a6 4b ee 8a 73 9f 17 bf 87 29 f7 30 14 cb 6e 2e d0 7d 0f dc a7 9d e2 29 17 10 c0 d1 15 19 0a 89 5d 31 a4 bc 02 0d a3 c9 1b 12 3b 1a 47 f8 1d 09 61 1d 9e a0 93 07 5c 63 84 ab 33 6b 70 1d e1 fd a2 24 d2 66 cf 06 d5 0f 0e f6 92 c4 c9 b5 ed ea 6b 3b d4 df e9 f6 70 30 23 6c 79 de 3f 37 23 6e e6 62 67 74 e5 e8 25 52 90 6b 12 66 03 3e 23 fe d6 8e f0 f5 a5 63 c3 52 af d9 52 1a b6 8a 4a ee c7 57 92 36 f9 7b 47 21 1b c4 39 c2 06 70 a7 15 86 6b 7f 69 b9 93 51 63 6b 8f 18 b4 ae f6 2d 84 b0 25 7a bf d0 cb dc 5d a7 6c 70 66 2e fe 68 fe eb 06 b2 e4 fd d3 37 8a 6d 23 91 f2 49 b7 4d 16 51 45 06 bb 1f e1 fa de 99 46 09 d7 59 fb 24 32 c8 88 15 b0 5d a7 6b 20 20 90 23 4f 01 2c 03 1b 61 f3 a6 f7 4d 68 de 4a e9 d8 e2 a5 5f db e3 c8 33 61 d1 d5 3a 95 3f f6 8e 42 ec 88 99 9b 6f Data Ascii: Ks)0n.})]1;Ga\c3kp$fk;p0#ly?7#nbgt%Rkf>#cRRJW6{G!9pkiQck-%z]lpf.h7m#IMQEFY$2]k #O,aMhJ_3a:?Bo
2024-10-31 16:11:39 UTC	1378	IN	Data Raw: e2 e1 fb d3 f0 d3 28 0a 25 6c d7 91 0b 72 ac 01 d2 45 68 3a 2e b3 40 48 16 55 6b 15 61 0c af 86 41 60 8e 06 86 ff 65 50 3b 0b 4d 15 0e 1b c5 b9 2b 7c fa 7e e9 f9 50 3b ef a2 50 79 27 78 0e 65 3e 72 6d 6e af d2 c8 4a 08 6f 72 c5 e8 d7 0b b4 6d a7 49 73 b3 8d a0 c2 31 58 0c 50 cf 77 d1 ac 40 f0 2d e0 44 01 86 c1 ca 3c 8c 64 2d fd d1 a2 08 96 5b 51 22 a3 51 4a b6 e3 c5 bd 7f f6 e3 f7 1f 43 d8 71 1b 8b e2 32 8f 40 64 38 5c 71 ab 22 a5 9a 67 df ab 96 26 a1 b6 66 49 c4 31 33 f4 22 e7 98 46 bb c6 e4 25 1e a8 88 0f 96 d1 88 63 19 a6 4a 06 ba 7c 87 ef ab 30 ae a1 df 10 49 fc af 34 e1 39 7b 10 73 16 f6 fe 91 e6 bd ff 22 f2 e1 81 3d 96 95 c6 9d 64 51 49 66 a6 ff df 07 d0 e0 42 3b f5 70 5e d7 fe fc 5c c7 ff f6 9f ff 57 23 04 c1 02 78 9e b0 a3 34 0b 41 ae f2 c8 74 5a Data Ascii: (%lrEh:.@HUkaA`eP;M+\|~P;Py'xe>rmnJormIs1XPw@-D<d-[Q"QJCq2@d8\q"g&fI13"F%cJ\|0I49{s"=dQIfB;p^\W#x4AtZ
2024-10-31 16:11:39 UTC	1378	IN	Data Raw: f6 d5 0d 20 c1 75 b0 00 67 9d ca 2e d0 19 0b 43 8c f8 17 11 92 53 b9 bc cf 24 62 e5 0e ce 91 81 f6 9c 24 a2 10 3b 6e 46 57 5e 54 4c 10 02 b1 b9 a2 65 3f 5e b7 06 e9 28 37 aa 34 f0 fd 8a 77 d7 08 0b 3e 83 f0 d3 f6 f0 fb e6 db 09 62 54 db df 2f 5d f6 88 5e af b6 8d b1 f9 7d 93 73 09 6b 3e 44 83 ef 0f 9f 51 19 bb ce e6 d0 6f bb aa b4 5a da 49 e0 94 d6 62 fe be d4 0c 3a 90 af f9 59 ca 12 e6 d8 6c f1 79 d9 b9 4c 67 f6 fc 72 2d d4 a9 c2 27 34 4d 25 81 af 80 66 bc 50 76 2a c7 76 40 be 9b 71 76 aa 76 f2 ea 17 e2 f2 0b 81 da 97 f5 37 b5 e3 4b db 94 fe bd d4 74 a1 b7 d2 8b 99 6b 80 4d c9 f8 2a 44 44 cd 74 28 48 cd 09 42 8f eb 80 2f 62 b3 4f e7 ad 2d a1 e2 73 d9 e1 38 e6 d7 c6 9e ad ce 8c 78 e2 ac 45 51 3b 1a cd 31 a1 c2 36 a7 83 20 df 76 5a 1d c4 ec a0 b5 bd b9 86 Data Ascii: ug.CS$b$;nFW^TLe?^(74w>bT/]^}sk>DQoZIb:YlyLgr-'4M%fPvv@qvv7KtkMDDt(HB/bO-s8xEQ;16 vZ
2024-10-31 16:11:39 UTC	1378	IN	Data Raw: af e6 69 8b da df 5c 51 19 05 9f 94 46 7a 6e 69 ac a8 1b b0 4e d9 63 49 c1 d6 dd 4d b4 62 20 b5 0a 0a 55 35 b5 5d 9f d8 ad dd 6d 45 2a e9 77 38 e2 50 ad e6 6b c9 e2 83 10 af d1 96 00 76 5a d2 70 f9 6c 47 1f 67 56 90 bc 0f fe e6 8b c2 66 4d 70 f0 82 a2 c3 c9 03 83 82 78 df 90 18 e1 fb 64 a3 e6 be 46 95 1a 42 9c b0 2e ac 53 a4 43 eb e9 6f d8 1b 93 c1 c6 cd 46 d0 be 1c 70 ff d9 7b 40 de 54 e8 3c 96 5e be 88 cb 01 3c 80 40 c6 9e 6f 34 d7 12 d0 02 7b 53 d5 de 48 30 01 ae 6b b6 d3 c0 0c 35 ad 9a 47 bf d2 74 71 a2 9e 96 92 6e f6 15 de d8 7d 91 00 25 b7 a2 f6 36 27 86 9a 40 17 04 43 cf d1 71 6b 76 1f ef 93 f9 22 d4 3c e1 9f 16 c1 b7 ca cc 51 4a 13 2e c4 12 87 a5 d5 5e 1c d4 1f aa 7d 73 76 9b 98 74 37 da 66 d1 b2 dc dc a1 10 79 66 83 26 ae dc 18 a8 e7 f9 b5 34 7b Data Ascii: i\QFzniNcIMb U5]mE*w8PkvZplGgVfMpxdFB.SCoFp{@T<^<@o4{SH0k5Gtqn}%6'@Cqkv"<QJ.^}svt7fyf&4{
2024-10-31 16:11:39 UTC	1378	IN	Data Raw: 0e c8 fd c4 74 05 cf 4c c0 42 5b ab 9c 62 ac 27 77 a3 e1 80 ac 22 97 bd 28 73 a0 05 a1 7e c8 4c 20 85 9b ac be 6b db ca 73 9d aa 5c dc 2a e2 e7 17 36 84 72 7b 72 3d bd 94 1a ac d5 23 fa 62 20 1d 59 ad a8 12 6a b0 ce 27 96 2f 64 f9 94 be 88 d4 8c 9a c6 a0 64 ac 39 a8 bd aa da 70 b9 71 78 6f ad 31 00 3b 92 ea ce da c6 10 02 9c 13 7d 10 da 74 77 29 c6 b5 7e fe 14 57 ac 63 93 e2 29 6e 8a 8b fb 7c 9d 9f 19 76 c2 05 d0 de 40 06 60 1f 58 85 b2 3f 38 39 19 1c 58 8f 28 41 37 f9 1c 8f f7 f6 f5 d7 a3 46 65 2d 87 08 bd 82 99 18 9c 34 70 b3 f6 d7 64 e3 25 ef 07 3f a4 74 a8 07 35 7f 4a 46 05 84 9c 6e ed 25 b6 bd e6 92 c2 49 09 50 75 5f 79 32 a7 8d 7c 61 f7 73 3d 3e 69 ed 0a 11 fb 2d e6 7c 5f e1 6d 27 23 0d 93 d1 84 58 a4 13 75 55 49 b2 ee c9 49 bd 3f f3 fa 78 0d e2 3a Data Ascii: tLB[b'w"(s~L ks\*6r{r=#b Yj'/dd9pqxo1;}tw)~Wc)n\|v@`X?89X(A7Fe-4pd%?t5JFn%IPu_y2\|as=>i-\|_m'#XuUII?x:
2024-10-31 16:11:39 UTC	1378	IN	Data Raw: 79 e2 e4 86 11 18 db 66 c5 9e ca 11 e7 e3 9d 07 c3 6d c7 a9 91 d2 48 a1 ae f9 35 b2 ea db 9e f7 56 b1 e1 11 5b 1c 04 24 06 d9 10 53 7b 64 ab d5 7b 74 b5 32 e5 90 9c 0c 19 13 51 23 e8 7c 12 61 72 50 5c 73 12 49 59 93 c8 30 77 10 66 55 a0 4d 84 d0 de 40 cf 2f a8 35 d3 2e ea 8e b8 47 3f f9 f8 c4 52 73 58 94 0b 4d 6d c0 09 db b1 83 4a b5 b5 66 55 a0 68 19 8d cd 88 61 18 77 86 ad 10 01 de 52 c4 51 c5 e5 d8 60 9a c3 73 97 2c 4c 9e 17 a5 36 e0 b6 7b d7 1d 5a 42 bf 5f c8 7a 31 06 d9 72 30 60 0d 96 5b 62 bc 27 d2 42 6e e5 8a ee e2 db 89 26 48 4e 6e 33 d3 55 09 95 98 93 23 95 51 27 70 c6 44 ec 9a 31 06 7c e0 25 a9 9b 66 37 b6 25 53 0d 47 9d d5 01 e0 a0 b3 1f 79 aa 84 f1 47 54 a9 b0 f9 c0 6a 86 c7 5d 0b 70 2f 49 46 45 ce 3c 68 ac 4b b3 00 2b a6 e9 82 bd 92 c3 75 e9 Data Ascii: yfmH5V[$S{d{t2Q#\|arP\sIY0wfUM@/5.G?RsXMmJfUhawRQ`s,L6{ZB_z1r0`[b'Bn&HNn3U#Q'pD1\|%f7%SGyGTj]p/IFE<hK+u
2024-10-31 16:11:39 UTC	1378	IN	Data Raw: 26 5d 03 a8 c1 8a 68 90 c5 ff 52 fc 53 15 c5 12 c6 8b eb 4e d0 3a c1 2b ba f8 bc 4d 2c c4 20 5c 64 f1 81 25 a1 39 2e a2 b6 e9 16 7c b6 02 b2 47 15 34 9a e3 26 87 31 ea 78 98 a8 1c 92 cc a9 56 31 9e 01 81 3d 6e 41 c4 00 0c 9e f9 59 40 cf da 4a e6 18 37 a4 2a f5 5c 14 00 2d f3 d6 d6 37 69 c5 6c d7 89 11 90 e9 b3 f4 14 7c 8c e5 90 58 74 c2 cc 59 5b 1e 27 75 f7 76 e4 7e 41 7e 67 3b f2 85 16 29 e6 29 3d d4 eb c0 d8 64 45 0a 3f b1 4d 12 86 a5 87 56 2f 09 ee 8a 25 71 e3 35 b3 b2 eb 50 5d 8b 10 f4 bc e8 e6 9f 69 84 b6 60 6e de 61 0c 82 1b f2 58 ad 36 5e f3 55 84 b4 4b a9 fd 62 0c 35 3e 6b 77 ef ca 37 62 f9 95 26 f1 8f 9a 9a 98 21 b0 92 8f 64 8b 59 cc b7 ff e4 7a a2 08 cb 8e 9d 9f ef 8c d7 c9 f7 c4 b3 1f 2c 23 66 b5 9a 6c 2b 08 96 8e e3 5e a9 76 60 0f 25 20 24 60 Data Ascii: &]hRSN:+M, \d%9.\|G4&1xV1=nAY@J7*\-7il\|XtY['uv~A~g;))=dE?MV/%q5P]i`naX6^UKb5>kw7b&!dYz,#fl+^v`% $`
2024-10-31 16:11:39 UTC	1378	IN	Data Raw: 46 d5 7f cf cc ad 64 86 7a 44 bc c1 fa a4 b6 b4 57 81 f7 98 f7 75 e0 07 f7 ad d5 30 44 f1 cd e3 8d 28 37 ea 78 45 be 17 76 d1 fa 3a 23 df 5e fc 75 08 46 af a5 9e 11 de a9 e3 4a b6 bc a6 dc 6b af b8 ac 3f 65 63 66 6d ec 79 bd 57 fc 6b f1 16 f5 d3 1d 06 53 66 da a8 cd 1e c4 22 cf 48 0f 28 36 da f7 c3 a8 39 27 db db 2c 2f 61 4a aa 3b ef 89 60 9a ea 2d f3 3a 8f ea 3b 0a 56 51 72 c1 a9 50 ec d1 4f ac f3 02 ab 7f aa f6 f3 0e 2d c4 fb 56 61 3f 18 a6 6f 71 c4 ec 0b a2 44 0f a3 be 47 c0 31 79 7d aa 1d 99 1f b9 34 87 af 7a f8 b5 f9 37 24 8f ec 7d b6 5e a0 0a 7c 94 5e 6b a1 2f 55 4d 1b 9e 36 4d bd bf 93 1f 67 fb b2 e5 6e d1 0c 72 d8 3a 8c c4 30 3b 10 5d 2e 0b 9a 0a 66 6d a8 42 32 c3 15 2e e8 bd 11 58 30 51 b6 4d 1d 72 4a 4c 2f a7 06 8d f1 61 17 39 f0 31 db 93 a6 29 Data Ascii: FdzDWu0D(7xEv:#^uFJk?ecfmyWkSf"H(69',/aJ;`-:;VQrPO-Va?oqDG1y}4z7$}^\|^k/UM6Mgnr:0;].fmB2.X0QMrJL/a91)

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report OPEN FOR MORE INFORMATION (1) (1).docx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{ABB1F47D-A9F2-44B4-B333-BFE396DC610E}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{1DF94741-352D-4801-8303-700CFAC82726}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{466CE3F4-1C30-4601-B694-59C14432DFE5}.tmp

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\OPEN FOR MORE INFORMATION (1) (1).LNK

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

C:\Users\user\Desktop\~$EN FOR MORE INFORMATION (1) (1).docx

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 150

Chrome Cache Entry: 151

Chrome Cache Entry: 152

Chrome Cache Entry: 153

Chrome Cache Entry: 154

Chrome Cache Entry: 155

Chrome Cache Entry: 156

Chrome Cache Entry: 157

Chrome Cache Entry: 158

Chrome Cache Entry: 159

Chrome Cache Entry: 160

Chrome Cache Entry: 161

Windows Analysis Report
OPEN FOR MORE INFORMATION (1) (1).docx

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:11:41 UTC	1385	OUT	POST /forms/d/e/1FAIpQLSeC_0Id_PGmRkuSPuck_fyi9ACKGBvbaZTzhoVmvM7jUAlm8w/naLogImpressions HTTP/1.1 Host: docs.google.com Connection: keep-alive Content-Length: 5456 sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" X-Same-Domain: 1 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-mobile: ?0 X-Client-Deadline-Ms: 20000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIlKHLAQiFoM0BCNy9zQEIuMjNAQ== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/forms/d/e/1FAIpQLSeC_0Id_PGmRkuSPuck_fyi9ACKGBvbaZTzhoVmvM7jUAlm8w/viewform?usp=send_form Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: S=spreadsheet_forms=zLjYZucY4wqZ5nFgan1ZnD16NtFWLVWRiAG6kT5dF9w; COMPASS=spreadsheet_forms=CjIACWuJVzFLN2yB295p6jUtBNmJOBySvjonGxSjmGRm-FxXVOAKmJ5ugIl9KItE5KOq-BDE9I65Bho0AAlriVcI2on9aJvDUXq2Gqv9HAojAuPKTPyPRvGvsGKdkJDO711hkexEqtEkRla3QZ3ljQ==; CONSENT=PENDING+962; NID=518=iv2Bx9YQZjR75UnDBe4XsD3LU3oXAYfW9WPuZwHHL5Tf--c9AJTjSNV6-lT31aQRz4OQ3kT8xO4KxTdH7IKBTeEwTeRKYK-ifXAwocV73pt24mkTnb5BOG2UIQp-ZpbhKsUzRLwybPpJsEgfg2bzxkXQTxw2ONJR_n8iodmocwVHZU7RMQ
2024-10-31 16:11:41 UTC	5456	OUT	Data Raw: 69 6d 70 72 65 73 73 69 6f 6e 42 61 74 63 68 3d 25 35 42 25 35 42 25 35 42 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 31 25 32 43 31 37 33 30 33 39 31 30 39 39 38 31 34 30 30 30 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 25 35 42 25 35 42 31 37 33 30 33 39 31 30 39 39 38 31 34 30 30 30 25 35 44 25 32 43 6e 75 6c 6c 25 32 43 31 25 35 44 25 32 43 6e 75 6c 6c 25 32 43 37 31 36 25 32 43 6e 75 6c 6c 25 32 43 31 25 32 43 31 25 35 44 25 35 44 25 32 43 25 35 42 25 32 32 43 4f 44 77 2d 4a 4b 42 75 59 6b 44 46 57 6e 41 7a 67 41 64 55 4d 34 35 43 51 25 32 32 25 32 43 31 37 33 30 33 39 31 30 39 39 38 31 33 30 30 30 25 32 43 31 37 33 30 33 39 31 30 39 32 31 31 35 35 35 31 25 32 43 25 32 32 41 44 46 4e 2d 63 73 59 54 30 4f 49 49 2d 54 78 41 Data Ascii: impressionBatch=%5B%5B%5Bnull%2Cnull%2C1%2C1730391099814000%2Cnull%2Cnull%2Cnull%2C%5B%5B1730391099814000%5D%2Cnull%2C1%5D%2Cnull%2C716%2Cnull%2C1%2C1%5D%5D%2C%5B%22CODw-JKBuYkDFWnAzgAdUM45CQ%22%2C1730391099813000%2C1730391092115551%2C%22ADFN-csYT0OII-TxA
2024-10-31 16:11:41 UTC	616	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 31 Oct 2024 16:11:41 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-Cx77paWp_6UKFXFUYsmr_Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval' Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:11:41 UTC	1370	OUT	POST /forms/d/e/1FAIpQLSeC_0Id_PGmRkuSPuck_fyi9ACKGBvbaZTzhoVmvM7jUAlm8w/font/getmetadata HTTP/1.1 Host: docs.google.com Connection: keep-alive Content-Length: 246 sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" X-Same-Domain: 1 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-mobile: ?0 X-Client-Deadline-Ms: 20000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIlKHLAQiFoM0BCNy9zQEIuMjNAQ== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/forms/d/e/1FAIpQLSeC_0Id_PGmRkuSPuck_fyi9ACKGBvbaZTzhoVmvM7jUAlm8w/viewform Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: S=spreadsheet_forms=zLjYZucY4wqZ5nFgan1ZnD16NtFWLVWRiAG6kT5dF9w; COMPASS=spreadsheet_forms=CjIACWuJVzFLN2yB295p6jUtBNmJOBySvjonGxSjmGRm-FxXVOAKmJ5ugIl9KItE5KOq-BDE9I65Bho0AAlriVcI2on9aJvDUXq2Gqv9HAojAuPKTPyPRvGvsGKdkJDO711hkexEqtEkRla3QZ3ljQ==; CONSENT=PENDING+962; NID=518=iv2Bx9YQZjR75UnDBe4XsD3LU3oXAYfW9WPuZwHHL5Tf--c9AJTjSNV6-lT31aQRz4OQ3kT8xO4KxTdH7IKBTeEwTeRKYK-ifXAwocV73pt24mkTnb5BOG2UIQp-ZpbhKsUzRLwybPpJsEgfg2bzxkXQTxw2ONJR_n8iodmocwVHZU7RMQ
2024-10-31 16:11:41 UTC	246	OUT	Data Raw: 66 61 6d 69 6c 69 65 73 3d 41 6d 61 74 69 63 25 32 30 53 43 25 32 43 43 61 76 65 61 74 25 32 43 43 6f 6d 66 6f 72 74 61 61 25 32 43 45 42 25 32 30 47 61 72 61 6d 6f 6e 64 25 32 43 4c 65 78 65 6e 64 25 32 43 4c 6f 62 73 74 65 72 25 32 43 4c 6f 72 61 25 32 43 4d 65 72 72 69 77 65 61 74 68 65 72 25 32 43 4d 6f 6e 74 73 65 72 72 61 74 25 32 43 4e 75 6e 69 74 6f 25 32 43 4f 73 77 61 6c 64 25 32 43 50 61 63 69 66 69 63 6f 25 32 43 50 6c 61 79 66 61 69 72 25 32 30 44 69 73 70 6c 61 79 25 32 43 52 6f 62 6f 74 6f 25 32 43 52 6f 62 6f 74 6f 25 32 30 4d 6f 6e 6f 25 32 43 52 6f 62 6f 74 6f 25 32 30 53 65 72 69 66 25 32 43 53 70 65 63 74 72 61 6c 26 75 73 65 41 6c 6c 53 75 62 73 65 74 73 3d 74 72 75 65 26 66 6f 72 6d 61 74 3d 77 6f 66 66 32 Data Ascii: families=Amatic%20SC%2CCaveat%2CComfortaa%2CEB%20Garamond%2CLexend%2CLobster%2CLora%2CMerriweather%2CMontserrat%2CNunito%2COswald%2CPacifico%2CPlayfair%20Display%2CRoboto%2CRoboto%20Mono%2CRoboto%20Serif%2CSpectral&useAllSubsets=true&format=woff2
2024-10-31 16:11:41 UTC	672	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 31 Oct 2024 16:11:41 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 16:11:41 UTC	706	IN	Data Raw: 37 30 30 36 0d 0a 29 5d 7d 27 0a 7b 22 66 6f 6e 74 4d 65 74 61 64 61 74 61 4d 61 70 22 3a 7b 22 43 61 76 65 61 74 22 3a 7b 22 64 6f 63 75 6d 65 6e 74 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 66 6f 6e 74 46 61 63 65 73 22 3a 5b 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c Data Ascii: 7006)]}'{"fontMetadataMap":{"Caveat":{"documentFont":false,"fontFaces":[{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap":0,
2024-10-31 16:11:41 UTC	1378	IN	Data Raw: 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 65 6e 74 22 3a 39 37 34 2c 22 75 73 57 69 6e 44 65 73 63 65 6e 74 22 3a 33 31 35 7d 2c 22 66 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 Data Ascii: t2":false,"codepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap":0,"ulCodePageRange1":151,"unitsPerEm":1000,"usWinAscent":974,"usWinDescent":315},"fontFamily":"Caveat","menuFont":false,"sources":[{"format":"woff2","isLocal":false,"url":"//font
2024-10-31 16:11:41 UTC	1378	IN	Data Raw: 38 2f 57 6e 7a 6e 48 41 63 35 62 41 66 59 42 32 51 52 61 68 37 70 63 70 4e 76 4f 78 2d 70 6a 66 4a 39 65 49 57 70 59 51 2e 77 6f 66 66 32 22 7d 5d 2c 22 73 74 79 6c 65 22 3a 22 6e 6f 72 6d 61 6c 22 2c 22 73 75 62 73 65 74 22 3a 22 4c 41 54 49 4e 22 2c 22 73 75 62 73 65 74 56 61 6c 75 65 22 3a 22 6c 61 74 69 6e 22 2c 22 77 65 69 67 68 74 22 3a 34 30 30 2c 22 77 65 69 67 68 74 65 64 46 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 20 52 65 67 75 6c 61 72 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 Data Ascii: 8/WnznHAc5bAfYB2QRah7pcpNvOx-pjfJ9eIWpYQ.woff2"}],"style":"normal","subset":"LATIN","subsetValue":"latin","weight":400,"weightedFontFamily":"Caveat Regular"},{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapF
2024-10-31 16:11:41 UTC	1378	IN	Data Raw: 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 65 6e 74 22 3a 39 37 34 2c 22 75 73 57 69 6e 44 65 73 63 65 6e 74 22 3a 33 31 35 7d 2c 22 66 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 63 61 76 65 61 74 2f 76 31 38 2f 57 6e 7a 6e 48 41 63 35 62 41 66 59 42 32 51 52 Data Ascii: :-300,"fsSelection":192,"lineGap":0,"ulCodePageRange1":151,"unitsPerEm":1000,"usWinAscent":974,"usWinDescent":315},"fontFamily":"Caveat","menuFont":false,"sources":[{"format":"woff2","isLocal":false,"url":"//fonts.gstatic.com/s/caveat/v18/WnznHAc5bAfYB2QR
2024-10-31 16:11:41 UTC	1378	IN	Data Raw: 32 22 7d 5d 2c 22 73 74 79 6c 65 22 3a 22 6e 6f 72 6d 61 6c 22 2c 22 73 75 62 73 65 74 22 3a 22 4c 41 54 49 4e 22 2c 22 73 75 62 73 65 74 56 61 6c 75 65 22 3a 22 6c 61 74 69 6e 22 2c 22 77 65 69 67 68 74 22 3a 35 30 30 2c 22 77 65 69 67 68 74 65 64 46 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 20 4d 65 64 69 75 6d 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 Data Ascii: 2"}],"style":"normal","subset":"LATIN","subsetValue":"latin","weight":500,"weightedFontFamily":"Caveat Medium"},{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender
2024-10-31 16:11:41 UTC	1378	IN	Data Raw: 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 65 6e 74 22 3a 39 37 34 2c 22 75 73 57 69 6e 44 65 73 63 65 6e 74 22 3a 33 31 35 7d 2c 22 66 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 63 61 76 65 61 74 2f 76 31 38 2f 57 6e 7a 6e 48 41 63 35 62 41 66 59 42 32 51 52 61 68 37 70 63 70 4e 76 4f 78 2d 70 6a 53 78 36 65 49 47 70 59 51 2e 77 6f 66 66 32 22 7d 5d 2c 22 73 74 79 6c 65 22 3a 22 6e 6f 72 6d Data Ascii: geRange1":151,"unitsPerEm":1000,"usWinAscent":974,"usWinDescent":315},"fontFamily":"Caveat","menuFont":false,"sources":[{"format":"woff2","isLocal":false,"url":"//fonts.gstatic.com/s/caveat/v18/WnznHAc5bAfYB2QRah7pcpNvOx-pjSx6eIGpYQ.woff2"}],"style":"norm
2024-10-31 16:11:42 UTC	1378	IN	Data Raw: 75 62 73 65 74 56 61 6c 75 65 22 3a 22 6c 61 74 69 6e 22 2c 22 77 65 69 67 68 74 22 3a 36 30 30 2c 22 77 65 69 67 68 74 65 64 46 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 20 53 65 6d 69 42 6f 6c 64 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 Data Ascii: ubsetValue":"latin","weight":600,"weightedFontFamily":"Caveat SemiBold"},{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap":0,"u
2024-10-31 16:11:42 UTC	1378	IN	Data Raw: 65 6e 74 22 3a 39 37 34 2c 22 75 73 57 69 6e 44 65 73 63 65 6e 74 22 3a 33 31 35 7d 2c 22 66 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 63 61 76 65 61 74 2f 76 31 38 2f 57 6e 7a 6e 48 41 63 35 62 41 66 59 42 32 51 52 61 68 37 70 63 70 4e 76 4f 78 2d 70 6a 52 56 36 65 49 47 70 59 51 2e 77 6f 66 66 32 22 7d 5d 2c 22 73 74 79 6c 65 22 3a 22 6e 6f 72 6d 61 6c 22 2c 22 73 75 62 73 65 74 22 3a 22 43 59 52 49 4c 4c 49 43 22 2c 22 73 75 62 73 65 74 56 61 6c 75 65 22 3a 22 63 79 Data Ascii: ent":974,"usWinDescent":315},"fontFamily":"Caveat","menuFont":false,"sources":[{"format":"woff2","isLocal":false,"url":"//fonts.gstatic.com/s/caveat/v18/WnznHAc5bAfYB2QRah7pcpNvOx-pjRV6eIGpYQ.woff2"}],"style":"normal","subset":"CYRILLIC","subsetValue":"cy
2024-10-31 16:11:42 UTC	1378	IN	Data Raw: 69 6c 79 22 3a 22 43 61 76 65 61 74 20 42 6f 6c 64 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 36 30 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 65 6e 74 22 3a Data Ascii: ily":"Caveat Bold"},{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":160,"lineGap":0,"ulCodePageRange1":151,"unitsPerEm":1000,"usWinAscent":

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:11:41 UTC	541	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://docs.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 16:11:42 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://docs.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Thu, 31 Oct 2024 16:11:42 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:11:43 UTC	955	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 4513 sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" Content-Type: text/plain;charset=UTF-8 X-Goog-AuthUser: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIlKHLAQiFoM0BCNy9zQEIuMjNAQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962; NID=518=iv2Bx9YQZjR75UnDBe4XsD3LU3oXAYfW9WPuZwHHL5Tf--c9AJTjSNV6-lT31aQRz4OQ3kT8xO4KxTdH7IKBTeEwTeRKYK-ifXAwocV73pt24mkTnb5BOG2UIQp-ZpbhKsUzRLwybPpJsEgfg2bzxkXQTxw2ONJR_n8iodmocwVHZU7RMQ
2024-10-31 16:11:43 UTC	4513	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 32 30 33 35 2c 5b 5b 22 31 37 33 30 33 39 31 30 39 39 38 31 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 5b 5b 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 31 2c 31 37 33 30 33 39 31 30 39 39 38 31 34 30 30 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 31 37 33 30 33 39 31 30 39 39 38 31 34 30 30 30 5d 2c 6e 75 6c 6c 2c 31 5d 2c 6e 75 6c 6c 2c 37 31 36 2c 6e 75 6c 6c 2c 31 2c 31 Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,null,[4,0,0,0,0]]],2035,[["1730391099815",null,null,null,null,null,null,"[[[null,null,1,1730391099814000,null,null,null,[[1730391099814000],null,1],null,716,null,1,1
2024-10-31 16:11:43 UTC	936	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://docs.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=pfY9vydiR6cbAkNmJiz2fNbbqSUCKveyHH_H0S-4j_YInXIGIGlaSsNpyaRs8YgXv1nM3hgYuI0Jrrpw-oXjXp-TT2q9WhP4nmBEFaMMlzz3nT0irkgg2lo67WeCcD-0uYPqkrIYco2Xygb2QEIcZ28a4n2rY1uAiTvUidP_Iu3QzxC5h87GvtFxDg; expires=Fri, 02-May-2025 16:11:43 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Thu, 31 Oct 2024 16:11:43 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Thu, 31 Oct 2024 16:11:43 GMT Connection: close Transfer-Encoding: chunked
2024-10-31 16:11:43 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-31 16:11:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:11:44 UTC	668	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIlKHLAQiFoM0BCLjIzQE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962; NID=518=pfY9vydiR6cbAkNmJiz2fNbbqSUCKveyHH_H0S-4j_YInXIGIGlaSsNpyaRs8YgXv1nM3hgYuI0Jrrpw-oXjXp-TT2q9WhP4nmBEFaMMlzz3nT0irkgg2lo67WeCcD-0uYPqkrIYco2Xygb2QEIcZ28a4n2rY1uAiTvUidP_Iu3QzxC5h87GvtFxDg
2024-10-31 16:11:44 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Thu, 31 Oct 2024 16:11:44 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-31 16:11:44 UTC	1108	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2024-10-31 16:11:44 UTC	447	IN	Data Raw: 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 30 30 25 20 31 30 30 25 7d 7d 23 6c 6f 67 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 35 34 70 78 3b 77 69 64 74 68 3a 31 35 30 70 78 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 3c 61 20 68 72 65 66 3d 2f 2f 77 77 77 2e 67 6f 6f 67 6c Data Ascii: -min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.googl

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:11:44 UTC	957	OUT	GET /forms/d/e/1FAIpQLSeC_0Id_PGmRkuSPuck_fyi9ACKGBvbaZTzhoVmvM7jUAlm8w/font/getmetadata HTTP/1.1 Host: docs.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIlKHLAQiFoM0BCLjIzQE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: S=spreadsheet_forms=zLjYZucY4wqZ5nFgan1ZnD16NtFWLVWRiAG6kT5dF9w; COMPASS=spreadsheet_forms=CjIACWuJVzFLN2yB295p6jUtBNmJOBySvjonGxSjmGRm-FxXVOAKmJ5ugIl9KItE5KOq-BDE9I65Bho0AAlriVcI2on9aJvDUXq2Gqv9HAojAuPKTPyPRvGvsGKdkJDO711hkexEqtEkRla3QZ3ljQ==; CONSENT=PENDING+962; NID=518=pfY9vydiR6cbAkNmJiz2fNbbqSUCKveyHH_H0S-4j_YInXIGIGlaSsNpyaRs8YgXv1nM3hgYuI0Jrrpw-oXjXp-TT2q9WhP4nmBEFaMMlzz3nT0irkgg2lo67WeCcD-0uYPqkrIYco2Xygb2QEIcZ28a4n2rY1uAiTvUidP_Iu3QzxC5h87GvtFxDg
2024-10-31 16:11:45 UTC	903	IN	HTTP/1.1 400 Bad Request Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 31 Oct 2024 16:11:45 GMT Content-Type: text/html; charset=utf-8 x-chromium-appcache-fallback-override: disallow-fallback Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-JTsTOgdEvsUcZlJXYfqL6g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval' Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 16:11:45 UTC	475	IN	Data Raw: 62 64 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 57 65 62 20 77 6f 72 64 20 70 72 6f 63 65 73 73 69 6e 67 2c 20 70 72 65 73 65 6e 74 61 74 69 6f 6e 73 20 61 6e 64 20 73 70 72 65 61 64 73 68 65 65 74 73 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 3c Data Ascii: bdb<!DOCTYPE html><html lang="en"><head><meta name="description" content="Web word processing, presentations and spreadsheets"><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=0"><
2024-10-31 16:11:45 UTC	1378	IN	Data Raw: 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6e 6f 6e 63 65 3d 22 7a 6f 47 5a 50 32 65 4c 68 4d 4c 35 35 61 43 59 2d 54 6b 4d 49 77 22 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 7a 6f 47 5a 50 32 65 4c 68 4d 4c 35 35 61 43 59 2d 54 6b 4d 49 77 22 3e 2e 67 6f 6f 67 2d 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 69 6e 6c 69 6e 65 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2a 20 68 74 6d 6c 20 2e 67 6f 6f 67 2d 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 7d 2a 3a 66 69 72 73 74 2d 63 68 69 6c 64 2b 68 74 6d 6c 20 2e 67 6f 6f 67 2d 69 6e 6c 69 6e 65 2d 62 6c 6f Data Ascii: stylesheet" type="text/css" nonce="zoGZP2eLhML55aCY-TkMIw"><style nonce="zoGZP2eLhML55aCY-TkMIw">.goog-inline-block{position:relative;display:-moz-inline-box;display:inline-block}* html .goog-inline-block{display:inline}*:first-child+html .goog-inline-blo
2024-10-31 16:11:45 UTC	1189	IN	Data Raw: 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 35 30 25 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 20 69 64 3d 22 6f 75 74 65 72 43 6f 6e 74 61 69 6e 65 72 22 3e 3c 64 69 76 20 69 64 3d 22 69 6e 6e 65 72 43 6f 6e 74 61 69 6e 65 72 22 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 2d 38 30 70 78 3b 22 3e 3c 64 69 76 20 69 64 3d 22 64 72 69 76 65 2d 6c 6f 67 6f 22 3e 3c 61 20 68 72 65 66 3d 22 2f 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 64 6f 63 73 2d 64 72 69 76 65 6c 6f 67 6f 2d 69 6d 67 22 20 74 69 74 6c 65 3d 22 47 6f 6f 67 6c 65 20 6c 6f 67 6f 22 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d Data Ascii: -weight: bold; line-height: 150%;}</style></head><body><div id="outerContainer"><div id="innerContainer"><div style="position: absolute; top: -80px;"><div id="drive-logo"><a href="/"><span class="docs-drivelogo-img" title="Google logo"></span><span class=
2024-10-31 16:11:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	12:10:54
Start date:	31/10/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13f100000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	12:11:25
Start date:	31/10/2024
Path:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x13fb60000
File size:	3'151'128 bytes
MD5 hash:	FFA2B8E17F645BCC20F0E0201FEF83ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	3
Start time:	12:11:26
Start date:	31/10/2024
Path:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=876 --field-trial-handle=1344,i,2167696845176286236,13665372515853021969,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x13fb60000
File size:	3'151'128 bytes
MD5 hash:	FFA2B8E17F645BCC20F0E0201FEF83ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	6
Start time:	12:11:29
Start date:	31/10/2024
Path:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "https://forms.gle/wsUZLdhHG5bDpNyj6"
Imagebase:	0x13fb60000
File size:	3'151'128 bytes
MD5 hash:	FFA2B8E17F645BCC20F0E0201FEF83ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true