Edit tour

Windows Analysis Report
https://docs.google.com/forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw/closedform

Overview

General Information

Sample URL:	https://docs.google.com/forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw/closedform
Analysis ID:	1660649
Infos:

Detection

Score:	1
Range:	0 - 100
Confidence:	80%

Signatures

Creates files inside the system directory

Deletes files inside the Windows folder

Classification

Process Tree

System is w10x64

chrome.exe (PID: 768 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,7672389889802415310,10890540999702537262,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2044 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6680 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://docs.google.com/forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw/closedform" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

HTTP traffic detected: POST /forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw/null/d/null/naLogImpressions HTTP/1.1Host: docs.google.comConnection: keep-aliveContent-Length: 5620X-Client-Deadline-Ms: 20000sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: application/x-www-form-urlencoded;charset=UTF-8sec-ch-ua-mobile: ?0X-Same-Domain: 1Accept: */*Origin: https://docs.google.comX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJOhywEInP7MAQiFoM0BCL7VzgEIgNbOAQjI3M4BCIrgzgEIruTOAQiL5c4BSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://docs.google.com/forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw/closedformAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: S=spreadsheet_forms=RL6dCFnTK4lVN8qq_RIx0O5s10zxPkAl8FGi4tW2OVY; COMPASS=spreadsheet_forms=CjIACWuJVxFRNvgab4_DduDSArS5Ksfdqn1ZMeEWopngrk8QNN03Gn6b9AlWzKtH4cd3tRDrtdm_BhpDAAlriVeGY0FP9OONgsYhKasJPl0fpm0XLoEnttYPEr7JNQisw_4Zow-W819IJSxUZcmxaU-6rTzXeqS0p1xCZao3sw==; NID=523=qq5ATcMX3RFSS7mL2yBskQFV9NHcwWD4JOe-cyu8DRbOqr3MrO6hFD8On3QTxQV0I2UpSyEkfypOy94o_T2zZmXN1X9py1ugtt-rB11SnjM3pACbHHRe3PGoy4KEQkwD4T4q_qxX-u6fAXm70IGq-x5k9A8l-wVObADr-H_gRK_B_m6lJdzHNG8Gwo6SpQgrJ_6Vgv0

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: application/json; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 09 Apr 2025 10:33:02 GMTX-Content-Type-Options: nosniffx-chromium-appcache-fallback-override: disallow-fallbackContent-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-ttOrigin-Trial: AsBCEoVg8pIwAkst2T88NNY429HzlH4fGwN+ALnF27Zl16u/ZR0Vylgws0om63IHSaH6pHPqY+k1GQ1sheqdhwgAAACGeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRvY3VtZW50UG9saWN5SW5jbHVkZUpTQ2FsbFN0YWNrc0luQ3Jhc2hSZXBvcnRzIiwiZXhwaXJ5IjoxNzQ5NTEzNjAwLCJpc1N1YmRvbWFpbiI6dHJ1ZX0=X-Frame-Options: SAMEORIGINX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Accept-Ranges: noneVary: Accept-EncodingConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: application/json; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 09 Apr 2025 10:33:02 GMTX-Content-Type-Options: nosniffx-chromium-appcache-fallback-override: disallow-fallbackContent-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-ttOrigin-Trial: AsBCEoVg8pIwAkst2T88NNY429HzlH4fGwN+ALnF27Zl16u/ZR0Vylgws0om63IHSaH6pHPqY+k1GQ1sheqdhwgAAACGeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRvY3VtZW50UG9saWN5SW5jbHVkZUpTQ2FsbFN0YWNrc0luQ3Jhc2hSZXBvcnRzIiwiZXhwaXJ5IjoxNzQ5NTEzNjAwLCJpc1N1YmRvbWFpbiI6dHJ1ZX0=X-Frame-Options: SAMEORIGINX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Accept-Ranges: noneVary: Accept-EncodingConnection: closeTransfer-Encoding: chunked

Source: chromecache_75.2.dr	String found in binary or memory: https://angular.dev/license
Source: chromecache_67.2.dr, chromecache_78.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/mathjax/
Source: chromecache_69.2.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_69.2.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_69.2.dr	String found in binary or memory: https://cloud.google.com/recaptcha/docs/troubleshoot-recaptcha-issues#automated-query-error
Source: chromecache_69.2.dr	String found in binary or memory: https://cloud.google.com/recaptcha/docs/troubleshoot-recaptcha-issues#localhost-error
Source: chromecache_69.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_82.2.dr, chromecache_64.2.dr	String found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v60/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RP
Source: chromecache_82.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVE9eOcEg.woff2)
Source: chromecache_82.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVF9eO.woff2)
Source: chromecache_82.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVFNeOcEg.woff2)
Source: chromecache_82.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVGdeOcEg.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xEIzIFKw.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xFIzIFKw.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xGIzIFKw.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xHIzIFKw.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xIIzI.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xLIzIFKw.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xMIzIFKw.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fBBc4.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fBBc4.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_67.2.dr, chromecache_78.2.dr	String found in binary or memory: https://ssl.gstatic.com/docs/common/cleardot.gif
Source: chromecache_69.2.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_69.2.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_69.2.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_69.2.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_75.2.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_69.2.dr, chromecache_85.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_69.2.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/hbAq-YhJxOnlU-7cpgBoAJHb/recaptcha__.
Source: chromecache_78.2.dr	String found in binary or memory: https://www.gstatic.com/_/apps-fileview/_/js/
Source: chromecache_85.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/hbAq-YhJxOnlU-7cpgBoAJHb/recaptcha__en.js
Source: chromecache_67.2.dr, chromecache_78.2.dr	String found in binary or memory: https://youtube.com/embed/
Source: chromecache_67.2.dr, chromecache_78.2.dr	String found in binary or memory: https://youtube.com/embed/?rel=0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.81.238:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.81.238:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.174:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.174:443 -> 192.168.2.4:49755 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir768_737268718

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir768_737268718

Jump to behavior

Source: classification engine

Classification label: clean1.win@21/42@19/5

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,7672389889802415310,10890540999702537262,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2044 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://docs.google.com/forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw/closedform"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,7672389889802415310,10890540999702537262,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2044 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://docs.google.com/forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw/closedform	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
docs.google.com	142.250.81.238	true	false	high
google.com	142.251.40.238	true	false	high
play.google.com	142.250.65.174	true	false	high
beacons-handoff.gcp.gvt2.com	142.251.186.94	true	false	high
gce-beacons.gcp.gvt2.com	35.227.218.218	true	false	high
www.google.com	142.251.40.132	true	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://www.google.com/recaptcha/api.js?trustedtypes=true	false	high
https://docs.google.com/forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw/null/d/null/naLogImpressions	false	high
https://docs.google.com/forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw/null/d/null/font/getmetadata	false	high
http://c.pki.goog/r/r4.crl	false	high
https://play.google.com/log?format=json&hasfast=true&authuser=0	false	high
https://docs.google.com/forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw/closedform	false	high
http://c.pki.goog/r/gsr1.crl	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://cloud.google.com/recaptcha/docs/troubleshoot-recaptcha-issues#localhost-error	chromecache_69.2.dr	false	high
https://youtube.com/embed/?rel=0	chromecache_67.2.dr, chromecache_78.2.dr	false	high
https://cdnjs.cloudflare.com/ajax/libs/mathjax/	chromecache_67.2.dr, chromecache_78.2.dr	false	high
https://youtube.com/embed/	chromecache_67.2.dr, chromecache_78.2.dr	false	high
https://support.google.com/recaptcha#6262736	chromecache_69.2.dr	false	high
https://cloud.google.com/recaptcha-enterprise/billing-information	chromecache_69.2.dr	false	high
https://cloud.google.com/recaptcha/docs/troubleshoot-recaptcha-issues#automated-query-error	chromecache_69.2.dr	false	high
https://angular.dev/license	chromecache_75.2.dr	false	high
https://support.google.com/recaptcha/?hl=en#6223828	chromecache_69.2.dr	false	high
https://cloud.google.com/contact	chromecache_69.2.dr	false	high
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	chromecache_75.2.dr	false	high
https://www.gstatic.c..?/recaptcha/releases/hbAq-YhJxOnlU-7cpgBoAJHb/recaptcha__.	chromecache_69.2.dr	false	high
https://play.google.com/log?format=json&hasfast=true	chromecache_75.2.dr	false	high
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca	chromecache_69.2.dr	false	high
https://support.google.com/recaptcha/#6175971	chromecache_69.2.dr	false	high
https://www.google.com/recaptcha/api2/	chromecache_69.2.dr, chromecache_85.2.dr	false	high
https://fonts.google.com/license/googlerestricted	chromecache_82.2.dr, chromecache_64.2.dr	false	high
https://support.google.com/recaptcha	chromecache_69.2.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.65.174	play.google.com	United States	15169	GOOGLEUS	false
142.250.81.238	docs.google.com	United States	15169	GOOGLEUS	false
142.251.40.132	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
192.168.2.15

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1660649
Start date and time:	2025-04-09 12:31:51 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://docs.google.com/forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw/closedform
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@21/42@19/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, sppsvc.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.40.238, 142.250.65.163, 142.251.40.206, 192.178.155.84, 142.251.32.110, 142.250.65.238, 142.251.35.174, 142.250.80.99, 142.250.81.234, 142.251.41.3, 142.250.176.195, 142.251.40.131, 199.232.214.172, 142.250.80.67, 23.203.176.221, 142.250.80.78, 142.251.41.14, 142.250.65.206, 142.250.65.227, 172.217.165.142, 142.250.176.206, 23.204.23.20, 52.149.20.212
Excluded domains from analysis (whitelisted): fonts.googleapis.com, ssl.gstatic.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://docs.google.com/forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw/closedform

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18536, version 1.0
Category:	downloaded
Size (bytes):	18536
Entropy (8bit):	7.986571198050597
Encrypted:	false
SSDEEP:	384:IhocXmE6eM871P7td/mcOKA454H2orQEONKrOqxw:f6WeL1P//9D54WCCKc
MD5:	8EFF0B8045FD1959E117F85654AE7770
SHA1:	227FEE13CEB7C410B5C0BB8000258B6643CB6255
SHA-256:	89978E658E840B927DDDB5CB3A835C7D8526ECE79933BD9F3096B301FE1A8571
SHA-512:	2E4FB65CAAB06F02E341E9BA4FB217D682338881DABA3518A0DF8DF724E0496E1AF613DB8E2F65B42B9E82703BA58916B5F5ABB68C807C78A88577030A6C2058
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......Hh..........H..............................Z..\|.`..J.T..<.....H..U..Z...x.6.$..0. ..t. ..I....p.0.VU.......1....AQ...d..x.....R..4.-.c..C$fUc.c..IX..@..~g.xs.....%...O...eJ.w..U.\|.......%..{.......U+..T#.S......`.n.....V.w.4..~P"..zk.%..../........=3...F.........V.FL..;Bc.........A.Uk.U1.b!Y.BH.DL...s.s...F.m.9a..GJ..1..#.`m5..DI..X5#.........B.Akm.....&..0...{.L.....G......-(.......O4.@3....=......f..l...$.....j..NO...e.Y.tJ2J>F.(.c....08..e...~....D2S7s:.G'Gm........!.7.........r.c.`,.....~.).......c>1.......Y.g2^...T-1.7./r./....>...g.ov@u.?.U.+._...'M..,.,g....!g..9."..yBF.#r+.Ps...%.d=....U...5.b.$:`.4R.II.<A....Q)....e...k.....M.8.z....+.....5}..F........F.d._...].~-](.Lf....Y..W....;-z...;. .@x._v../.%UIm....=s...P.C....G...^..Q.!g.!b._.P....at..?.}....t.z...O(..Y6..R.2.X....k.R..K.gw(.F.K?m..R...7....dj..7. .r.U..be.4......8.].w.B..B......Y..:..8.N..U...NEm...\.^q..f}.......{..6.". ...y-.Y...N.+.M E..`......R.$T

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.163
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.163
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.163
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw/closedform HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJOhywEInP7MAQiFoM0BCL7VzgEIgNbOAQjI3M4BCIrgzgEIruTOAQiL5c4BSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js?trustedtypes=true HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJOhywEInP7MAQiFoM0BCL7VzgEIgNbOAQjI3M4BCIrgzgEIruTOAQiL5c4BSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=523=qq5ATcMX3RFSS7mL2yBskQFV9NHcwWD4JOe-cyu8DRbOqr3MrO6hFD8On3QTxQV0I2UpSyEkfypOy94o_T2zZmXN1X9py1ugtt-rB11SnjM3pACbHHRe3PGoy4KEQkwD4T4q_qxX-u6fAXm70IGq-x5k9A8l-wVObADr-H_gRK_B_m6lJdzHNG8Gwo6SpQgrJ_6Vgv0
Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: google.com

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 9, 2025 12:32:43.743462086 CEST	49680	443	192.168.2.4	204.79.197.222
Apr 9, 2025 12:32:49.993105888 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 9, 2025 12:32:50.305888891 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 9, 2025 12:32:51.087171078 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 9, 2025 12:32:52.326201916 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 9, 2025 12:32:53.352015972 CEST	49680	443	192.168.2.4	204.79.197.222
Apr 9, 2025 12:32:54.728707075 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 9, 2025 12:32:56.280735016 CEST	49727	443	192.168.2.4	142.251.40.132
Apr 9, 2025 12:32:56.280797958 CEST	443	49727	142.251.40.132	192.168.2.4
Apr 9, 2025 12:32:56.280890942 CEST	49727	443	192.168.2.4	142.251.40.132
Apr 9, 2025 12:32:56.281090021 CEST	49727	443	192.168.2.4	142.251.40.132
Apr 9, 2025 12:32:56.281109095 CEST	443	49727	142.251.40.132	192.168.2.4
Apr 9, 2025 12:32:56.488473892 CEST	443	49727	142.251.40.132	192.168.2.4
Apr 9, 2025 12:32:56.488559961 CEST	49727	443	192.168.2.4	142.251.40.132
Apr 9, 2025 12:32:56.490015030 CEST	49727	443	192.168.2.4	142.251.40.132
Apr 9, 2025 12:32:56.490026951 CEST	443	49727	142.251.40.132	192.168.2.4
Apr 9, 2025 12:32:56.490438938 CEST	443	49727	142.251.40.132	192.168.2.4
Apr 9, 2025 12:32:56.539446115 CEST	49727	443	192.168.2.4	142.251.40.132
Apr 9, 2025 12:32:57.875416994 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:57.875479937 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:57.875544071 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:57.876425982 CEST	49731	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:57.876478910 CEST	443	49731	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:57.876616955 CEST	49731	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:57.876840115 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:57.876852036 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:57.877037048 CEST	49731	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:57.877051115 CEST	443	49731	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:58.076630116 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:58.076702118 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:58.077452898 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:58.077522993 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:58.077600002 CEST	443	49731	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:58.077651978 CEST	49731	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:58.080313921 CEST	443	49731	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:58.080374956 CEST	49731	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:58.406970978 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:58.407010078 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:58.407361031 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:58.407541037 CEST	49731	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:58.407578945 CEST	443	49731	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:58.407856941 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:58.408135891 CEST	443	49731	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:58.409432888 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 9, 2025 12:32:58.449060917 CEST	49731	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:58.452277899 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:58.714170933 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 9, 2025 12:32:59.068363905 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.068381071 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.068454027 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:59.068489075 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.068547010 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:59.080415010 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.080498934 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:59.093939066 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.094023943 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:59.101288080 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.101358891 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:59.164192915 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.164269924 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:59.173002005 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.173079967 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:59.180157900 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.180212021 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:59.193491936 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.193555117 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:59.193619013 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.201256990 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.201302052 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:59.201318979 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.207516909 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.207575083 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:59.207585096 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.214633942 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.214680910 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:59.214692116 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.220865965 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.220917940 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:59.220926046 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.226723909 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.226789951 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:59.226800919 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.233489990 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.233539104 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:59.233547926 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.239825010 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.239852905 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.239898920 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:59.239909887 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.239945889 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:59.245202065 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.253786087 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.253818035 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.253830910 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:59.253844023 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.253878117 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:59.259211063 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.259357929 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.259403944 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:59.259649992 CEST	49730	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:32:59.259664059 CEST	443	49730	142.250.81.238	192.168.2.4
Apr 9, 2025 12:32:59.327467918 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 9, 2025 12:32:59.540357113 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 9, 2025 12:33:00.528134108 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 9, 2025 12:33:00.953809977 CEST	49727	443	192.168.2.4	142.251.40.132
Apr 9, 2025 12:33:00.996278048 CEST	443	49727	142.251.40.132	192.168.2.4
Apr 9, 2025 12:33:01.071129084 CEST	443	49727	142.251.40.132	192.168.2.4
Apr 9, 2025 12:33:01.071206093 CEST	443	49727	142.251.40.132	192.168.2.4
Apr 9, 2025 12:33:01.071480989 CEST	49727	443	192.168.2.4	142.251.40.132
Apr 9, 2025 12:33:01.071511030 CEST	443	49727	142.251.40.132	192.168.2.4
Apr 9, 2025 12:33:01.071557045 CEST	443	49727	142.251.40.132	192.168.2.4
Apr 9, 2025 12:33:01.071616888 CEST	49727	443	192.168.2.4	142.251.40.132
Apr 9, 2025 12:33:01.109564066 CEST	49727	443	192.168.2.4	142.251.40.132
Apr 9, 2025 12:33:01.109589100 CEST	443	49727	142.251.40.132	192.168.2.4
Apr 9, 2025 12:33:02.471528053 CEST	49731	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:33:02.471528053 CEST	49731	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:33:02.471632004 CEST	443	49731	142.250.81.238	192.168.2.4
Apr 9, 2025 12:33:02.471777916 CEST	443	49731	142.250.81.238	192.168.2.4
Apr 9, 2025 12:33:02.495345116 CEST	49751	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:33:02.495390892 CEST	443	49751	142.250.81.238	192.168.2.4
Apr 9, 2025 12:33:02.495534897 CEST	49751	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:33:02.496153116 CEST	49751	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:33:02.496166945 CEST	443	49751	142.250.81.238	192.168.2.4
Apr 9, 2025 12:33:02.605019093 CEST	49753	443	192.168.2.4	142.250.65.174
Apr 9, 2025 12:33:02.605057001 CEST	443	49753	142.250.65.174	192.168.2.4
Apr 9, 2025 12:33:02.605263948 CEST	49753	443	192.168.2.4	142.250.65.174
Apr 9, 2025 12:33:02.605454922 CEST	49753	443	192.168.2.4	142.250.65.174
Apr 9, 2025 12:33:02.605465889 CEST	443	49753	142.250.65.174	192.168.2.4
Apr 9, 2025 12:33:02.703632116 CEST	443	49731	142.250.81.238	192.168.2.4
Apr 9, 2025 12:33:02.706367016 CEST	443	49731	142.250.81.238	192.168.2.4
Apr 9, 2025 12:33:02.706417084 CEST	49731	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:33:02.707379103 CEST	49731	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:33:02.707396984 CEST	443	49731	142.250.81.238	192.168.2.4
Apr 9, 2025 12:33:02.716742992 CEST	443	49751	142.250.81.238	192.168.2.4
Apr 9, 2025 12:33:02.717252970 CEST	49751	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:33:02.717252970 CEST	49751	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:33:02.717282057 CEST	443	49751	142.250.81.238	192.168.2.4
Apr 9, 2025 12:33:02.717292070 CEST	443	49751	142.250.81.238	192.168.2.4
Apr 9, 2025 12:33:02.717875957 CEST	49751	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:33:02.717880964 CEST	443	49751	142.250.81.238	192.168.2.4
Apr 9, 2025 12:33:02.814038038 CEST	443	49753	142.250.65.174	192.168.2.4
Apr 9, 2025 12:33:02.814121962 CEST	49753	443	192.168.2.4	142.250.65.174
Apr 9, 2025 12:33:02.814819098 CEST	443	49753	142.250.65.174	192.168.2.4
Apr 9, 2025 12:33:02.814870119 CEST	49753	443	192.168.2.4	142.250.65.174
Apr 9, 2025 12:33:02.816195011 CEST	49753	443	192.168.2.4	142.250.65.174
Apr 9, 2025 12:33:02.816210985 CEST	443	49753	142.250.65.174	192.168.2.4
Apr 9, 2025 12:33:02.816473961 CEST	443	49753	142.250.65.174	192.168.2.4
Apr 9, 2025 12:33:02.816895962 CEST	49753	443	192.168.2.4	142.250.65.174
Apr 9, 2025 12:33:02.864273071 CEST	443	49753	142.250.65.174	192.168.2.4
Apr 9, 2025 12:33:02.937875032 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 9, 2025 12:33:02.965285063 CEST	443	49751	142.250.81.238	192.168.2.4
Apr 9, 2025 12:33:02.965665102 CEST	443	49751	142.250.81.238	192.168.2.4
Apr 9, 2025 12:33:02.965874910 CEST	49751	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:33:02.967586994 CEST	49751	443	192.168.2.4	142.250.81.238
Apr 9, 2025 12:33:02.967600107 CEST	443	49751	142.250.81.238	192.168.2.4
Apr 9, 2025 12:33:03.032099009 CEST	443	49753	142.250.65.174	192.168.2.4
Apr 9, 2025 12:33:03.032174110 CEST	443	49753	142.250.65.174	192.168.2.4
Apr 9, 2025 12:33:03.032439947 CEST	49753	443	192.168.2.4	142.250.65.174
Apr 9, 2025 12:33:03.038360119 CEST	49753	443	192.168.2.4	142.250.65.174
Apr 9, 2025 12:33:03.038378000 CEST	443	49753	142.250.65.174	192.168.2.4
Apr 9, 2025 12:33:03.039365053 CEST	49755	443	192.168.2.4	142.250.65.174
Apr 9, 2025 12:33:03.039417982 CEST	443	49755	142.250.65.174	192.168.2.4
Apr 9, 2025 12:33:03.039839029 CEST	49755	443	192.168.2.4	142.250.65.174
Apr 9, 2025 12:33:03.040499926 CEST	49755	443	192.168.2.4	142.250.65.174
Apr 9, 2025 12:33:03.040524006 CEST	443	49755	142.250.65.174	192.168.2.4
Apr 9, 2025 12:33:03.251058102 CEST	443	49755	142.250.65.174	192.168.2.4
Apr 9, 2025 12:33:03.251183987 CEST	49755	443	192.168.2.4	142.250.65.174
Apr 9, 2025 12:33:03.251837015 CEST	443	49755	142.250.65.174	192.168.2.4
Apr 9, 2025 12:33:03.252285957 CEST	49755	443	192.168.2.4	142.250.65.174
Apr 9, 2025 12:33:03.268739939 CEST	49755	443	192.168.2.4	142.250.65.174
Apr 9, 2025 12:33:03.268760920 CEST	443	49755	142.250.65.174	192.168.2.4
Apr 9, 2025 12:33:03.269752979 CEST	443	49755	142.250.65.174	192.168.2.4
Apr 9, 2025 12:33:03.270230055 CEST	49755	443	192.168.2.4	142.250.65.174
Apr 9, 2025 12:33:03.270257950 CEST	49755	443	192.168.2.4	142.250.65.174
Apr 9, 2025 12:33:03.270402908 CEST	443	49755	142.250.65.174	192.168.2.4
Apr 9, 2025 12:33:03.461766958 CEST	443	49755	142.250.65.174	192.168.2.4
Apr 9, 2025 12:33:03.461996078 CEST	443	49755	142.250.65.174	192.168.2.4
Apr 9, 2025 12:33:03.462263107 CEST	49755	443	192.168.2.4	142.250.65.174
Apr 9, 2025 12:33:03.474569082 CEST	49755	443	192.168.2.4	142.250.65.174
Apr 9, 2025 12:33:03.474592924 CEST	443	49755	142.250.65.174	192.168.2.4
Apr 9, 2025 12:33:03.775363922 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 9, 2025 12:33:04.073503971 CEST	49710	443	192.168.2.4	204.79.197.222
Apr 9, 2025 12:33:04.086520910 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 9, 2025 12:33:04.090739965 CEST	49710	443	192.168.2.4	204.79.197.222
Apr 9, 2025 12:33:04.090827942 CEST	49710	443	192.168.2.4	204.79.197.222
Apr 9, 2025 12:33:04.166878939 CEST	443	49710	204.79.197.222	192.168.2.4
Apr 9, 2025 12:33:04.167918921 CEST	443	49710	204.79.197.222	192.168.2.4
Apr 9, 2025 12:33:04.167939901 CEST	443	49710	204.79.197.222	192.168.2.4
Apr 9, 2025 12:33:04.167984962 CEST	49710	443	192.168.2.4	204.79.197.222
Apr 9, 2025 12:33:04.168051004 CEST	49710	443	192.168.2.4	204.79.197.222
Apr 9, 2025 12:33:04.168843031 CEST	49710	443	192.168.2.4	204.79.197.222
Apr 9, 2025 12:33:04.183933020 CEST	443	49710	204.79.197.222	192.168.2.4
Apr 9, 2025 12:33:04.183957100 CEST	443	49710	204.79.197.222	192.168.2.4
Apr 9, 2025 12:33:04.187963009 CEST	443	49710	204.79.197.222	192.168.2.4
Apr 9, 2025 12:33:04.187983990 CEST	443	49710	204.79.197.222	192.168.2.4
Apr 9, 2025 12:33:04.188014030 CEST	49710	443	192.168.2.4	204.79.197.222
Apr 9, 2025 12:33:04.188050985 CEST	49710	443	192.168.2.4	204.79.197.222
Apr 9, 2025 12:33:04.266113043 CEST	443	49710	204.79.197.222	192.168.2.4
Apr 9, 2025 12:33:04.510763884 CEST	49761	80	192.168.2.4	142.251.35.163
Apr 9, 2025 12:33:04.606012106 CEST	80	49761	142.251.35.163	192.168.2.4
Apr 9, 2025 12:33:04.606107950 CEST	49761	80	192.168.2.4	142.251.35.163
Apr 9, 2025 12:33:04.614092112 CEST	49761	80	192.168.2.4	142.251.35.163
Apr 9, 2025 12:33:04.695938110 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 9, 2025 12:33:04.707552910 CEST	80	49761	142.251.35.163	192.168.2.4
Apr 9, 2025 12:33:04.708163023 CEST	80	49761	142.251.35.163	192.168.2.4
Apr 9, 2025 12:33:04.709897041 CEST	80	49761	142.251.35.163	192.168.2.4
Apr 9, 2025 12:33:04.710026026 CEST	49761	80	192.168.2.4	142.251.35.163
Apr 9, 2025 12:33:04.715121031 CEST	49761	80	192.168.2.4	142.251.35.163
Apr 9, 2025 12:33:04.809910059 CEST	80	49761	142.251.35.163	192.168.2.4
Apr 9, 2025 12:33:04.854221106 CEST	49761	80	192.168.2.4	142.251.35.163
Apr 9, 2025 12:33:05.901285887 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 9, 2025 12:33:07.750248909 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 9, 2025 12:33:08.320102930 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 9, 2025 12:33:09.145014048 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 9, 2025 12:33:13.133635998 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 9, 2025 12:33:17.355823994 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 9, 2025 12:33:22.743820906 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 9, 2025 12:33:56.244627953 CEST	49770	443	192.168.2.4	142.251.40.132
Apr 9, 2025 12:33:56.244677067 CEST	443	49770	142.251.40.132	192.168.2.4
Apr 9, 2025 12:33:56.244745016 CEST	49770	443	192.168.2.4	142.251.40.132
Apr 9, 2025 12:33:56.244932890 CEST	49770	443	192.168.2.4	142.251.40.132
Apr 9, 2025 12:33:56.244946003 CEST	443	49770	142.251.40.132	192.168.2.4
Apr 9, 2025 12:33:56.443928003 CEST	443	49770	142.251.40.132	192.168.2.4
Apr 9, 2025 12:33:56.444370031 CEST	49770	443	192.168.2.4	142.251.40.132
Apr 9, 2025 12:33:56.444403887 CEST	443	49770	142.251.40.132	192.168.2.4
Apr 9, 2025 12:34:05.130664110 CEST	49761	80	192.168.2.4	142.251.35.163
Apr 9, 2025 12:34:05.226135969 CEST	80	49761	142.251.35.163	192.168.2.4
Apr 9, 2025 12:34:05.226190090 CEST	49761	80	192.168.2.4	142.251.35.163
Apr 9, 2025 12:34:06.455938101 CEST	443	49770	142.251.40.132	192.168.2.4
Apr 9, 2025 12:34:06.456098080 CEST	443	49770	142.251.40.132	192.168.2.4
Apr 9, 2025 12:34:06.456177950 CEST	49770	443	192.168.2.4	142.251.40.132
Apr 9, 2025 12:34:08.183859110 CEST	49770	443	192.168.2.4	142.251.40.132
Apr 9, 2025 12:34:08.183900118 CEST	443	49770	142.251.40.132	192.168.2.4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 9, 2025 12:32:51.978074074 CEST	53	64746	1.1.1.1	192.168.2.4
Apr 9, 2025 12:32:52.145365000 CEST	53	49338	1.1.1.1	192.168.2.4
Apr 9, 2025 12:32:52.958030939 CEST	53	59612	1.1.1.1	192.168.2.4
Apr 9, 2025 12:32:53.105799913 CEST	53	57883	1.1.1.1	192.168.2.4
Apr 9, 2025 12:32:56.181869984 CEST	61757	53	192.168.2.4	1.1.1.1
Apr 9, 2025 12:32:56.182118893 CEST	59596	53	192.168.2.4	1.1.1.1
Apr 9, 2025 12:32:56.279072046 CEST	53	61757	1.1.1.1	192.168.2.4
Apr 9, 2025 12:32:56.279383898 CEST	53	59596	1.1.1.1	192.168.2.4
Apr 9, 2025 12:32:57.734024048 CEST	63863	53	192.168.2.4	1.1.1.1
Apr 9, 2025 12:32:57.734330893 CEST	49845	53	192.168.2.4	1.1.1.1
Apr 9, 2025 12:32:57.832504988 CEST	53	49845	1.1.1.1	192.168.2.4
Apr 9, 2025 12:32:57.832967997 CEST	53	63863	1.1.1.1	192.168.2.4
Apr 9, 2025 12:32:59.249253035 CEST	53	56461	1.1.1.1	192.168.2.4
Apr 9, 2025 12:32:59.252758980 CEST	53	64945	1.1.1.1	192.168.2.4
Apr 9, 2025 12:33:01.507076025 CEST	53	61870	1.1.1.1	192.168.2.4
Apr 9, 2025 12:33:02.286248922 CEST	53	60515	1.1.1.1	192.168.2.4
Apr 9, 2025 12:33:02.504342079 CEST	50701	53	192.168.2.4	1.1.1.1
Apr 9, 2025 12:33:02.505875111 CEST	59086	53	192.168.2.4	1.1.1.1
Apr 9, 2025 12:33:02.603203058 CEST	53	50701	1.1.1.1	192.168.2.4
Apr 9, 2025 12:33:02.603698969 CEST	53	59086	1.1.1.1	192.168.2.4
Apr 9, 2025 12:33:03.594476938 CEST	61325	53	192.168.2.4	1.1.1.1
Apr 9, 2025 12:33:03.594847918 CEST	62088	53	192.168.2.4	1.1.1.1
Apr 9, 2025 12:33:03.687314987 CEST	53	63992	1.1.1.1	192.168.2.4
Apr 9, 2025 12:33:03.692328930 CEST	53	61325	1.1.1.1	192.168.2.4
Apr 9, 2025 12:33:03.692477942 CEST	53	62088	1.1.1.1	192.168.2.4
Apr 9, 2025 12:33:10.445481062 CEST	53	50017	1.1.1.1	192.168.2.4
Apr 9, 2025 12:33:29.268481016 CEST	53	49293	1.1.1.1	192.168.2.4
Apr 9, 2025 12:33:51.648565054 CEST	53	63586	1.1.1.1	192.168.2.4
Apr 9, 2025 12:33:52.070050955 CEST	53	52311	1.1.1.1	192.168.2.4
Apr 9, 2025 12:33:54.638385057 CEST	53	64804	1.1.1.1	192.168.2.4
Apr 9, 2025 12:33:57.483799934 CEST	138	138	192.168.2.4	192.168.2.255
Apr 9, 2025 12:34:02.184849977 CEST	58219	53	192.168.2.4	1.1.1.1
Apr 9, 2025 12:34:02.185152054 CEST	65072	53	192.168.2.4	1.1.1.1
Apr 9, 2025 12:34:02.282064915 CEST	53	58219	1.1.1.1	192.168.2.4
Apr 9, 2025 12:34:02.282839060 CEST	53	65072	1.1.1.1	192.168.2.4
Apr 9, 2025 12:34:03.206291914 CEST	63326	53	192.168.2.4	1.1.1.1
Apr 9, 2025 12:34:03.206439972 CEST	63348	53	192.168.2.4	1.1.1.1
Apr 9, 2025 12:34:03.304375887 CEST	53	63326	1.1.1.1	192.168.2.4
Apr 9, 2025 12:34:03.305264950 CEST	53	63348	1.1.1.1	192.168.2.4
Apr 9, 2025 12:34:04.186702967 CEST	64338	53	192.168.2.4	1.1.1.1
Apr 9, 2025 12:34:04.186702967 CEST	49959	53	192.168.2.4	1.1.1.1
Apr 9, 2025 12:34:04.284955025 CEST	53	49959	1.1.1.1	192.168.2.4
Apr 9, 2025 12:34:04.285742998 CEST	53	64338	1.1.1.1	192.168.2.4
Apr 9, 2025 12:34:05.233510017 CEST	59285	53	192.168.2.4	1.1.1.1
Apr 9, 2025 12:34:05.331660032 CEST	53	59285	1.1.1.1	192.168.2.4
Apr 9, 2025 12:34:06.243483067 CEST	59285	53	192.168.2.4	1.1.1.1
Apr 9, 2025 12:34:06.340646029 CEST	53	59285	1.1.1.1	192.168.2.4
Apr 9, 2025 12:34:07.242961884 CEST	59285	53	192.168.2.4	1.1.1.1
Apr 9, 2025 12:34:07.340516090 CEST	53	59285	1.1.1.1	192.168.2.4
Apr 9, 2025 12:34:09.258501053 CEST	59285	53	192.168.2.4	1.1.1.1
Apr 9, 2025 12:34:09.355865955 CEST	53	59285	1.1.1.1	192.168.2.4
Apr 9, 2025 12:34:13.259049892 CEST	59285	53	192.168.2.4	1.1.1.1
Apr 9, 2025 12:34:13.357084990 CEST	53	59285	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2025 12:33:04.614092112 CEST	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 9, 2025 12:33:04.708163023 CEST	1254	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 1739 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 09 Apr 2025 10:26:39 GMT Expires: Wed, 09 Apr 2025 11:16:39 GMT Cache-Control: public, max-age=3000 Age: 385 Last-Modified: Mon, 07 Apr 2025 13:58:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Data Raw: 30 82 06 c7 30 82 05 af 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 57 31 0b 30 09 06 03 55 04 06 13 02 42 45 31 19 30 17 06 03 55 04 0a 13 10 47 6c 6f 62 61 6c 53 69 67 6e 20 6e 76 2d 73 61 31 10 30 0e 06 03 55 04 0b 13 07 52 6f 6f 74 20 43 41 31 1b 30 19 06 03 55 04 03 13 12 47 6c 6f 62 61 6c 53 69 67 6e 20 52 6f 6f 74 20 43 41 17 0d 32 35 30 34 30 37 30 30 30 30 30 30 5a 17 0d 32 35 30 37 31 35 30 30 30 30 30 30 5a 30 82 04 f1 30 2a 02 0b 04 00 00 00 00 01 1e 44 a5 e4 04 17 0d 31 34 31 31 32 35 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2a 02 0b 04 00 00 00 00 01 29 45 c3 a8 0f 17 0d 31 34 31 31 32 35 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2a 02 0b 04 00 00 00 00 01 20 19 c1 8d 68 17 0d 31 34 31 31 32 35 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2a 02 0b 04 00 00 00 00 01 2c 5e 7f 1a 88 17 0d 31 34 31 31 32 35 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2a 02 0b 04 00 00 00 00 01 15 4b 5a [TRUNCATED] Data Ascii: 000H0W10UBE10UGlobalSign nv-sa10URoot CA10UGlobalSign Root CA250407000000Z250715000000Z00D141125000000Z00U0)E141125000000Z00U0 h141125000000Z00U0,^141125000000Z00U0KZ160107000000Z00U0/NIR170419000000Z00U0/NG170419000000Z00U0/N9191120000000Z00U0/N=k191204000000Z00U
Apr 9, 2025 12:33:04.709897041 CEST	1198	IN	Data Raw: 03 0a 01 05 30 2a 02 0b 04 00 00 00 00 01 2f 4e e1 3b 58 17 0d 31 39 31 32 30 34 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2d 02 0e 47 c3 0f ff 8a 61 9a 37 f5 a8 2e f0 b5 75 17 0d 32 30 30 36 33 30 30 30 30 30 30 30 5a 30 Data Ascii: 0/N;X191204000000Z00U0-Ga7.u200630000000Z00U0-GA>ThA200630000000Z00U0-GK&TA+200630000000Z00U06::200711160000Z00U0/vSBS
Apr 9, 2025 12:33:04.715121031 CEST	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 9, 2025 12:33:04.809910059 CEST	1243	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 530 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 09 Apr 2025 10:08:38 GMT Expires: Wed, 09 Apr 2025 10:58:38 GMT Cache-Control: public, max-age=3000 Age: 1466 Last-Modified: Thu, 03 Apr 2025 14:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Data Raw: 30 82 02 0e 30 82 01 93 02 01 01 30 0a 06 08 2a 86 48 ce 3d 04 03 03 30 47 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 22 30 20 06 03 55 04 0a 13 19 47 6f 6f 67 6c 65 20 54 72 75 73 74 20 53 65 72 76 69 63 65 73 20 4c 4c 43 31 14 30 12 06 03 55 04 03 13 0b 47 54 53 20 52 6f 6f 74 20 52 34 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 17 0d 32 36 30 32 32 38 30 37 35 39 35 39 5a 30 81 e9 30 2f 02 10 6e 47 a9 ce 4f 46 c2 3d e2 49 ea cc 38 94 53 73 17 0d 31 39 30 39 33 30 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 f0 9c 5b 70 05 a6 dc 86 e2 f9 9e f3 17 0d 32 30 30 31 33 31 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 fe a5 81 44 7e 3b fd 3b b8 1c 24 98 17 0d 32 33 30 36 31 33 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 16 68 25 e1 70 04 40 61 24 91 f5 40 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 00 8e b2 58 e7 b5 94 0c 1f f9 00 44 17 0d 32 35 30 [TRUNCATED] Data Ascii: 000H=0G10UUS1"0 UGoogle Trust Services LLC10UGTS Root R4250403080000Z260228075959Z00/nGOF=I8Ss190930000000Z00U0,[p200131000000Z00U0,D~;;$230613000000Z00U0,h%p@a$@250403080000Z00U0,XD250403080000Z00U/0-0U0U#0LtI6>j0H=i0f1>2en:IN@g=;bQZ~`NX1?^4y[$\4{;$zDeU6O

Timestamp	Bytes transferred	Direction	Data
2025-04-09 10:32:58 UTC	1030	OUT	GET /forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw/closedform HTTP/1.1 Host: docs.google.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Browser-Channel: stable X-Browser-Year: 2025 X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q= X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved. X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJOhywEInP7MAQiFoM0BCL7VzgEIgNbOAQjI3M4BCIrgzgEIruTOAQiL5c4B Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-09 10:32:59 UTC	3979	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Robots-Tag: noindex, nofollow, nosnippet Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 09 Apr 2025 10:32:59 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-wnJGIndebx025H_GDzY9SA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval' Origin-Trial: AsBCEoVg8pIwAkst2T88NNY429HzlH4fGwN+ALnF27Zl16u/ZR0Vylgws0om63IHSaH6pHPqY+k1GQ1sheqdhwgAAACGeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRvY3VtZW50UG9saWN5SW5jbHVkZUpTQ2FsbFN0YWNrc0luQ3Jhc2hSZXBvcnRzIiwiZXhwaXJ5IjoxNzQ5NTEzNjAwLCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Reporting-Endpoints: default="/forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw/web-reports?bl=apps-forms.freebird_20250401.02_p1&context=eJwNx3lQ1GUcx_GH3-95viIIwoLLtWxB5IwwMkCWpmjBssuhgmPigxMEEusIgRAyHk3l8Yc6EOhIHFoKcSQBS2aSg-WBDYY1GGiDouaM5rmsLZAbxyT0-eM178_HZcTFwSSrc5bM4irZuJtkjR6S6TWS9WglW-gj2UevSha2ULLD4ZIVLpJsf6xktXBjo2SPYXaOZH7waYlkFXBzt2RPYEm5ZAkwdEiyp5BaJZkZpmslcz8iWdBlySLB-lyyKdjmkGwfnAxIYxchXp_GJBQkprFPYODdNHYP_l0wrEzDis2jigksP48qnWC_N6aMQ_5uh1IC6l6H4gqjH4wrkyCWTyhu8ABscN88oVhhV-mEsh-mr0wq9OukUqaZUipB_9WUMh9c2IyigQe6GcUGaTtnlCxIb3JScyClXlElhPYoahRsV1V1F_y-VlVvQNgeVX0NdPtVNQQqHqpqNayxL-VpUOlYxr-AWzXR_D7MtEfzWZZoXrtkOa-HLPk23wzzA2N4OBxIiOGHoDwphldB4bMYvh3WtcXydOhpj-V9UL7CwKvgmyID_w5Sthm4hNCTBh4FVacM_Bg87TTwUZgKiuNKcBz_O8jIp-GvMCMfhvZcIz8NPR8aeR_0nzPym_DkkZGPgDHYxIshIMvEX4GgHSYeCcaUBJ4KZakJvBKui0R-G1y9ErkXRM9K4nGQ7JLE10PKO3VCQsmZOvExeI_ViRDIeF4vzKDzahAh0BzWIDrhzTuNIga67I2iG7Ijm0QxROU3iaWQ9wAfLhc0i0Gw__S1GIfZlhPCE84_OyGuQtdLLaIbeje0iH64e7pFPILJ6lbhVNMqFGurcAHjyjaxGhyr28QLSK1pE2aoamkT [TRUNCATED] Document-Policy: include-js-call-stacks-in-crash-reports Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: S=spreadsheet_forms=RL6dCFnTK4lVN8qq_RIx0O5s10zxPkAl8FGi4tW2OVY; Domain=.docs.google.com; Expires=Wed, 09-Apr-2025 11:32:59 GMT; Path=/forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw; Secure; HttpOnly; Priority=LOW; SameSite=none Set-Cookie: COMPASS=spreadsheet_forms=CjIACWuJVxFRNvgab4_DduDSArS5Ksfdqn1ZMeEWopngrk8QNN03Gn6b9AlWzKtH4cd3tRDrtdm_BhpDAAlriVeGY0FP9OONgsYhKasJPl0fpm0XLoEnttYPEr7JNQisw_4Zow-W819IJSxUZcmxaU-6rTzXeqS0p1xCZao3sw==; Domain=.docs.google.com; Expires=Wed, 09-Apr-2025 11:32:59 GMT; Path=/forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw; Secure; HttpOnly; Priority=LOW; SameSite=none Set-Cookie: NID=523=qq5ATcMX3RFSS7mL2yBskQFV9NHcwWD4JOe-cyu8DRbOqr3MrO6hFD8On3QTxQV0I2UpSyEkfypOy94o_T2zZmXN1X9py1ugtt-rB11SnjM3pACbHHRe3PGoy4KEQkwD4T4q_qxX-u6fAXm70IGq-x5k9A8l-wVObADr-H_gRK_B_m6lJdzHNG8Gwo6SpQgrJ_6Vgv0; expires=Thu, 09-Oct-2025 10:32:58 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-04-09 10:32:59 UTC	3979	IN	Data Raw: 37 30 30 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 48 42 31 65 43 64 2d 55 4d 72 6e 6d 62 20 50 48 4f 63 56 62 22 3e 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 64 6f 63 73 2f 73 70 72 65 61 64 73 68 65 65 74 73 2f 66 6f 72 6d 73 2f 66 61 76 69 63 6f 6e 5f 71 70 32 2e 70 6e 67 22 3e 3c 74 69 74 6c 65 3e 45 6e 72 6f 6c 6c 20 69 6e 20 45 6d 61 69 6c 20 49 6e 76 6f 69 63 65 73 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 Data Ascii: 7006<!DOCTYPE html><html class="HB1eCd-UMrnmb PHOcVb"><head><link rel="shortcut icon" sizes="16x16" href="https://ssl.gstatic.com/docs/spreadsheets/forms/favicon_qp2.png"><title>Enroll in Email Invoices</title><link rel="stylesheet" href="https://www.gs
2025-04-09 10:32:59 UTC	3979	IN	Data Raw: 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 34 37 2f 4b 46 4f 4d 43 6e 71 45 75 39 32 46 72 31 4d 45 37 6b 53 6e 36 36 61 47 4c 64 54 79 6c 55 41 4d 51 58 43 38 39 59 6d 43 32 44 50 4e 57 75 59 61 61 6d 6d 57 2e 77 6f 66 66 32 22 7d 5d 2c 22 73 74 79 6c 65 22 3a 22 6e 6f 72 6d 61 6c 22 2c 22 73 75 62 73 65 74 22 3a 22 41 4c 4c 22 2c 22 73 75 62 73 65 74 56 61 6c 75 65 22 3a 22 2a 22 2c 22 77 65 69 67 68 74 22 3a 36 30 30 2c 22 77 65 69 67 68 74 65 64 46 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 52 6f 62 6f 74 6f 20 53 65 6d 69 42 6f 6c 64 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 31 35 Data Ascii: isLocal":false,"url":"//fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWuYaammW.woff2"}],"style":"normal","subset":"ALL","subsetValue":"*","weight":600,"weightedFontFamily":"Roboto SemiBold"},{"fontDrawSize":{"STypoAscender":15
2025-04-09 10:32:59 UTC	3979	IN	Data Raw: 75 33 72 31 67 49 68 4f 73 7a 6d 4f 43 6c 48 72 73 36 6c 6a 58 66 4d 4d 4c 6f 48 51 69 41 6f 2e 77 6f 66 66 32 22 7d 5d 2c 22 73 74 79 6c 65 22 3a 22 69 74 61 6c 69 63 22 2c 22 73 75 62 73 65 74 22 3a 22 41 4c 4c 22 2c 22 73 75 62 73 65 74 56 61 6c 75 65 22 3a 22 2a 22 2c 22 77 65 69 67 68 74 22 3a 34 30 30 2c 22 77 65 69 67 68 74 65 64 46 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 52 6f 62 6f 74 6f 20 52 65 67 75 6c 61 72 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 31 35 33 36 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 35 31 32 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 31 30 32 2c 22 61 73 63 65 6e 64 65 72 22 3a 31 39 30 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c Data Ascii: u3r1gIhOszmOClHrs6ljXfMMLoHQiAo.woff2"}],"style":"italic","subset":"ALL","subsetValue":"*","weight":400,"weightedFontFamily":"Roboto Regular"},{"fontDrawSize":{"STypoAscender":1536,"STypoDescender":-512,"STypoLineGap":102,"ascender":1900,"cmapFormat2":fal
2025-04-09 10:32:59 UTC	3979	IN	Data Raw: 61 63 65 73 20 3d 20 6e 75 6c 6c 3b 20 5f 64 6f 63 73 5f 77 65 62 66 6f 6e 74 73 5f 69 66 72 61 6d 65 5f 66 6f 6e 74 46 61 63 65 73 20 3d 20 6e 75 6c 6c 3b 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 5f 64 6f 63 73 5f 77 65 62 66 6f 6e 74 73 5f 63 72 65 61 74 65 46 6f 6e 74 46 61 63 65 73 20 3d 20 66 75 6e 63 74 69 6f 6e 28 64 6f 63 29 20 7b 69 66 20 28 64 6f 63 20 26 26 20 64 6f 63 2e 66 6f 6e 74 73 29 20 7b 76 61 72 20 77 69 6e 20 3d 20 77 69 6e 64 6f 77 3b 20 76 61 72 20 66 6f 6e 74 46 61 63 65 4f 62 6a 65 63 74 20 3d 20 7b 7d 3b 20 76 61 72 20 64 6f 63 73 5f 66 6f 6e 74 46 61 63 65 73 5f 64 61 74 61 20 3d 20 7b 22 52 6f 62 6f 74 6f 2d 34 30 30 2d 6e 6f 72 6d 61 6c 22 3a 7b 22 66 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 64 6f 63 73 2d 52 6f 62 6f 74 6f 22 2c 22 Data Ascii: aces = null; _docs_webfonts_iframe_fontFaces = null;(function() {_docs_webfonts_createFontFaces = function(doc) {if (doc && doc.fonts) {var win = window; var fontFaceObject = {}; var docs_fontFaces_data = {"Roboto-400-normal":{"fontFamily":"docs-Roboto","
2025-04-09 10:32:59 UTC	3979	IN	Data Raw: 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 22 6f 76 4b 48 73 62 5c 22 5d 2c 5b 34 35 36 37 33 36 38 36 2c 6e 75 6c 6c 2c 66 61 6c 73 65 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 22 54 56 64 6b 75 63 5c 22 5d 2c 5b 34 35 36 37 37 34 36 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 22 71 62 36 36 68 64 5c 22 2c 5b 5c 22 5b 5d 5c 22 5d 5d 2c 5b 34 35 36 37 33 36 38 37 2c 6e 75 6c 6c 2c 66 61 6c 73 65 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 22 4f 51 4b 67 6b 64 5c 22 5d 2c 5b 34 35 36 38 31 31 34 35 2c 6e 75 6c 6c 2c 66 61 6c 73 65 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 22 68 56 36 6b 63 64 5c 22 5d 2c 5b 34 35 36 37 38 32 36 35 2c 6e 75 6c 6c 2c 66 61 6c 73 65 2c 6e 75 6c 6c 2c 6e 75 Data Ascii: null,null,null,\"ovKHsb\"],[45673686,null,false,null,null,null,\"TVdkuc\"],[45677461,null,null,null,null,null,\"qb66hd\",[\"[]\"]],[45673687,null,false,null,null,null,\"OQKgkd\"],[45681145,null,false,null,null,null,\"hV6kcd\"],[45678265,null,false,null,nu
2025-04-09 10:32:59 UTC	3979	IN	Data Raw: 51 46 62 65 2e 75 33 62 57 34 65 20 3e 20 2e 4d 62 68 55 7a 64 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 61 28 37 36 2c 20 31 37 35 2c 20 38 30 2c 20 30 2e 31 35 29 3b 7d 2e 77 47 51 46 62 65 2e 77 47 51 46 62 65 3a 68 6f 76 65 72 20 3e 20 2e 4d 62 68 55 7a 64 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 61 28 37 36 2c 20 31 37 35 2c 20 38 30 2c 20 30 2e 30 34 29 3b 7d 2e 77 47 51 46 62 65 2e 77 47 51 46 62 65 3a 66 6f 63 75 73 20 3e 20 2e 4d 62 68 55 7a 64 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 61 28 37 36 2c 20 31 37 35 2c 20 38 30 2c 20 30 2e 31 35 29 3b 7d 2e 42 4a 48 41 50 2e 4e 32 52 70 42 65 2e 52 44 50 5a 45 2c 20 2e 42 4a 48 41 50 2e 42 36 56 68 71 65 2e 52 44 50 5a Data Ascii: QFbe.u3bW4e > .MbhUzd {background-color: rgba(76, 175, 80, 0.15);}.wGQFbe.wGQFbe:hover > .MbhUzd {background-color: rgba(76, 175, 80, 0.04);}.wGQFbe.wGQFbe:focus > .MbhUzd {background-color: rgba(76, 175, 80, 0.15);}.BJHAP.N2RpBe.RDPZE, .BJHAP.B6Vhqe.RDPZ
2025-04-09 10:32:59 UTC	3979	IN	Data Raw: 73 2d 77 69 74 68 69 6e 20 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 63 6f 6c 6f 72 3a 20 72 67 62 28 30 2c 20 31 34 35 2c 20 30 29 3b 7d 2e 4c 4b 48 30 67 65 20 2e 49 73 37 46 68 62 20 7b 63 6f 6c 6f 72 3a 20 72 67 62 28 30 2c 20 31 34 35 2c 20 30 29 3b 7d 2e 4c 4b 48 30 67 65 2e 75 33 62 57 34 65 20 2e 73 6e 42 79 61 63 20 7b 63 6f 6c 6f 72 3a 20 72 67 62 28 30 2c 20 31 34 35 2c 20 30 29 3b 7d 2e 4c 4b 48 30 67 65 2e 49 59 65 77 72 20 2e 6f 4a 65 57 75 66 2e 6d 49 5a 68 31 63 2c 20 2e 4c 4b 48 30 67 65 2e 49 59 65 77 72 20 2e 6f 4a 65 57 75 66 2e 63 58 72 64 71 64 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 28 32 31 30 2c 20 32 33 35 2c 20 32 31 31 29 3b 7d 2e 77 68 73 4f 6e 64 3a 6e 6f 74 28 5b 64 69 73 61 62 6c 65 64 5d 29 Data Ascii: s-within {border-bottom-color: rgb(0, 145, 0);}.LKH0ge .Is7Fhb {color: rgb(0, 145, 0);}.LKH0ge.u3bW4e .snByac {color: rgb(0, 145, 0);}.LKH0ge.IYewr .oJeWuf.mIZh1c, .LKH0ge.IYewr .oJeWuf.cXrdqd {background-color: rgb(210, 235, 211);}.whsOnd:not([disabled])
2025-04-09 10:32:59 UTC	833	IN	Data Raw: 3a 20 31 2e 35 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 30 3b 7d 2e 4f 49 43 39 30 63 2c 20 2e 4f 49 43 39 30 63 2e 52 6a 73 50 45 2c 20 2e 4f 49 43 39 30 63 20 2e 7a 48 51 6b 42 66 2c 20 2e 4f 49 43 39 30 63 20 2e 57 69 63 30 33 63 20 2e 74 4c 39 51 34 63 2c 20 2e 4f 49 43 39 30 63 20 2e 49 39 4f 4a 48 65 20 2e 4b 52 6f 71 52 63 2c 20 2e 4f 49 43 39 30 63 20 2e 50 79 72 42 34 2c 20 2e 4f 49 43 39 30 63 20 2e 73 6e 42 79 61 63 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 64 6f 63 73 2d 52 6f 62 6f 74 6f 27 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 74 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 35 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 30 3b 7d 2e 4f 49 43 39 30 63 20 Data Ascii: : 1.5;letter-spacing: 0;}.OIC90c, .OIC90c.RjsPE, .OIC90c .zHQkBf, .OIC90c .Wic03c .tL9Q4c, .OIC90c .I9OJHe .KRoqRc, .OIC90c .PyrB4, .OIC90c .snByac {font-family: 'docs-Roboto'; font-weight: 400;font-size: 11pt; line-height: 1.5;letter-spacing: 0;}.OIC90c
2025-04-09 10:32:59 UTC	1220	IN	Data Raw: 34 30 30 32 0d 0a 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 2e 6a 73 3f 74 72 75 73 74 65 64 74 79 70 65 73 3d 74 72 75 65 22 20 61 73 79 6e 63 20 64 65 66 65 72 20 6e 6f 6e 63 65 3d 22 77 6e 4a 47 49 6e 64 65 62 78 30 32 35 48 5f 47 44 7a 59 39 53 41 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 77 6e 4a 47 49 6e 64 65 62 78 30 32 35 48 5f 47 44 7a 59 39 53 41 22 3e 5f 64 6f 63 73 5f 66 6c 61 67 5f 69 6e 69 74 69 61 6c 44 61 74 61 3d 7b 22 64 6f 63 73 2d 61 69 6c 73 22 3a 22 64 6f 63 73 5f 63 6f 6c 64 22 2c 22 64 6f 63 73 2d 66 77 64 73 22 3a 22 64 6f 63 73 5f 6e 66 22 2c 22 64 6f 63 73 2d 63 72 73 22 3a 22 64 6f 63 73 5f 63 72 73 5f 6e 6c 6f 22 2c 22 64 6f 63 73 2d Data Ascii: 4002ps://www.google.com/recaptcha/api.js?trustedtypes=true" async defer nonce="wnJGIndebx025H_GDzY9SA"></script><script nonce="wnJGIndebx025H_GDzY9SA">_docs_flag_initialData={"docs-ails":"docs_cold","docs-fwds":"docs_nf","docs-crs":"docs_crs_nlo","docs-
2025-04-09 10:32:59 UTC	1220	IN	Data Raw: 22 2c 22 64 6f 63 73 2d 66 73 75 22 3a 22 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 74 6f 6f 6c 73 2f 66 65 65 64 62 61 63 6b 22 2c 22 64 6f 63 73 2d 6f 62 73 49 6d 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 64 6f 63 73 2f 63 6f 6d 6d 6f 6e 2f 6e 65 74 63 68 65 63 6b 2e 67 69 66 22 2c 22 64 6f 63 73 2d 74 65 78 74 2d 65 77 66 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 77 66 73 6c 22 3a 5b 22 63 61 22 2c 22 64 61 22 2c 22 64 65 22 2c 22 65 6e 22 2c 22 65 73 22 2c 22 66 69 22 2c 22 66 72 22 2c 22 69 74 22 2c 22 6e 6c 22 2c 22 6e 6f 22 2c 22 70 74 22 2c 22 73 76 22 5d 2c 22 64 6f 63 73 2d 65 66 72 73 64 65 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 65 66 70 73 66 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 65 64 66 6e 22 Data Ascii: ","docs-fsu":"www.google.com/tools/feedback","docs-obsImUrl":"https://ssl.gstatic.com/docs/common/netcheck.gif","docs-text-ewf":true,"docs-wfsl":["ca","da","de","en","es","fi","fr","it","nl","no","pt","sv"],"docs-efrsde":true,"docs-efpsf":true,"docs-edfn"

Timestamp	Bytes transferred	Direction	Data
2025-04-09 10:33:00 UTC	887	OUT	GET /recaptcha/api.js?trustedtypes=true HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJOhywEInP7MAQiFoM0BCL7VzgEIgNbOAQjI3M4BCIrgzgEIruTOAQiL5c4B Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=523=qq5ATcMX3RFSS7mL2yBskQFV9NHcwWD4JOe-cyu8DRbOqr3MrO6hFD8On3QTxQV0I2UpSyEkfypOy94o_T2zZmXN1X9py1ugtt-rB11SnjM3pACbHHRe3PGoy4KEQkwD4T4q_qxX-u6fAXm70IGq-x5k9A8l-wVObADr-H_gRK_B_m6lJdzHNG8Gwo6SpQgrJ_6Vgv0
2025-04-09 10:33:01 UTC	749	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Wed, 09 Apr 2025 10:33:01 GMT Date: Wed, 09 Apr 2025 10:33:01 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-04-09 10:33:01 UTC	471	IN	Data Raw: 36 36 31 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 661/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2025-04-09 10:33:01 UTC	1169	IN	Data Raw: 63 72 69 70 74 27 3b 70 6f 2e 61 73 79 6e 63 3d 74 72 75 65 3b 20 70 6f 2e 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3b 76 61 72 20 76 3d 77 2e 6e 61 76 69 67 61 74 6f 72 2c 6d 3d 64 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 6d 65 74 61 27 29 3b 6d 2e 68 74 74 70 45 71 75 69 76 3d 27 6f 72 69 67 69 6e 2d 74 72 69 61 6c 27 3b 6d 2e 63 6f 6e 74 65 6e 74 3d 27 41 37 76 5a 49 33 76 2b 47 7a 37 4a 66 75 52 6f 6c 4b 4e 4d 34 41 66 66 36 7a 61 47 75 54 37 58 30 6d 66 33 77 74 6f 5a 54 6e 4b 76 36 34 39 37 63 56 4d 6e 68 79 30 33 4b 44 71 58 37 6b 42 7a 2f 71 2f 69 69 64 57 37 73 72 57 33 31 6f 51 62 42 74 34 56 68 67 6f 41 41 41 43 55 65 79 4a 76 63 6d 6c 6e 61 57 34 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 33 64 33 64 79 35 6e 62 32 39 6e 62 47 55 75 Data Ascii: cript';po.async=true; po.charset='utf-8';var v=w.navigator,m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='A7vZI3v+Gz7JfuRolKNM4Aff6zaGuT7X0mf3wtoZTnKv6497cVMnhy03KDqX7kBz/q/iidW7srW31oQbBt4VhgoAAACUeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUu
2025-04-09 10:33:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-09 10:33:02 UTC	1455	OUT	POST /forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw/null/d/null/naLogImpressions HTTP/1.1 Host: docs.google.com Connection: keep-alive Content-Length: 5620 X-Client-Deadline-Ms: 20000 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-mobile: ?0 X-Same-Domain: 1 Accept: / Origin: https://docs.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJOhywEInP7MAQiFoM0BCL7VzgEIgNbOAQjI3M4BCIrgzgEIruTOAQiL5c4B Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw/closedform Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: S=spreadsheet_forms=RL6dCFnTK4lVN8qq_RIx0O5s10zxPkAl8FGi4tW2OVY; COMPASS=spreadsheet_forms=CjIACWuJVxFRNvgab4_DduDSArS5Ksfdqn1ZMeEWopngrk8QNN03Gn6b9AlWzKtH4cd3tRDrtdm_BhpDAAlriVeGY0FP9OONgsYhKasJPl0fpm0XLoEnttYPEr7JNQisw_4Zow-W819IJSxUZcmxaU-6rTzXeqS0p1xCZao3sw==; NID=523=qq5ATcMX3RFSS7mL2yBskQFV9NHcwWD4JOe-cyu8DRbOqr3MrO6hFD8On3QTxQV0I2UpSyEkfypOy94o_T2zZmXN1X9py1ugtt-rB11SnjM3pACbHHRe3PGoy4KEQkwD4T4q_qxX-u6fAXm70IGq-x5k9A8l-wVObADr-H_gRK_B_m6lJdzHNG8Gwo6SpQgrJ_6Vgv0
2025-04-09 10:33:02 UTC	5620	OUT	Data Raw: 69 6d 70 72 65 73 73 69 6f 6e 42 61 74 63 68 3d 25 35 42 25 35 42 25 35 42 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 31 25 32 43 31 37 34 34 31 39 34 37 38 31 39 32 39 30 30 30 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 25 35 42 25 35 42 31 37 34 34 31 39 34 37 38 31 39 32 39 30 30 30 25 35 44 25 32 43 6e 75 6c 6c 25 32 43 31 25 35 44 25 32 43 6e 75 6c 6c 25 32 43 37 31 36 25 32 43 6e 75 6c 6c 25 32 43 31 25 32 43 31 25 35 44 25 35 44 25 32 43 25 35 42 25 32 32 43 4a 44 35 34 66 48 66 79 6f 77 44 46 64 65 47 64 77 51 64 4a 35 41 6e 56 67 25 32 32 25 32 43 31 37 34 34 31 39 34 37 38 31 39 32 38 30 30 30 25 32 43 31 37 34 34 31 39 34 37 37 38 39 38 37 36 36 33 25 32 43 25 32 32 41 44 46 4e 2d 63 73 6c 46 37 54 51 62 64 66 51 7a Data Ascii: impressionBatch=%5B%5B%5Bnull%2Cnull%2C1%2C1744194781929000%2Cnull%2Cnull%2Cnull%2C%5B%5B1744194781929000%5D%2Cnull%2C1%5D%2Cnull%2C716%2Cnull%2C1%2C1%5D%5D%2C%5B%22CJD54fHfyowDFdeGdwQdJ5AnVg%22%2C1744194781928000%2C1744194778987663%2C%22ADFN-cslF7TQbdfQz
2025-04-09 10:33:02 UTC	944	IN	HTTP/1.1 404 Not Found Content-Type: application/json; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 09 Apr 2025 10:33:02 GMT X-Content-Type-Options: nosniff x-chromium-appcache-fallback-override: disallow-fallback Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Origin-Trial: AsBCEoVg8pIwAkst2T88NNY429HzlH4fGwN+ALnF27Zl16u/ZR0Vylgws0om63IHSaH6pHPqY+k1GQ1sheqdhwgAAACGeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRvY3VtZW50UG9saWN5SW5jbHVkZUpTQ2FsbFN0YWNrc0luQ3Jhc2hSZXBvcnRzIiwiZXhwaXJ5IjoxNzQ5NTEzNjAwLCJpc1N1YmRvbWFpbiI6dHJ1ZX0= X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-04-09 10:33:02 UTC	71	IN	Data Raw: 34 31 0d 0a 29 5d 7d 27 0a 0a 5b 5b 22 65 72 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 34 30 34 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 35 5d 2c 5b 22 64 69 22 2c 31 31 5d 5d 0d 0a Data Ascii: 41)]}'[["er",null,null,null,null,404,null,null,null,5],["di",11]]
2025-04-09 10:33:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-09 10:33:02 UTC	1454	OUT	POST /forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw/null/d/null/font/getmetadata HTTP/1.1 Host: docs.google.com Connection: keep-alive Content-Length: 237 X-Client-Deadline-Ms: 20000 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-mobile: ?0 X-Same-Domain: 1 Accept: / Origin: https://docs.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJOhywEInP7MAQiFoM0BCL7VzgEIgNbOAQjI3M4BCIrgzgEIruTOAQiL5c4B Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw/closedform Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: S=spreadsheet_forms=RL6dCFnTK4lVN8qq_RIx0O5s10zxPkAl8FGi4tW2OVY; COMPASS=spreadsheet_forms=CjIACWuJVxFRNvgab4_DduDSArS5Ksfdqn1ZMeEWopngrk8QNN03Gn6b9AlWzKtH4cd3tRDrtdm_BhpDAAlriVeGY0FP9OONgsYhKasJPl0fpm0XLoEnttYPEr7JNQisw_4Zow-W819IJSxUZcmxaU-6rTzXeqS0p1xCZao3sw==; NID=523=qq5ATcMX3RFSS7mL2yBskQFV9NHcwWD4JOe-cyu8DRbOqr3MrO6hFD8On3QTxQV0I2UpSyEkfypOy94o_T2zZmXN1X9py1ugtt-rB11SnjM3pACbHHRe3PGoy4KEQkwD4T4q_qxX-u6fAXm70IGq-x5k9A8l-wVObADr-H_gRK_B_m6lJdzHNG8Gwo6SpQgrJ_6Vgv0
2025-04-09 10:33:02 UTC	237	OUT	Data Raw: 66 61 6d 69 6c 69 65 73 3d 41 6d 61 74 69 63 25 32 30 53 43 25 32 43 43 61 76 65 61 74 25 32 43 43 6f 6d 66 6f 72 74 61 61 25 32 43 45 42 25 32 30 47 61 72 61 6d 6f 6e 64 25 32 43 4c 65 78 65 6e 64 25 32 43 4c 6f 62 73 74 65 72 25 32 43 4c 6f 72 61 25 32 43 4d 65 72 72 69 77 65 61 74 68 65 72 25 32 43 4d 6f 6e 74 73 65 72 72 61 74 25 32 43 4e 75 6e 69 74 6f 25 32 43 4f 73 77 61 6c 64 25 32 43 50 61 63 69 66 69 63 6f 25 32 43 50 6c 61 79 66 61 69 72 25 32 30 44 69 73 70 6c 61 79 25 32 43 52 6f 62 6f 74 6f 25 32 30 4d 6f 6e 6f 25 32 43 52 6f 62 6f 74 6f 25 32 30 53 65 72 69 66 25 32 43 53 70 65 63 74 72 61 6c 26 75 73 65 41 6c 6c 53 75 62 73 65 74 73 3d 74 72 75 65 26 66 6f 72 6d 61 74 3d 77 6f 66 66 32 Data Ascii: families=Amatic%20SC%2CCaveat%2CComfortaa%2CEB%20Garamond%2CLexend%2CLobster%2CLora%2CMerriweather%2CMontserrat%2CNunito%2COswald%2CPacifico%2CPlayfair%20Display%2CRoboto%20Mono%2CRoboto%20Serif%2CSpectral&useAllSubsets=true&format=woff2
2025-04-09 10:33:02 UTC	944	IN	HTTP/1.1 404 Not Found Content-Type: application/json; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 09 Apr 2025 10:33:02 GMT X-Content-Type-Options: nosniff x-chromium-appcache-fallback-override: disallow-fallback Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Origin-Trial: AsBCEoVg8pIwAkst2T88NNY429HzlH4fGwN+ALnF27Zl16u/ZR0Vylgws0om63IHSaH6pHPqY+k1GQ1sheqdhwgAAACGeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRvY3VtZW50UG9saWN5SW5jbHVkZUpTQ2FsbFN0YWNrc0luQ3Jhc2hSZXBvcnRzIiwiZXhwaXJ5IjoxNzQ5NTEzNjAwLCJpc1N1YmRvbWFpbiI6dHJ1ZX0= X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-04-09 10:33:02 UTC	71	IN	Data Raw: 34 31 0d 0a 29 5d 7d 27 0a 0a 5b 5b 22 65 72 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 34 30 34 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 35 5d 2c 5b 22 64 69 22 2c 31 30 5d 5d 0d 0a Data Ascii: 41)]}'[["er",null,null,null,null,404,null,null,null,5],["di",10]]
2025-04-09 10:33:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	29649
Entropy (8bit):	5.545452104367033
Encrypted:	false
SSDEEP:	768:V/hSTO+MerX/+QBUHNieLZD4EFRPRYHBCu4utyiVVl:V/kTf
MD5:	2241684F5D8066C120792F3514BE8163
SHA1:	5FE694D0737BEB7C2661848FFEA58170952CDECF
SHA-256:	4B13C0BDCD4FEECF3B5CB1084A565C6800A7BCB38AAF6B2C8CAA9125E0635E89
SHA-512:	59F9430FDB880DD1748D8DDBAC515833C1C1E71AD3A3CD11092D85A72E1926700EF5867C9413E36CE8EC85046F707D781FD0BC4AA44EBD6FB3D96E9DE78A4BE1
Malicious:	false
Reputation:	low
URL:	"https://fonts.googleapis.com/css?family=Google+Sans_old:400,500\|Roboto_old:300,400,400i,500,700&subset=latin,vietnamese,latin-ext,cyrillic,greek,cyrillic-ext,greek-ext"
Preview:	/. See: https://fonts.google.com/license/googlerestricted. /./ armenian /.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v60/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPiIUvaYr.woff2) format('woff2');. unicode-range: U+0308, U+0530-058F, U+2010, U+2024, U+25CC, U+FB13-FB17;.}./ bengali /.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v60/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPiAUvaYr.woff2) format('woff2');. unicode-range: U+0951-0952, U+0964-0965, U+0980-09FE, U+1CD0, U+1CD2, U+1CD5-1CD6, U+1CD8, U+1CE1, U+1CEA, U+1CED, U+1CF2, U+1CF5-1CF7, U+200C-200D, U+20B9, U+25CC, U+A8F1;.}./ cyrillic-ext */.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v60/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_I

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1586)
Category:	dropped
Size (bytes):	462985
Entropy (8bit):	5.701369766489667
Encrypted:	false
SSDEEP:	6144:KoNdYtvDrAJ/noMxSS8Uu2+vQwGhXlcbQq:UOno+BnwCiQq
MD5:	A080E30A3E48F372EC0D9DEC8BB98E47
SHA1:	03DCEFE936F70D69F93D3FB664B8AB49448BE69B
SHA-256:	7F35E5FA17ED0436722A80DB3AD64D242B1BFB6C73A4B4B1F5EFBFE206CB9745
SHA-512:	EFAA479BCB3050B8B61F28006F513C6DF755B9840BBCF6F7C0DFD42850A1E0569717818BDF76AE404B232CFE6178E215DF24BEB69EC26695ECC7A01521E663CF
Malicious:	false
Reputation:	low
Preview:	"use strict";this.default_v=this.default_v\|\|{};(function(_){var window=this;.try{._.Zs(_.$y);.}catch(e){_._DumpException(e)}.try{._.q("vGOnYd");.var WUb=function(){this.type=1;this.view=null},qY=function(){_.Cu.call(this)};_.B(qY,_.Eu);qY.ya=_.Eu.ya;qY.prototype.j=function(){return _.ss()};qY.prototype.start=function(){return new WUb};qY.prototype.cancel=function(){};qY.prototype.render=function(){return _.ts()};_.Gu(_.SBa,qY);._.u();.}catch(e){_._DumpException(e)}.try{.var sKa;_.rKa=function(a,b){if(a!=null)if(typeof a==="string")a=a?new _.cc(a,_.Th):_.Uh();else if(a.constructor!==_.cc)if(_.bb(a))a=a.length?new _.cc(new Uint8Array(a),_.Th):_.Uh();else{if(!b)throw Error();a=void 0}return a};sKa=function(a){return _.rKa(a,!0)};_.tKa=function(a,b){return _.zc(a.Ba,void 0,b,void 0,sKa)};_.lB=function(a,b){a=_.tKa(a,b);return a==null?_.Uh():a};_.uKa=function(a){this.Ba=_.n(a)};_.B(_.uKa,_.D);_.mB=[1];_.nB=function(a){this.Ba=_.n(a)};_.B(_.nB,_.D);_.nB.prototype.setBooleanValue=function(a){

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1510
Entropy (8bit):	4.0355432662902455
Encrypted:	false
SSDEEP:	24:t4qU/S93QRhYj45kRHDu9+u1lUetmCmifvqbbLaHu9HGn1u1lIdUWA/jTq9Km2zQ:A/S9rU5I1YdtmMqPLmum1YUUZ/jTq9J
MD5:	CECA603BD198568DAB00E6DFC3120706
SHA1:	871C637521103DCE8F6DF9AAC0D1B62900D511B8
SHA-256:	F4AF84EFE90891185D9B29A841181CA9D26D7560864EA47B6CD709D3B964AEE3
SHA-512:	D3F4A52AEADEA52FDAC82C8B9A7427897359B43C3FBCF3E79AACBF30571B3482C991C5346069CC5DDD474C3814CF6507065C4914369C1236FDE641A934A08706
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_dark_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24zm15.76-2c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52zm28.58-8.03h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3.52 1.74 0 3.1 1.5 3.1 3.54.01 2.03-1.36 3.5-3.1 3.5zM38 6.19c-3.21 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (594)
Category:	downloaded
Size (bytes):	561652
Entropy (8bit):	5.637398859811323
Encrypted:	false
SSDEEP:	12288:Cxh1RKtVFgp1RkOgInBLMueXl9JvpGEwmYb:e/RKNgpjDLMueXl9JvKt
MD5:	A3BA6F3831DFAC23271ED79DB3467B14
SHA1:	2F93EAE45276ABDCF26B684EF45036C7BF0D7F61
SHA-256:	9C60F375BB60B19DC9BB69D9F8ABC316D7652A2F088B26C42FCCBDFC15E6FF6A
SHA-512:	5583D01793029A9CC82260B74200812CBDB58CB715F20CCADD5AF76BCD7D561ACBABED018D3107951069AFFF11DC9A3D63A65F6AD17AC263FC0FFB8BECD9CFD1
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/hbAq-YhJxOnlU-7cpgBoAJHb/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var T=function(){return[function(c,u,t,d,h,F){if(!(c-((c^(h=[7,40,5],h[1]))&3\|\|w.call(this,u),h[2])&h[0]))H[4](88,u,d,t);return F},function(c,u,t,d,h,F,Z,E,y,m,W,a,G){return((((((a=[33,"play",250],(c\|5)>>4)\|\|(u_.call(this,t),this.S=u\|\|""),(c\|80)==c)&&(m=["1","block","none"],h==(t.F==3)?G=k[38](5):h?(Z=t.F,y=t.f9(),E=H[7](3,u,t),t.mS()?E.add(k[39](54,null,!1,t)):E.add(V[3](74,"",t,y,Z,!1)),k[4](16,!1,m[0],m[1],t),d&&d.resolve(),W=H[6](61),J[16](15,null,J[28](58,t),E,u,El(function(){W.resolve()},t)),.t.p9(3),E[a[1]](),G=W.promise):(H[39](7,"0",m[2],a[2],!0,t,F),t.p9(1),G=k[38](9))),(c\|8)&6)==2&&(Z=d.eq,u[t]=function

Timestamp	Bytes transferred	Direction	Data
2025-04-09 10:33:02 UTC	577	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-encoding,content-type,x-goog-authuser Origin: https://docs.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-09 10:33:03 UTC	546	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://docs.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,content-encoding,content-type,x-goog-authuser,origin Content-Type: text/plain; charset=UTF-8 Date: Wed, 09 Apr 2025 10:33:02 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-04-09 10:33:03 UTC	1023	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1711 sec-ch-ua-platform: "Windows" Content-Encoding: gzip User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/binary X-Goog-AuthUser: 0 sec-ch-ua-mobile: ?0 Accept: / Origin: https://docs.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJOhywEInP7MAQiFoM0BCL7VzgEIgNbOAQjI3M4BCIrgzgEIruTOAQiL5c4B Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=523=qq5ATcMX3RFSS7mL2yBskQFV9NHcwWD4JOe-cyu8DRbOqr3MrO6hFD8On3QTxQV0I2UpSyEkfypOy94o_T2zZmXN1X9py1ugtt-rB11SnjM3pACbHHRe3PGoy4KEQkwD4T4q_qxX-u6fAXm70IGq-x5k9A8l-wVObADr-H_gRK_B_m6lJdzHNG8Gwo6SpQgrJ_6Vgv0
2025-04-09 10:33:03 UTC	1711	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a b5 d8 59 6f 15 47 16 00 e0 bf 62 f9 29 91 3a 70 f6 45 79 62 42 08 d9 18 91 44 83 66 ae af 22 88 ed c4 c4 80 85 43 60 f8 f5 a3 73 aa ca d8 a0 28 c9 c3 c8 92 cf 77 ab 4f 2d 5d bd 56 ef 76 b8 3d 7f 75 7e fe 97 ff ed fe 5e b6 6c b0 df ef 37 02 d6 6d b7 3b 44 17 c1 14 0f 4c ca c3 3f a9 7c b8 db 5d eb 0d b7 1b 95 01 e0 83 ce 76 ef 67 ec 67 d5 19 1d ed aa ad fd 7e db 1d 1d 7e f6 d5 5d 95 d3 fb a7 ff 7d f1 fa ee bd e3 93 2f 8e 5f 3f 3c fe 4a ef 3c ff d7 cf 47 87 37 fa 8b ea 6f 15 78 64 b8 19 6f 47 87 77 ee de 7b f0 c9 4f 97 e7 f7 fc 87 87 4f 8e 4f 1f be e5 df fe f1 ec e7 1f 1f c0 eb 7f fe e7 f4 c9 97 df 7c 72 ca af 5e 5d 3c e3 a7 7c fc e6 eb 2f df 9c 3f 05 f8 fc bb ef 1e 7d 7e ef e9 bf 5f 7d 7f 79 79 f1 cb db bb cf 9e 5f de 7f f8 e4 Data Ascii: YoGb):pEybBDf"C`s(wO-]Vv=u~^l7m;DL?\|]vgg~~]}/_?<J<G7oxdoGw{OOO\|r^]<\|/?}~_}yy_
2025-04-09 10:33:03 UTC	957	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://docs.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=523=F_pWXRnlx650zeP4R4efVMrrzWtNdWx5QfcNGoyBqPTs7ZyLtk-IkQMVRQXR4niStzPwqPqBc2D0EgDXrlDDhEOLLT5bBSZo4qx5XMEN43LiiS60yf_rEYE3-dqeKfbWbZYasKtBA0UcreXjN-MFTnD5YRA39m32tBiBU343ZpEP-_rhydpMta_5vaaj0IkQRySHXxYUYRaO6MI; expires=Thu, 09-Oct-2025 10:32:58 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 09 Apr 2025 10:33:03 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 09 Apr 2025 10:33:03 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2025-04-09 10:33:03 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2025-04-09 10:33:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	1
Start time:	06:32:47
Start date:	09/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	06:32:50
Start date:	09/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,7672389889802415310,10890540999702537262,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2044 /prefetch:3
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	4
Start time:	06:32:57
Start date:	09/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://docs.google.com/forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw/closedform"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://docs.google.com/forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw/closedform

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
https://docs.google.com/forms/d/e/1FAIpQLSehU-GQCFTDukP2GLfO71VT4SUm9bWzqqY7GMqE9J3bVLFOUw/closedform

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre